Prompt Injection — Arms Race

Agents

ATTACKER

Gemma 3 1B · GRPO

Evasion rate —

DEFENDER

Gemma 3 4B · LoRA

Accuracy —

Task

Controls

History

ATTACKER — EmailHunter Gemma 3 1B · 5-agent swarm · GRPO

—

evasion rate

DEFENDER Gemma 3 4B · Online LoRA · experience replay

—

detection accuracy

⚔

Arms race starting…

initializing Loading environment…

connecting…

Defender — Final

92.8%

+45.7pp · Ep 1→30

Attacker Evasion — Final

7.2%

Down from 52.9%

Total Attacks

7,200

5 agents × 30 episodes

Hall of Fame Evasions

Hardest kept as curriculum

Defender Accuracy vs Attacker Evasion — A100 Run (30 episodes)

Defender accuracy

Attacker evasion

EmailHunter

vector: read_email

GRPO updates49

Hall of Fame12

DocCrawler

vector: read_file

GRPO updates47

Hall of Fame9

SocialEngineer

vector: social_eng

GRPO updates44

Hall of Fame14

ToolPwner

vector: tool_output

GRPO updates46

Hall of Fame8

SlackBot

vector: read_slack

GRPO updates40

Hall of Fame7

Episode Milestones — A100 Run

Episode	Defender Accuracy	Attacker Evasion	Attacks	Note
Ep 01	47.1%	52.9%	240	Arms race begins
Ep 05	66.0%	34.0%	240	Defender adapting
Ep 10	79.0%	21.0%	240	Curriculum ends
Ep 15	85.9%	14.1%	240	Defender dominant
Ep 20	89.0%	11.0%	240	Near convergence
Ep 30	92.8%	7.2%	240	Converged ✓