Large model self-reflection fine-tuning lets agents learn to defend against unknown prompt injection

A research team from Johns Hopkins University, Washington University in St. Louis and other institutions proposed the self-reflection fine-tuning method SRFT, which lets agents learn from their own erroneous decisions to defend against prompt injection. The method first has the model sample candidate actions in attacked contexts, has an expert model generate reflection text explaining the reasons for and consequences of the errors, and then performs LoRA supervised fine-tuning together with the correct actions. On AgentDojo, Llama-3.1-8B's attack success rate dropped from 7.59% to 1.26%, and Qwen3-8B's from 16.97% to 1.05%; against the RL-Hammer adaptive attack, the original Llama-3.1-8B model had an attack success rate of 98.5%, and after SRFT training only 17.5%.