Token-level training cuts prompt injection success to 9%

SecOPD, a new prompt-injection defense, drops adaptive attack success to 9.0% against PISmith injections on Qwen3.6-27B, per the SecOPD paper.

Meta-SecAlign, the previous best defense, let 94.0% of those same PISmith adaptive injections through on Qwen3.6-27B. Adaptive attacks are built to beat a defense once its exact behavior is already public, and every earlier defense before SecOPD broke against them. That matters for anyone running an agent that calls tools or reads content it doesn't control.

The gap comes from the training signal, the paper reports. SecOPD fine-tunes on token-level feedback during on-policy distillation, where Meta-SecAlign and other prior defenses trained on sequence-level feedback instead.

SecOPD also holds up outside the injection setting it was tuned on, cutting attack success to 4.7% on agentic tool calling. The model never saw that domain during training. That result points at the training signal as the fix for adaptive attacks, not broader domain coverage.