UC Berkeley论文：Agent技能可通过正常输出被逆向重建
New UC Berkeley paper Daydreaming shows a harder agent-security problem: legitim…
Agent商业化落地必须面对的技能保护难题，这篇论文给出了具体的逆向原理和防御思路，做Agent平台的同学务必关注。
New UC Berkeley paper Daydreaming shows a harder agent-security problem: legitimate task outputs alone can reveal enough behavior to build a portable replacement for a hidden skill.
加州大学伯克利分校的新论文《白日梦》（Daydreaming）揭示了一个更严峻的代理安全问题：仅凭合法的任务输出就足以揭示足够的行为信息，从而构建出隐藏技能的便携式替代品。
An attacker does not need your hidden prompt to copy your agent skill: normal task outputs recovered 86.8% of its behavior, so the work interface itself needs protection.
攻击者无需获取你的隐藏提示词即可复制你的代理技能：恢复的正常任务输出重现了其 86.8% 的行为，因此工作接口本身需要受到保护。
The attack never asks the agent to reveal its prompt, SKILL.md, or files.
该攻击从未要求代理透露其提示词、SKILL.md 或文件。
It just gives the service chosen customer tasks and learns from the answers.
它只是向服务选择的客户下达任务，并从回答中学习。
And the attacker did not need an exact copy of the original skill.
而且攻击者并不需要原始技能的精确副本。
The reconstructed files often matched the originals poorly, yet still reproduced much of the behavior on new tasks.
重建的文件通常与原始文件匹配度较差，但仍能在新任务上重现大部分行为。
That is the core problem: a skill can stay secret at the file level while its capability leaks through use.
这就是核心问题：技能在文件层面可以保持秘密，但其能力会通过使用而泄露。
So if you are selling hosted agent skills, the paper's recommendation is: protect the work path too by reducing unnecessary output detail, exposing fewer execution traces, and limiting or auditing adaptive probing.
因此，如果你正在出售托管代理技能，该论文的建议是：通过减少不必要的输出细节、暴露更少的执行痕迹以及限制或审计自适应探测，来保护工作路径。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力