Metraipolis › archive › dc_02c212c337fc

Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience — arXiv:2610.04269

Source: arXiv
Original: https://arxiv.org/abs/2610.04269
License (as archived): CC0-1.0
Archived: 2026-10-06T05:30:00.230Z
SHA-256 of the archived text: fdfd60a1895ea07d19b290634687f4ccde88c5cd2245771703df39864b4b43a2
Stable URL of this page: https://metraipolis.com/documento/dc_02c212c337fc

How to cite

Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience — arXiv:2610.04269 — arXiv, https://arxiv.org/abs/2610.04269 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_02c212c337fc (Metraipolis archive dc_02c212c337fc, sha256 fdfd60a1895ea07d19b290634687f4ccde88c5cd2245771703df39864b4b43a2)

BibTeX

@misc{dc02c212c337fc,
  title = {Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience — arXiv:2610.04269},
  howpublished = {arXiv},
  url = {https://arxiv.org/abs/2610.04269},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_02c212c337fc; sha256 fdfd60a1895ea07d19b290634687f4ccde88c5cd2245771703df39864b4b43a2},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv, https://arxiv.org/abs/2610.04269. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Large language model (LLM) agents are increasingly deployed in tool-augmented environments, but their reliance on external inputs makes them highly vulnerable to prompt injection attacks that can hijack task objectives. Existing safety alignment methods rely on static expert trajectories or preference optimization, limiting their ability to generalize to adaptive attack patterns. In this work, we propose Self-Reflection Fine-Tuning (SRFT), a training framework that enables agents to improve robustness by learning from their own failure experiences under adversarial conditions. Instead of passively imitating expert behaviors, SRFT exposes the agent to compromised trajectories constructed via injected attacks, and leverages an expert model to generate structured self-reflection reasoning that contrasts unsafe and optimal actions. This reflective supervision teaches the agent to identify malicious instructions, reason about their consequences, and maintain alignment with the original user intent. We instantiate this framework in SR-Agent, built on Llama-3.1-8B-Instruct and Qwen3-8B, and evaluate it on both static and adaptive prompt injection benchmarks. Experimental results show that SRFT substantially reduces attack success rates while preserving task performance, and demonstrates strong generalization under adaptive attacks. These findings suggest that learning from failure via self-reflection is a promising direction for building robust and secure LLM agents. Our code is released at this https URL .

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Machine Learning (cs.LG) ; Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2610.04269 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-06T05:26:35.380Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).