TRACER：基于轨迹正则化的间接提示注入防御训练

# TRACER: Trace-Regularized Training Against Indirect Prompt Injection
Source: [https://arxiv.org/html/2610.19133](https://arxiv.org/html/2610.19133)
Salem LahlouNils LukasAffiliation:Mohamed bin Zayed University of Artificial IntelligenceAffiliation:Abu Dhabi, United Arab EmiratesEmail:[\{kshitij\.mishra,salem\.lahlou,nils\.lukas\}@mbzuai\.ac\.ae](mailto:)

###### Abstract

Indirect prompt injection uses untrusted retrieved content, tool outputs, or agent messages to override an LLM’s intended behavior\. We show that defense robustness is channel\-conditioned: the same attack succeeds 18% of the time as a follow\-up message but 53% when placed in retrieved context\. We proposeTRACER\(Trace\-Regularized Adversarial Channel Exposure with Reward\-shaping\), a channel\-aware adversarial training method that samples presentation wrappers and combines an answer\-anchored, evidence\-gated reward with ATRC, which aligns attacked reasoning with clean evidence when an injection is invalid\. On GSM8K withQwen2\.5\-3B\-Instruct,TRACERreduces RAG\-framed ASR from 65\.5% to 6\.1% while preserving 78–82% clean accuracy\. Joint RAG\+tool training achieves 13\.9% average ASR across framings at 3B scale, while a single epoch at 7B reaches 9\.4%\. These results demonstrate that robust defenses must explicitly train and evaluate across deployment channels\. Research work’s codebase can be accessed at[https://github\.com/Mishrakshitij/TRACER\.git](https://github.com/Mishrakshitij/TRACER.git)\.

## 1Introduction

Modern LLM systems rarely operate on trusted prompts alone\. Retrieval\-augmented generation \(RAG\) pipelines ingest documents from search or knowledge bases\([Lewis et al\., 2020](https://arxiv.org/html/2610.19133#bib.bib3);[Gao et al\., 2023](https://arxiv.org/html/2610.19133#bib.bib4)\); tool\-using assistants consume API outputs\([Qin et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib14);[Patil et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib15)\); and LLM agents act on observations from interactive environments\([Liu et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib16)\)and on messages from other agents\([Li et al\., 2023](https://arxiv.org/html/2610.19133#bib.bib41)\)\. In each case, the model must act on text that it did not author and cannot fully trust\. This creates the setting for*indirect prompt injection*: malicious instructions hidden inside external content rather than entered as direct user prompts\([Greshake et al\., 2023](https://arxiv.org/html/2610.19133#bib.bib5)\)\.

A central but under\-tested assumption in this literature is that robustness transfers across presentation channels\. If the same malicious payload is tolerated as a conversational follow\-up, will it also be tolerated when wrapped as a retrieved document, a tool response with provenance metadata, or a message from another agent? Existing defenses are usually trained and evaluated within a single wrapper, so this question is rarely isolated directly\.

We begin by empirically testing this transfer assumption\. Specifically, we ask whether a model trained to resist malicious instructions in one presentation channel remains robust when the same attack content is re\-wrapped in another\. The answer is no: across six intermediate model snapshots trained against follow\-up\-style attacks, simply re\-wrapping the same attack strings as retrieved documents increases average ASR from 18% to 53%\. The base model also exhibits a strong authority gradient, where the same payload is less effective as a casual follow\-up than as a document, tool output, or agent message\. We call this phenomenon the*framing gap*\.

Figure 1:Left: the same malicious payload is injected through different untrusted\-context channels\. Middle: changing only the wrapper creates a framing gap; apparent authority/provenance cues are one possible explanation for the measured effect\. Right:TRACERtrains on channel\-sampled three\-turn games using an answer\-anchored, evidence\-gated reward and ATRC trace alignment, and evaluates both native robustness and cross\-framing transfer\.To address this gap, we proposeTRACER\(Trace\-RegularizedAdversarialChannelExposure withReward\-shaping\), a deployment\-matched adversarial training framework that treats the channel of untrusted context as part of the optimization problem\.TRACERcombines a three\-turn robustness game with two training components designed for indirect injection: an answer\-anchored, evidence\-gated composite reward for the*post\-attack*response, and ATRC, a committed\-span*Adversarial Trace Recovery and Consistency*loss that aligns attacked reasoning to clean anchor spans when injected evidence is invalid\. This lets us ask not only whether a defense works in one wrapper, but whether the learned robustness transfers across wrappers with different authority cues\. Ourkeycontributions are:

- •Framing gap\.We identify and quantify a channel\-conditioning effect in indirect prompt injection: identical adversarial content becomes substantially more successful when presented through a different untrusted\-context channel\.
- •Channel\-aware training\.We introduceTRACER, an adversarial training framework that combines wrapper\-sampled channel exposure, an answer\-anchored evidence\-gated reward, and a committed\-span ATRC trace\-alignment loss to preserve clean reasoning under invalid injected evidence\.
- •Cross\-framing evaluation\.We show that transfer across wrappers is asymmetric, revealing a depth–breadth trade\-off between native robustness and generalization\. Multi\-framing training gives the best 3B average performance, while 7B models substantially reduce the trade\-off\.

## 2Related Work

#### Indirect prompt injection and benchmarks\.

Indirect prompt injection was first highlighted as a practical threat to LLM\-integrated applications by[Greshake et al\. \(2023\)](https://arxiv.org/html/2610.19133#bib.bib5)\. Subsequent benchmarks broaden the attack surface from single applications to agents, dynamic environments, and web\-native settings, including BIPIA, InjecAgent, AgentDojo, ASB, WASP, and Hidden\-in\-Plain\-Text\([Yi et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib8);[Zhan et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib6);[Debenedetti et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib7);[Zhang et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib27);[Evtimov et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib28);[Guo and Wei, 2026](https://arxiv.org/html/2610.19133#bib.bib29)\)\. Our work is complementary to these benchmarks: rather than introducing another environment, we isolate one factor that cuts across them all, namely the wrapper through which untrusted content reaches the model\.

#### RAG robustness, poisoning, and attack design\.

A related literature studies how retrieved context can be noisy, conflicting, or poisoned\. ConflictQA, RGB, and PoisonedRAG evaluate failures under contradictory or corrupted retrieval\([Xie et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib10);[Chen et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib11);[Zou et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib9)\)\. More recent work explores realistic indirect injections such as TopicAttack\([Chen et al\., 2025c](https://arxiv.org/html/2610.19133#bib.bib30)\)\. These studies mainly treat robustness as a property of a fixed pipeline\. By contrast, we vary the*presentation channel*while holding the underlying payload fixed, allowing us to ask whether learned robustness generalizes across wrappers\.

#### Defenses\.

Existing defenses include prompt/data separation with structured instruction tuning\([Chen et al\., 2025a](https://arxiv.org/html/2610.19133#bib.bib13)\), data marking at inference time\([Hines et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib12)\), alignment\-based training such as SecAlign\([Chen et al\., 2025b](https://arxiv.org/html/2610.19133#bib.bib31)\), and runtime detector, re\-execution, parsing, or correction defenses such as MELON, CaMeL, instruction detection, robustness\-via\-referencing, PromptArmor, tool\-result parsing, ICON, and AttriGuard\([Zhu et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib32);[Debenedetti et al\., 2026](https://arxiv.org/html/2610.19133#bib.bib24);[Wen et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib25);[Chen et al\., 2026](https://arxiv.org/html/2610.19133#bib.bib33);[Shi et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib26);[Yu et al\., 2026](https://arxiv.org/html/2610.19133#bib.bib36);[Wang et al\., 2026](https://arxiv.org/html/2610.19133#bib.bib37);[He et al\., 2026](https://arxiv.org/html/2610.19133#bib.bib38)\)\. These approaches usually harden a fixed pipeline or add an auxiliary inference\-time module\. Our focus is complementary: we study how the base model itself can be trained to maintain correct post\-attack behavior when identical malicious content arrives through different untrusted channels\.

#### Reinforcement learning for reasoning\.

RL with verifiable rewards, most prominently GRPO, is now a standard way to improve LLM reasoning\([Shao et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib1);[Guo et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib2);[Yu et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib42)\), alongside process rewards for individual steps\([Lightman et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib22);[Wang et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib23)\)\. Follow\-up work encourages exploration and diversity\([Cui et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib43);[Cheng et al\., 2026](https://arxiv.org/html/2610.19133#bib.bib44);[Song et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib45);[Walder and Karkhanis, 2025](https://arxiv.org/html/2610.19133#bib.bib46);[Mishra et al\., 2026b](https://arxiv.org/html/2610.19133#bib.bib39)\)or lets several models reason and learn together\([Du et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib47);[Subramaniam et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib48);[Park et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib49);[Wan et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib50);[Mishra et al\., 2026a](https://arxiv.org/html/2610.19133#bib.bib40)\)\. These methods improve reasoning on clean inputs;TRACERinstead uses the clean reasoning trace as an anchor that attacked reasoning must stay consistent with when injected evidence is invalid\.

#### How prompt\-injection defenses should be evaluated\.

Recent evaluations argue that prompt\-injection defenses should be assessed jointly on security and utility, and against adaptive attacks rather than only static strings\([Jia et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib34);[Zhan et al\., 2025](https://arxiv.org/html/2610.19133#bib.bib35)\)\. Our framing\-gap analysis fits that agenda: a defense that appears robust in one wrapper may fail badly in another even when the adversarial payload is unchanged\. We therefore emphasize cross\-framing transfer, final\-checkpoint comparisons, and conditional ASR rather than only a single in\-channel score\.

