Adversarial Skill File Injection in LLM-Based Intelligent Tutoring Systems: Formal Threat Modeling and Multi-Architecture Validation

Valer Bocan · Valentina E. Balas

Large Language Model agents are increasingly deployed in Intelligent Tutoring Systems, with capabilities extended through modular skill files. This extensibility introduces an underexplored attack surface: adversarial skill file injection. We present a formal threat model distinguishing three attack classes: direct exploits, context-triggered stealth payloads, and temporal triggers exploiting academic calendars. Safety properties are specified using Linear Temporal Logic. Proof-of-concept implementations against fourteen large language models achieve 100% trigger-activation accuracy, demonstrating that the attack mechanism resides in the skill file abstraction rather than in model-specific behavior. The fidelity with which models then execute the injected instruction varies sharply: across three distinct tutoring tasks, standard instruction-tuned models remain largely faithful to skill-file pedagogy (88.7% mean adherence), whereas reasoning-focused models are markedly less and more unevenly adherent (63.5% mean, ranging from 52.6% to 83.9%). We further show that a reasoning model can disclose the full solution in its visible reasoning while phrasing its closing answer as a Socratic question, and that whether such reasoning is confined to collapsible tags is itself unstable across runs, so reasoning traces cannot be assumed safely hidden. As reasoning models gain traction in tutoring, both their lower and less predictable instruction-adherence and this exposure of solution content warrant attention. We propose layered mitigations spanning preventive, detective, and architectural controls, contributing to the broader agenda of building trustworthy and attack-resilient AI systems for education.