Chen and colleagues (UC Berkeley and Meta) train models with preference optimization to prefer responses that follow the legitimate instruction over those that follow injected instructions. In the ACM CCS 2025 version they report injection success rates below 10% even for attacks more sophisticated than those seen in training, with utility similar to the undefended model; the October 2024 first version reported GCG-based injection success on Mistral-7B falling from 56% to 2%.
Why it matters
SecAlign and its open-weight successor Meta SecAlign are leading training-time defenses whose robustness claims were later tested by adaptive attacks.
Key facts
As stated in the sources, with where to find them.
- CCS 2025 version (arXiv v3, July 2025): prompt injection success rates below 10% across tested attacks, including ones much more sophisticated than those seen in training.Abstract (v3)
- First version (October 7, 2024, then titled 'Aligning LLMs to Be Robust Against Prompt Injection'): GCG-based injection success on Mistral-7B fell from 56% to 2%.Abstract (v1)
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Oct 10, 2025
May 6, 2025
Feb 9, 2024
Oct 31, 2025
Mar 24, 2025
Apr 19, 2024