Attack Context

Black-box Research

Attacks requiring no knowledge of model internals

736 matching entries

Black-box research results

736 entries

Adaptive Role-Play Jailbreak

Published Aug 28, 2025Analyzed Dec 8, 2025Source: arXiv

Large Language Models (LLMs) and Vision-Language Models (VLMs) are vulnerable to an automated, adaptive role-play jailbreak attack known as GUARD (Guideline Upholding Test through Adaptive Role-play and Jailbreak Diagnostics). The vulnerability exists because the models fail to recognize malicious intent when harmful queries are embedded within complex, iteratively optimized "playing scenarios."

GUARD: Guideline Upholding Test through Adaptive Role-play and Jailbreak Diagnostics for LLMs

Evaluated models: Vicuna 13B, LongChat 7B, Llama 2 7B+5 more

Vicuna 13B
LongChat 7B
Llama 2 7B
Llama 3 8B
GPT-3.5
GPT-4
GPT-4o
MiniGPT-v2

Malicious Intent Bypass

Published Aug 27, 2025Analyzed Dec 9, 2025Source: arXiv

IntentionReasoner, specifically the 1.5B and 3B parameter versions optimized via Reinforcement Learning (RL), contains a safety regression vulnerability where the RL alignment process degrades the model's resistance to jailbreak attacks compared to the Supervised Fine-Tuning (SFT) baseline. While RL improves general utility and rewriting quality, it inadvertently increases the Attack Success Rate (ASR) for adversarial inputs in smaller architectures. This allows sophisticated jailbreak prompts…

IntentionReasoner: Facilitating Adaptive LLM Safeguards through Intent Reasoning and Selective Query Refinement

Evaluated models: GPT-4o, Qwen 2.5 7B Instruct, Llama 3.1 8B Instruct+3 more

GPT-4o
Qwen 2.5 7B Instruct
Llama 3.1 8B Instruct
DeepSeek V3
IntentionReasoner 1.5B
IntentionReasoner 3B

Familiar Pattern Analysis Hijack

Published Aug 24, 2025Analyzed Feb 22, 2026Source: arXiv

Large Language Models (LLMs) utilized for static code analysis, code review, and autonomous software engineering exhibit a cognitive vulnerability termed "Abstraction Bias." When processing code that structurally resembles common algorithmic patterns (e.g., standard sorting algorithms, helper functions, or mathematical formulas), the model relies on high-level memorized representations of the algorithm's intent rather than analyzing the specific local logic. Adversaries can exploit this by…

Trust Me, I Know This Function: Hijacking LLM Static Analysis using Bias

Evaluated models: GPT-4o, Claude 3.5 Sonnet, Gemini 2.0 Flash+3 more

GPT-4o
Claude 3.5 Sonnet
Gemini 2.0 Flash
o3
Claude Sonnet 4
Gemini 2.5 Pro

LLM Agent TOCTOU Vulnerabilities

Published Aug 23, 2025Analyzed Aug 31, 2025Source: arXiv

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in LLM-enabled agentic systems that execute multi-step plans involving sequential tool calls. The vulnerability arises because plans are not executed atomically. An agent may perform a "check" operation (e.g., reading a file, checking a permission) in one tool call, and a subsequent "use" operation (e.g., writing to the file, performing a privileged action) in another tool call. A temporal gap between these calls, often used for LLM…

Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents

Evaluated models: GPT-4o

Markovian Adaptive Jailbreak

Published Aug 18, 2025Analyzed Dec 8, 2025Source: arXiv

Large Language Models (LLMs) are vulnerable to an adaptive black-box jailbreaking framework named MAJIC (Markovian Adaptive Jailbreaking via Iterative Composition). This vulnerability allows an attacker to bypass safety alignment mechanisms by modeling the selection and composition of prompt disguise strategies as a Markov chain. Unlike static attacks, MAJIC initializes a transition matrix using a proxy model to determine the probability of a specific strategy succeeding after a prior strategy…

MAJIC: Markovian Adaptive Jailbreaking via Iterative Composition of Diverse Innovative Strategies

Evaluated models: Qwen 2.5 7B Instruct, Gemma 2 9B IT, Gemini 2.0 Flash+2 more

Qwen 2.5 7B Instruct
Gemma 2 9B IT
Gemini 2.0 Flash
GPT-4o
Claude 3.5 Sonnet

Universal Prompt Disables Guardrails

Published Aug 18, 2025Analyzed Aug 31, 2025Source: arXiv

A universal prompt injection vulnerability, termed "Involuntary Jailbreak," affects multiple large language models. The attack uses a single prompt that instructs the model to learn a pattern from abstract string operators (X and Y). The model is then asked to generate its own examples of questions that should be refused (harmful questions) and provide detailed, non-refusal answers to them, in order to satisfy the learned operator logic. This reframes the generation of harmful content as a…

