Language Model Security Database

Large Language Models (LLMs) utilized for Automatic Short Answer Grading (ASAG) are vulnerable to the "GradingAttack" framework, which employs fine-grained adversarial manipulation to alter grading outcomes. Attackers can leverage two distinct strategies: (1) Prompt-level attacks using role-play injection strings that instruct the model to pretend an answer is correct regardless of factual accuracy, and (2) Token-level attacks utilizing gradient-based optimization (similar to Greedy Coordinate…

Vision-Language Models (VLMs) are vulnerable to a universal and transferable adversarial attack dubbed "UltraBreak." This vulnerability allows remote attackers to bypass safety alignment filters and elicit harmful responses (e.g., hate speech, dangerous instructions) by supplying a single, specifically crafted adversarial image alongside a text query. Unlike traditional gradient-based attacks that optimize for specific token sequences (cross-entropy loss) and result in brittle…

Large Language Models (LLMs), including Qwen2.5, LLaMA-3, and Baichuan2, are vulnerable to causally optimized adversarial attacks where specific interpretable prompt features are manipulated to bypass safety alignment. Research utilizing a "Causal Analyst" framework reveals that specific prompt attributes—specifically "Number of Task Steps" (increasing procedural complexity), "Positive Character" (enforcing specific personas), and "Command Tone"—act as direct causal drivers for "Answer…

Large Vision-Language Models (LVLMs) possessing Optical Character Recognition (OCR) capabilities are vulnerable to a "Text Distraction Jailbreaking" (Text-DJ) attack. The vulnerability exploits a gap between the model's visual text extraction and its safety alignment mechanisms. By converting a decomposed harmful textual query into images and embedding these images within a grid of semantically irrelevant "distraction" text images, an attacker can bypass safety filters. The model's OCR…

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

End-to-end multimodal large language models (omni-models) that utilize a shared representation space for text and audio are vulnerable to cross-modality jailbreak transfer, a phenomenon termed the "alignment curse." Because these models are trained to strongly align audio and text embeddings in their mid-to-late layers, an attacker can reliably bypass audio-specific safety mechanisms by converting mature, text-based jailbreak prompts into audio using standard Text-to-Speech (TTS) tools. When…

End-to-end Large Audio-Language Models (LALMs) are vulnerable to paralinguistic jailbreak attacks where the acoustic delivery style of an input—specifically tone, prosody, and emotional framing—overrides safety alignment mechanisms. Unlike adversarial perturbations that inject noise, this vulnerability exploits the model's personification bias by utilizing standard Text-to-Speech (TTS) synthesis to render prohibited instructions in psychologically manipulative vocal styles (e.g…

Safety-aligned Large Language Models (LLMs) are vulnerable to Best-of-N (BoN) sampling attacks, where adversaries bypass safety guardrails by systematically executing large-scale, parallel queries with prompt variations until a harmful response is elicited. The scaling behavior of attack success rates (ASR) demonstrates that models appearing robust under standard single-shot or low-budget evaluations experience rapid, non-linear risk amplification under parallel adversarial pressure. Because…

Diffusion Large Language Models (D-LLMs) are vulnerable to a "Context Nesting" attack that bypasses safety alignment mechanisms. While D-LLMs typically utilize a stepwise reduction effect during the iterative denoising process to suppress harmful content, this mechanism fails when harmful requests are embedded within benign, structured contexts. By wrapping a malicious query inside high-level structural templates (such as code completion, table filling, JSON, or YAML formats), an attacker can…

The Google Agent Payments Protocol (AP2), specifically within the reference implementation built using the Google Agent Development Kit (ADK) and Gemini models, contains vulnerabilities allowing for both indirect and direct prompt injection. The architecture fails to sufficiently isolate the Large Language Model (LLM) context from untrusted external data sources and user inputs.