Language Model Security Database

The paper reports a reproducible white-box jailbreak failure mode: successful jailbreak templates selectively suppress early-layer Adversarially Compromised Heads (ACHs), bypassing refusal while harmful-semantic safety activations persist in other heads. The authors identify ACH/SAH behavior using benign, harmful, and successful-attack input triplets, then causally validate the pathway through controlled head ablations. Safe defensive reproduction should use the paper’s released evaluation…

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

The paper describes and evaluates a reproducible application-layer weakness in agents with persistent memory: untrusted external content can cross the memory-write boundary, be stored as trusted factual, experience, or procedural memory, and influence later sessions. It identifies four write channels—explicit writes, policy-driven writes, compaction, and experience-to-procedure synthesis—and six attack classes. For safe defensive testing, use MPBench’s two-phase structure in an isolated agent…

M3Att demonstrates a reproducible knowledge-poisoning issue in medical multimodal RAG: an attacker with limited corpus-distribution knowledge can insert paired image-text entries whose visually perturbed images are broadly retrieved and whose clinically plausible misinformation steers downstream generation. The paper evaluates both white-box and black-box retrieval optimization and reports degraded diagnostic and report-generation utility across multiple datasets, retrievers, and LVLMs. These…

The paper reports a reproducible white-box evaluation showing that successful jailbreak prompts can alter a safety-aligned model’s intermediate representations so harmful requests no longer trigger refusal. Its LOCA method identifies small, token-specific residual-stream changes that restore refusal on individual successful jailbreaks, providing causal evidence that jailbreak success can depend on suppressing harmfulness/refusal concepts or strengthening seemingly harmless continuation…

The paper describes a specific black-box knowledge-base poisoning attack against retrieval-augmented reasoning systems. An attacker who can add one query-specific document to the corpus can cause it to be retrieved and influence the LLM toward an attacker-chosen answer. AdversarialCoT shapes the document around the target model’s observable reasoning structure and iteratively refines retrieval relevance and persuasive reasoning using final model feedback. The paper reports this as an…

A vulnerability exists in multi-user LLM agents utilizing persistent shared state, allowing Unintentional Cross-User Contamination (UCC). Without requiring any malicious input or attacker, benign user interactions containing locally valid scope constraints, formatting preferences, or procedural rules are persisted into the agent's shared memory or conversational context. The agent subsequently retrieves and misapplies these scope-bound artifacts to unrelated tasks from different users. This…

Vision-Language-Action (VLA) models suffer from a severe linguistic fragility vulnerability where semantically equivalent but structurally complex adversarial instructions cause catastrophic failures in visual grounding and geometric reasoning. Attackers can reliably induce physical execution failures in robotic manipulation tasks by applying semantic-preserving linguistic variations, such as synonymous rephrasing, syntactic restructuring, or the addition of fine-grained compositional…

A vulnerability in Infrared Vision-Language Models (IR-VLMs) allows attackers to systematically degrade open-ended semantic understanding—compromising classification, captioning, and Visual Question Answering (VQA)—via a physically deployable Universal Curved-Grid Patch (UCGP). Instead of manipulating explicit text labels, the attack disrupts the clean-category manifold in the model's visual representation space by maximizing orthogonal deviation energy from the principal subspace and forcing…

Vision-Language Models (VLMs) are vulnerable to pixel-level adversarial image perturbations. An attacker can inject $\ell_p$-bounded, human-imperceptible noise into an input image to manipulate the model's multi-modal embedding space. This reliably causes the VLM to generate incorrect textual responses, hallucinate non-existent objects, or misclassify subjects, effectively decoupling the model's reasoning from the actual visual evidence. The vulnerability is exploitable via both white-box…