## 3TRACER

#### Problem setup\.

Let𝒟=\{\(xi,yi\)\}i=1N\\mathcal\{D\}=\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{N\}denote a task dataset, wherexix\_\{i\}is the user task andyiy\_\{i\}is the gold answer\. Letaia\_\{i\}denote adversarial content, and letc∈𝒞c\\in\\mathcal\{C\}denote the channel through which this content is presented\. In our experiments,

𝒞=\{followup,rag,tool,agent\}\.\\mathcal\{C\}=\\\{\\texttt\{followup\},\\texttt\{rag\},\\texttt\{tool\},\\texttt\{agent\}\\\}\.We writeρc​\(ai\)\\rho\_\{c\}\(a\_\{i\}\)for the channel\-specific rendering of the same adversarial payload\. Thus, the malicious instruction is held fixed while only its presentation channel changes\.

For a policyπ\\pi, let

y^i0=ans⁡\(π⁡\(xi\)\)\\hat\{y\}\_\{i\}^\{0\}=\\operatorname\{ans\}\(\\pi\(x\_\{i\}\)\)be the answer extracted from the clean response, and let

y^ic=ans⁡\(π⁡\(xi,ρc​\(ai\)\)\)\\hat\{y\}\_\{i\}^\{c\}=\\operatorname\{ans\}\(\\pi\(x\_\{i\},\\rho\_\{c\}\(a\_\{i\}\)\)\)be the answer extracted after adversarial content is introduced through channelcc\. We report three empirical quantities:

Acc^0​\(π\)\\displaystyle\\widehat\{\\operatorname\{Acc\}\}\_\{0\}\(\\pi\)=1N∑i=1N𝟏\[y^i0=yi\],\\displaystyle=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\[\\hat\{y\}\_\{i\}^\{0\}=y\_\{i\}\],\(1\)Acc^c​\(π\)\\displaystyle\\widehat\{\\operatorname\{Acc\}\}\_\{c\}\(\\pi\)=1N∑i=1N𝟏\[y^ic=yi\],\\displaystyle=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\[\\hat\{y\}\_\{i\}^\{c\}=y\_\{i\}\],\(2\)ASR^c​\(π\)\\displaystyle\\widehat\{\\operatorname\{ASR\}\}\_\{c\}\(\\pi\)=∑i=1N𝟏\[y^i0=yi\]𝟏\[y^ic≠yi\]∑i=1N𝟏\[y^i0=yi\]\.\\displaystyle=\\frac\{\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\[\\hat\{y\}\_\{i\}^\{0\}=y\_\{i\}\]\\mathbf\{1\}\[\\hat\{y\}\_\{i\}^\{c\}\\neq y\_\{i\}\]\}\{\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\[\\hat\{y\}\_\{i\}^\{0\}=y\_\{i\}\]\}\.\(3\)HereAcc^0\\widehat\{\\operatorname\{Acc\}\}\_\{0\}measures clean task performance,Acc^c\\widehat\{\\operatorname\{Acc\}\}\_\{c\}measures post\-attack accuracy under channelcc, andASR^c\\widehat\{\\operatorname\{ASR\}\}\_\{c\}measures conditional attack success rate\. The conditioning is important: an example counts as a successful attack only when the model solved the task before seeing the injected content and failed after seeing it\. This separates genuine injection\-induced failures from ordinary task errors\.

For a modelπS\\pi\_\{S\}trained on channel setS⊆𝒞S\\subseteq\\mathcal\{C\}, we define the cross\-channel transfer gap from a training channelctr∈Sc\_\{\\mathrm\{tr\}\}\\in Sto an evaluation channelcev∈𝒞c\_\{\\mathrm\{ev\}\}\\in\\mathcal\{C\}as

Δ^ctr→cev​\(πS\)=ASR^cev​\(πS\)−ASR^ctr​\(πS\)\.\\widehat\{\\Delta\}\_\{c\_\{\\mathrm\{tr\}\}\\rightarrow c\_\{\\mathrm\{ev\}\}\}\(\\pi\_\{S\}\)=\\widehat\{\\operatorname\{ASR\}\}\_\{c\_\{\\mathrm\{ev\}\}\}\(\\pi\_\{S\}\)\-\\widehat\{\\operatorname\{ASR\}\}\_\{c\_\{\\mathrm\{tr\}\}\}\(\\pi\_\{S\}\)\.\(4\)A positive value indicates that robustness learned underctrc\_\{\\mathrm\{tr\}\}does not fully transfer tocevc\_\{\\mathrm\{ev\}\}\. In other words, the model has learned channel\-specific skepticism rather than channel\-invariant robustness\.

#### Threat model\.

We consider indirect prompt injection in which the attacker can modify only*untrusted external context*\. The attacker cannot modify the original user task, hidden system or developer instructions, model weights, training procedure, or evaluation harness\. The defender must therefore solve a semantic\-control problem: the model should use external context as evidence when it is relevant and valid, but should not treat adversarial text inside that context as an instruction to obey\. This threat model covers retrieved documents, tool outputs, and messages from other agents\. These channels are especially challenging because their surface form often carries implicit authority even though their contents may be untrusted\.

#### Three\-turn robustness game\.

Each training episode is formulated as a three\-turn robustness game\. First, the model receives the clean taskxix\_\{i\}and produces a clean reasoning traceτi0\\tau\_\{i\}^\{0\}and clean answery^i0\\hat\{y\}\_\{i\}^\{0\}\. Second, the same adversarial payloadaia\_\{i\}is rendered through a sampled channelcic\_\{i\}asρci​\(ai\)\\rho\_\{c\_\{i\}\}\(a\_\{i\}\)\. Third, the model produces a post\-attack reasoning traceτici\\tau\_\{i\}^\{c\_\{i\}\}and answery^ici\\hat\{y\}\_\{i\}^\{c\_\{i\}\}\.

The central design choice is that the channelcic\_\{i\}is sampled as part of training:

ci∼p𝒮​\(c\),supp⁡\(p𝒮\)=S⊆𝒞\.c\_\{i\}\\sim p\_\{\\mathcal\{S\}\}\(c\),\\qquad\\operatorname\{supp\}\(p\_\{\\mathcal\{S\}\}\)=S\\subseteq\\mathcal\{C\}\.This allowsTRACERto instantiate both single\-channel specialists, such as RAG\-only training withS=\{rag\}S=\\\{\\texttt\{rag\}\\\}, and multi\-channel training, such as joint RAG\+tool training withS=\{rag,tool\}S=\\\{\\texttt\{rag\},\\texttt\{tool\}\\\}\. The wrapper is therefore not an evaluation afterthought; it is a random variable in the training objective\.

#### Composite post\-attack reward\.

TRACERassigns reward only to the post\-attack response\. The reward is designed to encourage*contextual skepticism*: the model should preserve a correct answer when injected evidence is invalid, but should still be able to revise its answer when new evidence is valid\. For a single training episode, the scalar reward is

r=∑k∈𝒦βk​rk,𝒦=\{ans,proc,anc,corr,len\}\.r=\\sum\_\{k\\in\\mathcal\{K\}\}\\beta\_\{k\}r\_\{k\},\\quad\\mathcal\{K\}=\\\{\\mathrm\{ans\},\\mathrm\{proc\},\\mathrm\{anc\},\\mathrm\{corr\},\\mathrm\{len\}\\\}\.\(5\)The five terms correspond to answer correctness, process quality, anchor retention, evidence\-gated corrigibility, and length control111The weights for answer correctness, process quality, anchor retention, corrigibility, and length control are0\.250\.25,0\.250\.25,0\.200\.20,0\.200\.20, and0\.100\.10, respectively\.\. We describe the reward terms for a single episode and omit the example indexii\. The answer term rewards post\-attack correctness:

rans=𝟏\[y^c=y\]\.r\_\{\\mathrm\{ans\}\}=\\mathbf\{1\}\[\\hat\{y\}^\{c\}=y\]\.\(6\)The process term rewards local validity of the post\-attack reasoning trace:

rproc=1\|Steps⁡\(τc\)\|​∑s∈Steps⁡\(τc\)V⁡\(s\),r\_\{\\mathrm\{proc\}\}=\\frac\{1\}\{\|\\operatorname\{Steps\}\(\\tau^\{c\}\)\|\}\\sum\_\{s\\in\\operatorname\{Steps\}\(\\tau^\{c\}\)\}V\(s\),\(7\)whereSteps⁡\(τc\)\\operatorname\{Steps\}\(\\tau^\{c\}\)denotes the reasoning steps extracted from the post\-attack trace andV⁡\(s\)V\(s\)scores whether stepssis locally valid\.

The anchor\-retention term measures whether propositions from the clean trace remain supported after the attack\. LetA0=A⁡\(τ0\)A^\{0\}=A\(\\tau^\{0\}\)be the set of anchor propositions extracted from the clean trace\. We use a verifierϕ\\phithat assigns support and contradiction scores, denotedsϕ\+s\_\{\\phi\}^\{\+\}andsϕ−s\_\{\\phi\}^\{\-\}, respectively\. The anchor\-retention reward is

ranc=1\|A0\|​∑p∈A0\(sϕ\+​\(p,τc\)−sϕ−​\(p,τc\)\)\.r\_\{\\mathrm\{anc\}\}=\\frac\{1\}\{\|A^\{0\}\|\}\\sum\_\{p\\in A^\{0\}\}\\left\(s\_\{\\phi\}^\{\+\}\(p,\\tau^\{c\}\)\-s\_\{\\phi\}^\{\-\}\(p,\\tau^\{c\}\)\\right\)\.\(8\)
The corrigibility term is evidence\-gated\. Letq0=𝟏\[y^0=y\]q^\{0\}=\\mathbf\{1\}\[\\hat\{y\}^\{0\}=y\]andqc=𝟏\[y^c=y\]q^\{c\}=\\mathbf\{1\}\[\\hat\{y\}^\{c\}=y\]denote clean and post\-attack correctness, and letv=𝟏​\[Valid⁡\(a,c\)\]v=\\mathbf\{1\}\[\\operatorname\{Valid\}\(a,c\)\]indicate whether the external evidence introduced through channelccis valid\. We write

rcorr=C⁡\(q0,qc,v\),r\_\{\\mathrm\{corr\}\}=C\(q^\{0\},q^\{c\},v\),\(9\)whereCCassigns positive reward when the model preserves a correct answer under invalid evidence or corrects itself under valid evidence, and assigns negative reward when invalid evidence flips an otherwise correct answer\. Appendix[B](https://arxiv.org/html/2610.19133#A2)gives the full truth table\. This term is what prevents the reward from collapsing into blanket refusal: the model is rewarded for resisting invalid evidence, but not for ignoring genuinely useful evidence\.

