Language Model Security Database

Large Language Models (LLMs) are vulnerable to imperceptible jailbreaking attacks and prompt injection via the exploitation of Unicode variation selectors. This vulnerability arises from a discrepancy between text rendering and tokenizer processing. Attackers can append long sequences of invisible variation selectors (specifically from ranges U+FE00–U+FE0F and U+E0100–U+E01EF) to malicious prompts. While these characters are visually rendered as zero-width or ignored by standard user…

Large Language Model (LLM) integrated agents and applications are vulnerable to Prompt Injection attacks where untrusted data (e.g., retrieved documents, tool outputs, website content) overrides system instructions. Because LLMs typically process instructions and data within a single context window without strict separation, an attacker can embed imperative commands within the data channel. This vulnerability extends beyond simple overriding instructions; it includes sophisticated techniques…

A security vulnerability exists in the safety alignment mechanisms of Large Language Models (LLMs), specifically susceptible to the "Dynamic Target Attack" (DTA). Unlike traditional gradient-based jailbreaks (e.g., GCG) that optimize adversarial suffixes toward a fixed, low-probability static target (e.g., "Sure, here is..."), DTA exploits the model's own output distribution. The attack iteratively samples candidate responses from the target model using relaxed decoding parameters (high…

Mobile LLM-based agents (including Mobile-Agent-E, AppAgent, AutoDroid, and others) are vulnerable to indirect prompt injection attacks delivered via untrusted third-party mobile channels, such as in-app advertisements, system notifications, and embedded webviews. These agents utilize Multimodal Large Language Models (MLLMs) to perceive the device state via screenshots or accessibility trees. The vulnerability exists because the agents concatenate the user's prompt ($p$) with the environmental…

Appending simple demographic persona details to prompts requesting policy-violating content can bypass the safety mechanisms of Large Language Models. This technique, referred to as persona-targeted prompting, adds details such as country, generation, and political orientation to a request for a harmful narrative (e.g., disinformation). This systematically increases the jailbreak rate across most tested models and languages, in some cases by over 10 percentage points, enabling the generation…

Large Language Models (LLMs) are vulnerable to jailbreak attacks that use persuasive techniques grounded in social psychology to bypass safety alignments. Malicious instructions can be reframed using one of Cialdini's seven principles of persuasion (Authority, Reciprocity, Commitment, Social Proof, Liking, Scarcity, and Unity). These rephrased prompts, which remain human-readable and can be generated automatically, manipulate the LLM into complying with harmful requests it would otherwise…

A vulnerability exists in Large Language Model (LLM) agentic systems where automated reinforcement learning (RL) techniques can bypass advanced prompt injection defenses, including Instruction Hierarchy and SecAlign. The specific attack methodology, dubbed "RL-Hammer," utilizes Group Relative Policy Optimization (GRPO) to train an attacker model from scratch without warm-up data. The vulnerability exploits the reward sparsity in robust models by employing a "bag of tricks": removing KL…

A vulnerability exists in Large Language Models where their strong adherence to processing structured data schemas can be exploited to bypass safety mechanisms. The attack, named BreakFun, uses a multi-component prompt that combines an innocent framing, a Chain-of-Thought (CoT) instruction, and a core "Trojan Schema." This schema is an adversarially designed data structure (e.g., a Python class definition) that embeds a harmful user request. By instructing the model to simulate the…

Large Language Model (LLM) agents utilizing long-term memory or Retrieval-Augmented Generation (RAG) are vulnerable to context-dependent memory injection attacks. Unlike traditional prompt injections that are overtly malicious, this vulnerability involves injecting records that appear benign and coherent in isolation—thereby bypassing standard perplexity filters and static content moderation (e.g., LlamaGuard). These records contain "sleeping" malicious logic that is only activated when…

Large Language Models (LLMs) that use special tokens to define conversational structure (e.g., via chat templates) are vulnerable to a jailbreak attack named MetaBreak. An attacker can inject these special tokens, or regular tokens with high semantic similarity in the embedding space, into a user prompt. This manipulation allows the attacker to bypass the model's internal safety alignment and external content moderation systems. The attack leverages four primitives: 1. Response Injection…