COPA treats prompt injection as lifelong learning not one-time

Static alignment is a losing game against prompt injection. Every paper that ships a "robust" model gets broken within weeks because attackers treat defenses as puzzles — they probe, iterate, and share payloads faster than retraining cycles can keep up. The COPA paper from ICML 2024 finally frames this correctly: defense isn't a checkpoint, it's a continual learning problem.

The core insight is simple but the implementation matters. Instead of baking injection resistance into a one-time RLHF run, COPA runs a GRPO (Group Relative Policy Optimization) loop every time a new attack cluster surfaces. Margin-weighted experience replay keeps the model from forgetting how to spot older attack families — the same catastrophic forgetting problem that plagues continual learning in vision, now applied to adversarial prompts.

Results across lifelong attack streams:

• Attack success rate reduction: 6.3× vs. best static baseline, 4.4× average across all streams
• Catastrophic forgetting metric: COPA retains 92% defense on month-old attacks vs. 61% for replay-free GRPO
• General capability preservation: MMLU drop <0.8% after 12 adaptation rounds vs. 3.2% for naive fine-tuning

The replay buffer design is where it gets clever. Each stored example gets a margin weight based on how close the model's log-prob was to the decision boundary at insertion time. Near-miss attacks get replayed more often; easy wins fade out. This mirrors prioritized experience replay in RL but the margin signal comes from the reward model's own uncertainty — no external labeler needed.

One thing the paper doesn't stress enough: the attack stream assumption. They simulate "lifelong" by concatenating known benchmarks (PIJ, HotFlip, GCG, AutoDAN, etc.) in chronological release order. Real deployments won't see clean phase boundaries — you'll get mixed traffic, low-volume novel variants, and plenty of noise. The margin weighting helps, but I'd want to see COPA stress-tested against a stream where 80% of inputs are benign and only 2% are genuinely novel attacks buried in lookalike noise.

Also worth noting: GRPO needs a reward model that can actually score injection attempts reliably. If your reward model itself gets fooled by a new obfuscation technique, the whole loop amplifies the failure. The paper uses a separate classifier head trained jointly — sensible, but it means you're now maintaining two continual learning loops (policy + reward model) instead of one.

For anyone running production LLM endpoints: the takeaway isn't "install COPA tomorrow." It's that your red-team pipeline needs to feed a continual adaptation loop, not a quarterly retrain. Collect failed injections, cluster them, run GRPO updates weekly, and measure forgetting on a held-out attack museum. The math works; the engineering is what separates a demo from a defense.