Finally, the length\-control term discourages unnecessary post\-attack verbosity while avoiding a penalty for incorrect answers:

rlen=−λlen1\[y^c=y\]max\{0,\|τc\|−\|τ0\|−δ\}\.r\_\{\\mathrm\{len\}\}=\-\\lambda\_\{\\mathrm\{len\}\}\\,\\mathbf\{1\}\[\\hat\{y\}^\{c\}=y\]\\,\\max\\\{0,\|\\tau^\{c\}\|\-\|\\tau^\{0\}\|\-\\delta\\\}\.\(10\)
This reward differs from answer\-only supervision in two important ways\. First, it distinguishes robustness from blanket refusal: the model should preserve its answer when external evidence is invalid, but should still revise when the evidence is valid\. Second, it makes the clean reasoning trace part of the optimization target, which matters in reasoning tasks where an attack may corrupt intermediate steps rather than only the final answer\.

Figure 2:TRACER:The method samples a task, payload, and channel; generates clean and post\-attack traces; computes the composite reward; applies ATRC on committed clean spans when the gate is active; and updatesπθ\\pi\_\{\\theta\}with the post\-attack objective\.
#### ATRC: Adversarial Trace Recovery and Consistency\.

The second algorithmic ingredient is ATRC, a trace regularizer that preserves clean reasoning under invalid evidence\. For exampleii, letMiM\_\{i\}denote the set of committed response positions induced by anchor spans in the clean traceτi0\\tau\_\{i\}^\{0\}\. Let

gi=𝟏\[y^i0=yi\]1\[Invalid\(ai,ci\)\]g\_\{i\}=\\mathbf\{1\}\[\\hat\{y\}\_\{i\}^\{0\}=y\_\{i\}\]\\,\\mathbf\{1\}\[\\operatorname\{Invalid\}\(a\_\{i\},c\_\{i\}\)\]\(11\)be the evidence gate\. The gate activates ATRC only when the clean response is correct and the injected evidence is invalid\. This prevents the method from forcing the model to preserve an incorrect clean trace or to ignore genuinely valid evidence\.

Letpi,t0p\_\{i,t\}^\{0\}andpi,tcip\_\{i,t\}^\{c\_\{i\}\}denote the clean and post\-attack token distributions at response\-relative positiontt, and letzi,t0z\_\{i,t\}^\{0\}be the clean target token at that position\. We define the per\-token ATRC loss as

ℓi,tATRC=\\displaystyle\\ell\_\{i,t\}^\{\\mathrm\{ATRC\}\}=\{\}αKL\(sg\[pi,t0\]∥pi,tci\)\\displaystyle\\alpha\\,\\mathrm\{KL\}\\\!\\left\(\\operatorname\{sg\}\[p\_\{i,t\}^\{0\}\]\\,\\\|\\,p\_\{i,t\}^\{c\_\{i\}\}\\right\)\(12\)−\(1−α\)​log⁡pi,tci​\(zi,t0\)\.\\displaystyle\-\(1\-\\alpha\)\\log p\_\{i,t\}^\{c\_\{i\}\}\(z\_\{i,t\}^\{0\}\)\.The full ATRC regularizer is then

ℒATRC=1B​∑i=1Bgi\|Mi\|​∑t∈Miℓi,tATRC\.\\mathcal\{L\}\_\{\\mathrm\{ATRC\}\}=\\frac\{1\}\{B\}\\sum\_\{i=1\}^\{B\}\\frac\{g\_\{i\}\}\{\|M\_\{i\}\|\}\\sum\_\{t\\in M\_\{i\}\}\\ell\_\{i,t\}^\{\\mathrm\{ATRC\}\}\.\(13\)
The KL term preserves the clean distribution over the vocabulary, while the token\-recovery term encourages exact recovery of committed clean tokens\. The stop\-gradient operatorsg⁡\[⋅\]\\operatorname\{sg\}\[\\cdot\]treats the clean distribution as a fixed target\. The implementation aligns clean and post\-attack responses by response\-relative position before applyingMiM\_\{i\}; this alignment is necessary because the attacked prompt contains additional channel\-rendered context before the model response begins\.

#### Overall training objective\.

The policy is optimized with GRPO\([Shao et al\., 2024](https://arxiv.org/html/2610.19133#bib.bib1)\)and ATRC regularization\. For a channel\-sampling distributionpSp\_\{S\}over training channelsSS, the objective is

maxθ\\displaystyle\\max\_\{\\theta\}𝔼\(x,y\)∼𝒟,a∼𝒜,c∼pS​\[rθ​\(x,y,a,c\)\]\\displaystyle\\mathbb\{E\}\_\{\(x,y\)\\sim\\mathcal\{D\},\\,a\\sim\\mathcal\{A\},\\,c\\sim p\_\{S\}\}\\left\[r\_\{\\theta\}\(x,y,a,c\)\\right\]\(14\)−λKLKL\(πθ∥π0\)−λregℒATRC,\\displaystyle\-\\lambda\_\{\\mathrm\{KL\}\}\\,\\mathrm\{KL\}\(\\pi\_\{\\theta\}\\,\\\|\\,\\pi\_\{0\}\)\-\\lambda\_\{\\mathrm\{reg\}\}\\,\\mathcal\{L\}\_\{\\mathrm\{ATRC\}\},whererθ​\(x,y,a,c\)r\_\{\\theta\}\(x,y,a,c\)is the composite reward in Equation[5](https://arxiv.org/html/2610.19133#S3.E5), computed from the post\-attack response generated after renderingaathrough channelcc\. A training step withTRACERis given in Algorithm[1](https://arxiv.org/html/2610.19133#alg1)\.

Algorithm 1TRACERTraining1:Sample a batch

\{\(xi,yi\)\}i=1B\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{B\}, adversarial payloads

\{ai\}i=1B\\\{a\_\{i\}\\\}\_\{i=1\}^\{B\}, and channels

ci∼pS​\(c\)c\_\{i\}\\sim p\_\{S\}\(c\)
2:Generate clean traces and answers

\(τi0,y^i0\)\(\\tau\_\{i\}^\{0\},\\hat\{y\}\_\{i\}^\{0\}\)from

πθ​\(xi\)\\pi\_\{\\theta\}\(x\_\{i\}\)
3:Form the clean dialogue prefix

hi0=\(xi,τi0,y^i0\)h\_\{i\}^\{0\}=\(x\_\{i\},\\tau\_\{i\}^\{0\},\\hat\{y\}\_\{i\}^\{0\}\)
4:Render each payload through its sampled channel as

ρci​\(ai\)\\rho\_\{c\_\{i\}\}\(a\_\{i\}\)
5:Generate post\-attack traces and answers

\(τici,y^ici\)\(\\tau\_\{i\}^\{c\_\{i\}\},\\hat\{y\}\_\{i\}^\{c\_\{i\}\}\)from

πθ​\(hi0,ρci​\(ai\)\)\\pi\_\{\\theta\}\(h\_\{i\}^\{0\},\\rho\_\{c\_\{i\}\}\(a\_\{i\}\)\)
6:Compute the composite reward

ri=∑k∈𝒦βk​ri,kr\_\{i\}=\\sum\_\{k\\in\\mathcal\{K\}\}\\beta\_\{k\}r\_\{i,k\}
7:Extract clean anchors

Ai0=A⁡\(τi0\)A\_\{i\}^\{0\}=A\(\\tau\_\{i\}^\{0\}\)and build the committed\-position mask

MiM\_\{i\}
8:Construct the ATRC gate

gi=𝟏\[y^i0=yi\]𝟏\[Invalid\(ai,ci\)\]g\_\{i\}=\\mathbf\{1\}\[\\hat\{y\}\_\{i\}^\{0\}=y\_\{i\}\]\\mathbf\{1\}\[\\operatorname\{Invalid\}\(a\_\{i\},c\_\{i\}\)\]
9:Align clean and post\-attack logits by response\-relative position and compute

ℒATRC\\mathcal\{L\}\_\{\\mathrm\{ATRC\}\}over

\{Mi,gi\}i=1B\\\{M\_\{i\},g\_\{i\}\\\}\_\{i=1\}^\{B\}
10:Update

πθ\\pi\_\{\\theta\}with the GRPO post\-attack objective, KL regularization, and ATRC

The optimizer itself is standard GRPO\. The novelty lies in the training objective:TRACERtreats the presentation channel as a sampled training variable, uses a structured post\-attack reward rather than answer\-only correctness, and adds a response\-aligned trace loss over committed clean reasoning spans, as shown in Figure[2](https://arxiv.org/html/2610.19133#S3.F2)\. This makes robustness channel\-aware: the model is trained not only to answer correctly after an attack, but also to preserve valid clean reasoning when untrusted content arrives through different deployment channels\.

## 4Experimental Setup

We primarily trainQwen2\.5\-3B\-Instructwith 4\-bit QLoRA\([Qwen Team, 2024](https://arxiv.org/html/2610.19133#bib.bib18);[Dettmers et al\., 2023](https://arxiv.org/html/2610.19133#bib.bib20);[Hu et al\., 2022](https://arxiv.org/html/2610.19133#bib.bib19)\); we also report a 7B scaling study\. The main training task is GSM8K\([Cobbe et al\., 2021](https://arxiv.org/html/2610.19133#bib.bib17)\), using 2,000 training examples and 200 evaluation examples per checkpoint\. Evaluation wrappers are follow\-up, RAG, tool\-output, and agent\-message\.

#### Attacks\.

We evaluate three malicious attack families\.*Reasoning rewrite*tries to replace the model’s solution path with an alternative chain of reasoning\.*Preemptive answer*presents a supposedly verified final answer\.*Prompt injection*issues explicit instructions to ignore prior reasoning or higher\-level intent\. Train and evaluation tasks are disjoint; additional tests use held\-out paraphrases and defense\-aware attacks\. Training also includes a 15% benign ratio so that robustness is not achieved by unconditional refusal\. Appendix[A](https://arxiv.org/html/2610.19133#A1)details the split and adversarial construction\.

#### Training protocol\.

The main 3B configuration uses three epochs, learning rate2×10−62\\times 10^\{\-6\}, batch size 1, gradient accumulation 8, group size 4, KL coefficient 0\.10, ATRC weight 0\.10, and vLLM\-accelerated rollouts\([Kwon et al\., 2023](https://arxiv.org/html/2610.19133#bib.bib21)\)\. We train channel specialists for RAG, tool\-output, and agent\-message framing, plus a joint model that alternates between RAG and tool framings\. Full hyperparameters appear in Appendix[H](https://arxiv.org/html/2610.19133#A8)\. Unless otherwise stated, cross\-framing comparisons use*final checkpoints*for every specialist model\. This avoids comparing a cherry\-picked best checkpoint for one channel against a final checkpoint for another\. When we analyze optimization dynamics, we separately report checkpoint\-level curves and the best intermediate checkpoint reached during training\.

#### Evaluation protocol\.

For transfer experiments, the adversarial payload is held fixed and only the wrapper changes\. This separates “learning the content of an attack” from “learning the channel through which that content arrives\.” Together, the evaluation axes let us answer three distinct questions: does framing create a real failure mode, doesTRACERclose the deployment\-matched gap, and how well does the learned robustness transfer beyond the native channel?

#### Terminology and metric boundary\.

We use*channel*for the source or pathway by which untrusted context enters the model,*wrapper*for its concrete textual rendering, and*framing gap*for the change in ASR when a fixed payload is re\-rendered through another channel\. Evidence validity is labeled by construction; training\-only step and anchor verifiers do not enter reported accuracy or ASR, which depend only on final\-answer correctness\. Appendix[A](https://arxiv.org/html/2610.19133#A1)documents their implementation and audit\.

## 5Results and Analysis

We organize the results around the paper’s three\-part claim: a scientific diagnosis of the framing gap, an algorithmic validation of the reward and trace\-regularizedTRACERobjective, and an empirical characterization of transfer across channels\.

#### The framing gap is large and consistent\.

Figure[3](https://arxiv.org/html/2610.19133#S5.F3)shows two complementary views of the problem\. The left panel measures base\-model vulnerability by framing and reveals a clear authority gradient: for prompt injection, ASR rises from 70% under casual follow\-ups to roughly 92–96% under agent, tool, and RAG wrappers\. The right panel isolates transfer failure directly\. Across six intermediate model snapshots trained only against follow\-up\-style attacks, merely switching to RAG presentation raises average ASR from 18% to 53% \(\+35pp\\,\\mathrm\{pp\}\)\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig_main_gap_gradient_frame.png)Figure 3:The framing gap\.Left: the base model is much more vulnerable when the same attack appears inside a more formal wrapper, revealing an authority gradient\. Right: six checkpoints trained only on follow\-up attacks fail to transfer to RAG evaluation even when the attack payload is unchanged\.This result has a direct deployment implication\. A model hardened against conversational follow\-up attacks should not be assumed robust in a RAG pipeline, a tool\-using assistant, or a multi\-agent system\. Robustness learned under one wrapper is often robustness to that*wrapper*, not to the underlying attack content\.

We use “authority” as an interpretive shorthand, not as an isolated causal conclusion\. Formatting, content position, provenance markers, and instruction\-tuning priors also change with the wrapper and may contribute to the measured gap\. The controlled claim is that the channel\-specific rendering changes ASR while payload content is held fixed\.

#### TRACERcloses the native RAG vulnerability\.

We next train directly in the deployment\-matched RAG wrapper\. Under held\-out RAG evaluation, the 3B final checkpoint reduces ASR from 65\.5% \(base model\) to 6\.1%\. Figure[4](https://arxiv.org/html/2610.19133#S5.F4)shows the full checkpoint trajectory: the sharpest gains appear between the late first epoch and early second epoch, and the best intermediate checkpoint reaches 3\.8% ASR while maintaining clean accuracy in the same 78–82% band as neighboring checkpoints\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig_main_rag_curve_frame.png)Figure 4:RAG training trajectory across model snapshots\.Clean accuracy stays near 78–82% while robust accuracy rises from 38% to above 80%\. The best intermediate model snapshot reaches 3\.8% ASR\.The gain is not merely a reduction in average failures\. Figure[5](https://arxiv.org/html/2610.19133#S5.F5)shows that prompt\-injection attacks drop from 77\.5% to 2\.3% ASR, while preemptive\-answer attacks drop from 54\.5% to 3\.4%\. Because ASR is measured only on examples the model solved in the clean condition, this improvement cannot be explained away as capability loss alone\. The model still solves the task and becomes far less willing to obey injected content\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig_main_per_attack_frame.png)Figure 5:Per\-attack effects of RAG\-framed training\.Prompt injection is both the most dangerous attack and the one most reduced byTRACER\.This is the main algorithmic win ofTRACER\. The wrapper exposes the model to deployment\-matched authority cues; the composite reward makes post\-attack correctness, anchor retention, and evidence\-sensitive revision directly valuable; and ATRC discourages the model from drifting away from clean anchor spans when the injected evidence is invalid\.

#### Stress tests, mixed evidence, and component attribution\.

Table[1](https://arxiv.org/html/2610.19133#S5.T1)consolidates the evaluations added to test the security boundary and isolate the method components\. On held\-out paraphrases,TRACERretains 10\.0% ASR versus 62\.7% for the base model, showing that the result is not explained by exact\-template recognition\. Channel\-aware escalation and defense\-aware attacks are stronger, raisingTRACERto 18\.1% and 23\.8% ASR, respectively, but the corresponding baselines remain 68\.8–70\.0%\. Thus,TRACERsubstantially narrows adaptive vulnerability without claiming immunity to a fully optimized white\-box adversary\.

\(a\) Attack generalization\(b\) Objective ablation\(c\) Valid evidence \+ injectionSettingBaseTRACERVariantATRCASRChannelEv\. acc\.Base flipTRACERflipOriginal65\.56\.1Baseno65\.5RAG83\.058\.113\.8Held\-out paraphrase62\.710\.0Answer\-onlyno21\.3Tool82\.552\.517\.5Channel\-aware68\.818\.1Composite rewardno13\.8Agent81\.046\.316\.3Defense\-aware70\.023\.8FullTRACERyes6\.1Table 1:Stress tests and attribution \(ASR in %\)\.\(a\) Generalization beyond the original RAG templates\. \(b\) Direct objective ablations under RAG evaluation\. \(c\) Mixed\-evidence evaluation, where useful channel content also contains an injection; “flip” is conditional ASR from a correct clean\-evidence response\.The direct ablation rules out channel exposure as the sole explanation: answer\-only training reaches 21\.3% ASR, the composite reward lowers this to 13\.8%, and ATRC further lowers it to 6\.1%\. The mixed\-evidence evaluation addresses blanket context rejection\. Clean/evidence accuracy remains 81\.0–83\.0%, while injection\-induced flip rates fall from 46\.3–58\.1% for the base model to 13\.8–17\.5% withTRACER\.

The principal uncertainty estimates support the large framing\-gap claim\. Follow\-up evaluation is 18\.0% ASR \(173/960; Wilson 95% CI\[15\.7,20\.6\]\[15\.7,20\.6\]\), whereas RAG evaluation is 53\.0% \(509/960;\[49\.9,56\.2\]\[49\.9,56\.2\]\)\. For native RAG, the base model is 65\.6% \(99/151;\[57\.7,72\.7\]\[57\.7,72\.7\]\) andTRACERis 6\.1% \(10/164;\[3\.3,10\.9\]\[3\.3,10\.9\]\)\. We do not claim that smaller differences among structured wrappers are all statistically distinct\.

#### Cross\-framing transfer reveals a depth–breadth trade\-off\.

The full picture emerges when we evaluate trained models across multiple framings\. Figure[6](https://arxiv.org/html/2610.19133#S5.F6)shows three distinct regimes\. First, the untrained 3B base model exhibits a strong authority gradient: ASR is lowest for casual follow\-ups \(41\.4%\) and highest for retrieved documents \(65\.5%\), with tool outputs and agent messages in between\. Formal wrappers make attacks more persuasive\.

Second, RAG\-specific training yields the deepest*native*defense but relatively weak transfer: the 3B RAG specialist reaches 6\.1% on RAG yet remains at 25\.7% and 26\.5% on tool and agent framings\. Tool\-output training shows the opposite pattern: its native ASR is higher \(15\.0%\), but it is nearly flat across all four framings \(15\.0–20\.2%\)\. In other words, RAG training learns depth, whereas tool training learns breadth\.

Third, multi\-framing training partially resolves this trade\-off\. The joint RAG\+tool model achieves the best 3B average ASR \(13\.9%\) and even slightly improves native RAG robustness over the final RAG specialist \(5\.2% vs\. 6\.1%\)\. This suggests that broader channel coverage during training helps the model acquire a more transferable notion of “untrusted external context\.” Hence, transfer asymmetry shows that robustness is not one\-dimensional: strong in\-channel defense can coexist with cross\-channel brittleness\. Single\-wrapper evaluation therefore misses the depth–breadth trade\-off\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig_main_transfer_heatmap_frame.png)Figure 6:Cross\-framing transfer at 3B scale\.Gold boxes mark native training framing\(s\)\. RAG\-specific training yields the deepest native defense, tool\-output training yields the flattest profile, and multi\-framing training gives the best average performance\.
#### Ablations, scaling, and broader transfer strengthen the story\.

Three additional results sharpen the main claim\. First, the RAG wrapper and the RAG\-specific system prompt are complementary: using both yields 5\.5% ASR, compared with 10\.0% for wrapper\-only, 11\.3% for prompt\-only, and 60\.5% for neither \(Appendix[F](https://arxiv.org/html/2610.19133#A6)\)\. This supports the view that deployment\-matched robustness depends on both structural cues and the surrounding instruction context\.

