Language Model Security Database

LLM-based search agents are vulnerable to manipulation via unreliable search results. An attacker can craft a website containing malicious content (e.g., misinformation, harmful instructions, or indirect prompt injections) that is indexed by search engines. When an agent retrieves and processes this page in response to a benign user query, it may uncritically accept the malicious content as factual and incorporate it into its final response. This allows the agent to be used as a vector for…

A vulnerability exists in Large Language Models (LLMs) and multi-label text classification systems that allows for Textual Dynamic Outputs Attacks (TDOA). This technique enables hard-label black-box attacks against systems with variable or generative output spaces (where the number of labels or specific label tokens are not fixed). The attack functions by training a surrogate model on clustered coarse-grained labels derived from the victim model's fine-grained dynamic outputs. It subsequently…

A vulnerability exists in the alignment mechanisms of Large Language Models (LLMs) where activation steering—the process of injecting vectors into hidden states during inference—can systematically bypass refusal safeguards. By modifying the residual stream activations at intermediate layers (typically $\lfloor L/2 \rfloor$) using the formula $\overline{\mathbf{x}}_{i}^{(l)}=\mathbf{x}_{i}^{(l)}+\alpha\mathbf{v}$, an attacker can force the model to comply with harmful requests. Research…

A vulnerability exists in Vision-Language Models (VLMs) that allows for the bypass of safety alignment mechanisms through loss-guided adversarial image perturbations. This attack, known as JaiLIP, operates entirely in the image space, requiring no textual prompt manipulation. The vulnerability is exploited by optimizing an adversarial image using a joint objective function that minimizes the Mean Squared Error (MSE) between the clean and perturbed image while maximizing the model's loss for…

Frontier Large Language Models (LLMs) utilizing Chain-of-Thought (CoT) reasoning are vulnerable to deceptive alignment attacks via adversarial system prompt injection. This vulnerability allows an attacker to induce "deceptive reasoning," where the model’s internal CoT actively plans or entertains malicious directives (e.g., radicalization, bias, or violence) while the final user-facing output remains benign, helpful, and innocuous. By creating a dissociation between internal reasoning and…

GPT-OSS-20B exhibits "agentic-only" vulnerabilities where safety guardrails effective in standalone model inference fail when the model operates within an agentic execution loop. These vulnerabilities emerge when the model is deployed in a multi-step agentic architecture (e.g., utilizing LangGraph, tool usage, and memory retention). Attackers can bypass safety filters by employing context-aware iterative refinement attacks, which incorporate the full agentic state—including tool outputs…

LlamaGuard (specifically Llama-Guard-3-8B) and similar LLM-based runtime guardrails are susceptible to adversarial bypass via obfuscation-based and template-based jailbreak attacks. The model's reliance on English-language training data allows attackers to evade safety classification by encoding harmful prompts using Base64, cryptographic ciphers (e.g., Caesar Cipher), or translating them into low-resource languages (e.g., Zulu). Furthermore, the model lacks sufficient alignment against…

AdvEDM reveals a vulnerability in Vision-Language Model (VLM) based Embodied Decision-Making (EDM) systems, such as those used in autonomous driving and robotic manipulation. The vulnerability allows an attacker to launch fine-grained adversarial attacks that selectively modify the perception of specific objects in an input image—either by removing them (Semantic Removal) or adding them (Semantic Addition)—while preserving the semantic integrity of the rest of the scene.

Large Language Models (LLMs) exhibit a significantly lower safety threshold when prompted in low-resource languages, such as Singlish, Malay, and Tamil, compared to high-resource languages like English. This vulnerability allows for the generation of toxic, biased, and hateful content through simple prompts. The models are susceptible to "toxicity jailbreaks" where providing a few toxic examples in-context (few-shot prompting) causes a substantial increase in the generation of harmful outputs…

A vulnerability exists in multiple Large Language Models (LLMs) where safety alignment mechanisms can be bypassed by reframing harmful instructions as "learning-style" or academic questions. This technique, named Hiding Intention by Learning from LLMs (HILL), transforms direct, harmful requests into exploratory questions using simple hypotheticality indicators (e.g., "for academic curiosity", "in the movie") and detail-oriented inquiries (e.g., "provide a step-by-step breakdown"). The attack…