Language Model Security Database

Point-based 3D Vision-Language Models (VLMs), specifically PointLLM and GPT4Point, are vulnerable to white-box, gradient-based adversarial attacks. The vulnerability exists in the model's processing of 3D point cloud data, where an attacker can optimize imperceptible geometric perturbations ($\delta$) on the input point cloud ($x$) to manipulate the model's textual output. The paper identifies two specific attack vectors: 1. Vision Attack: Directly perturbs the high-dimensional visual token…

A malicious model supply chain vulnerability exists involving a technique termed Adversarial Contrastive Learning (ACL) for Large Language Model (LLM) quantization attacks. This vulnerability allows an attacker to publish a model that appears benign and preserves high utility in full precision (e.g., BF16 or FP32) but exhibits malicious behaviors—such as jailbreak, over-refusal, or advertisement injection—immediately upon zero-shot quantization (e.g., INT8, FP4, or NF4).

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign…

Large Language Models (LLMs) exhibit a vulnerability to "hard-to-falsify" deceptive evidence injection, termed the "Facade of Truth." This vulnerability allows an attacker to override an LLM’s parametric knowledge (internal factual beliefs) by injecting sophisticated, iteratively refined fabricated evidence into the context window. Unlike overt misinformation which models typically reject, this attack utilizes a multi-agent adversarial framework (MisBelief) to generate evidence that mimics…

Large Language Model (LLM) agents utilizing external tool execution frameworks are vulnerable to Indirect Prompt Injection (IPI) via the "Tool Stream." Unlike traditional data-stream injections (e.g., malicious emails), this vulnerability exploits the agent's interpretation of functional tool definitions (docstrings, signatures) and runtime feedback (error messages, return values) as binding operational constraints. Adversaries functioning as compromised or malicious tool providers can embed…

A cognitive vulnerability exists in the reasoning mechanisms of autonomous Large Language Model (LLM) agents, specifically regarding "narrative overfitting"—the model's intrinsic drive to synthesize coherent causal stories from fragmented inputs. This vulnerability allows for "Cognitive Collusion Attacks" where an attacker creates a fabricated belief state in the victim agent using exclusively factually true evidence fragments. By employing a "Generative Montage" framework (consisting of…

Large Language Model (LLM) agents implementing the Model Context Protocol (MCP) are vulnerable to Implicit Tool Poisoning (ITP). This vulnerability allows an attacker to manipulate agent behavior by embedding malicious instructions within the metadata (specifically the natural language description) of a third-party tool. Unlike explicit tool poisoning, where the agent is tricked into invoking a malicious tool, ITP exploits the agent's contextual reasoning to force the invocation of a distinct…

Closed-source Multi-modal Large Language Models (MLLMs) are vulnerable to Universal Targeted Transferable Adversarial Attacks (UTTAA). An attacker can generate a single, image-agnostic adversarial perturbation ($\delta$) that, when added to any arbitrary source image, steers the victim model to output a description or classification matching a specific target image chosen by the attacker. This vulnerability exploits the transferability of adversarial features from open-source surrogate vision…

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

A vulnerability exists in Large Vision-Language Models (LVLMs) utilizing visual token compression mechanisms (e.g., VisionZip, VisPruner) to reduce inference latency. The vulnerability stems from an optimization-inference mismatch where standard adversarial defenses assume full-token processing, while the deployed model utilizes a subset of tokens selected via importance metrics (typically attention scores).