SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation
Prompt injection is listed as the \#1 threat to AI agents. When an agent accesses external data from websites, files, or emails, an attacker may inject a prompt into the data, saying, "Ignore all prior instructions and perform <an attacker's task>." To prevent arbitrary manipulation of agents, defenders try to train secure LLMs, which, however, still suffer from near 100% attack success rates (ASRs) against adaptive prompt injections. We note that this is because existing defensive finetuning recipes rely on sequence-level feedback signals (in DPO or GRPO). Treating an entire output equally prevents the model from learning precisely which output tokens are insecure. In this paper, we prop...
| Authors | Yibo Peng, Long Lian, David Wagner et al. |
|---|---|
| Primary category | cs.CR |
| Published | 21 August 2026 |
| Last updated at source | 21 August 2026 |
Connected in the knowledge graph
- pybbb/Qwen3.6-27B-SecOPDModel · cited by
Models and datasets referencing this paper
Silytics shows public metadata from arXiv and links to the original. Information may be incomplete or out of date. Last refreshed 17 October 2026. Licenses and terms of the original apply to the work itself. Not financial, legal or professional advice.