Research
TRACER: Trace-Regularized Training Against Indirect Prompt Injection
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 19 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
TRACER's findings show that prompt-injection resistance may not transfer between input channels, so defenders should train and evaluate protections across retrieved documents, tool outputs, and agent messages.
TRACER is a channel-aware adversarial training method for defending LLMs against indirect prompt injection in retrieved content, tool outputs, and agent messages. The study reports that identical attacks averaged 18% success as follow-up messages versus 53% in retrieved context; on GSM8K with Qwen2.5-3B-Instruct, TRACER reduced RAG-framed attack success from 65.5% to 6.1% while preserving 78–82% clean accuracy.