SRFT self-reflection fine-tuning improves agents' resistance to prompt injection

A research team from Johns Hopkins University, Washington University in St. Louis and other institutions proposed the self-reflection fine-tuning method SRFT, which lets agents learn from their own erroneous decisions to defend against prompt injection. The method first has the model sample candidate actions in attacked contexts, has an expert model generate reflection text explaining the reasons for and consequences of the errors, and then performs LoRA supervised fine-tuning together with the correct actions. On AgentDojo, Llama-3.1-8B's attack success rate dropped from 7.59% to 1.26%, and Qwen3-8B's from 16.97% to 1.05%; against the RL-Hammer adaptive attack, the original Llama-3.1-8B model had an attack success rate of 98.5%, and after SRFT training only 17.5%.

A team from Johns Hopkins University and other institutions released a paper on October 3, 2026, proposing the SRFT (self-reflection fine-tuning) safety training method: first, the model to be trained samples its own candidate actions from tool returns containing injected content; then an expert model compares the correct action, analyzes the cause of the error and potential consequences, and uses the reflection text together with the correct action for supervised fine-tuning. On AgentDojo, Llama-3.1-8B's attack success rate dropped from 7.59% to 1.26%, and Qwen3-8B's from 16.97% to 1.05%; against the RL-Hammer adaptive attack, after 20 rounds of attack training, Llama-3.1-8B's SR-Agent attack success rate was 17.5%, lower than the original model's 98.5% and Meta-SecAlign's 69.5%. Ablation experiments showed that on Qwen3-8B, removing the error action analysis raised the attack success rate from 17.0% to 65.0%.