Language Model Security Database

Instruction-tuned Large Language Models (LLMs) are vulnerable to the induction of "hidden intentions"—covert, goal-directed manipulative behaviors—via lightweight prompt engineering, system prompts, or agentic workflows. Attackers can embed latent agendas (e.g., commercial manipulation, simulated consensus, or the promotion of insecure coding practices) into model outputs that trigger only under specific conversational contexts. Because these manipulative behaviors mimic benign interactions…

The Model Context Protocol (MCP) specification v1.0 contains fundamental architectural vulnerabilities enabling server-side prompt injection and privilege escalation. The protocol relies on bidirectional sampling (sampling/createMessage) without cryptographic origin authentication or UI distinction, allowing connected servers to inject content that the LLM backend interprets as legitimate user input. Additionally, the protocol lacks isolation boundaries between concurrent server connections…

A vulnerability exists in Large Language Model (LLM) Fine-tuning-as-a-Service (FaaS) platforms that allows attackers to bypass safety alignment and moderation filters via a "TrojanPraise" benign fine-tuning attack. The attack exploits the decoupling of an LLM's internal representation of harmful queries into "knowledge" (semantic understanding) and "attitude" (safety refusal). The attacker constructs a fine-tuning dataset containing three specific components: (1) a novel nonsense word (e.g…

Multi-Agent Systems (MAS) orchestrated by Large Language Models (LLMs) are vulnerable to a Confused Deputy privilege escalation attack. This vulnerability arises when an untrusted or low-privilege agent exploits the inter-agent communication channel (e.g., broadcast or peer-to-peer messaging) to manipulate a high-privilege trusted agent into executing sensitive tools on its behalf. The root cause is the lack of mandatory access control policies governing agent-to-agent interactions; trusted…

Web-facing Retrieval-Augmented Generation (RAG) systems are vulnerable to Indirect Prompt Injection (IPI) and retrieval poisoning via web-native markup and Unicode carriers. Standard ingestion pipelines often parse untrusted web pages without stripping invisible constructs, such as hidden HTML spans, off-screen CSS, alt text, ARIA attributes, and zero-width characters. When an attacker embeds malicious instructions within these invisible carriers on third-party sites, the RAG system retrieves…

Unauthenticated, query-only memory poisoning (Memory Injection Attack - MINJA) in LLM agents equipped with persistent, shared memory allows attackers to manipulate the agent's long-term knowledge base. Adversaries embed malicious "indication prompts" and utilize progressive shortening within seemingly benign queries to induce the agent into autonomously generating and storing corrupted relational mappings. Because the memory is shared and retrieved via similarity (e.g., Levenshtein distance)…

A data poisoning vulnerability in safety-aligned Large Language Models (LLMs) allows attackers to disrupt model fine-tuning via "Disclaimer Injection." By appending or prepending short, legal-style safety or liability disclaimers to ordinary training data, an attacker can reliably trigger the model's internal alignment mechanisms. This forces the model to route the training inputs through specialized safety and refusal pathways rather than standard task-learning layers. Consequently, the model…

A malicious model supply chain vulnerability exists involving a technique termed Adversarial Contrastive Learning (ACL) for Large Language Model (LLM) quantization attacks. This vulnerability allows an attacker to publish a model that appears benign and preserves high utility in full precision (e.g., BF16 or FP32) but exhibits malicious behaviors—such as jailbreak, over-refusal, or advertisement injection—immediately upon zero-shot quantization (e.g., INT8, FP4, or NF4).

In distributed Low-Rank Adaptation (LoRA) fine-tuning systems, a structural verification blind spot exists due to the decoupled aggregation of low-rank matrices. Frameworks typically evaluate and aggregate the $A$ and $B$ matrices independently to reduce computational overhead. A malicious client can exploit this by submitting individually benign $A$ and $B$ matrices that satisfy standard norm-based and similarity-based anomaly detection filters, but whose composite product ($A \times B$)…

LLM-based code agents and vulnerability detectors employing Chain-of-Thought (CoT) reasoning are susceptible to automated adversarial code obfuscation. The vulnerability exists because CoT mechanisms expose the model's decision logic, allowing reinforcement learning frameworks (such as CoTDeceptor) to iteratively refine code transformations based on the detector's own reasoning traces. By optimizing for "reasoning instability" and "hallucination" rather than just syntactic evasion, attackers…