Black-box Vulnerabilities

A vulnerability in multi-tenant LLM serving frameworks allows attackers to reconstruct the private prompts of other users via an active Key-Value (KV) cache side-channel. Frameworks that utilize shared KV caches alongside specific scheduling policies, such as Longest Prefix Match (LPM), prioritize waiting requests based on the length of their matched prefix tokens. An attacker can exploit this by iteratively sending batches of guessed tokens mixed with dummy queries. If a guessed token matches…

Large Vision-Language Models (LVLMs) are vulnerable to zero-query, black-box adversarial image perturbations via Semantic-Guided Multimodal Attacks (SGMA). Unlike traditional attacks that scatter noise or target background pixels, SGMA leverages surrogate models (e.g., CLIP) to anchor imperceptible adversarial perturbations directly onto semantically critical foreground regions. The attack exploits two specific architectural traits of LVLMs: inconsistent visual grounding across models and…

Large Language Models (LLMs) subjected to machine unlearning techniques (specifically AltPO, GradDiff, IDKDPO, IDKNLL, UNDIAL, NPO, and SimNPO) contain a vulnerability regarding the persistence of latent knowledge. Despite achieving high "forgetting" scores on standard, benign benchmarks, these models remain susceptible to black-box evolutionary adversarial attacks. An attacker can utilize an automated framework (REBEL) comprising a "Hacker" model and a "Judge" model to iteratively mutate…

A vulnerability exists in Large Language Model (LLM) safety alignment mechanisms where the combination of Task-Oriented Prompts (ToP) and few-shot demonstrations significantly degrades defense effectiveness against jailbreak attacks. When few-shot examples (in-context learning) are appended to system prompts that explicitly define safety as a task objective (ToP), the model's attention to the safety instruction is diluted due to the "lost in the middle" phenomenon and attention entropy growth…

LLM serving frameworks utilizing continuous batching and PagedAttention (such as vLLM, SGLang, and Orca) are vulnerable to a resource exhaustion Denial-of-Service attack known as "Fill and Squeeze." An unprivileged remote attacker can exploit the deterministic state transitions of the scheduler's memory management to induce severe latency or service denial. The attack leverages a side-channel vulnerability where Inter-Token Latency (ITL) correlates linearly with global KV-cache usage due to…

Multiple open-source Large Language Models (LLMs) in the 1B to 7B parameter range are vulnerable to safety bypasses via long-form, multi-step reasoning prompt injection and jailbreak attacks. Attackers can evade alignment by embedding malicious instructions within extended contextual narratives, exploiting "attention dilution" and the models' tendency to prioritize contextual coherence over safety constraints (semantic camouflage). These reasoning-heavy attacks consistently bypass standard…

Large Language Models (LLMs), specifically LLaMA-3.2-11B, Qwen3-14B, Gemma 3-12B, and GPT-oss-20B, are vulnerable to black-box jailbreaking attacks via history-guided reinforcement learning (RL). The vulnerability arises from the models' inability to detect adversarial intent when prompts are iteratively refined based on historical interaction signals. An attacker can exploit this by employing a History-augmented Reinforcement Learning (HRL) framework, such as "TrailBlazer," which augments the…

Large Image Editing Models (LIEMs) supporting vision-prompt editing are vulnerable to Vision-Centric Jailbreak Attacks (VJA). This vulnerability arises from a modality mismatch in safety alignment: while safeguards primarily analyze textual instructions for policy violations, the underlying models are capable of interpreting and executing instructions embedded directly within the visual input (e.g., typographic text drawn on the image, arrows, symbols, or specific markings). An attacker can…

Large Language Models (LLMs), specifically those aligned primarily using English-centric data (such as LLaMA-3-8B-Instruct, GPT-OSS 20B, and Qwen3-32B), contain a cross-lingual safety generalization vulnerability. Safety guardrails and refusal logic fail to transfer effectively to linguistically distant languages, particularly Indic languages (Hindi, Assamese, Marathi, Kannada, and Gujarati). This vulnerability allows attackers to bypass safety alignment by translating structured adversarial…

Multiple large language models are vulnerable to cross-lingual and orthographic jailbreaks utilizing South Asian (Indic) languages. Attackers can bypass safety alignment and elicit harmful content by formulating requests in native Indic scripts (e.g., Bengali, Odia, Urdu) or by utilizing cross-lingual transfer attacks where English adversarial wrappers (format or instruction overrides) encapsulate Indic-language targets. Evaluations reveal a severe "contract gap": while imposing strict JSON…