Second, the phenomenon persists but becomes easier to mitigate at larger scale\. The 7B base model already shows a milder authority gradient than the 3B base, and a single epoch of RAG training reaches 9\.4% average ASR across the four framings, outperforming the best 3B system\. Evaluation\-only diagnostics on Llama\-3\.1\-8B\-Instruct, Gemma\-2\-9B\-It, and Mistral\-7B\-Instruct also exhibit 22\.0–24\.7pp\\,\\mathrm\{pp\}framing spreads \(Appendix[A](https://arxiv.org/html/2610.19133#A1)\)\. The final 7B model reaches 10\.8% average ASR, indicating that most of the gain is realized early and that early stopping may be preferable when transfer, rather than only native\-channel ASR, is the target\.

Third, we test transfer beyond the GSM8K training domain\. On RAG\-framed Natural Questions and TriviaQA, framing\-aware models retain relatively low ASR, but clean accuracy remains low for 3B models, indicating that robustness transfers more readily than task\-specific competence\. In other words, the model can learn to be skeptical of untrusted context before it becomes broadly strong at every downstream task\.

These results show that indirect prompt\-injection robustness is channel\-conditioned: changing only the wrapper can substantially change attack success\.TRACERimproves robustness by training on the channel that carries untrusted context, rather than treating the wrapper as an evaluation detail\. Cross\-channel evaluation further reveals a depth–breadth trade\-off hidden by single\-wrapper reporting: specialized training is strongest in\-channel, whereas multi\-channel training transfers better across deployment framings\.

## 6Conclusion

We study indirect prompt injection as a channel\-conditioned robustness problem\. Holding payloads fixed, we find that a model trained on malicious follow\-up messages remains vulnerable when the same attacks are rendered as retrieved context, increasing ASR from 18% to 53%\. We introduceTRACER, which samples presentation channels during training and combines composite post\-attack rewards with ATRC trace regularization\. On GSM8K withQwen2\.5\-3B\-Instruct,TRACERreduces RAG\-framed ASR from 65\.5% to 6\.1% while maintaining 78–82% clean accuracy; joint RAG\+tool training further achieves the best 3B cross\-channel average ASR of 13\.9%\. Held\-out, adaptive, and mixed\-evidence evaluations preserve substantial gains while exposing a clear residual attack surface\. These results show that defenses should train on deployment\-matched framings, report cross\-channel transfer, and remain paired with runtime safeguards\.

## Limitations

Our primary attacks are template\-based and designed to hold the adversarial payload fixed while varying the channel\. This supports a clean measurement of the framing gap\. Held\-out paraphrases and a targeted defense\-aware suite broaden the test, but do not cover arbitrary optimization\-based or multi\-turn adversaries\. In addition, the framing\-gap diagnostic spans several model families, whereas fullTRACERtraining is evaluated within Qwen2\.5 at 3B and 7B scale\. Broader architectures, tasks, seeds, and adaptive strategies remain important next steps\. Further,TRACERis a training\-time defense\. It is complementary to inference\-time safeguards such as retrieval filtering, tool\-output parsing, policy monitors, and sandboxing\. We expect the strongest deployed systems to combine channel\-aware robust training with such runtime protections\.

## Ethical Considerations

This work studies indirect prompt injection, a security\-relevant failure mode in LLM systems\. The research has dual\-use aspects: the same attack templates used to evaluate robustness could be adapted to probe deployed systems\. To reduce this risk, our experiments use controlled task settings and synthetic template\-based injections rather than targeting real users, private data, or production services\. The primary purpose of the attack construction is to measure and improve robustness under different presentation channels\.

The proposed method is intended as a defensive training procedure\. It may reduce susceptibility to malicious retrieved documents, tool outputs, and agent messages, but it should not be viewed as a complete security boundary\. In deployment, channel\-aware robust training should be combined with runtime safeguards such as retrieval filtering, tool\-output validation, monitoring, sandboxing, and least\-privilege tool access\. We also note that overly aggressive defenses can harm usefulness by causing unwarranted refusal or distrust of valid evidence\. Our reward design explicitly separates invalid\-evidence resistance from valid\-evidence correction to mitigate this risk\.

