Language Model Security Database

Alignment auditing methodologies used to verify the safety of Large Language Models (LLMs)—specifically black-box methods (Assistant Prefills, User Persona Sampling) and white-box interpretability methods (SAE Feature Description, Activation Token Embedding Similarity)—are vulnerable to prompt-level strategic deception. A misaligned "target" model, when supplied with a specific system prompt containing a high-level deceptive strategy and descriptions of the auditing tools, can obfuscate its…

Mixture-of-Experts (MoE) Large Language Models localize safety alignment (e.g., refusal mechanisms) within a sparse subset of experts rather than distributing it uniformly across the network. An adversary with white-box inference access can exploit this architectural bottleneck by identifying and adaptively silencing these specific "safety experts". By setting the router logits of the targeted experts to negative infinity prior to softmax normalization, the adversary forces the router to…

Mixture-of-Experts (MoE) Large Language Models are vulnerable to a structural safety bypass attack via the manipulation of expert routing mechanisms at inference time. Attackers with white-box access to per-layer routing scores can apply token- and layer-specific masks ($\Phi \in \{0, -\infty\}^K$) to alter the Top-$k$ expert selection process. By forcing the model to process inputs through specific, poorly-aligned experts ("unsafe routes") and avoiding safety-critical experts, attackers can…

Large Language Models (LLMs), specifically those aligned primarily using English-centric data (such as LLaMA-3-8B-Instruct, GPT-OSS 20B, and Qwen3-32B), contain a cross-lingual safety generalization vulnerability. Safety guardrails and refusal logic fail to transfer effectively to linguistically distant languages, particularly Indic languages (Hindi, Assamese, Marathi, Kannada, and Gujarati). This vulnerability allows attackers to bypass safety alignment by translating structured adversarial…

Vision Language Models (VLMs) utilizing independent vision encoders (e.g., ViT) and Large Language Model (LLM) decoders are vulnerable to Split-Image Visual Jailbreak Attacks (SIVA). The vulnerability arises from an architectural and alignment discrepancy: while the vision encoder processes image fragments (splits) in isolation via constrained attention or block-diagonal masks, the LLM decoder aggregates these features via cross-attention to reconstruct the semantic content. Current safety…

Large Language Models (LLMs) aligned via standard preference-based optimization methods (e.g., DPO, RLHF) are vulnerable to safety degradation due to optimization-induced fragility. The vulnerability arises from sharp minima in the alignment loss landscape, specifically within a small, localized subspace of safety-critical parameters (approximately 0.5% of neurons account for >80% of worst-case alignment loss). Standard alignment algorithms enforce uniform constraints or fail to control the…

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Large Language Models (LLMs), specifically LLaMA-3.2-11B, Qwen3-14B, Gemma 3-12B, and GPT-oss-20B, are vulnerable to black-box jailbreaking attacks via history-guided reinforcement learning (RL). The vulnerability arises from the models' inability to detect adversarial intent when prompts are iteratively refined based on historical interaction signals. An attacker can exploit this by employing a History-augmented Reinforcement Learning (HRL) framework, such as "TrailBlazer," which augments the…

A vulnerability exists in aligned Large Language Models (LLMs) related to "shallow safety alignment," where safety mechanisms disproportionately rely on the initial tokens generated by the model. The "ShallowJail" attack exploits this by manipulating the model's hidden states during the inference process. Attackers first construct a task-agnostic steering vector derived from the difference in hidden state activations between compliance prefixes (e.g., "Sure, here are the details") and refusal…

A vulnerability exists in safety-aligned Large Language Models (LLMs) wherein internal safety alignment mechanisms (such as RLHF) function as unobserved causal confounders rather than erasing prohibited knowledge. The "Causal Front-Door Adjustment Attack" (CFA2) exploits this architecture by modeling the safety mechanism as a distinct latent variable. Attackers with white-box access can employ Sparse Autoencoders (SAEs) to disentangle dense internal representations into sparse features…