Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks

• Prompt injection exploits LLMs’ inability to distinguish trusted instructions from untrusted data, creating risks including data exfiltration, security breaches, and malware execution.Source: §1 · p. 1
• Model-level defenses are currently more effective than system-level defenses, but commercial-grade implementations remain closed-source and difficult to reproduce or compare.Source: §1 · p. 1
• Meta SecAlign releases fully open-source 8B and 70B robust models, with the 70B model positioned for commercial-grade secure agentic applications and the 8B model for resource-constrained settings.Source: §1 · p. 1
• SecAlign++ adds an input message type for untrusted data and applies an improved SecAlign defense so developers can securely include untrusted data with a one-line code change.Source: §1 · p. 2
• Meta SecAlign’s evaluation covers 9 utility and 7 security benchmarks, with Meta-SecAlign-70B achieving commercial-grade utility and state-of-the-art prompt-injection security.Source: §1 · p. 2
• META SECALIGN generalizes security and utility to unseen downstream tasks, including agentic workflows, despite training only on generic instruction-tuning samples.Source: §1 · p. 2
• The training and evaluation code and model weights are publicly released to support reproducibility and further research on prompt-injection attacks and defenses.Source: §1 · p. 2

• LLM-integrated applications use an LLM as an orchestrator connecting users with system components such as data, tools, and documentation.Source: §2.1 · p. 2
• Prompt injection is a test-time attack in which a malicious environment adds instructions to data retrieved by an otherwise benign application.Source: §2.2 · p. 2
• The threat model assumes attackers know the benign prompt and prompt template but cannot change them, while embedded instructions can override user instructions.Source: §2.2 · p. 3
• System-level defenses alter application behavior, whereas model-level defenses aim to make the LLM fundamentally distinguish trusted prompts from untrusted data.Source: §2.3 · p. 3
• StruQ adds a message type that encapsulates untrusted data and fine-tunes the model to follow instructions only from trusted prompts.Source: §2.3 · p. 3
• SecAlign constructs preference data by injecting another instruction into input data, defining a desirable response that follows the user instruction and ignores the injected instruction.Source: §2.3 · p. 3
• SecAlign fine-tunes the model with DPO, which increases the log-likelihood difference between desirable and undesirable responses while limiting deviation from the reference model.Source: §2.3 · p. 3

3 SecAlign++: The Training Recipe for META SECALIGN

• SecAlign++ was motivated by utility losses in some domains and introduces randomized injection positions and self-generated responses on top of SecAlign.Source: §3 · p. 3

3.1 Randomized injection position

• A dedicated input message type separates untrusted data from system and user messages, using special delimiters in the chat template.Source: §3 · p. 3
• The message-type separation is applicable to other model families, while recursively filtering special delimiters prevents untrusted data from escaping the separation.Source: §3 · p. 4
• With randomized injection position, the example model generates an explanation and calls the correct tool, whereas the undefended-position model produces empty content and no tool calls.Source: §3.1 · p. 4
• Training injections only at the end of data causes SecAlign to learn a shortcut that ignores the last instructional sentence, potentially suppressing trusted user instructions and producing empty outputs.Source: §3.1 · p. 4
• Randomized injection position moves roughly half of straightforward attacks to the beginning of data, encouraging the model to identify the input role rather than ignore a fixed position.Source: §3.1 · p. 4

3.2 Self-generated responses

• SecAlign’s ground-truth labels can be low-quality or out-of-distribution, causing low utility and unsatisfactory security.Source: §3.2 · p. 5
• Self-generated responses improve utility over TEXT_DAVINCI_003 labels and security over high-quality but out-of-distribution GPT-5 or GPT-4O labels.Source: §3.2 · p. 5

Main results

• State-of-the-art security and commercial-level utility make Meta-SecAlign-70B an open secure foundation for LLM-integrated applications.Its reported utility is similar to most closed-source commercial LLMs with model-level defense.Source: §4 · p. 6

Instruction following

• One to two orders of magnitude lower ASR than Llama 3.3 70B Instruct is achieved on instruction-following benchmarks without noticeably harming utility.On the tested benchmarks, Meta-SecAlign-70B is more secure than all closed-source models except GPT-4O on AlpacaFarm, where ASR is 0.5% versus 0%.Source: §4.3 · pp. 8, 10

Agentic workflows

• 53.8% to 0.5% ASR on InjecAgent and 14.7% to 1.9% on AgentDojo show one-to-two-order-of-magnitude security reductions on agentic workflows.Meta-SecAlign-70B remains comparable to GPT-5 on AgentDojo and WASP utility.Source: §4.3 · p. 10

Generalization and trade-offs

• SecAlign++ establishes a new utility-security frontier over SecAlign without noticeable utility loss from the undefended counterpart, and remains effective across Qwen3 and Llama4.For Qwen3, AlpacaFarm ASR drops from 100% to 1.0% while MMLU utility changes from 70.7% to 70.6%.Source: §4.4 · p. 10

Discussion

• META-SECALIGN-70B bridges the gap between closed commercial-grade defenses and open secure foundation models for agentic applications.The work fully open-sources the model and its defensive training recipe.Source: §5.1 · p. 13
• Security generalizes to diverse downstream tasks unseen during SecAlign++ training, especially agentic workflows.The paper identifies agentic workflows as settings where prompt injection is a major threat.Source: §5.1 · p. 13

Limitations

• The model focuses on indirect prompt injections with benign users and malicious environments, and remains vulnerable to strong adaptive attacks.It does not claim to prevent jailbreaks or direct prompt injections.Source: §5.2 · p. 13

Future Work

• SecAlign++ uses offline preference optimization to build a prompt-injection security policy into a non-reasoning model.The paper contrasts this approach with online reinforcement learning for securing reasoning LLMs.Source: §5.3 · p. 13
• Reasoning LLMs may be more vulnerable to prompt injections, motivating prompt-injection-specific rewards for online reinforcement learning.The major challenge identified is preserving utility while securing reasoning models.Source: §5.3 · p. 13
• Visual prompt injections remain an open problem because image inputs are continuous and vision models have traditionally been more vulnerable to adversarial manipulation.This is especially relevant to multimodal web-navigation agents.Source: §5.3 · p. 13

Ethical Considerations

• The research develops defenses against prompt injection attacks, identified as a critical threat to LLM-integrated applications.It is explicitly intended to improve the security posture of AI systems without introducing new attack capabilities.Source: Ethical Considerations · p. 13
• The open-source secure-model release is intended to support broader research into robust defenses despite dual-use considerations.The authors state that they do not release novel attack techniques that could be misused.Source: Ethical Considerations · p. 13
• The evaluation uses publicly available benchmarks simulating realistic attacks in controlled environments without harming real systems or users.Source: Ethical Considerations · p. 13

Appendix

• GPT-5 results at reasoning levels other than the main paper’s high setting show similar security scores.Source: Appendix · p. 17, Table 9 · p. 17
• Tuning LoRA α at test time provides an easy utility-security trade-off for META-SECALIGN-70B.The appendix contrasts this with controlling the trade-off through learning-rate tuning during training.Source: Appendix · p. 17, Table 11 · p. 19
• Without sandwich prompting, InjecAgent and AgentDojo results still support META SECALIGN’s advantage over commercial LLMs.Source: Appendix · p. 17, Table 10 · p. 18
• Figure 5 reports utility-security trade-offs for SecAlign++ on Llama 3.3 70B Instruct under different training-time learning rates.Source: Figure 5 · p. 18
• The appendix includes a table of security and utility evaluations for LLMs with different capabilities.Source: Table 12 · p. 19