Attack Context

Black-box Research

Attacks requiring no knowledge of model internals

736 matching entries

Black-box research results

736 entries

UltraBreak Universal VLM Jailbreak

Published Feb 1, 2026Analyzed Feb 20, 2026Source: arXiv

Vision-Language Models (VLMs) are vulnerable to a universal and transferable adversarial attack dubbed "UltraBreak." This vulnerability allows remote attackers to bypass safety alignment filters and elicit harmful responses (e.g., hate speech, dangerous instructions) by supplying a single, specifically crafted adversarial image alongside a text query. Unlike traditional gradient-based attacks that optimize for specific token sequences (cross-entropy loss) and result in brittle…

Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models

Evaluated models: Qwen VL Chat, Qwen2-VL 7B Instruct, Qwen 2.5 VL 7B Instruct+6 more

Qwen VL Chat
Qwen2-VL 7B Instruct
Qwen 2.5 VL 7B Instruct
LLaVA v1.6 Mistral 7B
Kimi VL A3B Instruct
GLM-4.1V 9B Thinking
GPT-4.1 Nano
Gemini 2.5 Flash-Lite
Claude 3 Haiku

Adversarial Claim Search Deception

Published Jan 31, 2026Analyzed Feb 22, 2026Source: arXiv

Search-enabled Large Language Model (LLM) fact-checking systems are vulnerable to adversarial claim attacks that exploit the pipeline's reliance on claim interpretation, query formulation, and dynamic evidence retrieval. By manipulating the linguistic structure of an input claim while preserving its semantic factual intent, an attacker can induce systematic verification failures. This vulnerability stems from three specific attack surfaces: 1. Search Engine Misguidance: Altering lexical…

DECEIVE-AFC: Adversarial Claim Attacks against Search-Enabled LLM-based Fact-Checking Systems

Evaluated models: GPT-4o

Causal Driver Jailbreak Enhancement

Published Jan 31, 2026Analyzed Feb 20, 2026Source: arXiv

Large Language Models (LLMs), including Qwen2.5, LLaMA-3, and Baichuan2, are vulnerable to causally optimized adversarial attacks where specific interpretable prompt features are manipulated to bypass safety alignment. Research utilizing a "Causal Analyst" framework reveals that specific prompt attributes—specifically "Number of Task Steps" (increasing procedural complexity), "Positive Character" (enforcing specific personas), and "Command Tone"—act as direct causal drivers for "Answer…

A Causal Perspective for Enhancing Jailbreak Attack and Defense

Evaluated models: GPT-4o, Qwen 2.5 7B

OCR Image Distraction Jailbreak

Published Jan 31, 2026Analyzed Feb 20, 2026Source: arXiv

Large Vision-Language Models (LVLMs) possessing Optical Character Recognition (OCR) capabilities are vulnerable to a "Text Distraction Jailbreaking" (Text-DJ) attack. The vulnerability exploits a gap between the model's visual text extraction and its safety alignment mechanisms. By converting a decomposed harmful textual query into images and embedding these images within a grid of semantically irrelevant "distraction" text images, an attacker can bypass safety filters. The model's OCR…

Text is All You Need for Vision-Language Model Jailbreaking

Evaluated models: GPT-4o Mini, GPT-4.1 Mini, Gemini 2.5 Flash+3 more

GPT-4o Mini
GPT-4.1 Mini
Gemini 2.5 Flash
Qwen3-VL 4B Instruct
Qwen3-VL 8B Instruct
Qwen3-VL 30B-A3B Instruct

Pre-Task Persuasion Propagation

Published Jan 31, 2026Analyzed Feb 21, 2026Source: arXiv

A behavioral vulnerability exists in Large Language Model (LLM) agents where task-irrelevant persuasion introduced in prior interactions or system contexts induces a persistent "belief state" that alters downstream task execution. This phenomenon, termed "Persuasion Propagation," occurs when an agent adopts a stance on a controversial topic (e.g., politics, privacy) that is semantically unrelated to its primary function (e.g., coding, medical research). This adopted stance acts as a latent…

Persuasion Propagation in LLM Agents

Evaluated models: Llama 3.1 8B

Unified Robustness Gap

Published Jan 31, 2026Analyzed Mar 9, 2026Source: arXiv

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

Unifying Adversarial Robustness and Training Across Text Scoring Models

Evaluated models: E5 BERT-base, Qwen 3 0.6B, Llama 3.2 3B Instruct+2 more

E5 BERT-base
Qwen 3 0.6B
Llama 3.2 3B Instruct
Llama 3.1 8B Instruct
Skywork Reward V2

Adversarial Context Reasoning Brittleness

Published Jan 30, 2026Analyzed Mar 9, 2026Source: arXiv

Large Reasoning Models (LRMs) optimized via Reinforcement Learning from Verifiable Rewards (RLVR) are vulnerable to context pollution in their reasoning traces. An attacker can induce catastrophic reasoning failure by injecting locally coherent but logically or mathematically corrupted snippets into the model's Chain-of-Thought (CoT) or conditioning context. Because standard RLVR optimizes for final-answer correctness strictly under clean conditioning, the models treat the visible trajectory…

Learning Robust Reasoning through Guided Adversarial Self-Play

Evaluated models: DeepSeek R1 Distill Qwen 1.5B, DeepScaleR 1.5B, Qwen 3 4B+1 more

DeepSeek R1 Distill Qwen 1.5B
DeepScaleR 1.5B
Qwen 3 4B
Qwen 3 8B

Alignment Curse Jailbreak Transfer

Published Jan 30, 2026Analyzed Mar 9, 2026Source: arXiv

End-to-end multimodal large language models (omni-models) that utilize a shared representation space for text and audio are vulnerable to cross-modality jailbreak transfer, a phenomenon termed the "alignment curse." Because these models are trained to strongly align audio and text embeddings in their mid-to-late layers, an attacker can reliably bypass audio-specific safety mechanisms by converting mature, text-based jailbreak prompts into audio using standard Text-to-Speech (TTS) tools. When…

The Alignment Curse: Cross-Modality Jailbreak Transfer in Omni-Models

Evaluated models: GPT-4o, Qwen 2.5 3B

Audio Narrative Jailbreak

Published Jan 30, 2026Analyzed Feb 21, 2026Source: arXiv

End-to-end Large Audio-Language Models (LALMs) are vulnerable to paralinguistic jailbreak attacks where the acoustic delivery style of an input—specifically tone, prosody, and emotional framing—overrides safety alignment mechanisms. Unlike adversarial perturbations that inject noise, this vulnerability exploits the model's personification bias by utilizing standard Text-to-Speech (TTS) synthesis to render prohibited instructions in psychologically manipulative vocal styles (e.g…

Now You Hear Me: Audio Narrative Attacks Against Large Audio-Language Models

Evaluated models: GPT-4o Realtime, Gemini 2.0 Flash, Qwen 2.5 Omni 7B

Best-of-N Risk Amplification

Published Jan 30, 2026Analyzed Mar 8, 2026Source: arXiv

Safety-aligned Large Language Models (LLMs) are vulnerable to Best-of-N (BoN) sampling attacks, where adversaries bypass safety guardrails by systematically executing large-scale, parallel queries with prompt variations until a harmful response is elicited. The scaling behavior of attack success rates (ASR) demonstrates that models appearing robust under standard single-shot or low-budget evaluations experience rapid, non-linear risk amplification under parallel adversarial pressure. Because…

Statistical Estimation of Adversarial Risk in Large Language Models under Best-of-N Sampling

Evaluated models: GPT-4o, Llama 3.1 8B

Related research categories