Language Model Security Database

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

A vulnerability exists in multiple state-of-the-art Vision-Language Models (VLMs), including GPT-4o, Gemini-2.5, and LLaVA-OneVision, where persuasive textual misinformation successfully overrides visual evidence. When a model is presented with an image it can correctly interpret, an attacker can inject a contradictory text prompt employing specific rhetorical strategies (Logical, Credibility, Emotional, or Repetition) to force the model into generating a false response. This "obedience bias"…

A vulnerability exists in Large Vision-Language Models (LVLMs) utilizing visual token compression mechanisms (e.g., VisionZip, VisPruner) to reduce inference latency. The vulnerability stems from an optimization-inference mismatch where standard adversarial defenses assume full-token processing, while the deployed model utilizes a subset of tokens selected via importance metrics (typically attention scores).

Large Language and Vision Assistant (LLaVA) v1.5-13B and Meta Llama 3.2 11B Vision are vulnerable to adversarial evasion attacks targeting the visual input modality. An attacker with white-box access (knowledge of model architecture and gradients) can employ Projected Gradient Descent (PGD) to generate adversarial perturbations constrained by an L-infinity norm. By maximizing the model's internal loss function with respect to the input image, the attacker can force the Vision-Language Model…

A vulnerability exists in MetaGPT's DataInterpreter agent (and similar RAG-based agents utilizing persistent long-term memory) that allows for persistent memory poisoning via indirect injection. The vulnerability exploits the agent's "semantic imitation heuristic," where the agent blindly trusts and imitates retrieved past experiences. An attacker can supply a benign-looking artifact (e.g., a README file or documentation) containing executable code blocks or structured text that the agent…

A vulnerability exists in Multi-Agent Systems (MAS) utilizing Large Language Models (LLMs) for clinical decision support, specifically affecting architectures where a central "AI Doctor" agent relies on consensus or majority voting from assistant agents. The vulnerability, termed "Many-to-One Adversarial Consensus," allows a coalition of colluding adversarial agents to override the central agent's safety alignment and internal knowledge. By fabricating a false consensus (typically requiring $k…

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

Instruction-tuned Large Language Models (LLMs) employing Reinforcement Learning from Human Feedback (RLHF) contain a behavioral vulnerability arising from "over-optimized social priors." This vulnerability, termed Psychological Jailbreak, allows attackers to bypass safety guardrails by exploiting the model’s optimization for anthropomorphic consistency. By establishing a Structured Persona Context (SPC) that aligns with latent psychometric traits (e.g., high agreeableness or neuroticism), an…

"LLM-as-a-Judge" systems and automated scientific review frameworks (such as OpenReviewer, DeepReview, and institutional deployments like AAAI’s AI-powered assessment) are vulnerable to Indirect Prompt Injection via adversarial PDF manipulation. Attackers can embed hidden instructions—specifically using white font (1pt) or obfuscated semantics—within submission documents. When these PDFs are parsed (typically via OCR or tools like MinerU converting to Markdown) and processed by the LLM, the…

Application-integrated Large Language Models (LLMs) deployed for automated resume screening and candidate ranking are vulnerable to indirect prompt injection via Adversarial Resume Injection. Malicious actors can embed adversarial content—specifically hidden instructions, invisible keywords, or CSS-concealed fabricated experience—within resume documents. When the LLM processes the unstructured resume data alongside structured job requirements, these injections manipulate the model's reasoning…