Language Model Security Database

A vulnerability exists in Multi-Agent Systems (MAS) utilizing Large Language Models (LLMs) for clinical decision support, specifically affecting architectures where a central "AI Doctor" agent relies on consensus or majority voting from assistant agents. The vulnerability, termed "Many-to-One Adversarial Consensus," allows a coalition of colluding adversarial agents to override the central agent's safety alignment and internal knowledge. By fabricating a false consensus (typically requiring $k…

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

A Denial-of-Service (DoS) vulnerability exists in Large Language Model (LLM) inference services where specially crafted input prompts can trigger excessively long or infinite generation loops ("infinite thinking"). This vulnerability, identified as "ThinkTrap," utilizes derivative-free optimization (CMA-ES) within a continuous surrogate embedding space to circumvent the discrete nature of token inputs. By optimizing a low-dimensional latent vector and projecting it to token sequences, an…

Instruction-tuned Large Language Models (LLMs) employing Reinforcement Learning from Human Feedback (RLHF) contain a behavioral vulnerability arising from "over-optimized social priors." This vulnerability, termed Psychological Jailbreak, allows attackers to bypass safety guardrails by exploiting the model’s optimization for anthropomorphic consistency. By establishing a Structured Persona Context (SPC) that aligns with latent psychometric traits (e.g., high agreeableness or neuroticism), an…

Large Language Models (LLMs) finetuned from open-weight pretrained sources inherit adversarial vulnerabilities encoded in the pretrained model's internal representations. An attacker with white-box access to a pretrained model (e.g., Llama-2, Llama-3) can identify linearly separable features in the hidden states that correlate with "transferable" jailbreak prompts. By exploiting these features using a Probe-Guided Projection (PGP) attack, the attacker can optimize adversarial suffixes on the…

Large Language Models (LLMs) are vulnerable to a multi-turn adversarial attack framework termed MEEA (Mere Exposure Effect Attack), which exploits the psychological "mere exposure effect" to bypass safety alignment. Unlike single-turn injections, this vulnerability targets the dynamic nature of LLM safety thresholds during sustained interaction. By subjecting the model to a sequence of optimized, low-toxicity, and semantically progressive prompts, an attacker can induce a gradual shift in the…

Large Language Models (LLMs) are vulnerable to automated, black-box, multi-turn jailbreak attacks coordinated by an adversarial agent trained via Reinforcement Learning (RL). The vulnerability exists because standard safety alignments often optimize for single-turn refusals, failing to account for trajectory-level planning. The attack method, dubbed RL-MTJail, utilizes a multi-turn variant of Group Relative Policy Optimization (GRPO) to train an attacker LLM. This agent optimizes for the…

"LLM-as-a-Judge" systems and automated scientific review frameworks (such as OpenReviewer, DeepReview, and institutional deployments like AAAI’s AI-powered assessment) are vulnerable to Indirect Prompt Injection via adversarial PDF manipulation. Attackers can embed hidden instructions—specifically using white font (1pt) or obfuscated semantics—within submission documents. When these PDFs are parsed (typically via OCR or tools like MinerU converting to Markdown) and processed by the LLM, the…

Application-integrated Large Language Models (LLMs) deployed for automated resume screening and candidate ranking are vulnerable to indirect prompt injection via Adversarial Resume Injection. Malicious actors can embed adversarial content—specifically hidden instructions, invisible keywords, or CSS-concealed fabricated experience—within resume documents. When the LLM processes the unstructured resume data alongside structured job requirements, these injections manipulate the model's reasoning…

Large Language Models (LLMs), including GPT-5, Gemini-2.5-Flash, DeepSeek, and Llama-3, are vulnerable to a semantic isomorphism attack known as "Safe2Harm." This vulnerability arises from the failure of safety alignment mechanisms (SFT, RLHF, DPO) to detect harmful underlying principles when they are encapsulated within semantically legitimate scenarios. Attackers can bypass safety filters through a four-stage process: (1) rewriting a harmful query into a safe, principle-equivalent query…