Policy-Verified Self-Training: Learning Agent Compliance from Verifiable Policy Rewards

Summary

Runtime policy verifiers usually discard their enforcement decisions, but this paper asks whether those verdicts can train the agent instead. The authors propose Policy-Verified Self-Training (PVST), where a deterministic gate compiled from a written policy scores the agent's own trajectories, reinforcing compliant ones and using violations as negatives for preference optimization. On held-out AgentDojo tasks under prompt injection, training Qwen3-8B cut violating trajectories from 37.2% to 10.3% and successful attacks from 12.4% to 0.5%, though utility fell on travel tasks.

Related items

• HighCVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted toolsSimilar attack · NVD/CVE Database
• LowAgents at the Edge: Extending AI Security Governance to Physical AI with DefenseClawSimilar attack · Cisco AI Blog
• InfoMMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• InfoTRACER: Trace-Regularized Training Against Indirect Prompt InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)