ReasAlign: Reasoning-enhanced safety alignment defends against prompt injection attacks

The researchers propose ReasAlign, a model-level safety alignment method against indirect prompt injection attacks. Its core is to add structured reasoning steps into safety alignment, analyzing the user query, identifying conflicting instructions, and maintaining the continuity of the user's original task; it also introduces a test-time scaling mechanism, in which a preference-optimized judge model scores the reasoning steps and selects the best trajectory. On the CyberSecEval2 open-ended benchmark containing multiple prompt injection tasks, ReasAlign achieves 94.6% utility and 3.6% attack success rate (ASR), significantly outperforming the previously strongest defense model Meta SecAlign (56.4% utility, 74.4% ASR), with utility comparable to an undefended model. Code and experimental results are available at https://github.com/leolee99/ReasAlign。