# SecPO: adaptive prompt injections still break Meta-SecAlign

> SecPO reports that adaptive prompt injections still reach 78.8% attack success against Meta-SecAlign on AgentDojo.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Research, Attack
- **Published by:** UC Berkeley
- **Disclosed:** 2026-10-30
- **Affects:** Meta-SecAlign, Llama-3.1-8B-Instruct, Qwen3.6-27B
- **Research by:** Sizhe Chen, Yibo Peng, Jaewon Chang, Chawin Sitawarin, David Wagner
- **Primary source:** https://arxiv.org/abs/2610.41998
- **Page:** https://theinjection.dev/items/arxiv-secpo/

SecPO is a prompt-injection training method from UC Berkeley. The authors report that Meta-SecAlign, the best prior defended model, reaches 78.8% attack success on AgentDojo under an adaptive search attack, against 8.8% for their model.

## What happened

Five researchers published SecPO on arXiv on October 30, 2026, a training method meant to make a language model refuse instructions hidden in untrusted data. The paper lists UC Berkeley and Anthropic as affiliations, with a note that the Anthropic author's work was done at Google DeepMind. The team first measures how Meta-SecAlign, the best-defended published model, holds up when an attacker searches for a working injection, then trains its own models to beat that result.

## How it works

Adversarial training plus a new preference-optimization loss is the method. The authors argue that DPO anchors a defended model to an undefended reference model, which caps how secure training can make it, and they derive SecPO from an injection-invariant, utility-preserving reference instead. Their pipeline optimizes each training injection to best@240 rather than reusing fixed templates. Three adaptive attacks are held out from training: Genetic search with MAP-Elites, TAP tree search, and PISmith, an attacker trained with reinforcement learning.

## Who is affected

Teams that treat an injection-hardened model as a security boundary are the audience for this result, and Meta-SecAlign is the control the paper measures. Llama-3.1-8B-Instruct and Qwen3.6-27B are the models the authors train, with thinking disabled, and they report that benign utility holds across nine benchmarks. Scores for the undefended model, Meta-SecAlign and SecPO are in the table on this page.

## What to do

Test any injection-hardened model with a search-based attack rather than fixed injection templates before relying on it: the paper's static and adaptive scores differ by more than an order of magnitude. The code is published under Apache-2.0, and both trained models and their training sets are on Hugging Face under separate terms, so the numbers can be reproduced.

## Attack success rate, AgentDojo under adaptive Genetic search at 800 calls

Higher is worse for defenders. Under static attacks the same three score 26.9%, 2.2% and 0.0%.

| Result | Score |
|---|---|
| Undefended Qwen3.6-27B | 81.3% |
| Meta-SecAlign | 78.8% |
| **SecPO with adversarial training** (this story) | 8.8% |

Source: https://arxiv.org/html/2610.41998v1

## Quick facts

- **Baseline:** Meta-SecAlign, trained with DPO
- **Models trained:** Llama-3.1-8B-Instruct (online) and Qwen3.6-27B (offline adversarial training)
- **Adaptive attacks:** Genetic search with MAP-Elites, TAP and PISmith, all held out from training
- **Benchmarks:** AgentDojo, SEP and DTaP for security, plus nine benign utility benchmarks
- **Code:** github.com/Sizhe-Chen/SecPO under Apache-2.0; models and training sets on Hugging Face
- **arXiv v1:** 2026-10-30

## Questions

### Does Meta-SecAlign stop prompt injection in the SecPO tests?

Meta-SecAlign stops the fixed injection templates but not the search-based ones. In the paper's main results the authors measure 2.2% attack success for Meta-SecAlign on AgentDojo under static attacks and 78.8% under adaptive Genetic search with 800 victim calls. The same gap appears on SEP, where Meta-SecAlign moves from 2.9% under static attacks to 93.7% under that search.

### What does SecPO change compared with DPO training?

SecPO replaces the reference model that DPO optimizes against. The authors say anchoring training to an undefended reference model limits how secure the result can be, and use an injection-invariant, utility-preserving reference instead. Over DPO they report a further 2.4 to 4.6 times reduction in attack success, while adversarial training with stronger optimized injections accounts for a 1.5 to 14.5 times reduction against Meta-SecAlign.

### Can defenders reproduce the SecPO results?

Code, training data and trained models are public. The SecPO repository carries the training and evaluation code under Apache-2.0, and Hugging Face hosts the SecPO versions of Llama-3.1-8B-Instruct and Qwen3.6-27B together with their training sets. The repository notes that model, dataset and benchmark terms are separate from the code license, and that redistribution review for the Qwen training set is still pending.

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.41998)
2. [Full Text](https://arxiv.org/html/2610.41998v1)
3. [SecPO Code](https://github.com/Sizhe-Chen/SecPO)
4. [SecPO Qwen Model](https://huggingface.co/Sizhe-Chen/Qwen3.6-27B-Instruct-SecPO)