Large-model self-reflection fine-tuning SRFT lets agents learn to defend against unknown prompt injection

A team from Johns Hopkins University and other institutions released a paper on October 3, 2026, proposing the SRFT (self-reflection fine-tuning) safety training method: first, the model to be trained samples its own candidate actions from tool returns containing injected content; then an expert model compares the correct action, analyzes the cause of the error and potential consequences, and uses the reflection text together with the correct action for supervised fine-tuning. On AgentDojo, Llama-3.1-8B's attack success rate dropped from 7.59% to 1.26%, and Qwen3-8B's from 16.97% to 1.05%; against the RL-Hammer adaptive attack, after 20 rounds of attack training, Llama-3.1-8B's SR-Agent attack success rate was 17.5%, lower than the original model's 98.5% and Meta-SecAlign's 69.5%. Ablation experiments showed that on Qwen3-8B, removing the error action analysis raised the attack success rate from 17.0% to 65.0%.