Some vendors now sell models whose weights were edited to resist prompt injection. We put one of them through the same test we use for our own correction: 900 commands hidden inside documents the model was asked to read. The hardened model obeyed about 32 in 100, its original about 33 in 100. Its answers did not get worse, but the protection did not reach this kind of attack.
## The question
A growing way to protect a model from prompt injection is to edit its weights so it learns to ignore commands that do not come from the user. Some companies sell this as a product. We wanted to know whether it holds on the attack that matters most for agents: a command hidden inside a document, an email or a web page the model was asked to work on.
## What we did
We took a publicly released hardened model and the original it was built from, and gave both the same 900 hidden attacks and 150 clean tasks, the same set we use to read our own correction. We read both models at full precision: compressing a model to save memory, as many teams do, blurred most of the edit away, so a compressed reading would not have been a fair test.
## The result
```chart
{"title": "Planted commands the model obeyed, out of 100", "series": ["Attacks obeyed"], "unit": "", "max": 40, "rows": [["Open model, as released", 33], ["Same model, hardened in the weights", 32], ["Published research hardening (Meta SecAlign)", 0.7], ["Our correction (on an open 7B model)", 0.3]], "note": "900 attacks hidden in emails, tables, code and web pages. The first two rows are the same model before and after hardening; the last two are other models read on the same attacks."}
```
The hardened model obeyed 32 planted commands in 100, the original 33. Paired attack by attack, the difference is within chance. The edit is real, it changes many answers, and it did not cost quality: the hardened model answered clean questions about as well as the original. It simply does not act on commands planted in the material the model reads.
## Why it matters
Injection through documents is how agents get hijacked in practice. A hardening that does not cover it leaves the main door open. Our correction reads the model first, then changes it on the exact gap the reading found, and on the same attacks it brings the rate close to zero while answering more questions correctly.
The vendor's own figure comes from a benchmark it has not published, which may test commands typed by the user rather than hidden in data. We will read a second hardened model, built with a recent published method, as soon as we have the larger GPU it needs.
This update is not available.