SecPO: Principled Adversarial Training for Prompt Injection Security

Summary

The SecPO paper addresses prompt injection, where instructions in untrusted data manipulate an AI agent. It argues that Meta-SecAlign's DPO-based training anchors to an insecure reference model and uses weak simulated attacks, and proposes a SecPO loss plus an adversarial training pipeline that synthesizes strong injections (best@240). On Qwen3.6-27B, the authors report AgentDojo ASR@800 of 8.8% versus 78.8% for Meta-SecAlign under AttackerMovesSecond, with no noticeable benign utility loss across nine benchmarks.

Mitigation

The proposed defense is the SecPO loss combined with adversarial training (AT) on synthesized injected inputs; the authors release code, training data and a model at the linked GitHub and Hugging Face locations.

Topics

• Prompt injection and jailbreaks

Related items

• MediumTop AI coding agent security resources — November 2026Similar attack · Adversa AI Blog
• MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSimilar attack · NVD/CVE Database
• HighCVE-2026-61789: DBHub read-only SQL validation bypass on MySQL and MariaDB connectorsSimilar attack · NVD/CVE Database
• InfoErase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-DistillationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)