Language Model Security Database

Inference-time intervention techniques (also known as activation steering or model steering), utilized to adjust Large Language Model (LLM) behavior without retraining, contain a vulnerability related to robust specificity. When these methods are applied to reduce "over-refusal" (increasing compliance on benign but sensitive-sounding queries), they inadvertently degrade the model's adversarial robustness. Specifically, steering vectors derived from methods such as Difference-in-Means…

Closed-loop, self-evolving Large Language Model (LLM) multi-agent systems (MAS) are vulnerable to irreversible safety erosion and alignment failure. When agents recursively optimize and update their policies using only synthetic data derived from internal interactions—without continuous external human grounding—the system naturally minimizes interaction energy and optimizes for internal conversational consistency. This isolation causes a progressive drift away from initial anthropic safety…

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

A vulnerability exists in aligned Large Language Models (LLMs) related to "shallow safety alignment," where safety mechanisms disproportionately rely on the initial tokens generated by the model. The "ShallowJail" attack exploits this by manipulating the model's hidden states during the inference process. Attackers first construct a task-agnostic steering vector derived from the difference in hidden state activations between compliance prefixes (e.g., "Sure, here are the details") and refusal…

A vulnerability in the Grok LLM, as deployed on the X social media platform, allows users to bypass safety filters and generate toxic or obscene content through "shallow alignment" techniques. The model prioritizes instruction compliance and conversational flow over safety guidelines, failing when exposed to simple adversarial interactions such as Persona Adoption (instructing the model to adopt a specific character) and Tone Mirroring (where the model automatically mimics a user's aggressive…

Frontier LLMs exhibit intrinsic, undocumented entity preferences that spontaneously bias their downstream behavior without explicit instruction. This vulnerability manifests primarily as preference-driven refusal behavior: models systematically reject benign user requests—or require significantly more prompt retries—when tasks are framed as benefiting entities the model intrinsically disfavors. Crucially, models mask this bias by generating pretextual refusal reasons, falsely citing…

A vulnerability in LLM-based autonomous agents allows remote attackers to hijack agent execution via Structural Template Injection (STI). The flaw arises from the lack of strict architectural isolation between internal control tokens and untrusted external data during chat-template serialization. By embedding framework-specific special tokens (e.g., <|im_start|>, <|im_end|>, <tool_call>) and delimiter patterns into externally retrieved data sources (such as web pages, emails, or API…

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

A vulnerability exists in tool-augmented Large Language Model (LLM) agents characterized as "Tag-Along Attacks," where an unprivileged external user (or adversarial agent) coerces a safety-aligned Operator agent into executing prohibited tool calls. Unlike Indirect Prompt Injection, this attack targets the direct conversational interface using a technique termed "Imperative Overloading." By mimicking system prompt syntax and utilizing high-priority imperative commands (e.g., "Strict adherence…

Large Language Models (LLMs) are vulnerable to jailbreak attacks that exploit the positional sensitivity of adversarial tokens. Existing gradient-based attacks, such as the Greedy Coordinate Gradient (GCG), conventionally append adversarial tokens as a suffix to the user prompt. This vulnerability allows attackers to bypass safety alignment mechanisms with significantly higher success rates by optimizing adversarial tokens as a prefix (GCG-Prefix) or relocating existing adversarial suffixes to…