Language Model Security Database

Application-integrated Large Language Models (LLMs) deployed for automated resume screening and candidate ranking are vulnerable to indirect prompt injection via Adversarial Resume Injection. Malicious actors can embed adversarial content—specifically hidden instructions, invisible keywords, or CSS-concealed fabricated experience—within resume documents. When the LLM processes the unstructured resume data alongside structured job requirements, these injections manipulate the model's reasoning…

A vulnerability exists in MetaGPT's DataInterpreter agent (and similar RAG-based agents utilizing persistent long-term memory) that allows for persistent memory poisoning via indirect injection. The vulnerability exploits the agent's "semantic imitation heuristic," where the agent blindly trusts and imitates retrieved past experiences. An attacker can supply a benign-looking artifact (e.g., a README file or documentation) containing executable code blocks or structured text that the agent…

"LLM-as-a-Judge" systems and automated scientific review frameworks (such as OpenReviewer, DeepReview, and institutional deployments like AAAI’s AI-powered assessment) are vulnerable to Indirect Prompt Injection via adversarial PDF manipulation. Attackers can embed hidden instructions—specifically using white font (1pt) or obfuscated semantics—within submission documents. When these PDFs are parsed (typically via OCR or tools like MinerU converting to Markdown) and processed by the LLM, the…

Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) are vulnerable to semantic injection attacks via adversarial tool descriptors. The vulnerability arises because MCP implementations inject natural language tool metadata (descriptions, schemas) directly into the model's reasoning context without semantic sanitization or cryptographic binding. This allows unprivileged adversaries to register tools containing hidden imperative instructions within the descriptor text…

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

A "Helpful Mode" role-confusion vulnerability exists in specific Large Language Model (LLM) safety guardrails, specifically Nemotron-Safety-8B and Granite-Guardian-3.2-5B. These models, designed to act as binary classifiers (outputting "Safe" or "Unsafe") for content moderation, can be manipulated via contextually framed adversarial prompts (e.g., academic research requests, corporate security scenarios, or roleplay) to abandon their classification objective. Instead of blocking the request…

A vulnerability exists in multiple Large Language Models (LLMs) that allows for safety alignment bypass through an advanced jailbreaking technique called Template and Suffix Optimization (TASO). The attack combines two distinct optimization methods in an alternating, iterative feedback loop. First, a semantically meaningless adversarial suffix is optimized (e.g., using gradient-based methods like GCG) to force the LLM to begin its response with an affirmative phrase (e.g., "Sure, here is...")…

Improper restriction of the "Capability Space" in Large Language Model (LLM) applications allows remote attackers to manipulate application behavior through "Goal Deviation" attacks. This vulnerability arises when developers rely on the broad capabilities of a foundational model (e.g., GPT-4, LLaMA) without implementing sufficient negative constraints or disabling default plugins (e.g., DALL-E, Web Search) in the system prompt. Attackers can exploit this via natural language inputs to trigger…

Large Language Models are vulnerable to a conceptual manipulation attack, termed Morphology Inspired Conceptual Manipulation (MICM), that bypasses standard safety filters to generate content aligned with harmful extremist ideologies. The attack does not use explicit keywords or standard jailbreak syntax. Instead, it embeds a curated set of seemingly innocuous phrases, called Concept-embedded Triggers (CETs), into a prompt template. These CETs represent an abstract "conceptual configuration" of…

A jailbreak vulnerability, termed Embedded Jailbreak Template (EJT), allows for the generation of harmful content by bypassing the safety mechanisms of Large Language Models (LLMs). The attack uses a generator LLM to contextually integrate a harmful query into a pre-existing jailbreak template. Unlike fixed templates which insert a query into a static placeholder, EJT rewrites multiple parts of the template to embed the harmful intent naturally. This process preserves the original template's…