Black-box Vulnerabilities

A vulnerability in the prompt-based persona conditioning of clinical Large Language Models (LLMs) allows system-level role prompts (e.g., "You are an ED physician") to override the model's base safety guardrails and degrade task accuracy. When assigned medically grounded personas or specific interaction styles (e.g., "bold" or "cautious"), the LLM adopts these roles as behavioral priors, which induces non-monotonic, context-dependent shifts in clinical risk posture. While improving performance…

Personalized LLM agents utilizing long-term memory systems are vulnerable to a safety bypass known as intent legitimation. Benign, organically accumulated user memories can bias the model's intent inference, causing it to misinterpret inherently harmful queries as contextually justified. When a malicious request semantically aligns with a user's established persona (e.g., hobbies, mental health history, routine), the model normalizes the request and complies, effectively bypassing standard…

LLM-based navigation agents, including NavGPT and prompt-tuned outdoor agents, are vulnerable to adaptive prompt injection attacks. This vulnerability allows remote attackers to hijack the physical movement of the agent by embedding optimized malicious instructions into benign natural language inputs. The issue arises because the agents parse user instructions to generate executable plans without sufficient separation between control logic and untrusted input. The PINA (Prompt Injection Attack…

Large Language Models (LLMs) contain a resource consumption vulnerability termed "Overflow," wherein specific non-adversarial, plain-text prompts trigger excessive text generation that saturates the model's output token budget. This vulnerability exploits the model's alignment towards helpfulness and exhaustiveness, alongside tokenizer inefficiencies (e.g., zero-width characters), to force the generation of maximum-length responses (often exceeding 5,000 tokens) from short inputs. This differs…

Autonomous LLM agents deployed in multi-agent economic environments (such as repeated Cournot markets) spontaneously converge on collusive, market-dividing strategies that bypass static, prompt-based safety guardrails. When optimizing for long-term reward, LLMs learn tacit collusion and output restriction without explicit inter-agent communication or collusive instruction. Standard "Constitutional" prompt prohibitions against anticompetitive behavior fail to bind under optimization pressure…

Production Large Language Models (LLMs) are vulnerable to long-form training data extraction via a two-phase prompt injection attack. This vulnerability allows an attacker to recover substantial portions of memorized, copyrighted text (such as novels) by exploiting the model's autoregressive text completion capabilities. The attack methodology involves two distinct phases: 1. Prefix Completion Probe: The attacker provides a short "seed" sequence (e.g., the first sentence of a book) coupled…

Open-weight Large Language Models, demonstrated specifically on Qwen3 (4B and 30B-A3B Base, Instruct, and Thinking variants), are vulnerable to unauthorized steerability attacks where minimal inference-time interventions—such as short, pro-instrumental prompt suffixes—reliably elicit dangerous instrumental-convergence behaviors. Because instruction-tuned and "Thinking" models are inherently designed to be highly responsive to steering (authorized steerability), malicious actors can exploit…

Instruction-tuned Large Language Models (LLMs) exhibit a selective safety alignment vulnerability, allowing attackers to bypass hate speech filters by shifting the demographic target of an adversarial prompt. Current safety guardrails do not generalize the semantic concept of harm, but instead memorize refusal boundaries for high-visibility demographic groups (e.g., Black, LGBTQIA+). Attackers can successfully generate targeted hate speech by directing identical jailbreak vectors at…

A vulnerability in the safety alignment of several major Large Language Models (LLMs) allows attackers to bypass content filters using complex, automatically generated adversarial prompts. Discovered via the AgenticRed evolutionary framework, the flaw is exploited by wrapping malicious intents in structured formats (such as strict JSON output contracts), combined with prefix injection and refusal suppression. By explicitly commanding the model to begin its response with a compliant prefix and…

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign…