Skip to main content
LLM Security Database
Skip to research search
Last analyzed Sep 9, 2026

Language Model Security Database

985 research findings · 1119 evaluated models

Filtered research findings

2 entries

Matches every word across titles, descriptions, sources, affected systems, and models.

Query-Agnostic Poisoning of Medical Multimodal RAG

Published Analyzed Source: arXiv

M3Att demonstrates a reproducible knowledge-poisoning issue in medical multimodal RAG: an attacker with limited corpus-distribution knowledge can insert paired image-text entries whose visually perturbed images are broadly retrieved and whose clinically plausible misinformation steers downstream generation. The paper evaluates both white-box and black-box retrieval optimization and reports degraded diagnostic and report-generation utility across multiple datasets, retrievers, and LVLMs. These…

Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation
Evaluated models: GPT-4o, GPT-5 Chat, Gemini 2.5 Flash+5 more
  • GPT-4o
  • GPT-5 Chat
  • Gemini 2.5 Flash
  • Claude Haiku 4.5
  • LLaVA Med
  • CLIP ViT-Large-Patch14-336
  • BGE-VL-base
  • SigLIP-SO400M-Patch14-384
Application layer
Poisoning
RAG
Embedding

Synchronized Multimodal Steering

Published Analyzed Source: arXiv

Multimodal Large Language Model-based Recommender Systems (MLLM-RecSys) are vulnerable to Cross-Modal Interactive Data Poisoning. Attackers can manipulate the system by injecting compromised user-generated content (UGC) that contains synchronized, coupled perturbations across both textual and visual modalities. While MLLMs naturally filter out single-modality noise via cross-modal consensus, this vulnerability exploits the consensus mechanism itself. By leveraging cross-modal attention to…

VENOMREC: Cross-Modal Interactive Poisoning for Targeted Promotion in Multimodal LLM Recommender Systems
Evaluated models: Not reported
Model layer
Poisoning
Multimodal
Vision

Research methodology

Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.

Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.