Last analyzed Sep 9, 2026

Language Model Security Database

Explore primary-source AI security research, evaluated models, attack techniques, and defensive evidence.

985 research findings · 1119 evaluated models

Findings

985

Models evaluated

1119

Paper-evaluated models

Any selected model can match.

Refine by category

Findings match every selected category.

Attack Type1 selected

Attack Context

Architecture Components1 selected

Attack Surface

Impact1 selected

Advanced filters

Published fromPublished throughEvidence status

Research indexed from arXiv.

Filtered research findings

5 entries

Matches every word across titles, descriptions, sources, affected systems, and models.

Selective refusal gaps in visual question answering

Published Sep 4, 2026Analyzed Sep 9, 2026Source: arXiv

KoNA measures whether vision-language models answer valid image questions while refusing unsafe components or correcting unsupported premises. Its 9,300 question-answer pairs include mixed and fully answerable controls.

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

Evaluated models: InternVL3 2B Instruct, InternVL3-78B-Instruct, Qwen 2.5 VL 3B Instruct+5 more

InternVL3 2B Instruct
InternVL3-78B-Instruct
Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 72B Instruct
GPT-5
Gemini 2.5 Flash
InternVL3-2B-KoNA
Qwen2.5-VL-3B-KoNA

VLM Text Overrides Image

Published Jan 27, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in multiple state-of-the-art Vision-Language Models (VLMs), including GPT-4o, Gemini-2.5, and LLaVA-OneVision, where persuasive textual misinformation successfully overrides visual evidence. When a model is presented with an image it can correctly interpret, an attacker can inject a contradictory text prompt employing specific rhetorical strategies (Logical, Credibility, Emotional, or Repetition) to force the model into generating a false response. This "obedience bias"…

Do Images Speak Louder than Words? Investigating the Effect of Textual Misinformation in VLMs

Evaluated models: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, InternVL3 1B+8 more

Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 7B Instruct
InternVL3 1B
InternVL3 2B
InternVL3 8B
LLaVA-OneVision 0.5B
LLaVA-OneVision 7B
Gemini 2.5 Flash
Gemini 2.5 Pro
GPT-4o Mini
GPT-4o

Sound Induces Trimodal Collapse

Published Jan 20, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in trimodal audio-video-language models where an attacker can systematically degrade multimodal reasoning through untargeted, audio-only adversarial perturbations. By optimizing a shared perturbation $\delta$ applied to the audio channel, an attacker can manipulate internal representations—specifically targeting audio encoder embeddings and cross-modal attention mechanisms—without modifying visual or textual inputs. The attack exploits the model's reliance on the audio…

SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Models

Evaluated models: VideoLLAMA2, Qwen 2 7B Instruct, Whisper Large-v2+1 more

VideoLLAMA2
Qwen 2 7B Instruct
Whisper Large-v2
PANNs

Point Cloud Adversarial Attack

Published Jan 10, 2026Analyzed Feb 22, 2026Source: arXiv

Point-based 3D Vision-Language Models (VLMs), specifically PointLLM and GPT4Point, are vulnerable to white-box, gradient-based adversarial attacks. The vulnerability exists in the model's processing of 3D point cloud data, where an attacker can optimize imperceptible geometric perturbations ($\delta$) on the input point cloud ($x$) to manipulate the model's textual output. The paper identifies two specific attack vectors: 1. Vision Attack: Directly perturbs the high-dimensional visual token…

On the Adversarial Robustness of 3D Large Vision-Language Models

Evaluated models: Vicuna 7B

JailFlip Implicit Harm

Published Jun 9, 2025Analyzed Dec 8, 2025Source: arXiv

A vulnerability exists in the safety alignment mechanisms of Large Language Models (LLMs) (including GPT-4, Claude 3, Gemini, and Qwen families) leading to "Implicit Harm." Unlike traditional jailbreaks that use overtly harmful queries, this vulnerability allows remote attackers to coerce the model into providing factually incorrect, plausible, and dangerous responses to benign-looking inputs. By employing "JailFlip" techniques—specifically constructed affirmative-type or denial-type queries…

Beyond Jailbreaks: Revealing Stealthier and Broader LLM Security Risks Stemming from Alignment Failures

Evaluated models: GPT-4.1, GPT-4.1 Mini, GPT-4o+3 more

GPT-4.1
GPT-4.1 Mini
GPT-4o
GPT-4o Mini
Qwen Plus
Qwen Turbo

Research methodology

Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.

Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.