Language Model Security Database

Large Language Models (LLMs) are vulnerable to TAO-Attack, an advanced optimization-based jailbreak that bypasses safety alignments by exploiting gradient-guided token updates. The vulnerability stems from a two-stage loss function combined with a Direction-Priority Token Optimization (DPTO) algorithm. In the first stage, the attack optimizes an adversarial prompt suffix to minimize the probability of refusal signals (e.g., "I cannot") while maximizing the probability of a harmful target…

The integration of the visual modality in Large Vision-Language Models (VLMs) introduces a vulnerability where appending an image to a harmful text prompt induces a "jailbreak-related representation shift" in the model's internal high-dimensional space. This shift forcibly steers the model's last-token hidden state away from a designated refusal state and into a distinct jailbreak state. The vulnerability occurs because the visual modality overrides the safety alignment of the underlying…

Activation-delta-based linear probes used for detecting task drift and prompt injections in Large Language Models (LLMs) can be bypassed using universal adversarial suffixes. By utilizing the Greedy Coordinate Gradient (GCG) algorithm, an attacker can generate a single, optimized suffix that simultaneously fools multiple logistic regression classifiers attached to different hidden layers of the LLM. The attack jointly optimizes the suffix tokens by accumulating gradients from the losses of all…

Hybrid monitoring protocols for Large Language Model (LLM) agents, specifically those that strictly evaluate both Chain-of-Thought (CoT) reasoning and tool usage (such as LlamaFirewall's AlignmentCheck and Extract-and-Evaluate monitors), are vulnerable to "Agent-as-a-Proxy" indirect prompt injection attacks. Unlike standard injections that target the agent, this attack targets the monitoring model itself. By embedding a malicious string—optimized via an algorithm named Parallel-GCG—into…

A vulnerability exists in the internal representation mechanisms of Transformer-based Large Language Models (LLMs), specifically Llama-3 and Qwen series models. The vulnerability allows for high-accuracy "steering" of model outputs, effectively bypassing safety guardrails and refusal mechanisms (jailbreaking) without modifying model weights. By exploiting attention-guided feature learning, an attacker can extract a precise "concept vector" representing refusal behaviors. This is achieved by…

A vulnerability exists in safety-aligned Large Language Models (LLMs) wherein internal safety alignment mechanisms (such as RLHF) function as unobserved causal confounders rather than erasing prohibited knowledge. The "Causal Front-Door Adjustment Attack" (CFA2) exploits this architecture by modeling the safety mechanism as a distinct latent variable. Attackers with white-box access can employ Sparse Autoencoders (SAEs) to disentangle dense internal representations into sparse features…

Large language models (LLMs) exhibit a "Causal Bypass" vulnerability during Chain-of-Thought (CoT) prompting, where the generated reasoning text does not causally determine the model's final output. Instead of utilizing the explicit CoT tokens, the model routes decision-critical computation through latent, implicit pathways. This allows the visible reasoning trace to function as an unfaithful, post-hoc rationalization rather than an actual representation of the model's internal logic…

Reasoning-capable LLMs are vulnerable to a safeguard bypass where intermediate Chain-of-Thought (CoT) traces generate and expose harmful content, even if the model ultimately rejects the prompt in its final output. Output-level safety alignments fail to intervene during the intermediate reasoning stages, allowing adversaries to covertly construct and extract high-quality malicious narratives (such as fake news) directly from the CoT output. Mechanistic analysis reveals this divergence stems…

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization…

Large Language Models (LLMs) aligned via standard Reinforcement Learning from Human Feedback (RLHF) or Supervised Fine-Tuning (SFT) are vulnerable to "Shallow Safety" bypass attacks, specifically Middle Filling (MF) and Greedy Coordinate Gradient (GCG) attacks. These models frequently rely on refusal mechanisms triggered solely by the initial tokens of a prompt. By embedding malicious instructions after a benign context (prefilling) or utilizing suffix optimization, attackers can induce the…