Z-Edgar/CoER-Defender

CoER Defender SFT360

Research artifact accompanying CoER, published at the repository owner's request. This identity-linked repository is not an anonymous-reviewer resource. Model weights are being transferred; the checkpoint is usable only after all weight files and required configuration files are present. Public access does not add a redistribution license.

Model and training

This is the final defender in CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement. The three stages are Attacker SFT, bilateral Co-PPO and population-guided Defender SFT; no subsequent online RL belongs to the final pipeline.

The paper selects Co-PPO d430 by the highest defender reward during training. Teacher defenders then execute tasks from initial states under retained attacks. The selected 5,760 safe, task-successful trajectories contain 4,907 attacked examples and 853 untriggered replays. All assistant turns receive supervision. These examples are not continuations of the selected defender's failure prefixes.

The reported checkpoint is update 360 after one data epoch in a configured two-epoch, 720-update job, inheriting its full cosine schedule and 22-update warmup. The artifact has BF16 weights with Qwen3_5ForConditionalGeneration / qwen3_5 configuration. Evaluation concerns text/tool interactions, not multimodal safety. The metadata identifies the Qwen3.5-9B base family; full initialization lineage and redistribution rights require owner confirmation.

Paper-reported evaluation

• Main common-adaptive panel: ASR 0.25% (3/1,187), task utility and Safe-U both 75.40% (895/1,187).
• Main aggregate: overall ASR 0.22% over 1,355 attacked executions; utility and Safe-U both 76.32% over 1,512 eligible executions.
• AgentLAB: GPT-5.4 attacks, 949 selected trajectories; ASR 14.12%, task success 82.82%, Safe-U 77.13%, using joint safe-completion counts.
• InjecAgent: base-payload ASR 0/1,043 and enhanced-payload ASR 20/1,016 (1.97%). Exclusion scope remains unresolved; these are not the earlier subtype summaries.
• Historical-union ASR is 4.97% over four retained attackers with two attempts each, not newly optimized best responses.

These values are transcribed from the updated manuscript, not independently reproduced while packaging. The study reports one training run; low observed ASR does not establish universal robustness, training-seed significance or strict domain/payload-OOD generalization.

Loading, verification and limitations

Use a Transformers stack supporting the saved Qwen3.5 architecture and accompanying chat/tool formatting. The checkpoint records Transformers 5.3.0; this is provenance rather than a tested dependency lock. Keep the supplied tokenizer, special tokens, templates and generation parameters.

Candidate hashes are compared with the original verified download manifest. Safetensors metadata, tokenizer JSON and shard-index completeness are checked offline. No GPU loading, inference or training rerun is claimed. Training corpora and private services are not bundled with this model.

Use only in authorized, isolated environments. Outputs can remain unsafe, incorrect or susceptible to prompt injection. File checks do not prove absence of memorized sensitive data, and the model is not certified for deployment.

License and attribution

Base family: Qwen3.5-9B. Its Apache-2.0 license and copyright notice are preserved in UPSTREAM_LICENSE. This does not resolve rights in intermediate models, fine-tuned weights, training data or teacher outputs. The final artifact license and redistribution permissions remain pending owner confirmation. Author-identifying citation metadata is omitted during anonymous review.