## References

- Chenet al\.\(2024\)J\. Chen, H\. Lin, X\. Han, and L\. SunBenchmarking large language models in retrieval\-augmented generation\.Proceedings of the AAAI Conference on Artificial Intelligence38\(16\),pp\. 17754–17762\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v38i16.29728)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px2.p1.1)\.
- Chenet al\.\(2025a\)S\. Chen, J\. Piet, C\. Sitawarin, and D\. WagnerStruQ: defending against prompt injection with structured queries\.In34th USENIX Security Symposium \(USENIX Security 25\),pp\. 2383–2400\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Chenet al\.\(2025b\)S\. Chen, A\. Zharmagambetov, S\. Mahloujifar, K\. Chaudhuri, D\. Wagner, and C\. GuoSecAlign: defending against prompt injection with preference optimization\.InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security \(CCS\),pp\. 2833–2847\.External Links:[Document](https://dx.doi.org/10.1145/3719027.3744836)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Chenet al\.\(2025c\)Y\. Chen, H\. Li, Y\. Li, Y\. Liu, Y\. Song, and B\. HooiTopicAttack: an indirect prompt injection attack via topic transition\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,pp\. 7327–7345\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px2.p1.1)\.
- Chenet al\.\(2026\)Y\. Chen, H\. Li, Y\. Sui, Y\. Liu, Y\. He, X\. Bai, C\. Fei, Y\. Li, H\. Ma, Y\. Song, and B\. HooiRobustness via referencing: defending against prompt injection attacks by referencing the executed instruction\.InFindings of the Association for Computational Linguistics: ACL 2026,pp\. 1194–1215\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.findings-acl.61)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Chenget al\.\(2026\)D\. Cheng, S\. Huang, X\. Zhu, B\. Dai, W\. X\. Zhao, Z\. Zhang, and F\. WeiReasoning with exploration: an entropy perspective\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 30377–30385\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i36.40290)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Cobbeet al\.\(2021\)K\. Cobbe, V\. Kosaraju, M\. Bavarian, M\. Chen, H\. Jun, L\. Kaiser, M\. Plappert, J\. Tworek, J\. Hilton, R\. Nakano,et al\.Training verifiers to solve math word problems\.arXiv preprint arXiv:2110\.14168\.Cited by:[§4](https://arxiv.org/html/2610.19133#S4.p1.1)\.
- Cuiet al\.\(2025\)G\. Cui, Y\. Zhang, J\. Chen, L\. Yuan, Z\. Wang, Y\. Zuo, H\. Li, Y\. Fan, H\. Chen, W\. Chen, Z\. Liu, H\. Peng, L\. Bai, W\. Ouyang, Y\. Cheng, B\. Zhou, and N\. DingThe entropy mechanism of reinforcement learning for reasoning language models\.arXiv preprint arXiv:2505\.22617\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Debenedettiet al\.\(2026\)E\. Debenedetti, I\. Shumailov, T\. Fan, J\. Hayes, N\. Carlini, D\. Fabian, C\. Kern, C\. Shi, A\. Terzis, and F\. TramèrDefeating prompt injections by design\.InIEEE Conference on Secure and Trustworthy Machine Learning \(SaTML\),Note:arXiv:2503\.18813Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Debenedettiet al\.\(2024\)E\. Debenedetti, J\. Zhang, M\. Balunović, L\. Beurer\-Kellner, M\. Fischer, and F\. TramèrAgentDojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents\.InAdvances in Neural Information Processing Systems \(NeurIPS\), Datasets and Benchmarks Track,Vol\.37\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px1.p1.1)\.
- Dettmerset al\.\(2023\)T\. Dettmers, A\. Pagnoni, A\. Holtzman, and L\. ZettlemoyerQLoRA: efficient finetuning of quantized LLMs\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.36,pp\. 10088–10115\.Cited by:[§4](https://arxiv.org/html/2610.19133#S4.p1.1)\.
- Duet al\.\(2024\)Y\. Du, S\. Li, A\. Torralba, J\. B\. Tenenbaum, and I\. MordatchImproving factuality and reasoning in language models through multiagent debate\.InProceedings of the 41st International Conference on Machine Learning \(ICML\),Proceedings of Machine Learning Research, Vol\.235,pp\. 11733–11763\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Evtimovet al\.\(2025\)I\. Evtimov, A\. Zharmagambetov, A\. Grattafiori, C\. Guo, and K\. ChaudhuriWASP: benchmarking web agent security against prompt injection attacks\.InAdvances in Neural Information Processing Systems \(NeurIPS\), Datasets and Benchmarks Track,Vol\.38\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px1.p1.1)\.
- Gaoet al\.\(2023\)Y\. Gao, Y\. Xiong, X\. Gao, K\. Jia, J\. Pan, Y\. Bi, Y\. Dai, J\. Sun, M\. Wang, and H\. WangRetrieval\-augmented generation for large language models: a survey\.arXiv preprint arXiv:2312\.10997\.Cited by:[§1](https://arxiv.org/html/2610.19133#S1.p1.1)\.
- Greshakeet al\.\(2023\)K\. Greshake, S\. Abdelnabi, S\. Mishra, C\. Endres, T\. Holz, and M\. FritzNot what you’ve signed up for: compromising real\-world LLM\-integrated applications with indirect prompt injection\.InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security \(AISec\),pp\. 79–90\.External Links:[Document](https://dx.doi.org/10.1145/3605764.3623985)Cited by:[§1](https://arxiv.org/html/2610.19133#S1.p1.1),[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px1.p1.1)\.
- Guoet al\.\(2025\)D\. Guo, D\. Yang, H\. Zhang, J\. Song, P\. Wang, Q\. Zhu, R\. Xu, R\. Zhang, S\. Ma, X\. Bi,et al\.DeepSeek\-R1 incentivizes reasoning in LLMs through reinforcement learning\.Nature645\(8081\),pp\. 633–638\.External Links:[Document](https://dx.doi.org/10.1038/s41586-025-09422-z)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Guo and Wei \(2026\)H\. Guo and Z\. WeiHidden\-in\-plain\-text: a benchmark for social\-web indirect prompt injection in RAG\.InProceedings of the ACM Web Conference 2026 \(WWW ’26\),Note:arXiv:2601\.10923Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px1.p1.1)\.
- Heet al\.\(2026\)Y\. He, H\. Zhu, Y\. Li, S\. Shao, H\. Yao, Z\. Liu, and Z\. QinAttriGuard: defeating indirect prompt injection in LLM agents via causal attribution of tool invocations\.In35th USENIX Security Symposium \(USENIX Security 26\),pp\. 1547–1566\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Hineset al\.\(2024\)K\. Hines, G\. Lopez, M\. Hall, F\. Zarfati, Y\. Zunger, and E\. KıcımanDefending against indirect prompt injection attacks with spotlighting\.InProceedings of the Conference on Applied Machine Learning in Information Security \(CAMLIS\),CEUR Workshop Proceedings, Vol\.3920,pp\. 48–62\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Huet al\.\(2022\)E\. J\. Hu, Y\. Shen, P\. Wallis, Z\. Allen\-Zhu, Y\. Li, S\. Wang, L\. Wang, and W\. ChenLoRA: low\-rank adaptation of large language models\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§4](https://arxiv.org/html/2610.19133#S4.p1.1)\.
- Jiaet al\.\(2025\)Y\. Jia, Z\. Shao, Y\. Liu, J\. Jia, D\. Song, and N\. Z\. GongA critical evaluation of defenses against prompt injection attacks\.arXiv preprint arXiv:2505\.18333\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px5.p1.1)\.
- Kwonet al\.\(2023\)W\. Kwon, Z\. Li, S\. Zhuang, Y\. Sheng, L\. Zheng, C\. H\. Yu, J\. E\. Gonzalez, H\. Zhang, and I\. StoicaEfficient memory management for large language model serving with PagedAttention\.InProceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles,pp\. 611–626\.Cited by:[§4](https://arxiv.org/html/2610.19133#S4.SS0.SSS0.Px2.p1.1)\.
- Lewiset al\.\(2020\)P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel,et al\.Retrieval\-augmented generation for knowledge\-intensive NLP tasks\.Advances in Neural Information Processing Systems33,pp\. 9459–9474\.Cited by:[§1](https://arxiv.org/html/2610.19133#S1.p1.1)\.
- Liet al\.\(2023\)G\. Li, H\. A\. A\. K\. Hammoud, H\. Itani, D\. Khizbullin, and B\. GhanemCAMEL: communicative agents for “mind” exploration of large language model society\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.36\.Cited by:[§1](https://arxiv.org/html/2610.19133#S1.p1.1)\.
- Lightmanet al\.\(2024\)H\. Lightman, V\. Kosaraju, Y\. Burda, H\. Edwards, B\. Baker, T\. Lee, J\. Leike, J\. Schulman, I\. Sutskever, and K\. CobbeLet’s verify step by step\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Liuet al\.\(2024\)X\. Liu, H\. Yu, H\. Zhang, Y\. Xu, X\. Lei, H\. Lai, Y\. Gu, H\. Ding, K\. Men, K\. Yang, S\. Zhang, X\. Deng, A\. Zeng, Z\. Du, C\. Zhang, S\. Shen, T\. Zhang, Y\. Su, H\. Sun, M\. Huang, Y\. Dong, and J\. TangAgentBench: evaluating LLMs as agents\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§1](https://arxiv.org/html/2610.19133#S1.p1.1)\.
- Mishraet al\.\(2026a\)K\. Mishra, M\. Aubakirov, M\. Takac, N\. Lukas, and S\. LahlouCoRe: collaborative reasoning via cross teaching\.InProceedings of the 43rd International Conference on Machine Learning \(ICML\),Note:arXiv:2601\.21600External Links:[Link](https://arxiv.org/abs/2601.21600)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Mishraet al\.\(2026b\)K\. Mishra, N\. Lukas, and S\. LahlouSD\-E2\{\}^\{2\}: semantic exploration for reasoning under token budgets\.InFindings of the Association for Computational Linguistics: EACL 2026,pp\. 6144–6157\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.findings-eacl.323),[Link](https://aclanthology.org/2026.findings-eacl.323/)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Parket al\.\(2025\)C\. Park, S\. Han, X\. Guo, A\. E\. Ozdaglar, K\. Zhang, and J\. KimMAPoRL: multi\-agent post\-co\-training for collaborative large language models with reinforcement learning\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 30215–30248\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1459)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Patilet al\.\(2024\)S\. G\. Patil, T\. Zhang, X\. Wang, and J\. E\. GonzalezGorilla: large language model connected with massive APIs\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.37\.Cited by:[§1](https://arxiv.org/html/2610.19133#S1.p1.1)\.
- Qinet al\.\(2024\)Y\. Qin, S\. Liang, Y\. Ye, K\. Zhu, L\. Yan, Y\. Lu, Y\. Lin, X\. Cong, X\. Tang, B\. Qian, S\. Zhao, L\. Hong, R\. Tian, R\. Xie, J\. Zhou, M\. Gerstein, D\. Li, Z\. Liu, and M\. SunToolLLM: facilitating large language models to master 16000\+ real\-world APIs\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§1](https://arxiv.org/html/2610.19133#S1.p1.1)\.
- Qwen Team \(2024\)Qwen TeamQwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.Cited by:[§4](https://arxiv.org/html/2610.19133#S4.p1.1)\.
- Shaoet al\.\(2024\)Z\. Shao, P\. Wang, Q\. Zhu, R\. Xu, J\. Song, X\. Bi, H\. Zhang, M\. Zhang, Y\. K\. Li, Y\. Wu, and D\. GuoDeepSeekMath: pushing the limits of mathematical reasoning in open language models\.arXiv preprint arXiv:2402\.03300\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1),[§3](https://arxiv.org/html/2610.19133#S3.SS0.SSS0.Px6.p1.2)\.
- Shiet al\.\(2025\)T\. Shi, K\. Zhu, Z\. Wang, Y\. Jia, W\. Cai, W\. Liang, H\. Wang, H\. Alzahrani, J\. Lu, K\. Kawaguchi, B\. Alomair, X\. Zhao, W\. Y\. Wang, N\. Gong, W\. Guo, and D\. SongPromptArmor: simple yet effective prompt injection defenses\.arXiv preprint arXiv:2507\.15219\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Songet al\.\(2025\)Y\. Song, J\. Kempe, and R\. MunosOutcome\-based exploration for LLM reasoning\.arXiv preprint arXiv:2509\.06941\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Subramaniamet al\.\(2025\)V\. Subramaniam, Y\. Du, J\. B\. Tenenbaum, A\. Torralba, S\. Li, and I\. MordatchMultiagent finetuning: self improvement with diverse reasoning chains\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Walder and Karkhanis \(2025\)C\. Walder and D\. T\. KarkhanisPass@K policy optimization: solving harder reinforcement learning problems\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.38,pp\. 169225–169254\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Wanet al\.\(2025\)Z\. Wan, Y\. Li, X\. Wen, Y\. Song, H\. Wang, L\. Yang, M\. Schmidt, J\. Wang, W\. Zhang, S\. Hu, and Y\. WenReMA: learning to meta\-think for LLMs with multi\-agent reinforcement learning\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.38,pp\. 140399–140445\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Wanget al\.\(2026\)C\. Wang, F\. Zhang, J\. Zhang, Z\. Zhang, Y\. Wang, L\. Huang, J\. Gao, Z\. Chen, and W\. Y\. B\. LimICON: indirect prompt injection defense for agents based on inference\-time correction\.arXiv preprint arXiv:2602\.20708\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Wanget al\.\(2024\)P\. Wang, L\. Li, Z\. Shao, R\. Xu, D\. Dai, Y\. Li, D\. Chen, Y\. Wu, and Z\. SuiMath\-Shepherd: verify and reinforce LLMs step\-by\-step without human annotations\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 9426–9439\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.510)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Wenet al\.\(2025\)T\. Wen, C\. Wang, X\. Yang, H\. Tang, Y\. Xie, L\. Lyu, Z\. Dou, and F\. WuDefending against indirect prompt injection by instruction detection\.InFindings of the Association for Computational Linguistics: EMNLP 2025,pp\. 19472–19487\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.findings-emnlp.1060)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Xieet al\.\(2024\)J\. Xie, K\. Zhang, J\. Chen, R\. Lou, and Y\. SuAdaptive chameleon or stubborn sloth: revealing the behavior of large language models in knowledge conflicts\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px2.p1.1)\.
- Yiet al\.\(2025\)J\. Yi, Y\. Xie, B\. Zhu, E\. Kiciman, G\. Sun, X\. Xie, and F\. WuBenchmarking and defending against indirect prompt injection attacks on large language models\.InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining \(KDD\),pp\. 1809–1820\.External Links:[Document](https://dx.doi.org/10.1145/3690624.3709179)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px1.p1.1)\.
- Yuet al\.\(2026\)Q\. Yu, X\. Cheng, and C\. LiuDefense against indirect prompt injection via tool result parsing\.arXiv preprint arXiv:2601\.04795\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Yuet al\.\(2025\)Q\. Yu, Z\. Zhang, R\. Zhu, Y\. Yuan, X\. Zuo, Y\. Yue, W\. Dai, T\. Fan, G\. Liu, J\. Liu, L\. Liu, X\. Liu,et al\.DAPO: an open\-source LLM reinforcement learning system at scale\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.38,pp\. 125532–125554\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px4.p1.1)\.
- Zhanet al\.\(2025\)Q\. Zhan, R\. Fang, H\. S\. Panchal, and D\. KangAdaptive attacks break defenses against indirect prompt injection attacks on LLM agents\.InFindings of the Association for Computational Linguistics: NAACL 2025,pp\. 7116–7132\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.findings-naacl.395)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px5.p1.1)\.
- Zhanet al\.\(2024\)Q\. Zhan, Z\. Liang, Z\. Ying, and D\. KangInjecAgent: benchmarking indirect prompt injections in tool\-integrated large language model agents\.InFindings of the Association for Computational Linguistics: ACL 2024,pp\. 10471–10506\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.624)Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px1.p1.1)\.
- Zhanget al\.\(2025\)H\. Zhang, J\. Huang, K\. Mei, Y\. Yao, Z\. Wang, C\. Zhan, H\. Wang, and Y\. ZhangAgent security bench \(ASB\): formalizing and benchmarking attacks and defenses in LLM\-based agents\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px1.p1.1)\.
- Zhuet al\.\(2025\)K\. Zhu, X\. Yang, J\. Wang, W\. Guo, and W\. Y\. WangMELON: provable defense against indirect prompt injection attacks in AI agents\.InProceedings of the 42nd International Conference on Machine Learning \(ICML\),Proceedings of Machine Learning Research, Vol\.267,pp\. 80310–80329\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px3.p1.1)\.
- Zouet al\.\(2025\)W\. Zou, R\. Geng, B\. Wang, and J\. JiaPoisonedRAG: knowledge corruption attacks to retrieval\-augmented generation of large language models\.In34th USENIX Security Symposium \(USENIX Security 25\),pp\. 3827–3844\.Cited by:[§2](https://arxiv.org/html/2610.19133#S2.SS0.SSS0.Px2.p1.1)\.

