SecOPD Releases Qwen Checkpoint for Prompt-Injection Defense
SecOPD released a research implementation and merged Qwen3.6-27B checkpoint for mitigating adaptive indirect prompt injections through on-policy distillation. According to the project's Hugging Face model card, its reported results include a 9.0% PISmith attack success rate, versus 94.0% for Meta-SecAlign and 97.9% for an undefended model.
The SecOPD project released a research implementation, training recipes, benchmark evaluators, and a merged Qwen3.6-27B checkpoint for mitigating adaptive indirect prompt injections with on-policy distillation. The repository includes training code for its full-response KL formulation, along with evaluators for SEP, PISmith, AgentDojo, and utility benchmarks including MMLU-Pro, GPQA Diamond, GSM8K, and Minerva MATH.
According to the SecOPD repository, the method trains a student model to generate under an attacked context while a clean-context teacher, initialized from the same base model, scores the sampled response tokens under a paired clean context. The reverse-KL training signal applies across every generated token, including reasoning tokens, rather than selecting a supervision span using a </think> boundary.
Released model and training configuration
The Hugging Face model card identifies the released artifact as a merged checkpoint based on Qwen/Qwen3.6-27B, with LoRA training merged into 15 safetensors shards. It lists 19,000 training examples derived from Cleaned-Alpaca with simulated prompt injections, LoRA rank 128, a 1e-4 learning rate, temperature 1.0, and a maximum training generation length of 16,000 tokens.
The project documentation warns that raw Tinker adapters should not be merged using vanilla PEFT. According to the repository, Qwen3.6 linear-attention and lm_head key names require the weight mapping implemented in tinker_cookbook.weights.
Reported security results
The Hugging Face model card reports lower attack success rates for SecOPD than the compared baselines on several tests:
- •PISmith ASR: 9.0%, compared with 94.0% for Meta-SecAlign and 97.9% for the undefended model.
- •SEP static ASR: 1.3%.
- •SEP basic-adaptive ASR: 0.2%.
- •AgentDojo ASR: 4.7%.
The model card notes that attack success rate is lower-is-better, that PISmith uses non-thinking evaluation, and that the other cited evaluations use thinking-enabled inference. These are project-reported benchmark results; the supplied materials do not provide an independent replication.
Deployment boundary remains material
SecOPD's model card instructs users to place trusted instructions in the user role and untrusted documents, tool outputs, images, or other attacker-controlled material in the input role. It explicitly warns against concatenating attacker-controlled content into system or user messages.
That boundary is important because the reported training formulation depends on distinguishing attacked and clean contexts. In comparable agent-security deployments, model-side robustness methods and application-layer role separation address different parts of the threat model: a defensive checkpoint does not remove the need to label untrusted inputs correctly before inference.
Key Points
- 1SecOPD releases reproducible training and evaluation code for adaptive prompt-injection defense across SEP, PISmith, and AgentDojo benchmarks.
- 2Project-reported PISmith ASR falls to 9.0%, providing a substantial benchmark gap versus the listed undefended and Meta-SecAlign baselines.
- 3Comparable agent-security systems depend on explicit trust boundaries, because model training cannot compensate for misclassified attacker-controlled inputs.
Scoring Rationale
This is a practically relevant open research release for teams evaluating defenses against indirect and adaptive prompt injection in LLM agents. The included checkpoint, training recipe, and multiple evaluators make the work more actionable than a paper-only result, though the reported benchmark claims require independent replication.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
