RAISED: self-distillation to harden agents against prompt injection

What is this?

On October 5, 2026, a team led by Mohamed Dhouib (with Elie Bursztein among the authors) posted RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents (arXiv:2610.06401, cs.CR). It targets indirect prompt injection: a tool-using agent reads untrusted external content (a web page, a document, a tool response) and is manipulated into acting on instructions hidden in it.

The paper is a defense contribution, not a new attack. Its starting observation is that training-time defenses do lower attack success rates but often degrade general capabilities, and that the cause may be a shift in the model’s output distribution even on benign inputs.

How it works

According to the abstract, the authors identify a specific failure of existing defended models: on benign tool-use tasks they sometimes skip a step required to finish an authorized task, particularly when a tool output is what indicates that step. The model has learned to distrust tool output so broadly that it ignores legitimate guidance.

RAISED (Robust Attack Invariance through Self-Distillation) addresses this in three moves:

1. The model generates its own tool-use scenarios, emphasizing cases where completing the task requires acting on legitimate guidance found in tool outputs.
2. A teacher provides the behavior it would show in a clean context.
3. A student is trained to match the teacher’s clean-context behavior on both the clean and the injected version of the same trajectory.

The intent is “attack invariance”: the injected text should not change what the agent does. The authors report that attack success for injections in tool responses is reduced substantially while utility on agentic and general-purpose benchmarks is preserved. The abstract gives no numeric results, so concrete figures should be taken from the full paper rather than assumed.

For context, a related paper published on August 21, 2026, SecOPD (Peng, Lian, Wagner, Chen), also uses distillation: token-level feedback from the initial model scored against the clean input. It reports a 9.0% attack success rate on adaptive injections for a defended Qwen3.6-27B, versus 94.0% for Meta-SecAlign, and 4.7% versus 5.5% on an unseen agentic tool-calling domain. The two works differ in method but share the idea of using the clean-input behavior as the training target.

Why it matters

Prompt injection remains the central unsolved problem for agents, and defenders face a trade-off: stronger resistance often means a less useful agent. A defense that fails by skipping legitimate steps is operationally costly, because it shows up as unreliable task completion rather than as a security alert. Evaluating both attack success and benign task completion is therefore necessary; reporting only one hides the cost.

This is a preprint. It has not been independently replicated, and training-based defenses address model behavior only, not the surrounding system.

Defenses

• Treat training-time robustness as one layer. Keep least-privilege tool permissions, human approval for sensitive actions, and isolation of untrusted content regardless of the model used.
• Measure utility alongside security. When evaluating a defended model, run benign multi-step tool tasks where a tool output legitimately directs the next step, and track skipped steps.
• Test on your own tool outputs. Benchmark results may not transfer to your agent’s real data formats.
• Use adaptive attacks in evaluation, not only static injection strings.
• Monitor and log tool calls so deviations from the authorized task are detectable.

Status

Item	Detail
Paper	arXiv:2610.06401, v1, submitted 2026-10-05
Peer review	Not indicated (preprint)
Quantitative results	Not stated in the abstract
Related work	SecOPD, arXiv:2608.21500, 2026-08-21
Vulnerability / CVE	Not applicable (defense research)