TRACER: channel-aware adversarial training defense against indirect prompt injection
Start here
An arXiv paper released on October 14, 2026, proposes TRACER, a channel-aware adversarial training method for defending against indirect prompt injection. The authors point out that defense robustness is related to the channel in which the attack occurs: the same attack has a success rate of 18% when sent as a follow-up message, but rises to 53% when placed in the retrieval context. Using Qwen2.5-3B-Instruct on GSM8K, TRACER reduces the attack success rate in RAG scenarios from 65.5% to 6.1%, while maintaining a clean accuracy of 78-82%; joint training with RAG and tools achieves an average attack success rate of 13.9% at the 3B scale.
Generated by AI from reports · Updated 29 days ago
Attention and developments
Attention, hourly
Now 27, 0% in 24 hours·Peak 27 (Nov 6 03:00)
Related research
This event's paper
- TRACER: Trace-Regularized Training Against Indirect Prompt Injection
arXiv · 2026-10-13 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesTRACER: Trajectory-regularized training against indirect prompt injection
The paper proposes TRACER, a channel-aware adversarial training method to defend against indirect prompt injection. The authors point out that defense robustness is related to the channel in which the attack occurs; the same attack has a success rate of 18% when sent as a subsequent message, rising to 53% when placed in the retrieval context. On GSM8K with Qwen2.5-3B-Instruct, TRACER reduced the attack success rate in the RAG scenario from 65.5% to 6.1%, while maintaining a clean accuracy of 78-82%. Joint training with RAG and tools achieved an average attack success rate of 13.9% at the 3B scale, and single-round training at the 7B scale reached 9.4%. Based on this, the authors argue that robust defense requires separate training and evaluation on each deployment channel.