## Appendix ACamera\-ready evaluation additions

This section records the additional controls requested during author–reviewer discussion\. They refine the scope of the main claim without changing the original training objective or evaluation protocol\.

### A\.1Attack construction and split

The train and evaluation sets use disjoint GSM8K task instances\. The high\-level attack families are shared intentionally so that cross\-channel experiments vary the presentation pathway rather than the attack taxonomy\. Held\-out evaluation additionally changes the surface form through templates and paraphrases not used in training\. The targeted adaptive suite strengthens wrapper provenance cues and explicitly references the defense’s expected behavior\.

Table 2:Attack families and split\.Families are shared to isolate channel transfer; task instances and held\-out surface forms are disjoint\.Table 3:Adaptive evaluation\.The defense\-aware suite explicitly targets the learned training behavior\.The original result should therefore be read as controlled robustness to known or family\-matched attacks, not as robustness to arbitrary attacks\. Held\-out paraphrases show that the gain is not exact\-string memorization\. The stronger adaptive results identify the remaining attack surface and motivate combiningTRACERwith runtime safeguards\.

### A\.2Training signals and verifier audit

Evidence validity is a ground\-truth construction label attached when an episode is generated; it is not inferred from the policy output\. The step scorer segments the post\-attack trace and applies the training verifier/rules to local reasoning steps\. The anchor verifier checks whether propositions extracted from the clean trace remain supported or are contradicted in the attacked trace\. These two signals affect reward computation only\. Final\-answer extraction compares the normalized answer with the gold label and is the only learned\-output judgment used by reported clean accuracy, robust accuracy, and ASR\.

Table 4:Training and evaluation signals\.Verifier audits report agreement on a manually checked sample; evaluation metrics do not depend on the training\-only step or anchor verifiers\.The objective\-ablation panel in Table[1](https://arxiv.org/html/2610.19133#S5.T1)further separates the sources of improvement: answer\-only channel exposure reaches 21\.3% RAG ASR, the composite reward reaches 13\.8%, and ATRC reduces the final result to 6\.1%\.

### A\.3Statistical uncertainty and denominators

Because ASR is conditioned on clean correctness, its denominator is the number of clean\-solved examples, not the full evaluation set\. Table[5](https://arxiv.org/html/2610.19133#A1.T5)reports the supplied exact counts and Wilson intervals for the headline comparisons\. The large follow\-up\-to\-RAG transfer gap remains well separated; small pairwise differences among structured wrappers should not be interpreted as a strict ordering\.

Table 5:Conditional\-ASR denominators and uncertainty\.Minor differences between aggregated and plotted percentages arise from the reporting granularity of the corresponding evaluations\.For the held\-out and defense\-awareTRACERevaluations, the corresponding exact outcomes are 16/160 \(10\.0%\) and 38/160 \(23\.8%\), respectively\.

### A\.4Mixed valid evidence and embedded injection

The original three\-turn protocol is an isolation experiment: it starts from a clean solution and measures attack\-induced correct\-to\-incorrect flips\. A deployment system may instead receive useful evidence that also contains an injection\. We therefore place task\-relevant evidence and a malicious instruction in the same RAG, tool, or agent channel\. Table[6](https://arxiv.org/html/2610.19133#A1.T6)shows thatTRACERretains high clean/evidence accuracy while substantially reducing the contamination\-induced flip rate\.

Table 6:Valid evidence with an embedded injection\.High evidence accuracy argues against blanket refusal or wholesale context ignoring\.For evidence\-dependent tasks, a clean\-evidence baseline is preferable to the clean\-no\-evidence anchor used for GSM8K\. The mixed\-evidence test is a deployment\-facing extension rather than a change to the isolation protocol\.

### A\.5Broader\-model framing diagnostics

Table[7](https://arxiv.org/html/2610.19133#A1.T7)evaluates the framing phenomenon, without additionalTRACERtraining, on several instruction\-tuned model families\. Absolute robustness varies with scale and model family, but every tested model shows a 22\.0–27\.1pp\\,\\mathrm\{pp\}spread across renderings\. The evidence supports a cross\-model framing\-gap diagnosis; the training\-time mitigation is established on Qwen2\.5\-3B/7B, and full cross\-architecture training remains future work\.

Table 7:Evaluation\-only framing diagnostics across model families\.Spread is the maximum minus minimum ASR across channels\.

## Appendix BAdditional method details

#### Full corrigibility truth table\.

The corrigibility reward implements six cases: invalid evidence with a correct clean answer is rewarded when the model stays correct and penalized when it flips; valid evidence is rewarded when the model corrects a wrong clean answer and mildly penalized when it fails to do so\. This makes “good stubbornness” and “good revision” distinct behaviors rather than opposites on one axis\.

#### Anchor spans and gating\.

Anchor propositions are extracted from the clean reasoning trace and filtered through a verifier gate so that ATRC applies only when the clean answer is worth preserving\. In the implementation, anchor spans are aligned in response\-relative coordinates before clean and attacked logits are compared\.

#### Channel wrappers\.

The four wrappers correspond to realistic deployment pathways: user follow\-up, retrieved document, tool response, and agent message\. The wrapper changes the model’s interpretation of the same string without changing its underlying adversarial content\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig_main_rag_curve_frame.png)Figure 7:Complete RAG training evaluation \(200 samples per checkpoint\)\.Clean accuracy, robust accuracy, and ASR across 28 checkpoints\. Most of the gain appears before the end of epoch 2\.![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig8_framing_gap_matrix.png)Figure 8:Full transfer matrix visualization\.The heatmap includes all 3B and 7B settings considered in the paper\. The base model shows an authority gradient, while trained models differ in how concentrated or broad their robustness becomes\.![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig12_transfer_asymmetry.png)Figure 9:Transfer asymmetry as reduction from the base model\.Specialists reduce ASR unevenly across evaluation wrappers\. RAG training gives the deepest native reduction, tool training gives the flattest profile, and multi\-framing plus 7B training improve the overall shape\.Table 8:Complete cross\-framing transfer matrix\.Attack success rate \(%\) across training conditions and evaluation framings\. Spread is the maximum minus minimum ASR across the four framings for a given trained model\.

## Appendix CComplete RAG training trajectory

Figure[7](https://arxiv.org/html/2610.19133#A2.F7)serves as the full checkpoint\-level evaluation in place of a long checkpoint table\. The steepest improvement occurs once the model begins treating retrieved content as potentially adversarial rather than automatically authoritative\.

## Appendix DComplete cross\-framing results

Table[8](https://arxiv.org/html/2610.19133#A2.T8)and Figures[8](https://arxiv.org/html/2610.19133#A2.F8)–[9](https://arxiv.org/html/2610.19133#A2.F9)provide the full appendix view behind the condensed main\-paper heatmap\. The important point is that robustness is not a single scalar property: each trained model has both a*level*of robustness \(its average ASR across framings\) and a*shape*of robustness \(how unevenly that ASR is distributed across framings\)\. The 3B base model averages 53\.2% ASR across the four wrappers, with a 24\.1pp\\,\\mathrm\{pp\}spread between follow\-up and RAG presentation\. This authority gradient is present before any finetuning, which means that wrapper semantics alone materially change how persuasive the exact same injected content appears to the model\.

#### Depth versus breadth\.

The 3B RAG specialist gives the deepest native defense: 6\.1% ASR in its matched RAG setting, a 59\.4pp\\,\\mathrm\{pp\}reduction from the RAG base model\. But its transfer profile remains uneven, with 25\.7% ASR on tool outputs and 26\.5% on agent messages\. Tool\-output training exhibits the opposite behavior\. At the end of epoch 1 it is still weak everywhere \(32\.1–40\.3%\), but already noticeably flatter than the RAG specialist\. After convergence, the final tool\-trained model reaches 15\.0–20\.2% ASR across all four wrappers, reducing the spread to only 5\.2pp\\,\\mathrm\{pp\}\. The final multi\-framing model partially combines these benefits: it retains very strong RAG performance \(5\.2%\) while achieving the best overall 3B average ASR \(13\.9%\)\. These patterns are the empirical basis for the depth–breadth trade\-off described in the main text\.

#### Interpreting the asymmetry\.

Figure[9](https://arxiv.org/html/2610.19133#A2.F9)makes the asymmetry easier to see by plotting improvement relative to the corresponding base\-model framing rather than raw ASR\. RAG training gives its largest gain in RAG itself and smaller but still substantial reductions on follow\-up, tool, and agent evaluation\. Agent\-message training occupies an intermediate regime: it does not match the uniformity of the final tool specialist, but it improves all four framings and achieves its best final transfer to RAG \(15\.7%\), suggesting that structured agent messages and retrieved documents share some authority cues\. The practical implication is that cross\-framing transfer is systematic rather than random: neighboring channels can share robustness, but the amount of sharing depends on the authority structure of the wrapper\.

