Language Model Security Database

Large Audio-Language Models (LAMs) are vulnerable to style-aware audio jailbreak attacks that bypass safety alignment mechanisms. This vulnerability exists because current safety alignment strategies often overlook the expressive variations of human speech. Attackers can exploit this by manipulating three specific attributes of the audio input: linguistic (rewriting text with emotional semantics), paralinguistic (modulating emotional acoustic tone), and extralinguistic (altering speaker age…

Vision-Language Models (VLMs) are vulnerable to a jailbreak attack vector termed "weak-OOD" (weak Out-of-Distribution), specifically instantiated via the JOCR (Jailbreak via OCR-Aware Embedded Text Perturbation) method. The vulnerability arises from an asymmetry between the model's pre-training phase (which establishes robust OCR capabilities and intent perception) and the safety alignment phase (which lacks generalization to visual anomalies). Attackers can embed malicious text instructions…

The JPRO (Automated Multimodal Jailbreaking via Multi-Agent Collaboration) framework exploits a vulnerability in Large Vision-Language Models (VLMs) related to insufficient cross-modal safety alignment and lack of maliciousness sustainability in multi-turn dialogues. The attack leverages a multi-agent system (Planner, Attacker, Modifier, Verifier) to automate the generation of adversarial image-text pairs. By employing hybrid tactics—such as combining role-playing with malicious content…

Mobile LLM-based agents (including Mobile-Agent-E, AppAgent, AutoDroid, and others) are vulnerable to indirect prompt injection attacks delivered via untrusted third-party mobile channels, such as in-app advertisements, system notifications, and embedded webviews. These agents utilize Multimodal Large Language Models (MLLMs) to perceive the device state via screenshots or accessibility trees. The vulnerability exists because the agents concatenate the user's prompt ($p$) with the environmental…

The paper describes a reproducible black-box evaluation and attack framework, PolyJailbreak, for multimodal LLMs. It reports that uneven text-versus-vision safety alignment allows jointly optimized text and image inputs to bypass refusal behavior without model internals. The authors attribute this to visual alignment weakening textual refusal representations and to cross-modal fusion making harmful intent harder to separate from benign intent. These are paper-reported findings, not…

A vulnerability exists in the self-reflection and introspection capabilities of Large Language Models (LLMs) and Vision-LLMs that allows attackers to perform black-box adversarial optimization using only textual model responses. This technique, termed "Asking for Directions" (AfD), bypasses the need for access to gradients, logits, or continuous confidence scores. The attacker employs a hill-climbing optimization strategy where they present the target model with two candidate inputs (an…

Agentic AI browsers and LLM-powered browser extensions are vulnerable to indirect prompt injection via the processing of untrusted web content. The vulnerability arises when the AI agent ingests the Document Object Model (DOM), including hidden elements, HTML comments, metadata, and accessibility labels, into its context window to perform tasks such as page summarization or autonomous navigation. Because the LLM cannot distinguish between system instructions and untrusted external data, an…

Large Vision-Language Model (LVLM) driven mobile agents, such as Mobile-Agent-E, are vulnerable to a touch-guided visual prompt injection attack. This vulnerability allows an attacker to hijack the agent's execution flow via a malicious Android application interface without requiring system-level privileges. The attack leverages "Non-privileged Perception Compromise," where a visual payload is embedded in the application UI and conditionally rendered only during agent-specific interaction…

Large Language Models (LLMs), including proprietary and open-weight state-of-the-art systems, are vulnerable to automated, self-evolving adversarial attacks orchestrated by multi-agent frameworks. The vulnerability exists because current safety alignment strategies (RLHF, static safety filters) fail to generalize against the "SafeEvalAgent" attack vector. In this vector, an "Analyst" agent analyzes model refusals to iteratively refine attack strategies, while a "Specialist" agent grounds these…

A vulnerability exists in Vision-Language Models (VLMs) that allows for the bypass of safety alignment mechanisms through loss-guided adversarial image perturbations. This attack, known as JaiLIP, operates entirely in the image space, requiring no textual prompt manipulation. The vulnerability is exploited by optimizing an adversarial image using a joint objective function that minimizes the Mean Squared Error (MSE) between the clean and perturbed image while maximizing the model's loss for…