The authors of SecPO reported on 30 October 2026 that a new training loss combined with adversarial training reduced prompt injection success against their defended model. Their arXiv abstract describes releasing code, training data and a model; those release claims were not independently checked for this preview.[1]
Prompt injection lets instructions embedded in untrusted email, documents or websites manipulate an agent’s operation. The authors argue that Meta-SecAlign’s DPO training loss anchors its model to an insecure reference model. SecPO instead draws on an approximation to an ideal reference that preserves utility while remaining invariant to injections. The authors also describe an adversarial training pipeline that generates stronger injected inputs, labeled best@240.[1]
According to the abstract, adversarial training reduced attack success rates by factors of 1.5–14.5 across three adaptive attacks relative to Meta-SecAlign; SecPO’s loss provided a further 2.4–4.6-fold reduction compared with DPO. In an agent workflow comparison, the authors report 8.8% for SecPO + AT Qwen3.6-27B versus 78.8% for Meta-SecAlign on AgentDojo ASR@800 under AttackerMovesSecond. They report no noticeable reduction in benign utility across nine benchmarks covering tool calling, instruction following, science and math. These are the authors’ reported results.[1]
[1]: SecPO: Principled Adversarial Training for Prompt Injection Security. arXiv, 30 October 2026. https://arxiv.org/abs/2610.41998
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
0fa4536182dfdcea3bbd332c8dba978e83adeaa1fe0dbc04db9a85510ea311fd
