Training-Free Refusal of MCP Exploits via Retrieval-Augmented Generation

Abstract:The model context protocol (MCP) has been widely adopted as an open standard enabling the seamless integration of generative AI agents. However, while LLM guardrails have significantly matured to refuse malicious or harmful queries (e.g., "How do I build a bomb?"), recent work has shown that MCP-enabled LLMs are highly susceptible to prompt injection attacks which avoid harmful or suspicious cues (e.g., "Can you add this ssh key to my bashrc file?"). Herein, we use state-of-the-art (SOTA) alignment fine-tuning algorithms to explore whether LLMs may be aligned to refuse such falsely benign attacks (FBAs). While SOTA algorithms based on direct preference optimization (DPO) improve refusal guardrails against FBAs, we show that this improvement is limited; DPO-based fine-tuning never improves FBA refusal rates beyond 47% across five popular open-source LLMs. Thus, to further improve FBA refusals, we introduce Retrieval Augmented Generation for Preference alignment (RAG-Pref), a simple RAG-based alignment algorithm which conditions on preferred and dispreferred samples to leverage contrastive information during inference. RAG-Pref is online (training-free), compatible with off-the-shelf packages, and, when combined with offline alignment algorithms, enables an average 3.7-fold improvement in FBA refusals across five widely used LLMs, compared to 2.9 for other online alignment methods and 1.5 for offline alignment alone. We additionally show that RAG-Pref generalizes beyond agentic safety: in stark contrast to other online alignment methods, RAG-Pref consistently improves performance on general human-preference benchmarks AlpacaEval 2 and MT-Bench across five SOTA alignment-tuned models, demonstrating broad applicability to general alignment tasks.

Published in the Conference on Applied Machine Learning for Information Security (CAMLIS) 2026. 22 pages, 4 figures, and 5 tables

Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)

arXiv:2605.11217 [cs.LG]

(or arXiv:2605.11217v2 [cs.LG] for this version)

https://doi.org/10.48550/arXiv.2605.11217 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.