G.O.S.S.I.P Reading Recommendation 2026-11-05 LocalAlign, improving the generalization of prompt injection defenses through near-target adversarial training

Researchers from Nanyang Technological University and Wuhan University, in the CCS 2026 paper LocalAlign, propose improving the generalization of prompt injection defenses through near-target adversarial training. Addressing two types of insufficient generalization—input-side optimized injection text and target-side attack objectives close to correct answers—they design a three-stage training process: warm-up, near-target adversarial example generation, and margin-aware alignment. On Llama-3.1-8B-Instruct and Qwen3-4B-Instruct-2507, the ASR of optimization-free attacks on six out-of-distribution datasets all drops below 10%, while adaptive attacks remain more challenging; for Llama-3.1-8B-Instruct, the in-distribution adaptive GCG ASR on AlpacaFarm drops from 2.40% to 0.48%. Compared with Meta-SecAlign, normal capability drops by at most 2.00 percentage points; relative to the undefended original model, Qwen's MMLU-Pro drops from 56.74% to 49.35%. The paper and code are open-sourced.