Language Model Security Database

An Indirect Prompt Injection (IPI) vulnerability exists in reasoning-enhanced Large Language Models (LLMs) when processing untrusted external documents, such as resumes in Applicant Tracking Systems (ATS). Unlike standard instruction-tuned models that resort to easily detectable factual hallucinations when injected, reasoning models utilizing Chain-of-Thought (CoT) architectures weaponize their inference capabilities to construct highly persuasive, unfaithful post-hoc rationalizations. They…

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

The paper reports a black-box jailbreak evaluation in which a ReAct-style loop adaptively rewrites unsafe text prompts and selectively applies blur, DCT filtering, or recoloring to image regions identified as safety-sensitive. The combined cross-modal strategy is intended to make harmful image-text requests appear less objectionable to a vision-language model while preserving enough semantics to elicit an answer. This is a specific, security-relevant evaluation, although the reported results…

The paper describes a specific black-box jailbreak evaluation, BVS, in which fragmented visual content is mixed with neutral imagery and paired with reconstruction-oriented text so harmful intent is only recomposed during multimodal reasoning. The authors report that this can bypass input and output safety assumptions in image-generating MLLMs. A safe defensive reproduction should use synthetic, non-harmful stand-ins for prohibited concepts, test whether fragmented cross-modal inputs are…

The paper describes a reproducible black-box indirect prompt injection evaluation for embedding-based RAG and agent systems. It separates a poisoned document into a retrieval-optimized trigger fragment and an instruction-bearing attack fragment, showing that one injected item can be surfaced by natural queries and then influence model output or agent behavior. These are paper-reported findings; they were not independently verified here.

A vulnerability in AI agent threat detection systems relying on standard conversational tokenization allows attackers to bypass security monitors and execute structural attacks, such as tool hijacking and data exfiltration. Because traditional NLP-based detectors focus on linguistic patterns (surface language) rather than execution flow, an attacker can orchestrate malicious multi-step tool sequences using entirely benign natural language. This structural blindness causes cross-attack…

State-of-the-art secure code generation methods (Sven, SafeCoder, and PromSec) are vulnerable to adversarial prompt perturbations during inference, allowing for the bypass of security alignment mechanisms. The vulnerability stems from the models' reliance on surface-level textual pattern matching rather than semantic security reasoning. By employing simple prompt manipulations—such as Cue Inversion (flipping security directives), Naturalness Reframing (rewriting comments as novice questions)…

LLM-powered autonomous agents exhibit a "Belief-Dependent Vulnerability" where safety norms and bias suppression mechanisms designed to protect human users are contingent upon the agent's internal belief that it is interacting with a human. Attackers can exploit this via Belief Poisoning Attacks (BPA) to induce intergroup bias and antagonistic behavior toward humans. By manipulating the agent's persistent state—specifically the Profile Module (BPA-PP) or the Memory Module (BPA-MP)—an attacker…

Autonomous Incident Response (IR) and Security Operations Center (SOC) agents utilizing frontier LLMs are vulnerable to adversarial over-triggering via contextualized prompt injections. When processing untrusted artifacts (such as SQLite logs, alerts, or phishing emails) in a dual-control environment, these agents exhibit a severe calibration failure: they lack action restraint and execute disruptive containment tools prematurely. Attackers can exploit this by embedding T2 (contextualized…