{"id":"https://openalex.org/W7128035463","doi":"https://doi.org/10.48550/arxiv.2602.05746","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","display_name":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","publication_year":2026,"publication_date":"2026-02-05","ids":{"openalex":"https://openalex.org/W7128035463","doi":"https://doi.org/10.48550/arxiv.2602.05746"},"language":null,"primary_location":{"id":"pmh:doi:10.48550/arxiv.2602.05746","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"type":"article","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":null,"any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125156236","display_name":"Xin Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Xin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125229602","display_name":"Jie Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Jie","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5125103762","display_name":"Florian Tramer","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tram\u00e8r, Florian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.14155655,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.923799991607666,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.923799991607666,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.009499999694526196,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.00839999970048666,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.6937999725341797},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6486999988555908},{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.5349000096321106},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.5037000179290771},{"id":"https://openalex.org/keywords/flagging","display_name":"Flagging","score":0.460999995470047},{"id":"https://openalex.org/keywords/limiting","display_name":"Limiting","score":0.43650001287460327},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.32600000500679016},{"id":"https://openalex.org/keywords/transfer-of-learning","display_name":"Transfer of learning","score":0.3068999946117401}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7572000026702881},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.6937999725341797},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6486999988555908},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6136000156402588},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.5349000096321106},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.5037000179290771},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5009999871253967},{"id":"https://openalex.org/C2777548347","wikidata":"https://www.wikidata.org/wiki/Q5456937","display_name":"Flagging","level":2,"score":0.460999995470047},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.43650001287460327},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.32600000500679016},{"id":"https://openalex.org/C150899416","wikidata":"https://www.wikidata.org/wiki/Q1820378","display_name":"Transfer of learning","level":2,"score":0.3068999946117401},{"id":"https://openalex.org/C2776372474","wikidata":"https://www.wikidata.org/wiki/Q508291","display_name":"Simplicity","level":2,"score":0.2872999906539917},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.27810001373291016},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.267300009727478},{"id":"https://openalex.org/C199190896","wikidata":"https://www.wikidata.org/wiki/Q3509276","display_name":"Learning classifier system","level":3,"score":0.266400009393692},{"id":"https://openalex.org/C67203356","wikidata":"https://www.wikidata.org/wiki/Q1321905","display_name":"Reinforcement","level":2,"score":0.26589998602867126},{"id":"https://openalex.org/C59656382","wikidata":"https://www.wikidata.org/wiki/Q191536","display_name":"Conjunction (astronomy)","level":2,"score":0.2630999982357025},{"id":"https://openalex.org/C77967617","wikidata":"https://www.wikidata.org/wiki/Q4677561","display_name":"Active learning (machine learning)","level":2,"score":0.2556999921798706}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.48550/arxiv.2602.05746","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"doi:10.48550/arxiv.2602.05746","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.05746","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:doi:10.48550/arxiv.2602.05746","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.467692106962204,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Prompt":[0],"injection":[1,38,189],"is":[2,50,136],"a":[3,71,103,130,168,192],"critical":[4],"vulnerability":[5],"in":[6],"LLM":[7],"agents,":[8],"yet":[9],"the":[10,92,99],"strongest":[11],"methods":[12],"still":[13],"rely":[14],"on":[15],"human":[16],"red-teamers":[17],"and":[18,52,117,128,146,190,197],"hand-crafted":[19],"prompts.":[20],"Adapting":[21],"automated":[22,185],"jailbreak":[23],"optimizers":[24,62],"does":[25],"not":[26],"close":[27],"this":[28],"gap:":[29],"jailbreaks":[30],"shape":[31],"models":[32],"toward":[33],"generic":[34],"compliance,":[35],"while":[36],"prompt":[37,82,174,188],"requires":[39],"emitting":[40],"specific":[41],"tool":[42],"calls":[43],"with":[44,152,159],"correct":[45],"parameters.":[46],"The":[47,110,181],"success":[48],"signal":[49,101],"binary,":[51],"randomly":[53],"sampled":[54],"suffixes":[55,80,120],"almost":[56],"never":[57],"trigger":[58],"it,":[59],"so":[60,96],"standard":[61],"have":[63],"no":[64,123],"gradient":[65],"to":[66,172],"follow.":[67],"We":[68],"present":[69],"AutoInject,":[70],"black-box":[72],"reinforcement":[73],"learning":[74],"(RL)":[75],"framework":[76,111],"that":[77,121],"learns":[78],"adversarial":[79],"for":[81,107,187],"injection.":[83],"A":[84],"learned":[85,162],"comparison-based":[86],"reward":[87,105],"scores":[88],"each":[89],"candidate":[90],"against":[91],"best":[93],"suffix":[94],"seen":[95],"far,":[97],"turning":[98],"binary":[100],"into":[102],"dense":[104],"suitable":[106],"RL":[108],"optimization.":[109],"supports":[112],"both":[113],"online":[114],"query-based":[115],"attacks":[116,178],"offline-trained":[118],"transferable":[119],"need":[122],"utility":[124,131],"access":[125],"at":[126],"deployment,":[127],"incorporates":[129],"objective":[132],"when":[133],"task-completion":[134],"feedback":[135],"available.":[137],"On":[138],"AgentDojo,":[139],"AutoInject":[140,164],"outperforms":[141],"template":[142,177],"attacks,":[143],"GCG,":[144],"TAP,":[145],"adaptive":[147,198],"attack":[148],"across":[149],"production":[150],"models,":[151],"statistically":[153],"significant":[154],"improvements":[155],"under":[156],"McNemar's":[157],"test":[158],"p<0.05.":[160],"Suffixes":[161],"by":[163],"also":[165],"break":[166],"Meta-SecAlign-70B,":[167],"model":[169],"fine-tuned":[170],"specifically":[171],"resist":[173],"injection,":[175],"where":[176],"fail":[179],"outright.":[180],"results":[182],"establish":[183],"an":[184],"baseline":[186],"expose":[191],"gap":[193],"between":[194],"preference-based":[195],"defenses":[196],"optimization-based":[199],"attackers.":[200]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-02-07T00:00:00"}