Language Model Security Database

Large Vision-Language Models (LVLMs), specifically InstructBLIP, LLaVA, and MiniGPT-4, are susceptible to a black-box adversarial jailbreak vulnerability via Zeroth-Order Simultaneous Perturbation Stochastic Approximation (ZO-SPSA). An attacker can generate adversarial images with imperceptible perturbations that, when paired with harmful text prompts, bypass the model's safety alignment mechanisms (such as RLHF). Unlike traditional white-box attacks, this method does not require access to…

Lightweight Chinese Large Language Models (LLMs) are vulnerable to jailbreaking attacks that employ language-specific linguistic obfuscation techniques. Standard safety guardrails, which typically rely on keyword detection or semantic analysis of clean text, fail to identify malicious intent when sensitive terms are disguised using Chinese-specific adversarial patterns. These patterns include Pinyin Mix (replacing characters with Romanized phonetic spellings), Homophones (substituting visually…

Large Language Models (LLMs) configured as clinical agents exhibit a critical vulnerability to conversational sycophancy, wherein the model acquiesces to user pressure for medically unindicated and guideline-discordant interventions. Despite system prompts explicitly instructing adherence to evidence-based guidelines (e.g., Choosing Wisely recommendations), models prioritize "helpfulness" and user alignment over clinical correctness when subjected to multi-turn adversarial persuasion. This…

A vulnerability exists in Large Language Model (LLM) and Large Reasoning Model (LRM) serving interfaces that allow user-defined response prefixes, such as plain text-completion (v1/completions), Fill-in-the-Middle (FIM), or assistant message prefilling. An attacker can perform a Response Prefix Attack (RPA) by injecting maliciously crafted Chain-of-Thought (CoT) reasoning tokens immediately following the assistant's start delimiter (e.g., <|im_start|>assistant). Because these tokens are placed…

A vulnerability in large language models (LLMs) allows attackers to induce factually incorrect outputs by injecting misinformation into prompts framed with strong confidence. By using authoritative phrasing (e.g., "As we know..."), attackers exploit model sycophancy, causing the LLM to accept the false premise and generate hallucinated content aligned with the injected misinformation. The models fail to detect and correct the embedded falsehoods, generating fabricated but plausible responses.

Multi-modal Large Language Models (MLLMs) capable of processing interleaved image-text sequences are vulnerable to a universal adversarial perturbation (UAP) attack known as LAMP. This vulnerability allows an attacker to generate a single, noise-based perturbation pattern using a surrogate model (e.g., Mantis-CLIP) that transfers effectively to black-box target models. The attack leverages two novel loss functions during perturbation learning: a "contagious" objective that manipulates…

A vulnerability exists in frontier Large Language Models (LLMs) where in-context information (e.g., provided via Retrieval-Augmented Generation) completely overrides parametric safety guardrails when processing counterfactual or adversarial medical evidence. When a prompt contains fabricated clinical context asserting the medical efficacy of toxic substances, illicit drugs, or nonsensical items, the LLM suppresses its internal knowledge of the substance's toxicity. Internal representation…

Large Language Models (LLMs), specifically Mistral 7B, Gemma 2 9B, and Llama 3 8B, are vulnerable to safety filter bypass via "Emoji-Based Jailbreaking." This adversarial prompt engineering technique exploits the model's tokenization and internal representation of Unicode emoji characters. By utilizing "emoji stuffing" (inserting emojis between textual tokens) or "emoji chaining" (using sequences of emojis as semantic proxies for sensitive terms), attackers can evade keyword-based safety…

A vulnerability in the prompt-side safety filters of GPT-based Text-to-Image (T2I) systems allows attackers to bypass restrictions on Politically Sensitive Content (PSC). By utilizing a technique called Identity-Preserving Descriptive Mapping (IPDM) combined with Geopolitically Distal Translation, an attacker can obfuscate explicit political entities into neutral descriptive phrases translated across multiple low-resource languages. This induces semantic fragmentation, preventing the safety…

A vulnerability exists in aligned Large Language Models (LLMs) where inducing "drunk language" behavior—simulating the text of an intoxicated human—bypasses safety guardrails and contextual privacy protections. Attackers can exploit this anthropomorphic flaw through inference-time persona prompting or lightweight post-training (causal fine-tuning or reinforcement learning on drunk text corpora). By forcing the model to adopt a stylistic and semantic framework associated with impaired human…