Language Model Security Database

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

A semantic slot filling vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety filters and elicit prohibited content via a single query. The attack, known as StructAttack, decomposes a harmful instruction into a central topic and locally benign-appearing semantic slot types (e.g., "Raw Materials", "Making Process"). These individual slots are embedded into structured visual prompts (such as mind maps, tables, or sunburst diagrams) alongside harmless distractor…

Multimodal Large Language Models (LLMs) are vulnerable to alignment bypass via Inter-Turn Modality Switching (ITMS). By systematically rotating the input modality (e.g., alternating between text, audio, and image) across successive turns in a multi-turn adversarial conversation, an attacker can destabilize the model's safety defenses. The cross-modal transition mechanism exploits alignment gaps between differing input processing pipelines, accelerating the erosion of safety guardrails and…

An imperceptible visual prompt injection vulnerability in Multimodal Large Language Models (MLLMs) allows attackers to execute precise command-hijacking via a Covert Triggered dual-Target Attack (CoTTA). By embedding a bounded, learnable textual overlay ($L_\infty$ norm bound $\varepsilon \le 16$) and adversarial noise into an input image, the attack forces the source image's internal feature representation to align with both the textual and visual embeddings of an attacker-specified…

Multi-Modal Large Language Models (MLLMs) are vulnerable to a highly transferable, black-box adversarial image attack known as the Multi-Paradigm Collaborative Attack (MPCAttack). Attackers can craft imperceptible visual perturbations by jointly aggregating and optimizing semantic feature representations extracted from surrogate models across three distinct learning paradigms: cross-modal alignment (e.g., CLIP), multi-modal understanding (e.g., InternVL3), and visual self-supervised learning…

A vulnerability in Multimodal Large Language Models (MLLMs) allows attackers to bypass safety alignments via Multi-Image Dispersion and Semantic Reconstruction (MIDAS). Attackers decompose malicious instructions into risk-bearing semantic subunits, fragment them, and distribute them across multiple benign-looking Game-style Visual Reasoning (GVR) puzzles (e.g., Letter Equations, Rank-and-Read, Odd-One-Out). A sanitized, persona-driven textual prompt with sequential placeholders is then used to…

Large Vision-Language Models (LVLMs) are vulnerable to multi-turn, multi-modal jailbreak attacks where malicious intent is incrementally introduced and obfuscated through intertwined text and image prompts. Attackers can systematically bypass safety alignments by starting with self-optimized, benign-seeming conversation starters (horizontal expansion) and progressively stacking text and image attack augmentations across multiple conversation turns (vertical expansion). Furthermore, models fail…

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

LLaVA-v1.5-7B, when deployed as a vision-language autonomous agent, is highly vulnerable to adversarial image perturbations. An attacker can inject imperceptibly modified images into a web environment (such as an e-commerce storefront). When the VLM agent captures a screenshot containing the perturbed image, the visual noise forces the model to misclassify the scene and output incorrect, structured JSON actions. This allows an attacker to hijack the agent's task execution, bypassing the user's…