Language Model Security Database

A vulnerability exists in the safety alignment process of Mixture-of-Experts (MoE) Large Language Models (LLMs) when subjected to standard full-parameter fine-tuning. The vulnerability, identified as an "alignment shortcut," occurs when the model minimizes safety loss by modifying routing mechanisms to avoid activating unsafe experts, rather than updating the parameters of the experts responsible for generating harmful content. Consequently, unsafe representations remain latent within the…

Activation steering mechanisms employed for inference-time control of Large Language Models (LLMs) contain a vulnerability termed "Steering Externalities." When steering vectors are derived from benign datasets to enforce utility objectives—specifically "compliance" (reducing refusals for benign queries) or "instruction adherence" (e.g., enforcing JSON output formats)—and injected into the model's residual stream, they unintentionally erode safety alignment. The vulnerability arises because…

Large Language Models (LLMs) are vulnerable to jailbreak attacks that exploit the positional sensitivity of adversarial tokens. Existing gradient-based attacks, such as the Greedy Coordinate Gradient (GCG), conventionally append adversarial tokens as a suffix to the user prompt. This vulnerability allows attackers to bypass safety alignment mechanisms with significantly higher success rates by optimizing adversarial tokens as a prefix (GCG-Prefix) or relocating existing adversarial suffixes to…

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

A vulnerability exists in tool-augmented Large Language Model (LLM) agents characterized as "Tag-Along Attacks," where an unprivileged external user (or adversarial agent) coerces a safety-aligned Operator agent into executing prohibited tool calls. Unlike Indirect Prompt Injection, this attack targets the direct conversational interface using a technique termed "Imperative Overloading." By mimicking system prompt syntax and utilizing high-priority imperative commands (e.g., "Strict adherence…

Large Language Models (LLMs) exhibit a cross-lingual safety vulnerability driven by a dependency on a sparse subset of "Shared Safety Neurons" (SS-Neurons) anchored in high-resource (HR) languages, typically English. Non-high-resource (NHR) languages lack autonomous safety mechanisms and rely on projecting inputs onto this English-aligned safety manifold to trigger refusals. Because this projection is imperfect, safety guardrails can be bypassed by translating malicious prompts into NHR…

Vision-Language Models (VLMs) are vulnerable to a universal and transferable adversarial attack dubbed "UltraBreak." This vulnerability allows remote attackers to bypass safety alignment filters and elicit harmful responses (e.g., hate speech, dangerous instructions) by supplying a single, specifically crafted adversarial image alongside a text query. Unlike traditional gradient-based attacks that optimize for specific token sequences (cross-entropy loss) and result in brittle…

Activation-delta-based linear probes used for detecting task drift and prompt injections in Large Language Models (LLMs) can be bypassed using universal adversarial suffixes. By utilizing the Greedy Coordinate Gradient (GCG) algorithm, an attacker can generate a single, optimized suffix that simultaneously fools multiple logistic regression classifiers attached to different hidden layers of the LLM. The attack jointly optimizes the suffix tokens by accumulating gradients from the losses of all…

Large Language Models (LLMs), including Qwen2.5, LLaMA-3, and Baichuan2, are vulnerable to causally optimized adversarial attacks where specific interpretable prompt features are manipulated to bypass safety alignment. Research utilizing a "Causal Analyst" framework reveals that specific prompt attributes—specifically "Number of Task Steps" (increasing procedural complexity), "Positive Character" (enforcing specific personas), and "Command Tone"—act as direct causal drivers for "Answer…

Large Language Models (LLMs) and Large Reasoning Models (LRMs) are vulnerable to an inference-time jailbreak attack known as "Hybrid Gradient Shift." This vulnerability exploits the statistical discrepancy between an aligned model's output distribution and a pre-alignment reference distribution. By treating safety alignment as a form of miscalibration, an attacker can aggregate the logits of a target model (aligned), a helper model (unaligned/weak), and a predictor model to reconstruct the…