TRACER: Trace-Regularized Training Against Indirect Prompt Injection
We propose TRACER (Trace-Regularized Adversarial Channel Exposure with Reward-shaping), a channel-aware adversarial training method that samples presentation wrappers and combines an answer-anchored, evidence-gated reward with ATRC, which aligns attacked reasoning with clean evidence when an injection is invalid.
ProofPaper ↗
Key points
- Indirect prompt injection uses untrusted retrieved content, tool outputs, or agent messages to override an LLM's intended behavior.
- We show that defense robustness is channel-conditioned: the same attack succeeds 18% of the time as a follow-up message but 53% when placed in retrieved context.
- On GSM8K with Qwen2.5-3B-Instruct, TRACER reduces RAG-framed ASR from 65.5% to 6.1% while preserving 78-82% clean accuracy.
- These results demonstrate that robust defenses must explicitly train and evaluate across deployment channels.
Sources (1)
- [1]TRACER: Trace-Regularized Training Against Indirect Prompt InjectionarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 13, 08:03 PM
We propose TRACER (Trace-Regularized Adversarial Channel Exposure with Reward-shaping), a channel-aware adversarial training method that samples presentation wrappers and combines an answer-anchored, evidence-gated reward with ATRC, which aligns attacked reasoning with clean evidence when an injection is invalid.
Indirect prompt injection uses untrusted retrieved content, tool outputs, or agent messages to override an LLM's intended behavior.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 13, 2026Run fast, private agents on-device with LFM2.5-24B-A2B
- Oct 13, 2026Gemini 4 Argon: Built to solve your hardest problems
- Oct 13, 2026black-forest-labs/flux-3-image-klein-comfy
- Oct 13, 2026Towards Green AI: Evaluating Energy Efficiency for Quantized LLM Inference
- Oct 12, 2026Qwen3.8-27B vs Frontier vs Others
- Oct 12, 2026Alibaba Qwen Introduces QwenGyre: Elastic Reinforcement Learning RL for XLong-Horizon Agents