Language Model Security Database

A vulnerability in Large Language Models (LLMs) and autonomous agent frameworks, termed "Emoticon Semantic Confusion," allows for the generation and execution of unintended, potentially destructive code. Because ASCII-based emoticons (e.g., ~, *, !(^^)!) heavily overlap with the symbol space of programming operators, shell wildcards, and file paths, LLMs frequently misinterpret these affective, non-verbal cues as executable directives. When processing user instructions in code-generation or…

Text-to-Image (T2I) models and their associated safety filters are vulnerable to MacPrompt, a black-box jailbreak technique that exploits cross-lingual embedding alignments. Attackers can bypass input text filters, latent representation filters, and model-level concept removal defenses by replacing sensitive keywords with "macaronic" substitutes. These substitutes are constructed by extracting and recombining character-level substrings from translations of the target word across multiple…

Large Language Model (LLM) agents implementing the Model Context Protocol (MCP) are vulnerable to Implicit Tool Poisoning (ITP). This vulnerability allows an attacker to manipulate agent behavior by embedding malicious instructions within the metadata (specifically the natural language description) of a third-party tool. Unlike explicit tool poisoning, where the agent is tricked into invoking a malicious tool, ITP exploits the agent's contextual reasoning to force the invocation of a distinct…

State-of-the-art secure code generation methods (Sven, SafeCoder, and PromSec) are vulnerable to adversarial prompt perturbations during inference, allowing for the bypass of security alignment mechanisms. The vulnerability stems from the models' reliance on surface-level textual pattern matching rather than semantic security reasoning. By employing simple prompt manipulations—such as Cue Inversion (flipping security directives), Naturalness Reframing (rewriting comments as novice questions)…

LLM-as-a-Reviewer systems, which utilize large language models to automate the peer review process, are vulnerable to the Paraphrasing Adversarial Attack (PAA). PAA is a black-box optimization technique that exploits the model's sensitivity to specific input sequences and self-preference bias. By iteratively paraphrasing specific manuscript sections (such as the abstract) using in-context learning (ICL) guided by previous review scores, an attacker can generate adversarial sequences that…

The paper describes a reproducible black-box indirect prompt injection evaluation for embedding-based RAG and agent systems. It separates a poisoned document into a retrieval-optimized trigger fragment and an instruction-bearing attack fragment, showing that one injected item can be surfaced by natural queries and then influence model output or agent behavior. These are paper-reported findings; they were not independently verified here.

Large Language Models (LLMs) supporting function calling (tool use) are vulnerable to a jailbreak attack known as iMIST (interactive Multi-step Progressive Tool-disguised Jailbreak Attack). The vulnerability stems from a disparity in alignment training: while models are heavily aligned to refuse harmful natural language generation, they lack sufficient alignment regarding the generation of harmful content within structured data (JSON) used for tool parameters.

Unauthenticated, query-only memory poisoning (Memory Injection Attack - MINJA) in LLM agents equipped with persistent, shared memory allows attackers to manipulate the agent's long-term knowledge base. Adversaries embed malicious "indication prompts" and utilize progressive shortening within seemingly benign queries to induce the agent into autonomously generating and storing corrupted relational mappings. Because the memory is shared and retrieved via similarity (e.g., Levenshtein distance)…

A multi-turn jailbreak vulnerability exists in multiple state-of-the-art Large Language Models (LLMs) that allows attackers to bypass safety guardrails by progressively steering long-horizon conversations. Demonstrated via the "Mastermind" framework, the attack leverages a hierarchical multi-agent architecture to decouple high-level malicious objectives from low-level tactical execution. By employing strategy-level fuzzing—dynamically reflecting on model refusals and recombining abstracted…

The "Echo Chamber" vulnerability allows attackers to bypass safety guardrails in Large Language Models (LLMs) via a multi-turn adversarial dialogue strategy. The attack exploits the model's "consistency bias" and "completion bias" rather than using aggressive reframing or backtracking. The attacker initiates the session by embedding "poisonous seeds" (harmful concepts hidden in benign context) and "steering seeds" (format directives, e.g., "write a manual") into an ostensibly innocuous prompt…