SecPO: adaptive prompt injections still break Meta-SecAlign

01What happened

Five researchers published SecPO on arXiv on October 30, 2026, a training method meant to make a language model refuse instructions hidden in untrusted data. The paper lists UC Berkeley and Anthropic as affiliations, with a note that the Anthropic author's work was done at Google DeepMind. The team first measures how Meta-SecAlign, the best-defended published model, holds up when an attacker searches for a working injection, then trains its own models to beat that result.

02How it works

Adversarial training plus a new preference-optimization loss is the method. The authors argue that DPO anchors a defended model to an undefended reference model, which caps how secure training can make it, and they derive SecPO from an injection-invariant, utility-preserving reference instead. Their pipeline optimizes each training injection to best@240 rather than reusing fixed templates. Three adaptive attacks are held out from training: Genetic search with MAP-Elites, TAP tree search, and PISmith, an attacker trained with reinforcement learning.

03Who is affected

Teams that treat an injection-hardened model as a security boundary are the audience for this result, and Meta-SecAlign is the control the paper measures. Llama-3.1-8B-Instruct and Qwen3.6-27B are the models the authors train, with thinking disabled, and they report that benign utility holds across nine benchmarks. Scores for the undefended model, Meta-SecAlign and SecPO are in the table on this page.

04What to do

Test any injection-hardened model with a search-based attack rather than fixed injection templates before relying on it: the paper's static and adaptive scores differ by more than an order of magnitude. The code is published under Apache-2.0, and both trained models and their training sets are on Hugging Face under separate terms, so the numbers can be reproduced.

Measured results

Questions people ask

Does Meta-SecAlign stop prompt injection in the SecPO tests?

Meta-SecAlign stops the fixed injection templates but not the search-based ones. In the paper's main results the authors measure 2.2% attack success for Meta-SecAlign on AgentDojo under static attacks and 78.8% under adaptive Genetic search with 800 victim calls. The same gap appears on SEP, where Meta-SecAlign moves from 2.9% under static attacks to 93.7% under that search.

What does SecPO change compared with DPO training?

SecPO replaces the reference model that DPO optimizes against. The authors say anchoring training to an undefended reference model limits how secure the result can be, and use an injection-invariant, utility-preserving reference instead. Over DPO they report a further 2.4 to 4.6 times reduction in attack success, while adversarial training with stronger optimized injections accounts for a 1.5 to 14.5 times reduction against Meta-SecAlign.

Can defenders reproduce the SecPO results?

Code, training data and trained models are public. The SecPO repository carries the training and evaluation code under Apache-2.0, and Hugging Face hosts the SecPO versions of Llama-3.1-8B-Instruct and Qwen3.6-27B together with their training sets. The repository notes that model, dataset and benchmark terms are separate from the code license, and that redistribution review for the Qwen training set is still pending.

Sources 4 links, all fetched

1. 1arxiv.orgarXiv Paper
2. 2arxiv.orgFull Text
3. 3github.comSecPO Code
4. 4huggingface.coSecPO Qwen Model