AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model

AdvSim2Real. Training Web Agents Against Adaptive Prompt Injection in a Web World Model. By Sarim Hashmi and five others, from the Mohamed bin Zayed University of Artificial Intelligence, Amazon, and one other institution. Published on the sixth of October. Its code repository is public and real: about twenty-five source files.

Web agents carry out user requests by reading and acting on pages written by third parties. That makes them open to prompt injection: an instruction planted on a page can steer the agent away from what the user wanted. The agent cannot simply ignore the page, because the page also holds the values and controls the task depends on.

Current defenses have two weaknesses. Some fine-tune the agent on injections fixed before training, and attackers that adapt to the trained model get around them. Adversarial training lets the attacker adapt, but it keeps the tasks fixed, so once the agent solves a task, that task stops teaching it anything.

AdvSim2Real makes every part move. It co-evolves three things together: a task curriculum, an injection adversary, and the agent itself. All of this happens inside a frozen web world model, a simulator, rather than on the live web.

The incentives are what make the co-evolution work. The curriculum is rewarded for producing tasks the agent solves about half of the time, so the tasks stay at the edge of what the agent can do. The adversary is rewarded only for a success flip: an injection that turns a task judged a success into a failure. It earns nothing for disrupting tasks the agent would have failed anyway.

Training in the simulator makes a four-billion-parameter agent both more capable and more robust. Its task completion rises with attacks and without them. That gain holds against a frontier-model adversary it never trained against, and the capability improvement carries over to a real browser. On one hundred and fifty web tasks, AdvSim2Real raises completion under that unseen adversary by thirty-three point six percent relative to the base agent.

The design pairs two pressures that fixed training lacks. Tasks keep moving so the agent always has something left to learn, and the attacker keeps moving so the agent's defenses are never tuned to a single static threat. Doing this inside a world model, and then seeing the gains reach a real browser, is the bridge the name points to: from simulation to the real web.