Involuntary Jailbreak

Evaluated models: Claude 3.5 Haiku, Claude 3.7 Sonnet, Claude Opus 4+29 more

Claude 3.5 Haiku
Claude 3.7 Sonnet
Claude Opus 4
Claude Opus 4.1
Claude Sonnet 4
Claude Sonnet 4.5
DeepSeek R1
DeepSeek R1 Distill Llama 70B
DeepSeek V3
Gemini 2.0 Flash
Gemini 2.5 Flash
Gemini 2.5 Flash-Lite
Gemini 2.5 Pro
Gemini 3 Pro
GPT-4.1
GPT-4.1 Mini
GPT-4o
GPT-oss 20B
Grok 3
Grok 3 Fast
Grok 3 Mini
Grok 4
Grok 4.1
Llama 3.1 8B
Llama 3.1 405B
Llama 3.3 70B
Llama 4 Scout
Llama 4 Maverick
Mistral Small 24B
Qwen 2.5 72B Instruct
Qwen 3 235B-A22B Instruct 2507
Qwen 3 Coder 480B-A35B Instruct

MDH: Hybrid Jailbreak Detection Strategy

Published Aug 14, 2025Analyzed Aug 31, 2025Source: arXiv

Large language models that support a developer role in their API are vulnerable to a jailbreaking attack that leverages malicious developer messages. An attacker can craft a developer message that overrides the model's safety alignment by setting a permissive persona, providing explicit instructions to bypass refusals, and using few-shot examples of harmful query-response pairs. This technique, named D-Attack, is effective on its own. A more advanced variant, DH-CoT, enhances the attack by…

Jailbreaking Commercial Black-Box LLMs with Explicitly Harmful Prompts

Evaluated models: GPT-3.5 Turbo, GPT-4o, GPT-4.1+13 more

GPT-3.5 Turbo
GPT-4o
GPT-4.1
o1-mini
o1
o3-mini
o3
o4-mini
Gemini 2.5 Pro
Gemini 2.0 Flash Thinking
Claude 3.5 Sonnet
Claude 3.7 Sonnet
Claude Sonnet 4
DeepSeek V3
DeepSeek R1 0528
DeepSeek R1

Automated LLM Fingerprinting

Published Aug 12, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Models (LLMs) exposed via public APIs are vulnerable to model fingerprinting attacks where an attacker can identify the exact backend model family and version (e.g., distinguishing Mistral-7B-v0.1 from v0.3) by analyzing response patterns. While traditional fingerprinting relies on manual query curation, this vulnerability is exacerbated by Reinforcement Learning (RL) based query optimization. An attacker can train an RL agent (specifically using Proximal Policy Optimization) to…

Attacks and defenses against llm fingerprinting

Evaluated models: Mistral 7B, Qwen 2 5B, Gemma 2 2B+1 more

Mistral 7B
Qwen 2 5B
Gemma 2 2B
Gemma 7B

Back-Translation Watermark Stripping

Published Aug 11, 2025Analyzed Dec 30, 2025Source: arXiv

Implementations of Large Language Model (LLM) watermarking algorithms—specifically KGW (Kirchenbauer et al.), Semantic Invariant Robust (SIR) Watermark, Entropy-based Text Watermarking (EWD), and Unbiased Watermarking—are vulnerable to watermark stripping via adversarial text perturbation. When watermarked text generated by models such as OPT-1.3B is subjected to automated paraphrasing or back-translation (e.g., English $\to$ French $\to$ English), the embedded statistical signals are…

Signature vs. Substance: Evaluating the Balance of Adversarial Resistance and Linguistic Quality in Watermarking Large Language Models

Evaluated models: Llama 3 8B

Balanced Multimodal Jailbreak

Published Aug 11, 2025Analyzed Dec 8, 2025Source: arXiv

Multimodal Large Language Models (MLLMs) are vulnerable to a jailbreak attack strategy known as Balanced Structural Decomposition (BSD). This vulnerability exploits a structural trade-off in safety alignment where models fail to detect malicious intent when the input balances semantic relevance ("On-Topicness") with distributional novelty ("OOD-Intensity"). The attack functions by recursively decomposing a harmful text objective into a tree of sub-tasks using an "Explore" (diversity) and…

Towards Effective MLLM Jailbreaking Through Balanced On-Topicness and OOD-Intensity

Evaluated models: GPT-4o, GPT-4o Mini, GPT-4.1+10 more

GPT-4o
GPT-4o Mini
GPT-4.1
GPT-4.1 Mini
Claude Sonnet 4
Claude 3.5 Haiku
Gemini 2.5 Pro
Gemini 2.5 Flash
Qwen 2.5 VL 7B Instruct
Qwen 2.5 VL 32B Instruct
InternVL3 8B
InternVL3 14B
InternVL3 38B

Related research categories