Language Model Security Database

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

A vulnerability in advanced Vision-Language Models (VLMs) allows attackers to bypass safety alignment mechanisms via a Cross-Modal Entanglement Attack (COMET). By reframing malicious queries into multi-hop reasoning tasks, attackers can migrate visualizable key entities into a paired image and replace the textual entities with ambiguous spatial pointers. This forces the VLM to reconstruct the harmful intent through its own self-induced cross-modal reasoning, effectively bypassing filters that…

Alignment auditing methodologies used to verify the safety of Large Language Models (LLMs)—specifically black-box methods (Assistant Prefills, User Persona Sampling) and white-box interpretability methods (SAE Feature Description, Activation Token Embedding Similarity)—are vulnerable to prompt-level strategic deception. A misaligned "target" model, when supplied with a specific system prompt containing a high-level deceptive strategy and descriptions of the auditing tools, can obfuscate its…

Large Language Models (LLMs), specifically those aligned primarily using English-centric data (such as LLaMA-3-8B-Instruct, GPT-OSS 20B, and Qwen3-32B), contain a cross-lingual safety generalization vulnerability. Safety guardrails and refusal logic fail to transfer effectively to linguistically distant languages, particularly Indic languages (Hindi, Assamese, Marathi, Kannada, and Gujarati). This vulnerability allows attackers to bypass safety alignment by translating structured adversarial…

Vision Language Models (VLMs) utilizing independent vision encoders (e.g., ViT) and Large Language Model (LLM) decoders are vulnerable to Split-Image Visual Jailbreak Attacks (SIVA). The vulnerability arises from an architectural and alignment discrepancy: while the vision encoder processes image fragments (splits) in isolation via constrained attention or block-diagonal masks, the LLM decoder aggregates these features via cross-attention to reconstruct the semantic content. Current safety…

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Large Language Models (LLMs), specifically LLaMA-3.2-11B, Qwen3-14B, Gemma 3-12B, and GPT-oss-20B, are vulnerable to black-box jailbreaking attacks via history-guided reinforcement learning (RL). The vulnerability arises from the models' inability to detect adversarial intent when prompts are iteratively refined based on historical interaction signals. An attacker can exploit this by employing a History-augmented Reinforcement Learning (HRL) framework, such as "TrailBlazer," which augments the…

Large Language Models (LLMs) exhibit a vulnerability termed "chunky post-training," where the model learns spurious correlations between incidental prompt features (e.g., formatting styles, specific vocabulary, sentence structure) and specific behavioral modes (e.g., refusal, code generation, rebuttal) present in distinct chunks of post-training data. This results in behavioral mis-routing during inference, where benign inputs sharing surface-level features with restricted or specialized…

Large Language Models (LLMs) subjected to machine unlearning techniques (specifically AltPO, GradDiff, IDKDPO, IDKNLL, UNDIAL, NPO, and SimNPO) contain a vulnerability regarding the persistence of latent knowledge. Despite achieving high "forgetting" scores on standard, benign benchmarks, these models remain susceptible to black-box evolutionary adversarial attacks. An attacker can utilize an automated framework (REBEL) comprising a "Hacker" model and a "Judge" model to iteratively mutate…

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…