Yongli Xiang, Zhifang Zhang, Bojun Yang, Ziming Hong, Lei Feng, Miao Xu, Tongliang Liu
5 min
Abstract
Persona skills distill personal interaction histories into portable and executable artifacts for downstream agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual records or retrieval-based memory. To systematically investigate the safety of the persona-skill pipeline, we introduce AntiSkillBench, an end-to-end benchmark for evaluating risks and defenses across the persona-skill pipeline. It comprises: (i) a dataset of 7,500 persona-grounded dialogue traces, constructed from 50 behaviorally rich profiles spanning diverse task scenarios; (ii) an evaluation suite that measures skill-level privacy leakage and agent-level attribute disclosure and behavioral impersonation across three skill-distillation strategies; and (iii) a defense evaluation covering four configurations across online and post-hoc interventions, including active risk suppression and passive provenance protection. Experiments across three frontier agents show that persona-skill risks persist across agent backbones and distillation protocols, extending from explicit attributes to communication styles and personality traits. Existing defenses exhibit limited and distillation-dependent effectiveness, failing to generalize across risk and distillation strategies. These results highlight AntiSkillBench as a challenging benchmark for developing privacy-preserving and authenticity-aware persona skills.
Alex: And what did they actually find when they ran these tests?
Sam: The results were notable, and somewhat sobering. The privacy risks turned out to be structural—meaning they aren't just a bug you can patch. They're a byproduct of how these persona skills are built in the first place. The researchers tested a defense called "Privacy Sanitization," which works by scrubbing the file of obvious identifiers: names, addresses, that kind of thing. It helped, but only partially.
Alex: So you clean out the obvious clues, and the clone still works?
Sam: That's the core finding. The sanitization could stop the AI from directly stating your home address. But it couldn't stop the AI from mimicking the way you construct an argument, or the particular phrases you reach for when you're making a point. Your identity isn't stored in the file like a label on a jar—it's woven into the entire pattern of how the AI learned to behave. You can't scrub it out without destroying the thing that makes the skill useful in the first place.
Alex: So is there anything that actually works as a defense?
Sam: The paper suggests one more promising approach: something called "Adversarial Obfuscation." Instead of just removing information, this method actively feeds the AI false or conflicting signals during training—essentially muddying the waters so the resulting persona is less of a clean copy. It's more effective than simple scrubbing, but the researchers are careful not to present it as a complete solution. The underlying tension remains. As long as we want AI to be deeply personalized, we are training it to be a mirror. And a mirror, by design, reflects everything it sees.
Alex: That's a genuinely uncomfortable trade-off to sit with. The more useful the tool, the more of yourself you've handed over to it.
Sam: That's precisely the dilemma the paper leaves us with. And it's worth noting that this isn't a distant hypothetical—persona skills are already being developed and deployed. The researchers are essentially saying: we need to think carefully about the privacy architecture of these systems before they become widespread, not after.
Alex: It's one of those cases where the technology moves faster than our understanding of its risks. Thanks for walking us through it, Sam. And thanks to everyone listening to ResearchPod.