CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement
Boyang Zhang, Qingxin Xiao, Lingwei Dang, Qingyao Wu
cs.LG
Quick verdict
CoER cuts adaptive IPI ASR 42.12%→0.25% via attacker-defender co-evolution + verified SFT; strong gains, but single-run, matched-attacker evidence limits scope.
Summary
The paper formulates within-task adaptive indirect prompt injection (IPI) against tool-using LLM agents as a general-sum Markov game: the attacker may inject several times during one execution, conditioning later payloads on the defender's public responses. CoER proceeds in three stages. First, attacker supervised fine-tuning on verified successful attack trajectories collected against the base defender. Second, bilateral Co-PPO, where both roles retain frozen historical policy populations and training mixes current and historical opponents (0.40/0.25/0.25/0.10) to reduce overfitting to the latest pairing. Third, population-guided Defender SFT: retained attackers challenge GLM-5.2 and DeepSeek V4 Pro teachers, and only demonstrations passing independent safety and task verifiers (5,760 trajectories) fine-tune the co-evolved defender. In the main seven-domain evaluation (1,512 executions), safe task completion on 1,187 adaptive cases rises from 38.75% to 75.40% while observed attack success falls from 42.12% to 0.25%; a matched 2x2 study attributes gains to both co-evolved initialization and population-derived refinement data. External transfer holds (InjecAgent 0.0%/1.97%; AgentLAB ASR 14.12%). Limitations: single-seed single-run training, deterministic verifiers covering only specified goals, and a 4.97% historical-union ASR.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Adaptive IPI in tool agents is usefully modeled as a general-sum Markov game with multi-injection attackers that condition on the defender's public responses.
- CoER reduces observed adaptive attack success from 42.12% to 0.25% (3/1,187) and raises safe task completion from 38.75% to 75.40% on its seven-domain benchmark.
- A matched 2x2 study shows both co-evolved initialization (+6.07 Safe-U) and population-derived refinement data (+8.00) contribute to defender quality, with the combination best.
- Gains transfer to external benchmarks: InjecAgent total ASR 0.0% (base payload)/1.97% (enhanced) and AgentLAB Task-Injection ASR 37.41% to 14.12% under a GPT-5.4 attacker.
Strengths
Exceptional candor about its own evidence limits
Results are labeled seed-0 single-run descriptive point estimates (Section 5.1); the historical-union ASR of 4.97% is reported against the 0.25% headline (Q4); and GLM-5.2-Thinking beating CoER on overall Safe-U (81.47 vs 76.32, Table 1b) is disclosed alongside its confound explanation.
Matched 2x2 attribution design
Table 1c crosses Base/Co-PPO initialization with Std/Pop refinement data, matching cross-entropy, data size, updates, and teachers; Table 8 gives exact numerators (e.g., cell D 895/1,187 Safe-U, 3/1,187 ASR), cleanly separating the two contributions.
Independent dual verifiers and unpooled protocols
Well-controlled same-backbone ablation ladder
Implementation transparency
Weaknesses
Single seed, single training run, single execution per case
Headline ASR is attacker-specific
Aggregate gains hide per-suite regressions
Unreconciled denominators and superseded diagnostics
Verifier scope bounds the security claim
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
CoER targets within-task adaptive indirect prompt injection (IPI): an attacker that may inject several times during a single tool-agent execution, conditioning later payloads on the defender's public responses (Figure 1). The central empirical claims are: (1) on the main seven-domain workload (three AgentDyn + four AgentDojo suites; 1,512 executions, 1,187 adaptive cases), CoER cuts observed adaptive ASR from 42.12% (base Qwen3.5-9B) to 0.25% (3/1,187) and lifts Safe-U from 38.75% to 75.40% (Table 1a; aggregate Table 6: overall ASR 38.45→0.22, U 63.23→76.32); (2) a matched 2x2 study (Table 1c) attributes +8.00 and +6.07 adaptive Safe-U points to population-derived refinement data and co-evolved initialization respectively, with the combination best (cell D: 75.40 Safe-U, 0.25 ASR); (3) gains transfer externally (Table 2: InjecAgent total ASR 0.0%/1.97%; AgentLAB Task-Injection ASR 37.41→14.12 under a GPT-5.4 attacker).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is CoER?
CoER (Co-Evolution and Refinement) is a three-stage defense framework for tool-using LLM agents facing indirect prompt injection. It first fine-tunes an attacker on verified successful attacks, then co-trains attacker and defender with reinforcement learning (Co-PPO) while mixing in historical opponent policies, and finally fine-tunes the defender on teacher demonstrations that pass both safety and task verifiers.
How effective is CoER against prompt injection attacks?
On the paper's own seven-domain adaptive benchmark (1,187 cases), observed attack success drops from 42.12% (base model) to 0.25% (3 cases) and safe task completion rises from 38.75% to 75.40%. On external benchmarks the picture is more modest: AgentLAB Task-Injection ASR falls from 37.41% to 14.12% under GPT-5.4 attacks, and the union of all retained historical attackers still succeeds on 4.97% of cases.
Is CoER's code or model available?
Not at submission time. The paper promises a released artifact including configuration and evaluation manifests, subject to dual-use safeguards (the trained attacker is potentially harmful). Exact replication also requires ~56 GPUs and proprietary teacher APIs (GLM-5.2, DeepSeek V4 Pro) that are not immutably snapshotted.
What are CoER's main limitations?
All headline results come from a single seed and single training run with no variance estimates; deterministic verifiers only cover pre-declared attack goals; the historical-union attack success rate is 4.97% versus the headline 0.25%; aggregate gains hide per-suite regressions (e.g., Banking clean utility falls from 87.50% to 68.75% versus the Co-PPO checkpoint); and no independent human audit of verifier correctness exists yet.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The extraction appears complete through Appendix H (p. 26) with no visible truncation; figures are present only as caption text, so plot-level claims were assessed from values quoted in captions and body text.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.