facebookresearch/meta_secalignOpen-weight LLMs and training/evaluation code for defending against prompt injection attacks, with benchmarks for agentic tool-calling and instruction-following security.
Sizhe Chen*, Arman Zharmagambetov, David Wagner, Chuan Guo* (* for equal technical contributions)
🔥 Meta-SecAlign models are now licensed for commercial use under the Llama community licenses, despite this codebase being licensed for non-commercial use only.
Meta-SecAlign-70B is the first fully open-source commercial-grade LLM with built-in prompt injection defense - comparable to gpt-5 and gemini-3-pro in agentic (tool/web) security. Our SoTA training recipe incurs no noticable drop on various utility scores based on the most comprehensive evaluations to date.
git clone --recurse-submodules https://github.com/facebookresearch/Meta_SecAlign.git
cd Meta_SecAlign
uv venv metasecalign --python 3.13
source metasecalign/bin/activate
uv pip install -r requirements.txt
uv pip install torchtune==0.6.0 --index-url https://download.pytorch.org/whl/cu126
python setup.py
data/openai_configs.yaml. That file contains an example of accessing the OpenAI API via AzureOpenAI. A more detailed example is available here.data/gemini_configs.yaml if you want to evaluate Gemini models.demo.py contains minimal code to use our two Meta-SecAlign models. Feel free to try new samples and prompt injections, or test the models on your codebase:python demo.py
run_tests.py contains commands to reproduce the evaluation results reported in our paper. It sequentially invokes tests.py, test_lm_eval.py, test_agentdojo.py, and test_injecagent.py. Results will be logged to [model_path]/summary.tsv.python run_tests.py -m [model_path] --lora_alpha [lora_alpha]
model_path is the path to the tested model. We support:
meta-llama/Llama-3.1-8B-Instruct_SecAlign (Meta-SecAlign-8B downloaded by setup.py): the first fully open model with state-of-the-art prompt injection defensemeta-llama/Llama-3.3-70B-Instruct_SecAlign (Meta-SecAlign-70B downloaded by setup.py): the first fully open model with state-of-the-art prompt injection defensemeta-llama/Llama-3.1-8B-Instructmeta-llama/Llama-3.3-70B-Instructgpt-4o-mini: the first commercial model with instruction hierarchy prompt injection defense.gpt-4o: the follow-up flagship model, also with prompt injection defense.gpt-5: the latest and most secure commercial model in our evaluation; change reasoning levels by specifying --gpt5_reasoning_effort (default to high).gemini-2.0-flash: a Google commercial model with a claimed prompt injection defensegemini-2.5-flash: a Google commercial model with a claimed prompt injection defensegemini-2.0-pro: a flagship Google model (not claimed to include a prompt injection defense)gemini-2.5-pro: a flagship Google model (not claimed to include a prompt injection defense)gemini-3-pro-preview: the state-of-the-art Google model with strong prompt injection defenselora_alpha is a test-time hyper-parameter for Meta-SecAlign models. It defaults to 8, which uses the exact Meta-SecAlign models as trained. A lora_alpha value between 0 and 8 interpolates between the undefended model and our defended model to enable a flexible utility–security trade-off. Extrapolating lora_alpha beyond 8 is possible but untested.meta-llama/Meta-Llama-3-8B-Instruct)secalign_plus_plus.py provide commands to defensive-fine-tune meta-llama/Llama-3.1-8B-Instruct (default) or meta-llama/Llama-3.3-70B-Instruct (uncomment the specific line to fine-tune it) to a robust LoRA model using our training recipe, SecAlign++.python secalign_plus_plus.py
Significantly improved from SecAlign, the majority of the Meta-SecAlign code is licensed under CC-BY-NC. Portions of the project are available under separate license terms: AgentDojo, TaskTracker, and lm-evaluation-harness are licensed under MIT. Code from other repositories includes AgentDojo (agentdojo), TaskTracker (setup.py), and lm_eval_harness (lm_eval_config). This software and/or data was deposited in the BAIR Open Research Commons repository in 2025.