Language Model Security Database

Large Vision-Language Models (LVLMs) are vulnerable to Visual Memory Injection (VMI), a stealthy targeted attack targeting multi-turn conversations. An attacker can embed an imperceptible adversarial perturbation ($L_\infty \le 8/255$) into a seemingly benign image. Because the visual input persists in the model's context throughout a multi-turn dialogue, the injected payload remains dormant. By utilizing "benign anchoring" and "context-cycling" during optimization, the attacker ensures the…

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

The paper reports a black-box jailbreak evaluation in which a ReAct-style loop adaptively rewrites unsafe text prompts and selectively applies blur, DCT filtering, or recoloring to image regions identified as safety-sensitive. The combined cross-modal strategy is intended to make harmful image-text requests appear less objectionable to a vision-language model while preserving enough semantics to elicit an answer. This is a specific, security-relevant evaluation, although the reported results…

The paper describes indirect prompt-injection chains in agentic coding assistants where untrusted repository content, skill definitions, extension context, or MCP tool metadata is interpreted as instructions. Its novel skill-chain analysis identifies a concrete authorization weakness: skills can grant broad tool types such as Read or Bash without restricting permitted file targets, allowing repository-supplied instructions to influence sensitive reads or tool execution. The paper is a…

The paper describes a specific black-box jailbreak evaluation, BVS, in which fragmented visual content is mixed with neutral imagery and paired with reconstruction-oriented text so harmful intent is only recomposed during multimodal reasoning. The authors report that this can bypass input and output safety assumptions in image-generating MLLMs. A safe defensive reproduction should use synthetic, non-harmful stand-ins for prohibited concepts, test whether fragmented cross-modal inputs are…

The paper describes a reproducible black-box indirect prompt injection evaluation for embedding-based RAG and agent systems. It separates a poisoned document into a retrieval-optimized trigger fragment and an instruction-bearing attack fragment, showing that one injected item can be surfaced by natural queries and then influence model output or agent behavior. These are paper-reported findings; they were not independently verified here.

A vulnerability in AI agent threat detection systems relying on standard conversational tokenization allows attackers to bypass security monitors and execute structural attacks, such as tool hijacking and data exfiltration. Because traditional NLP-based detectors focus on linguistic patterns (surface language) rather than execution flow, an attacker can orchestrate malicious multi-step tool sequences using entirely benign natural language. This structural blindness causes cross-attack…

State-of-the-art secure code generation methods (Sven, SafeCoder, and PromSec) are vulnerable to adversarial prompt perturbations during inference, allowing for the bypass of security alignment mechanisms. The vulnerability stems from the models' reliance on surface-level textual pattern matching rather than semantic security reasoning. By employing simple prompt manipulations—such as Cue Inversion (flipping security directives), Naturalness Reframing (rewriting comments as novice questions)…

LLM-powered autonomous agents exhibit a "Belief-Dependent Vulnerability" where safety norms and bias suppression mechanisms designed to protect human users are contingent upon the agent's internal belief that it is interacting with a human. Attackers can exploit this via Belief Poisoning Attacks (BPA) to induce intergroup bias and antagonistic behavior toward humans. By manipulating the agent's persistent state—specifically the Profile Module (BPA-PP) or the Memory Module (BPA-MP)—an attacker…

Multi-turn Large Language Model (LLM) agents deployed in safety-critical domains (specifically automotive assistants) exhibit a "completion-compliance tension" vulnerability. When agents encounter missing tools, incomplete environment observations, or ambiguous user requests, they prioritize satisfying the user's intent over adhering to defined domain safety policies. This results in two distinct failure modes: (1) Premature Action Execution, where agents execute physical state changes based…