SecPO: Principled Adversarial Training for Prompt Injection Security
The researchers report an 8.8% prompt-injection attack success rate for their defended agent, versus 78.8% for Meta-SecAlign in the same test.
That result comes from AgentDojo under the AttackerMovesSecond attack at ASR@800. SecPO combines a new training loss with adversarial training on strong, synthesized prompt injections. Across three adaptive attacks, adversarial training reduced attack success rates by 1.5–14.5 times relative to Meta-SecAlign; replacing DPO with SecPO delivered a further 2.4–4.6-fold reduction. The authors report no noticeable loss of benign utility across nine benchmarks and release their code, training data and model.
ArXiv · AI/CL/LG's note
That result comes from AgentDojo under the AttackerMovesSecond attack at ASR@800. SecPO combines a new training loss with adversarial training on strong, synthesized prompt injections. Across three adaptive attacks, adversarial training reduced attack success rates by 1.5–14.5 times relative to Meta-SecAlign; replacing DPO with SecPO delivered a further 2.4–4.6-fold reduction. The authors report no noticeable loss of benign utility across nine benchmarks and release their code, training data and model.
ArXiv · AI/CL/LG's note
score 5