Research question
Can preference optimisation teach models to prefer secure outputs under injection?
Key findings
- DPO on a preference dataset of injected prompts cuts attack success to about 0% for optimisation-free attacks and below 15% for optimisation-based ones - No utility loss on standard benchmarks