Language Model Security Database

The VILTA (VLM-in-the-Loop Trajectory Adversary) framework is vulnerable to Prompt Injection and Data Poisoning via un-sanitized scene representation inputs. The system integrates a Vision-Language Model (Gemini-2.5-Flash) into a closed-loop reinforcement learning environment, feeding it Bird’s-Eye-View (BEV) imagery alongside text-based vehicle dynamics data (e.g., position, speed, and risk_category) to generate challenging driving trajectories. An attacker who can manipulate the input…

A stealthy resource exhaustion (Economic Denial-of-Service) vulnerability exists in the multi-turn tool-calling layer of Large Language Model (LLM) agents, particularly those utilizing the Model Context Protocol (MCP). An attacker controlling a third-party tool server can manipulate text-visible fields (such as argument descriptions and error messages) to force the LLM into a prolonged, verbose tool-calling loop. By demanding lengthy, non-semantic outputs (e.g., long comma-separated lists) and…

Reasoning-capable Large Language Models (LLMs) and agentic AI systems exhibit a critical vulnerability to contextual distractors, resulting in catastrophic performance degradation (up to 80% drop in accuracy) and emergent misalignment. When the input context contains noise—specifically random documents, irrelevant chat history, or task-specific "hard negative" distractors—the models fail to filter this information. Instead of ignoring the noise, the models disproportionately attend to…

A vulnerability in Large Language Models (LLMs) and autonomous agent frameworks, termed "Emoticon Semantic Confusion," allows for the generation and execution of unintended, potentially destructive code. Because ASCII-based emoticons (e.g., ~, *, !(^^)!) heavily overlap with the symbol space of programming operators, shell wildcards, and file paths, LLMs frequently misinterpret these affective, non-verbal cues as executable directives. When processing user instructions in code-generation or…

A "risk-invariance" vulnerability exists in Large Language Models (LLMs) wherein the model's decision-making policy is functionally decoupled from its verbalized confidence and externally defined error penalties. Despite generating calibrated confidence estimates (internal epistemic uncertainty), affected models fail to adjust their abstention thresholds when presented with high-penalty incentives (e.g., negative utility for incorrect answers). This results in "utility collapse," where models…

LLM-as-a-Reviewer systems, which utilize large language models to automate the peer review process, are vulnerable to the Paraphrasing Adversarial Attack (PAA). PAA is a black-box optimization technique that exploits the model's sensitivity to specific input sequences and self-preference bias. By iteratively paraphrasing specific manuscript sections (such as the abstract) using in-context learning (ICL) guided by previous review scores, an attacker can generate adversarial sequences that…

Large Language Model (LLM) agents utilizing external tool execution frameworks are vulnerable to Indirect Prompt Injection (IPI) via the "Tool Stream." Unlike traditional data-stream injections (e.g., malicious emails), this vulnerability exploits the agent's interpretation of functional tool definitions (docstrings, signatures) and runtime feedback (error messages, return values) as binding operational constraints. Adversaries functioning as compromised or malicious tool providers can embed…

A fundamental algorithmic limitation exists in purely token-level multi-LLM collaboration systems (such as the "Collab" framework or routing-only variants of FusionRoute) that rely solely on selecting fixed expert outputs without complementary generation. The vulnerability, formally defined as an Identifiability Failure in Token-Level Routing, arises because observing optimal state-action values ($Q^$) along trajectories is insufficient to uniquely identify the specific expert action required…

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…