SecPO training cuts prompt-injection success on AgentDojo to 8.8%, versus 78.8% for Meta-SecAlign
Prompt injection is when instructions hidden in emails, documents or websites take over an agent. The authors train on strong synthesized injected inputs and replace the usual DPO loss with SecPO, which anchors training to an idealized injection-proof reference model rather than the insecure undefended one. Their defended Qwen3.6-27B has an 8.8% attack success rate on AgentDojo under the AttackerMovesSecond attack, against 78.8% for Meta-SecAlign, with no noticeable loss on nine benchmarks of normal use.