Language Model Security Database

Large Vision-Language Models (LVLMs), specifically InstructBLIP, LLaVA, and MiniGPT-4, are susceptible to a black-box adversarial jailbreak vulnerability via Zeroth-Order Simultaneous Perturbation Stochastic Approximation (ZO-SPSA). An attacker can generate adversarial images with imperceptible perturbations that, when paired with harmful text prompts, bypass the model's safety alignment mechanisms (such as RLHF). Unlike traditional white-box attacks, this method does not require access to…

Text-to-Video (T2V) diffusion models are vulnerable to black-box adversarial prompt attacks that degrade output quality regarding semantic fidelity and temporal dynamics. This vulnerability is exploited via the T2VAttack framework, which utilizes two primary vector strategies: T2VAttack-S (Substitution) and T2VAttack-I (Insertion). T2VAttack-S leverages a greedy search to identify key semantic tokens and replaces them with high-similarity synonyms defined in lexical databases (e.g., WordNet)…

Commercial Multimodal Large Language Model (MLLM) integrated systems are vulnerable to a "Dual Steganography" jailbreak paradigm (referred to as Odysseus). The vulnerability arises from the reliance of safety filters on the assumption that malicious content must be explicitly visible in the input or output modalities (text or image). Attackers can bypass these filters by encoding malicious queries into binary matrices and embedding them into benign-looking images using steganographic encoders…

Large Language and Vision Assistant (LLaVA) v1.5-13B and Meta Llama 3.2 11B Vision are vulnerable to adversarial evasion attacks targeting the visual input modality. An attacker with white-box access (knowledge of model architecture and gradients) can employ Projected Gradient Descent (PGD) to generate adversarial perturbations constrained by an L-infinity norm. By maximizing the model's internal loss function with respect to the input image, the attacker can force the Vision-Language Model…

Improper restriction of the "Capability Space" in Large Language Model (LLM) applications allows remote attackers to manipulate application behavior through "Goal Deviation" attacks. This vulnerability arises when developers rely on the broad capabilities of a foundational model (e.g., GPT-4, LLaMA) without implementing sufficient negative constraints or disabling default plugins (e.g., DALL-E, Web Search) in the system prompt. Attackers can exploit this via natural language inputs to trigger…

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

Large Vision Language Models (LVLMs) are vulnerable to a jailbreaking attack that combines image typography manipulation with multi-turn prompting. The vulnerability exploits the model's visual encoder and instruction-following capabilities by embedding a harmful textual query directly into a benign image as a visible caption (using specific fonts and blending techniques). An attacker then engages the model in a three-turn conversation: first asking a benign question about the visual object…

LLM-enhanced Graph Neural Networks (GNNs), which integrate Large Language Model (LLM) feature encoders with graph message-passing architectures, are vulnerable to a black-box node injection attack known as "GraphTextack." This vulnerability exists because the joint model architecture creates a dual attack surface: the GNN component is sensitive to structural perturbations (changes in graph topology), while the LLM component is sensitive to semantic perturbations (adversarial phrasing).

Multimodal Large Language Models (MLLMs) capable of processing speech and audio are vulnerable to Speech-Audio Compositional Attacks. This vulnerability exists because current safety mechanisms often rely on text-only transcription or fail to analyze the full acoustic context of an input. By manipulating the composition of audio signals, an attacker can bypass safety filters and elicit harmful responses. The attacks exploit three specific mechanisms: (1) Speech Overlap, where harmful…