Skip to main content
LLM Security Database
Skip to research search
Last analyzed Sep 9, 2026

Language Model Security Database

985 research findings · 1119 evaluated models

Filtered research findings

2 entries

Matches every word across titles, descriptions, sources, affected systems, and models.

Fluent Single-Document RAG Corpus Poisoning

Published Analyzed Source: arXiv

SilentRetrieval describes a specific RAG corpus-integrity vulnerability: an attacker able to add a topically relevant document to a retrieval corpus can make that document rank highly and influence the generated answer while remaining fluent enough to evade simple perplexity checks. The paper evaluates a two-stage method combining retrieval-oriented document optimization with context-adaptive claim integration. A safe defensive reproduction is to use only isolated benchmark corpora and inert…

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning
Evaluated models: Llama 2 7B Chat, Mistral 7B Instruct v0.2, Qwen 7B Chat+1 more
  • Llama 2 7B Chat
  • Mistral 7B Instruct v0.2
  • Qwen 7B Chat
  • GPT-3.5 Turbo

Universal Magic Word Jailbreak

Published Analyzed Source: arXiv

A vulnerability exists in text embedding models used as safeguards for Large Language Models (LLMs). Due to a biased distribution of text embeddings, universal "magic words" (adversarial suffixes) can be appended to input or output text, manipulating the similarity scores calculated by the embedding model and thus bypassing the safeguard. This allows attackers to inject malicious prompts or responses undetected.

Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models
Evaluated models: E5 Base v2, Jina Embeddings v2, Nomic Embed+2 more
  • E5 Base v2
  • Jina Embeddings v2
  • Nomic Embed
  • Qwen 2.5 0.5B
  • Sentence-T5 Base

Research methodology

Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.

Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.