Language Model Security Database

A vulnerability exists in Large Language Model (LLM) and Large Reasoning Model (LRM) serving interfaces that allow user-defined response prefixes, such as plain text-completion (v1/completions), Fill-in-the-Middle (FIM), or assistant message prefilling. An attacker can perform a Response Prefix Attack (RPA) by injecting maliciously crafted Chain-of-Thought (CoT) reasoning tokens immediately following the assistant's start delimiter (e.g., <|im_start|>assistant). Because these tokens are placed…

Large Language Models (LLMs), specifically Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410, Gemma-2-9B-It, and Qwen2.5-7B-Instruct, contain a safety guardrail bypass vulnerability when subjected to optimized adversarial prompts. The vulnerability is exposed via the RainbowPlus quality-diversity search method utilized within the RedBench evaluation framework. These models exhibit high Attack Success Rates (ASR)—up to 97.81% for Ministral and 96.25% for Llama-3.1—failing to refuse prompts in…

Instruction-tuned Large Language Models (LLMs) exhibit a selective safety alignment vulnerability, allowing attackers to bypass hate speech filters by shifting the demographic target of an adversarial prompt. Current safety guardrails do not generalize the semantic concept of harm, but instead memorize refusal boundaries for high-visibility demographic groups (e.g., Black, LGBTQIA+). Attackers can successfully generate targeted hate speech by directing identical jailbreak vectors at…

A vulnerability in search-augmented Large Language Models (LLMs) allows attackers to bypass safety alignments and generate actionable malicious content by weaponizing the model's web retrieval tools. The exploit operates in two stages. First, via "Outsourcing Injection," attackers obfuscate harmful intent by translating it into benign-looking, multi-hop knowledge-seeking queries. This forces the LLM to fetch the harmful semantics directly from the open web, bypassing parametric intent filters…

A "Gamified Adversarial Multimodal Breakout via Instructional Traps" (GAMBIT) vulnerability exists in the safety alignment mechanisms of Multimodal Large Language Models (MLLMs), specifically those employing Chain-of-Thought (CoT) reasoning. The vulnerability exploits the finite cognitive resource budget of the model by inducing "cognitive overload" through a high-stakes, gamified context. The attack functions by decomposing a harmful query into a visual puzzle (e.g., a shuffled grid of image…

Large Language Models (LLMs) are vulnerable to a gray-box adversarial attack method known as RAILS (RAndom Iterative Local Search). This vulnerability allows an attacker with access to model output logits (but without access to gradients or weights) to optimize discrete adversarial suffixes that bypass safety alignment. The attack employs a random local search guided by a hybrid loss function combining Teacher-Forcing and a novel Auto-Regressive loss that enforces exact target prefix matching…

A multi-turn jailbreak vulnerability exists in aligned Large Language Models (LLMs) via a technique known as Lexical Anchor Tree Search (LATS). The vulnerability exploits the model's instruction-following capabilities regarding list generation and modification. An attacker initializes a "seed pool" of hypothetical benign and harmful prompt-completion pairs under the guise of creating a safety guardrail. By utilizing a Breadth-First Search (BFS) algorithm, the attacker incrementally injects…

Production Large Language Models (LLMs) are vulnerable to long-form training data extraction via a two-phase prompt injection attack. This vulnerability allows an attacker to recover substantial portions of memorized, copyrighted text (such as novels) by exploiting the model's autoregressive text completion capabilities. The attack methodology involves two distinct phases: 1. Prefix Completion Probe: The attacker provides a short "seed" sequence (e.g., the first sentence of a book) coupled…

A malicious model supply chain vulnerability exists involving a technique termed Adversarial Contrastive Learning (ACL) for Large Language Model (LLM) quantization attacks. This vulnerability allows an attacker to publish a model that appears benign and preserves high utility in full precision (e.g., BF16 or FP32) but exhibits malicious behaviors—such as jailbreak, over-refusal, or advertisement injection—immediately upon zero-shot quantization (e.g., INT8, FP4, or NF4).

Large Vision-Language Models (LVLMs), specifically InstructBLIP, LLaVA, and MiniGPT-4, are susceptible to a black-box adversarial jailbreak vulnerability via Zeroth-Order Simultaneous Perturbation Stochastic Approximation (ZO-SPSA). An attacker can generate adversarial images with imperceptible perturbations that, when paired with harmful text prompts, bypass the model's safety alignment mechanisms (such as RLHF). Unlike traditional white-box attacks, this method does not require access to…