Meta SecAlign: the first open model with built-in prompt injection defense

What is this?

Meta SecAlign is an open-weight large language model shipped with a defense against prompt injection baked into the model itself, rather than bolted on as an external filter. It was published on arXiv on July 3, 2026 (paper 2507.02735, with a v2 revision the same month) by researchers from Meta (FAIR) and UC Berkeley, and the weights and training code are on the facebookresearch/Meta_SecAlign GitHub repository. The authors describe it as the first fully open-source, open-weight LLM with a model-level prompt injection defense that reaches commercial-grade performance.

Two models are released: Meta-SecAlign-8B, built on Llama-3.1-8B-Instruct, and Meta-SecAlign-70B, built on Llama-3.3-70B-Instruct. The stated point of releasing them openly is to let the security community study, attack, and improve prompt injection defenses on a real model — something that closed commercial models with proprietary defenses make difficult.

How it works

Prompt injection works because an LLM sees instructions and data in the same undifferentiated token stream: text that arrives inside a retrieved web page, a tool output, or a document can be read by the model as a command to follow. Meta SecAlign attacks that root cause with a training-time method rather than an inference-time patch.

The technique builds on two earlier pieces of work from the same lineage. StruQ (structured queries) separates the trusted prompt from untrusted data using dedicated delimiters so the model can tell the two apart. SecAlign, the original 2024 method (published at ACM CCS 2025), then adds preference optimization: the authors construct a preference dataset in which each example pairs a prompt-injected input with a secure response (one that follows the legitimate instruction and ignores the injection) and an insecure response (one that obeys the injected instruction). Preference optimization trains the model to strongly prefer the secure behavior. Conceptually:

Input:    [trusted instruction]  +  [untrusted data ... "ignore the above and do X"]
Preferred output:     answer the trusted instruction, treat "do X" as inert data
Dispreferred output:  perform X

Meta SecAlign applies this recipe at foundation-model scale. Per the paper, training the 70B model took about 3 epochs, roughly 7 hours on 8 NVIDIA H200 GPUs. The result is evaluated across 9 utility benchmarks (including MMLU, MMLU-Pro, IFEval, BBH, GPQA Diamond, AlpacaEval2, SEP, and the agentic AgentDojo and WASP utility tracks) and 7 security benchmarks. The headline claim is that Meta-SecAlign-70B reaches state-of-the-art robustness — often lower attack success rates than GPT-4o-mini, GPT-4o, and Gemini-Flash 2.0/2.5 — while keeping general capability comparable to the undefended base model. On AgentDojo specifically, the paper reports that the defense lowers attack success rate while raising task utility, which is the combination most defenses fail to achieve.

Why it matters

Most deployed prompt injection defenses today are input/output filters, classifiers, or prompt-engineering tricks (delimiters, “sandwich” reminders). These are useful but shallow: the underlying model still wants to follow any instruction it reads, so a determined attacker who gets past the filter reaches an undefended model. The earlier SecAlign work reported that a naive “sandwich” defense left a 96% attack success rate and StruQ still broke in roughly 56% of cases, whereas preference-optimized alignment pushed many injection attacks below 10%. Moving the defense into the weights changes the economics: the attacker now has to defeat the model’s learned preference, not just a wrapper around it.

The open release is the other reason this is notable. Until now, the strongest model-level injection defenses lived inside closed products, so external researchers could not measure them, probe them, or reproduce them. An openly available defended model gives red teams, ML engineers, and academics a shared, inspectable baseline — which is exactly the kind of co-development of attacks and defenses that moves a field forward. It also means teams building agents can adopt a hardened model directly instead of trusting a vendor’s opaque claim.

The honest caveat: no defense is complete. A model trained to resist injection is more robust, not immune, and robustness measured on today’s benchmarks can erode against tomorrow’s adaptive attacks. SecAlign-style training reduces attack success dramatically but does not zero it, and it should be layered with the architectural controls below rather than treated as a silver bullet.

Defenses

1. Prefer a model with a built-in injection defense for agentic workloads. If you are choosing a base model for a tool-using agent, an openly evaluated defended model such as Meta SecAlign gives you a measurable robustness baseline instead of an unverifiable vendor claim.
2. Keep the trust boundary in your architecture, not only in the model. Continue to separate trusted instructions from untrusted data, constrain tool permissions, and apply least privilege so that a successful injection has limited blast radius. Model-level defense reduces the probability of a breach; it does not contain one.
3. Layer defenses. Combine the hardened model with input/output filtering, structured-query delimiters, and human-in-the-loop approval for high-impact actions. Defense-in-depth still applies.
4. Re-test against adaptive attacks. Benchmark numbers reflect known attacks. Run your own red-team suite (and rerun it as new injection techniques are published) rather than assuming a training-time defense generalizes to every future attack.
5. Watch utility as well as security. The reason to prefer a jointly optimized model is that heavy-handed filtering degrades task performance; verify on your own workload that the defended model preserves the behavior you need.

Status

Item	Reference	Date	Notes
Meta SecAlign paper	arXiv 2507.02735 (v1)	2026-07-03	First open-weight LLM with model-level prompt injection defense
Weights + training code	facebookresearch/Meta_SecAlign (GitHub)	2026-07	Meta-SecAlign-8B (Llama-3.1-8B), Meta-SecAlign-70B (Llama-3.3-70B)
Original SecAlign method	arXiv 2410.05451 / ACM CCS 2025	2024-10 → 2025	Preference-optimization defense; StruQ predecessor
BAIR explainer (StruQ + SecAlign)	Berkeley AI Research blog	2025-04-11	Background on the structured-query + preference-optimization approach

The shift worth noting: prompt injection defense is moving from wrappers around a willing model to the model’s own learned preferences — and, for the first time, in a form the whole community can inspect and stress-test.