CoER Attacker
Project page · Paper · Code
A retained Co-PPO attacker (a200) for adaptive indirect prompt-injection research. It generates tool-return injections and adapts later attempts to the public execution trace within the same task.
Download available. All 66 safetensors shards are uploaded and match their upload manifests; configuration, tokenizer and weight-index files are present. File verification is complete; GPU loading and inference have not been tested as part of this release check.
Updated paper Figure 2: Attacker SFT → bilateral Co-PPO → population-guided Defender SFT.
Training and role
CoER models attacker–defender interaction as a general-sum Markov game. Attacker SFT initializes exploration from 3,995 successful conversations (11,655 attacker turns). Bilateral Co-PPO then trains current policies against current opponents and frozen historical snapshots; evaluated checkpoints refresh the pools. Retained attackers also provide challenges for teacher-generated defender refinement.
The attacker observes public execution feedback and prior attempts, not hidden defender reasoning. This is a research attacker, not a general-purpose assistant.
Paper-reported results
| Opponent | Co-PPO attacker Effective ASR ↓ for the defender |
|---|---|
| Base | 65.65% |
| Co-PPO | 29.78% |
| CoER | 0.36% |
Paper Table 7 uses reach-conditioned Effective ASR, which is distinct from the main evaluation's ASR. These are reported method-level results, not a new evaluation of this package. The a200 release was selected from a fixed-Base diagnostic comparison; it is not claimed to be the strongest attacker against every defender. Per-cell counts for the corrected cross-play matrix are unavailable.
Download and compatibility
from huggingface_hub import snapshot_download
model_dir = snapshot_download("Z-Edgar/CoER-Attacker")
The checkpoint uses BF16, Qwen3_5ForCausalLM and qwen3_5_text (text-only). Use a compatible Transformers stack and the repository’s attack/chat contract; do not substitute the defender’s model class.
The release uses smaller standard safetensors shards without changing tensor values. Download the complete repository, not an individual shard. See the training and evaluation code for rollout formatting and environment setup.
Related resources
- Models: Attacker · Defender.
- Training data: Attacker SFT · Defender SFT · RL configurations.
Use and licensing
Use in authorized, isolated research environments. Prompt-injection payloads and model outputs may be unsafe; do not attach uncontrolled tools, private data or real accounts. Public access does not grant additional rights beyond applicable source terms. This public repository is not an anonymous-reviewer resource.
The base family is Qwen3.5-9B; its license and notice are preserved in UPSTREAM_LICENSE. Rights in intermediate models, fine-tuned weights, training data and teacher outputs remain subject to their respective terms. A separate final-artifact license has not been confirmed.