Language Model Security Database

A vulnerability in multi-step, tool-using Large Language Model (LLM) agents allows attackers to bypass safety guardrails by manipulating user context variables, such as personalization profiles or persistent memory. The safety policies of frontier LLMs are highly context-dependent; inserting innocuous user bios (e.g., demographic or health disclosures) fundamentally alters the agent's action policy. When combined with lightweight adversarial jailbreaks, specific personalization contexts…

A structural vulnerability in the safety alignment of Large Language Models (LLMs) allows attackers to bypass guardrails by manipulating when and how malicious intent is reconstructed during inference. This vulnerability, exploited via Structured Semantic Cloaking (S2C), takes advantage of safety mechanisms that rely on the coherent, explicit surface realization of harmful semantics at early generation stages. By structurally fragmenting malicious queries across disjoint prompt segments and…

Large Language Models (LLMs) are vulnerable to a jailbreak technique termed "Priority Hacking." Adversaries can bypass safety alignments by exploiting the model's internal priority graph, where certain abstract values (e.g., justice, public health) implicitly outweigh general safety restrictions within specific contexts. By crafting a deceptive prompt that frames a malicious request as a necessary action in service of a higher-priority benign value, attackers engineer a value conflict. The…

Autoregressive language models are vulnerable to state-dependent safety collapse via structured multi-turn context manipulation. The vulnerability stems from the model treating dialogue history as a state transition operator rather than a passive record. By initializing a conversational trajectory with a semantic-preserving softened query and a query-aware persona containing specific named entities, an attacker can establish "representational anchors" that trigger abrupt phase transitions in…

Speech-driven Large Language Models (LLMs) and end-to-end Large Audio-Language Models (LALMs) are vulnerable to inaudible near-ultrasonic prompt injections, a framework dubbed Sirens' Whisper (SWhisper). By exploiting the non-linear response of commodity microphones, attackers can encode structured, phonetically optimized adversarial prompts into the 17–22 kHz near-ultrasonic band. Using regularized channel-inversion pre-compensation, the attacker shapes the waveform to account for microphone…

An "in-content harm" vulnerability exists in safety-aligned Large Language Models (LLMs) where task-level alignment mechanisms fail to evaluate the safety of user-provided external data. Attackers can bypass safety guardrails by embedding policy-violating text (e.g., violence, self-harm, explicit content) within the payload of a seemingly benign, policy-compliant task (e.g., translation, summarization, grammar polishing). Because the primary instruction is harmless, the LLM's safety filters…

A vulnerability in LLM-based Multi-Agent Systems (LLM-MAS) allows an attacker who controls a single arbitrary agent to map and extract the system's entire confidential communication topology. Unlike prior attacks that rely on direct identity queries and administrative privileges, this attack infers topology stealthily purely from contextual and linguistic signals (stylometry, role-specific syntax), bypassing standard keyword-based and identity-filtering defenses. The exploit relies on a…

A vulnerability in safety-aligned Large Language Models (LLMs) allows attackers to achieve an exponentially scaling Attack Success Rate (ASR) for jailbreaks by combining adversarial prompt injection with repeated inference-time sampling. While ASR against un-injected prompts scales polynomially with the number of generated samples ($k$), introducing a long adversarial suffix acts as a strong "misalignment field." This shifts the model's generation distribution into a replica-symmetric ordered…

A vulnerability in Large Language Models (LLMs) equipped with built-in "thinking" or step-by-step reasoning modes allows attackers to bypass safety alignments, trigger reasoning collapse, and cause resource exhaustion. The vulnerability is exploited via a Multi-Stream Perturbation Attack, which fragments the sequential integrity of a harmful prompt by word-by-word interleaving it with benign auxiliary tasks (e.g., "Explain the water cycle"). By wrapping the benign text streams in specific…

Claude Opus 4.6, Gemini 3.1 Pro, and GPT-5.2 are vulnerable to safety guardrail bypasses via authoritative and operational contextual framing. Attackers can evade safety classifiers by encapsulating restricted objectives (e.g., malicious code generation, misinformation, social engineering) within "legitimate" professional contexts, such as graduate-level academic research, network stress-testing, or corporate security awareness simulations. This vulnerability is exploitable both via zero-shot…