#### Model\-size effects\.

The 7B rows are included explicitly to show that scale reduces, but does not eliminate, framing dependence\. The 7B base model starts at a much lower average ASR than the 3B base \(24\.3% vs\. 53\.2%\), yet still exhibits a pronounced spread between follow\-up \(9\.5%\) and tool/RAG framing \(34–37%\)\. After one epoch of RAG\-framed training, the 7B model reaches 9\.4% average ASR with only 8\.3pp\\,\\mathrm\{pp\}spread, outperforming every 3B configuration in the table\. Additional epochs slightly worsen this cross\-framing average, which is why the main paper treats early stopping as an important design choice when transfer is the target metric rather than only native\-channel performance\. Overall, the complete matrix reinforces the main claim: wrapper\-conditioned training changes not only how much robustness is learned, but also what kind of robustness is learned\.

## Appendix ETool\-output and agent\-message training

These runs test whether theTRACERrecipe is specific to RAG documents or whether the same reward\- and trace\-regularized training objective can adapt to other high\-authority channels\. The answer is yes, but the optimization dynamics differ by wrapper\. Tool outputs and agent messages both present the attack as external system state rather than as a direct user request, yet the resulting robustness profiles are not identical\.

Table 9:Tool\-output training trajectory\.Three epochs of tool\-output training improve native tool\-output robustness from 59\.4% to 15\.0%\.![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig13_tool_training_curve.png)Figure 10:Tool\-output training curve\.Tool\-output training converges more gradually than RAG training but ultimately reaches 15\.0% native ASR\.#### Tool\-output training\.

Table[9](https://arxiv.org/html/2610.19133#A5.T9)and Figure[10](https://arxiv.org/html/2610.19133#A5.F10)show that tool\-output training improves more gradually than RAG training\. Native tool\-output ASR falls from 59\.4% in the base model to 39\.6% at the end of epoch 1, 28\.8% by late epoch 2, and 15\.0% at the final checkpoint\. Clean accuracy simultaneously rises from 64\.0% to 77\.5%\. Compared with the sharper phase transition observed in RAG training, this smoother curve suggests that tool wrappers encourage a broader but less sharply localized form of skepticism: the model becomes progressively less willing to treat tool\-returned text as executable instruction, rather than learning a single document\-specific counter\-pattern\.

Table 10:Agent\-message training trajectory\.Agent\-message training improves average ASR, but its strongest final transfer is to RAG framing rather than native agent framing\.
#### Why tool training transfers broadly\.

The cross\-framing numbers support that interpretation in Table[10](https://arxiv.org/html/2610.19133#A5.T10)\. Even before full convergence, the epoch\-1 tool checkpoint is already relatively flat across follow\-up, RAG, tool, and agent evaluation \(32\.1%, 33\.1%, 39\.6%, 40\.3%\), despite not yet being strong in any single framing\. After full training, the same recipe reaches a near\-uniform 15–20% ASR profile\. This is qualitatively different from the RAG specialist, whose native ASR is much lower but whose transfer is less even\. One plausible explanation is that tool outputs mix provenance, status, and content fields in a way that forces the model to rely less on any single authority cue and more on the underlying semantic question: is this external text evidence to reason over, or an instruction to obey?

#### Agent\-message training\.

Agent\-message training also improves robustness substantially, reducing average ASR from 53\.2% in the base model to 31\.6% after epoch 1 and 19\.4% after epoch 2\. The final epoch\-3 checkpoint slightly worsens the average to 20\.0%, which is why we report it as a specialized final model rather than as the best checkpoint\. Notably, the strongest final transfer is to RAG framing \(15\.7%\) rather than to native agent framing \(18\.4%\)\. This suggests that the model treats agent messages and retrieved documents as partially overlapping sources of delegated authority\. In other words, the wrapper taxonomy is not arbitrary: some channels are closer than others in the trust geometry learned by the model\.

#### Takeaway\.

These results show thatTRACERis not just a RAG\-specific defense\. The same training game, composite reward, and ATRC regularization can be instantiated for multiple untrusted\-context channels\. What changes from channel to channel is the learned robustness profile: RAG training gives deep specialization, tool training gives the broadest transfer, and agent training lands between them\. That pattern is exactly what the cross\-framing hypothesis would predict if wrappers affect the model’s trust calibration rather than merely its formatting preferences\.

## Appendix FAblation and scaling

We use two compact studies to separateTRACER’s ingredients from confounds\. The first ablation asks whether the RAG gain comes mainly from the wrapper, from the RAG\-specific system prompt, or from their combination\. The second asks how the framing gap changes with model scale and training duration\.

Table 11:RAG ablation\.Both the RAG wrapper and the RAG\-specific system prompt matter\. The wrapper contributes slightly more, but the strongest robustness appears only when both are present\.#### Wrapper versus system prompt\.

Table[11](https://arxiv.org/html/2610.19133#A6.T11)and Figure[12](https://arxiv.org/html/2610.19133#A6.F12)show that both components matter\. Removing the RAG\-specific system prompt but keeping the document wrapper increases ASR from 5\.5% to 10\.0%; removing the wrapper but keeping the prompt increases ASR to 11\.3%\. Removing both raises ASR to 60\.5%, close to the undefended baseline\. Two conclusions follow\. First, the gain is not reducible to prompt wording alone: the wrapper structure itself carries crucial authority cues\. Second, the gain is not reducible to wrapper structure alone either: telling the model how to treat retrieved content still adds a meaningful margin\. This complements the method claim in the main paper\. Channel\-sampled exposure matters because the model must actually see the deployment wrapper during training, while reward shaping and ATRC matter because the model must learn what behavior to preserve once that wrapper is present\.

Table 12:7B scaling results\.Larger models are substantially more robust before training and reach even lower average ASR after framing\-aware training\.
#### Scaling behavior\.

Table[12](https://arxiv.org/html/2610.19133#A6.T12)and Figure[11](https://arxiv.org/html/2610.19133#A6.F11)show a favorable scaling trend\. At 7B, the base model is already substantially more robust than the 3B base, especially under follow\-up and agent framing\. Yet the framing gap does not disappear: RAG and tool wrappers still raise ASR into the mid\-30s\. Training closes much of this remaining gap quickly\. After a single epoch of RAG\-framed training, the 7B model reaches 9\.4% average ASR across the four framings, with 10\.4% native RAG ASR and only 8\.3pp\\,\\mathrm\{pp\}spread overall\. Later checkpoints remain strong but do not improve this average, ending at 10\.8% for the final model\. This is why we interpret 7B scaling as evidence that larger models learn contextual skepticism more readily, not as evidence that scale alone solves the problem\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig19_7b_scaling_compact.png)Figure 11:7B scaling\.Larger models begin from a better robustness baseline and achieve their best cross\-framing average after a single epoch of RAG\-framed training\.
#### Implications for method design\.

The ablation and scaling results together support three practical recommendations\. First, deployment\-matched wrappers should be part of the training distribution rather than treated as cosmetic formatting\. Second, when transfer across wrappers is the target, model selection should use cross\-framing averages rather than only native\-channel ASR; the best 7B checkpoint by that criterion appears after one epoch rather than at the end of training\. Third, stronger base models reduce the amount of channel\-specific training needed, but they do not remove the need for channel\-aware evaluation\. Even at 7B, the difference between follow\-up and retrieved\-document vulnerability remains large enough that a single in\-channel robustness number would be misleading\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig18_ablation_compact.png)Figure 12:Wrapper vs\. system prompt\.The document wrapper and the RAG\-specific system prompt provide complementary gains\.

## Appendix GCross\-domain robustness

We also evaluate framing\-aware robustness outside the GSM8K training domain\. On RAG\-framed Natural Questions and TriviaQA, framing\-aware models maintain relatively low ASR, but clean accuracy is low for 3B models, indicating that capability rather than robustness is the main bottleneck in these cross\-domain settings\.

![Refer to caption](https://arxiv.org/html/2610.19133v1/figures/fig15_cross_domain.png)Figure 13:Cross\-domain robustness transfer\.Framing\-aware skepticism transfers across domains more readily than task\-specific clean accuracy\.
## Appendix HHyperparameters and reproducibility

#### Primary 3B configuration\.

We use Qwen2\.5\-3B\-Instruct with 4\-bit QLoRA \(rank 64,α=128\\alpha=128\), three epochs of training, batch size 1, gradient accumulation 8, group size 4, warmup ratio 0\.1, and learning rate2×10−62\\times 10^\{\-6\}\. The KL coefficient is0\.100\.10, the PPO clip parameter is0\.20\.2, the ATRC regularization weight is0\.10\.1, and the ATR/TCR blend parameter is0\.50\.5\.

#### Reward weights\.

The reward weights arewans=0\.25w\_\{\\mathrm\{ans\}\}=0\.25,wprm=0\.25w\_\{\\mathrm\{prm\}\}=0\.25,wanchor=0\.20w\_\{\\mathrm\{anchor\}\}=0\.20,wcorr=0\.20w\_\{\\mathrm\{corr\}\}=0\.20, andwlen=0\.10w\_\{\\mathrm\{len\}\}=0\.10\.

#### Compute notes\.

All models are trained with vLLM\-accelerated rollouts and LoRA\-style adaptation rather than full dense finetuning\. We provide the configuration needed to reproduce the experiments, but do not report exact wall\-clock measurements for every run; we therefore answer the checklist conservatively\.

## Appendix IAssets and licenses

The experiments rely on public assets cited in the paper, including base models, datasets, and verifier backbones\. The submission package contains only manuscript sources and figures; it does not redistribute third\-party model weights or dataset contents\. Subject to the licenses of the underlying assets, training wrappers, evaluation scripts, and configuration files are available through the project repository linked in the abstract\.