Language Model Security Database

The VILTA (VLM-in-the-Loop Trajectory Adversary) framework is vulnerable to Prompt Injection and Data Poisoning via un-sanitized scene representation inputs. The system integrates a Vision-Language Model (Gemini-2.5-Flash) into a closed-loop reinforcement learning environment, feeding it Bird’s-Eye-View (BEV) imagery alongside text-based vehicle dynamics data (e.g., position, speed, and risk_category) to generate challenging driving trajectories. An attacker who can manipulate the input…

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

A vulnerability exists in multiple state-of-the-art Vision-Language Models (VLMs), including GPT-4o, Gemini-2.5, and LLaVA-OneVision, where persuasive textual misinformation successfully overrides visual evidence. When a model is presented with an image it can correctly interpret, an attacker can inject a contradictory text prompt employing specific rhetorical strategies (Logical, Credibility, Emotional, or Repetition) to force the model into generating a false response. This "obedience bias"…

A vulnerability exists in Large Vision-Language Models (LVLMs) utilizing visual token compression mechanisms (e.g., VisionZip, VisPruner) to reduce inference latency. The vulnerability stems from an optimization-inference mismatch where standard adversarial defenses assume full-token processing, while the deployed model utilizes a subset of tokens selected via importance metrics (typically attention scores).

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Large Language and Vision Assistant (LLaVA) v1.5-13B and Meta Llama 3.2 11B Vision are vulnerable to adversarial evasion attacks targeting the visual input modality. An attacker with white-box access (knowledge of model architecture and gradients) can employ Projected Gradient Descent (PGD) to generate adversarial perturbations constrained by an L-infinity norm. By maximizing the model's internal loss function with respect to the input image, the attacker can force the Vision-Language Model…

Commercial Multimodal Large Language Model (MLLM) integrated systems are vulnerable to a "Dual Steganography" jailbreak paradigm (referred to as Odysseus). The vulnerability arises from the reliance of safety filters on the assumption that malicious content must be explicitly visible in the input or output modalities (text or image). Attackers can bypass these filters by encoding malicious queries into binary matrices and embedding them into benign-looking images using steganographic encoders…

Text-to-Video (T2V) diffusion models are vulnerable to black-box adversarial prompt attacks that degrade output quality regarding semantic fidelity and temporal dynamics. This vulnerability is exploited via the T2VAttack framework, which utilizes two primary vector strategies: T2VAttack-S (Substitution) and T2VAttack-I (Insertion). T2VAttack-S leverages a greedy search to identify key semantic tokens and replaces them with high-similarity synonyms defined in lexical databases (e.g., WordNet)…

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

Large Vision Language Models (LVLMs) are vulnerable to a jailbreaking attack that combines image typography manipulation with multi-turn prompting. The vulnerability exploits the model's visual encoder and instruction-following capabilities by embedding a harmful textual query directly into a benign image as a visible caption (using specific fonts and blending techniques). An attacker then engages the model in a three-turn conversation: first asking a benign question about the visual object…