Attack Context

Black-box Research

Attacks requiring no knowledge of model internals

736 matching entries

Black-box research results

736 entries

Echo Chamber Escalation Jailbreak

Published 1/1/2026

Analyzed 2/20/2026

The "Echo Chamber" vulnerability allows attackers to bypass safety guardrails in Large Language Models (LLMs) via a multi-turn adversarial dialogue strategy. The attack exploits the model's "consistency bias" and "completion bias" rather than using aggressive reframing or backtracking. The attacker initiates the session by embedding "poisonous seeds" (harmful concepts hidden in benign context) and "steering seeds" (format directives, e.g., "write a manual") into an ostensibly innocuous prompt…

The Echo Chamber Multi-Turn LLM Jailbreak

Evaluated models: DeepSeek R1 0528, Qwen 3 32B, Gemini 2.5 Pro +7 more

Source: arXiv

Gamified Goal Pursuit Jailbreak

Published 1/1/2026

Analyzed 2/20/2026

A "Gamified Adversarial Multimodal Breakout via Instructional Traps" (GAMBIT) vulnerability exists in the safety alignment mechanisms of Multimodal Large Language Models (MLLMs), specifically those employing Chain-of-Thought (CoT) reasoning. The vulnerability exploits the finite cognitive resource budget of the model by inducing "cognitive overload" through a high-stakes, gamified context. The attack functions by decomposing a harmful query into a visual puzzle (e.g., a shuffled grid of image…

GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Models

Evaluated models: GPT-4o, Grok 2 Vision, GLM-4.1V Thinking +3 more

Source: arXiv

Gradient-Free Transferable Jailbreak

Published 1/1/2026

Analyzed 2/20/2026

Large Language Models (LLMs) are vulnerable to a gray-box adversarial attack method known as RAILS (RAndom Iterative Local Search). This vulnerability allows an attacker with access to model output logits (but without access to gradients or weights) to optimize discrete adversarial suffixes that bypass safety alignment. The attack employs a random local search guided by a hybrid loss function combining Teacher-Forcing and a novel Auto-Regressive loss that enforces exact target prefix matching…

Jailbreaking LLMs Without Gradients or Priors: Effective and Transferable Attacks

Evaluated models: Llama 2 7B Chat, Llama 3 8B Instruct, Vicuna 7B v1.5 +5 more

Source: arXiv

Hard-Negative Prompt Evasion

Published 1/1/2026

Analyzed 2/21/2026

Embedding-based LLM prompt injection detectors, specifically those based on the DeBERTa-v3 architecture, are vulnerable to adversarial evasion attacks utilizing "hard-negative" mining and fuzzing techniques. Attackers can circumvent detection mechanisms by iteratively generating adversarial prompts that are semantically malicious but structurally mutated to evade the classifier's decision boundary. Specific evasion vectors identified include semantic fuzzing (paraphrasing), syntactic fuzzing…

Proactive Hardening of LLM Defenses with HASTE

Evaluated models: GPT-4o

Source: arXiv

Helpful Agent Default Bypass

Published 1/1/2026

Analyzed 2/21/2026

A vulnerability exists in the task-planning and execution logic of Large Language Model (LLM) agents, specifically within trip-planning and web-use agents. The vulnerability, identified as a "User-Mediated Attack," occurs because agents prioritize task completion and "helpfulness" over safety verification when processing content provided by the user. When a benign user forwards untrusted external content (e.g., promotional text containing phishing links or malicious instructions) to the agent…

Too Helpful to Be Safe: User-Mediated Attacks on Planning and Web-Use Agents

Evaluated models: Not reported

Source: arXiv

Hidden Social RAG Injection

Published 1/1/2026

Analyzed 3/9/2026

Web-facing Retrieval-Augmented Generation (RAG) systems are vulnerable to Indirect Prompt Injection (IPI) and retrieval poisoning via web-native markup and Unicode carriers. Standard ingestion pipelines often parse untrusted web pages without stripping invisible constructs, such as hidden HTML spans, off-screen CSS, alt text, ARIA attributes, and zero-width characters. When an attacker embeds malicious instructions within these invisible carriers on third-party sites, the RAG system retrieves…

Hidden-in-Plain-Text: A Benchmark for Social-Web Indirect Prompt Injection in RAG

Evaluated models: Llama 3 8B, Mistral 7B, Qwen 2.5 14B

Source: arXiv

Intent-Context Coupling Jailbreak

Published 1/1/2026

Analyzed 2/21/2026

Large Language Models (LLMs), including GPT-4o, Claude 3.5 Sonnet, and Llama 3, are vulnerable to an "Intent-Context Coupling" multi-turn jailbreak attack (automated by the ICON framework). The vulnerability arises from an alignment failure where safety constraints are relaxed when a malicious intent is paired with a semantically congruent "authoritative-style" context pattern. By routing specific prohibited intents (e.g., Hacking) to pre-optimized context patterns (e.g., Scientific Research…

ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack

Evaluated models: Llama 4 Maverick Instruct, Llama 3.1 405B Instruct, Qwen-Max 2025-01-25 +8 more

Source: arXiv

Invisible Headline Trading Loss

Published 1/1/2026

Analyzed 2/21/2026

Improper input validation in Large Language Model (LLM) integrated Algorithmic Trading Systems (ATS) allows remote attackers to manipulate trading decisions via crafted "adversarial news" headlines. The vulnerability exists when ATS pipelines ingest financial news data via standard scraping libraries (e.g., Scrapy, BeautifulSoup, Cheerio) and pass raw HTML or non-normalized text directly to LLMs (such as FinBERT, FinGPT, or GPT-4) for entity recognition (stock-name association) and sentiment…

Adversarial News and Lost Profits: Manipulating Headlines in LLM-Driven Algorithmic Trading

Evaluated models: FinBERT, FinGPT, FinLLaMA +7 more

Source: arXiv

Knowledge-Graph Implicit Prompts

Published 1/1/2026

Analyzed 2/21/2026

Large Language Models (LLMs) are vulnerable to a domain-specific obfuscation attack method termed "StealthGraph," which leverages Knowledge Graph (KG) guidance to bypass safety alignment. The vulnerability arises because current safety mechanisms primarily focus on explicit, general-domain harmful queries and fail to generalize to implicit, highly technical requests in specialized domains (e.g., medicine, finance, law).

StealthGraph: Exposing Domain-Specific Risks in LLMs through Knowledge-Graph-Guided Harmful Prompt Generation

Evaluated models: GPT-4o Mini, Gemini 2.5 Flash, Grok 3 Mini +10 more

Source: arXiv

LLM Agent Disguised URL Bypass

Published 1/1/2026

Analyzed 2/21/2026

Large Language Models (LLMs) acting as web agents exhibit a vulnerability in their decision-making process when validating external URLs. The models fail to correctly identify malicious domains when the Uniform Resource Locator (URL) structure—specifically the subdomain, directory path, or query parameters—is manipulated to include semantically "safe" keywords or mimic benign websites (URL disguising). Attackers can induce the agent to accept and visit a malicious link by embedding natural…

MalURLBench: A Benchmark Evaluating Agents' Vulnerabilities When Processing Web URLs

Evaluated models: GPT-3.5, GPT-4o, Llama 2 7B +4 more

Source: arXiv

Related research categories