SRFT lets LLM agents learn from their own failures, cutting AgentDojo attack success from 7.59% to 1.26%
The work proposes Self-Reflection Fine-Tuning (SRFT): it injects attack instructions into clean expert trajectories, samples the agent's own potentially failing actions under the attacked context, and has an expert model generate structured self-reflection reasoning that contrasts unsafe and optimal actions, which then supervises fine-tuning; instantiated as SR-Agent on Llama-3.1-8B-Instruct and Qwen3-8B, it reduces AgentDojo attack success rate from 7.59% to 1.26% and from 16.97% to 1.05% respectively, and keeps a low attack success rate under the RL-Hammer adaptive attack.