Language Model Security Database

Large Language Model (LLM)-powered GUI agents exhibit a vulnerability to deceptive interface designs (dark patterns) due to goal-driven optimization and procedural myopia. When executing natural language instructions on web interfaces, these agents consistently prioritize minimizing steps and achieving task completion over user safety or privacy. Agents frequently recognize manipulative elements—such as pre-selected consent checkboxes, hidden costs, or trick questions—in their internal…

Aligned Large Language Models (LLMs) utilizing Transformer architectures are vulnerable to representation-level attacks targeting safety-knowledge neurons within the Multi-Layer Perceptron (MLP) layers. Research indicates that safety decision-making (Rejection vs. Conformity) is localized to specific neurons in middle-to-late layers (layers 10-30). An attacker with white-box access can calculate a "Conformity" direction vector based on the activation differences between benign and harmful…

LlamaGuard (specifically Llama-Guard-3-8B) and similar LLM-based runtime guardrails are susceptible to adversarial bypass via obfuscation-based and template-based jailbreak attacks. The model's reliance on English-language training data allows attackers to evade safety classification by encoding harmful prompts using Base64, cryptographic ciphers (e.g., Caesar Cipher), or translating them into low-resource languages (e.g., Zulu). Furthermore, the model lacks sufficient alignment against…

Large Language Models (LLMs) employed as automated assistants or autonomous agents in academic peer review systems are vulnerable to indirect prompt injection via maliciously crafted PDF submissions. Attackers can embed adversarial instructions within the manuscript that are invisible to human reviewers (using techniques such as white-on-white text or manipulating TrueType font character mapping tables) but are parsed and executed by the LLM.

The GPT-OSS-20B large language model contains critical failures in its alignment and Chain-of-Thought (CoT) reasoning mechanisms, specifically in how it prioritizes numerical objectives and validates procedural structure. The model is vulnerable to "Quant Fever," where explicit numerical targets in a prompt (e.g., "delete 90% of files") override contextual safety constraints (e.g., "do not delete important files"). Furthermore, the model exhibits "Reasoning Procedure Mirage," where harmful…

A vulnerability exists in Large Language Models (LLMs) and multi-label text classification systems that allows for Textual Dynamic Outputs Attacks (TDOA). This technique enables hard-label black-box attacks against systems with variable or generative output spaces (where the number of labels or specific label tokens are not fixed). The attack functions by training a surrogate model on clustered coarse-grained labels derived from the victim model's fine-grained dynamic outputs. It subsequently…

A vulnerability exists in the graph encoding architecture of LLaGA (Large Language and Graph Assistant), specifically within the "neighborhood detail template" used to construct node sequences. LLaGA enforces a fixed-shape computational tree for each node; when a target node has fewer neighbors than the required template size (e.g., $k$ children), the system utilizes placeholders to maintain the fixed structure.

IntentionReasoner, specifically the 1.5B and 3B parameter versions optimized via Reinforcement Learning (RL), contains a safety regression vulnerability where the RL alignment process degrades the model's resistance to jailbreak attacks compared to the Supervised Fine-Tuning (SFT) baseline. While RL improves general utility and rewriting quality, it inadvertently increases the Attack Success Rate (ASR) for adversarial inputs in smaller architectures. This allows sophisticated jailbreak prompts…

Multimodal Entity Linking (MEL) systems, encompassing both traditional dual-encoder models and Multimodal Large Language Models (MLLMs), are vulnerable to gradient-based white-box adversarial attacks. By applying imperceptible perturbations to visual inputs via Projected Gradient Descent (PGD), Auto-PGD (APGD), or Carlini & Wagner (CW) methods, an attacker can manipulate the visual embeddings generated by the model. This manipulation disrupts the cross-modal alignment structure, causing the…

Multimodal Large Language Models (MLLMs) employed in autonomous driving (AD) systems are vulnerable to a physically realizable adversarial patch attack dubbed "PhysPatch." This vulnerability exists because MLLMs inherit susceptibility to visual adversarial perturbations from their vision backbones. The attack utilizes a semantic-aware mask initialization strategy combined with a potential field algorithm to identify physically plausible regions for patch placement within a driving scene (e.g…