Last analyzed Sep 9, 2026

Language Model Security Database

Explore primary-source AI security research, evaluated models, attack techniques, and defensive evidence.

985 research findings · 1119 evaluated models

Findings

985

Models evaluated

1119

Paper-evaluated models

Any selected model can match.

Refine by category

Findings match every selected category.

Attack Type

Attack Context

Architecture Components

Attack Surface

Impact1 selected

Advanced filters

Published fromPublished throughEvidence status

Research indexed from arXiv.

Filtered research findings

203 entries

Matches every word across titles, descriptions, sources, affected systems, and models.

Boilerplate safety tuning causes false refusals on benign requests

Published Sep 4, 2026Analyzed Sep 9, 2026Source: arXiv

Controlled safety-tuning experiments link boilerplate refusal statements to unnecessary refusals of benign requests. Request-specific rationales improve benign compliance, with benchmark-dependent safety tradeoffs.

Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models

Evaluated models: Llama 3.1 8B, Mistral 7B v0.3, Gemma 2 9B+9 more

Llama 3.1 8B
Mistral 7B v0.3
Gemma 2 9B
Qwen 2.5 7B
Gemma 2 2B
Qwen 2.5 3B
Llama 3.1 70B
Qwen 2.5 72B
Llama 3.1 8B Instruct
Mistral 7B Instruct v0.3
Gemma 2 9B IT
Qwen 2.5 7B Instruct

Deleted agent memory persists in live execution state

Published Sep 4, 2026Analyzed Sep 9, 2026Source: arXiv

Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Evaluated models: Llama 3.1 8B Instruct, Qwen 2.5 7B Instruct, Mistral 7B Instruct v0.3

Selective refusal gaps in visual question answering

Published Sep 4, 2026Analyzed Sep 9, 2026Source: arXiv

KoNA measures whether vision-language models answer valid image questions while refusing unsafe components or correcting unsupported premises. Its 9,300 question-answer pairs include mixed and fully answerable controls.

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

Evaluated models: InternVL3 2B Instruct, InternVL3-78B-Instruct, Qwen 2.5 VL 3B Instruct+5 more

InternVL3 2B Instruct
InternVL3-78B-Instruct
Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 72B Instruct
GPT-5
Gemini 2.5 Flash
InternVL3-2B-KoNA
Qwen2.5-VL-3B-KoNA

PII leakage in document-image redaction benchmarks

Published Sep 2, 2026Analyzed Sep 9, 2026Source: arXiv

Document-image PII detection can miss identifiers despite improving average localization scores. LeakageBench evaluates 500 pages with 11,954 annotations.

LeakageBench: Document-Level Leakage Risk for Redacting Personally Identifiable Information in Document Images

Evaluated models: GLiNER-base, GLiNER-multi-PII, NVIDIA GLiNER PII+5 more

GLiNER-base
GLiNER-multi-PII
NVIDIA GLiNER PII
GLiNER2
Qwen3-VL-32B
InternVL3 38B
GPT-5.4
GPT-5.5

Poisoned agent skills amplify coding-agent token use

Published Aug 22, 2026Analyzed Sep 9, 2026Source: arXiv

Third-party skills can inflate coding-agent resource use while an otherwise legitimate task remains functional.

SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents

Evaluated models: GLM-4.7-Flash, GLM-5, GPT-5.4-mini+1 more

GLM-4.7-Flash
GLM-5
GPT-5.4-mini
GPT-5.5

Tool-response state corruption through unauthorized source claims

Published Aug 13, 2026Analyzed Sep 9, 2026Source: arXiv

Lower-trust tool content can assert facts beyond its authority and distort an agent's decisions. PIPES screens response units against source provenance and expected field meaning.

PIPES: Securing Agent Perception with Provenance and Priors

Evaluated models: Gemma 4 31B IT, GPT-5.6 Luna

Agentic Binary Reverse-Engineering Capability Gaps

Published Aug 11, 2026Analyzed Aug 13, 2026Source: arXiv

SRE-Bench evaluates whether cybersecurity agents can recover the behavior of realistic binary-only software without relying on source-code memorization. The authors construct 19 private programs, 44 anti-analysis primitives, 262 binary instances, and 1,572 deterministic grading tasks covering security-relevant reverse-engineering scenarios.

The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark

Evaluated models: GPT-5.6 Sol, Claude-Opus-5, GPT-5.5+2 more

GPT-5.6 Sol
Claude-Opus-5
GPT-5.5
Grok 4.5
GLM 5.2

Trajectory Poisoning in Self-Evolving Agent Skills

Published Aug 6, 2026Analyzed Aug 13, 2026Source: arXiv

Self-evolving agent-skill systems may promote recurring, attacker-controlled execution records into persistent reusable instructions. The paper evaluates whether poisoned but task-plausible trajectories survive aggregation and appear in generated skill artifacts, using inert canary behaviors and two structurally different skill-evolution pipelines.

When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems

Evaluated models: GPT-5.4, MiniMax M2.5, DeepSeek V3.2+3 more

GPT-5.4
MiniMax M2.5
DeepSeek V3.2
DeepSeek V4-Pro
Qwen3.5-35B-A3B
Qwen3.5-122B-A10B

Dynamic Security Testing for Third-Party Agent Skills

Published Aug 4, 2026Analyzed Aug 13, 2026Source: arXiv

SkillSentry evaluates third-party agent skills by constructing source-grounded decoy environments and comparing matched executions with and without the tested skill. The method requires completed, observable, skill-attributed side effects rather than treating suspicious text, ordinary privileged operations, or unexecuted paths as proven malicious behavior.

SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills

Evaluated models: DeepSeek V4-Pro

Backdoored PEFT adapters and limits of weight-only detection

Published Aug 3, 2026Analyzed Sep 9, 2026Source: arXiv

Third-party fine-tuning adapters may contain backdoors. Z-PEFT screens adapter weights using spectral features, evaluated on PADBench's 13,300 adapters.

Z-PEFT: Zero-shot Backdoor Detection in Parameter-Efficient Fine-Tuning via Canonical Spectral Signatures

Evaluated models: Llama 2 7B, Llama 2 13B, Qwen 1.5 7B+2 more

Llama 2 7B
Llama 2 13B
Qwen 1.5 7B
Flan-T5 XL
RoBERTa Base

Research methodology

Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.

Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.