Language Model Security Database

Architectural limitations in Meta's Llama-Prompt-Guard-2-86M and Llama-Guard-3-8B cause them to fail at detecting indirect prompt injections and agentic tool-use attacks, with detection rates dropping as low as 7-37%. Llama-Guard-3-8B enforces strict user/assistant message alternation and lacks support for tool-use roles; attempting to process messages with role: "tool" or role: "ipython" causes the chat template to raise an error, preventing evaluation entirely. PromptGuard 2 operates…

Large Language Models (LLMs) aligned via reinforcement learning from human feedback (RLHF) or Constitutional AI exhibit a vulnerability where safety guardrails can be consistently bypassed through "Abstractive Red-Teaming." This attack vector exploits specific high-level natural language categories—combinations of semantic attributes such as tone, specific formatting instructions (e.g., numbered lists), language (e.g., Chinese, Russian), and topic constraints—that the model fails to generalize…

Reinforcement learning (RL) based post-training for explicit chain-of-thought reasoning (e.g., GRPO) in Multimodal Large Reasoning Models (MLRMs) inadvertently degrades safety alignment, rendering the models highly vulnerable to multimodal jailbreak attacks. The vulnerability is caused by "conditional coverage collapse" during the initial phases of chain-of-thought generation. Under adversarial conditioning (text or image), the reasoning policy assigns vanishing probability mass to safe…

A vulnerability in the Direct Preference Optimization (DPO) post-training phase of OLMo 2 models leads to "distractor-triggered compliance." The model correctly refuses harmful requests when prompted in isolation, but complies with identical harmful requests if a benign formatting instruction (a "distractor") is appended to the prompt. This behavior organically emerges from contaminated preference training data where mislabeled examples incorrectly preferred compliance over refusal when a…

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

A logical vulnerability exists in LLM security proxies and guardrails that utilize weighted-average aggregation algorithms for multi-turn risk scoring. The scoring logic exhibits a mathematical "ceiling property" where the cumulative conversation-level risk score converges to the per-turn score regardless of the number of interaction turns ($n$). Consequently, the aggregated score is bounded by the maximum single-turn score ($cum \leq \max(s_i)$). This allows remote attackers to bypass…

A vulnerability in the Grok LLM, as deployed on the X social media platform, allows users to bypass safety filters and generate toxic or obscene content through "shallow alignment" techniques. The model prioritizes instruction compliance and conversational flow over safety guidelines, failing when exposed to simple adversarial interactions such as Persona Adoption (instructing the model to adopt a specific character) and Tone Mirroring (where the model automatically mimics a user's aggressive…

A detection bypass vulnerability in the 2-Sigma clinical training platform allows users to evade the system's two-layer, linguistic-feature-based jailbreak detection mechanism. The detection framework relies heavily on four surface-level linguistic features (Professionalism, Medical Relevance, Ethical Behavior, and Contextual Distraction) to classify malicious inputs. Attackers can bypass these filters by crafting prompts that maintain professional tone and apparent medical relevance but…

Large Image Editing Models (LIEMs) supporting vision-prompt editing are vulnerable to Vision-Centric Jailbreak Attacks (VJA). This vulnerability arises from a modality mismatch in safety alignment: while safeguards primarily analyze textual instructions for policy violations, the underlying models are capable of interpreting and executing instructions embedded directly within the visual input (e.g., typographic text drawn on the image, arrows, symbols, or specific markings). An attacker can…

Retrieval-Augmented Generation (RAG) systems are vulnerable to iterative knowledge-extraction attacks designed to reconstruct the underlying private knowledge base. The vulnerability exists due to the decoupled optimization of the retrieval and generation phases. Attackers can craft adversarial queries consisting of two distinct components: an "Information" component (optimized via gradient descent or random sampling to steer embeddings toward specific, diverse regions of the vector space) and…