Attack Context

Black-box Research

Attacks requiring no knowledge of model internals

736 matching entries

Black-box research results

736 entries

Activation-Guided Local Editing Jailbreak

Published Aug 1, 2025Analyzed Aug 16, 2025Source: arXiv

A vulnerability exists in multiple Large Language Models (LLMs) that allows for safety alignment bypass through a technique named Activation-Guided Local Editing (AGILE). The attack uses white-box access to a source model's internal states (activations and attention scores) to craft a transferable text-based prompt that elicits harmful content.

Activation-Guided Local Editing for Jailbreaking Attacks

Evaluated models: Claude 3.5 Sonnet, DarkIdol Llama 3.1 8B Instruct, DeepSeek V3+9 more

Claude 3.5 Sonnet
DarkIdol Llama 3.1 8B Instruct
DeepSeek V3
Gemini 2.0 Flash
GLM 4 9B Chat
GPT-4o
Llama 2 7B Chat
Llama 3 8B Instruct
Llama 3.1 8B Instruct
Llama 3.2 3B Instruct
Phi-4 Mini Instruct
Qwen 2.5 7B Instruct

Full-Spectrum Diffusion Attack

Published Jul 31, 2025Analyzed Dec 9, 2025Source: arXiv

A targeted adversarial attack vulnerability exists in Multimodal Large Language Models (MLLMs) susceptible to Adversarial-Guided Diffusion (AGD). This technique generates adversarial images by injecting targeted semantic information into the noise component of the reverse-diffusion process within a text-to-image generative model (specifically Stable Diffusion). Unlike traditional pixel-based attacks that introduce high-frequency perturbations easily removed by low-pass filtering, AGD utilizes…

Adversarial-guided diffusion for multimodal llm attacks

Evaluated models: Vicuna 13B

Synergistic Bias Jailbreak

Published Jul 30, 2025Analyzed Dec 30, 2025Source: arXiv

Large Language Models (LLMs) utilizing Reinforcement Learning from Human Feedback (RLHF) and other safety alignment techniques are vulnerable to "CognitiveAttack," a jailbreak vector that exploits synergistic cognitive biases. The vulnerability exists because models internalize human-like reasoning fallacies during pre-training and alignment. Adversaries can bypass safety guardrails by rewriting harmful instructions to trigger specific psychological heuristics—specifically through the…

Exploiting Synergistic Cognitive Biases to Bypass Safety in LLMs

Evaluated models: GPT-3.5, Llama 2 7B, DeepSeek R1+2 more

GPT-3.5
Llama 2 7B
DeepSeek R1
DeepSeek V3
o4-mini

Prompt-Based Jailbreak Taxonomy

Published Jul 29, 2025Analyzed Aug 16, 2025Source: arXiv

Large Language Models (LLMs) and Text-to-Image (T2I) models are vulnerable to jailbreaking through prompt-based attacks that use narrative framing, semantic substitution, and context diffusion to bypass safety moderation pipelines. These attacks do not require specialized knowledge or technical expertise. Attackers can embed harmful requests within benign narratives, frame them as fictional or professional inquiries, or use euphemistic language to circumvent input filters and output…

Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Is

Evaluated models: Not reported

Agent Policy Hacking

Published Jul 28, 2025Analyzed Sep 7, 2025Source: arXiv

LLM-powered agentic systems that use external tools are vulnerable to prompt injection attacks that cause them to bypass their explicit policy instructions. The vulnerability can be exploited through both direct user interaction and indirect injection, where malicious instructions are embedded in external data sources processed by the agent (e.g., documents, API responses, webpages). These attacks cause agents to perform prohibited actions, leak confidential data, and adopt unauthorized…

Security challenges in ai agent deployment: Insights from a large scale public competition

Evaluated models: Claude 3.5 Sonnet, Claude 3.7 Sonnet, Command R+11 more

Claude 3.5 Sonnet
Claude 3.7 Sonnet
Command R
Command R+
Gemini 1.5 Flash
Gemini 1.5 Pro
Gemini 2.0 Flash
Gemini 2.5 Pro
GPT-4.5
GPT-4o
Llama 3.3 70B
o3
o3-mini
o4-mini

Persona-Enhanced Genetic Jailbreak

Published Jul 28, 2025Analyzed Aug 16, 2025Source: arXiv

A vulnerability exists where Large Language Models (LLMs) can be manipulated by prepending a specially crafted 'persona prompt', often in the system prompt. These persona prompts cause the model to shift its attention from sensitive keywords in a harmful request to the stylistic instructions of the persona. This weakens the model's safety alignment, significantly reducing its refusal rate for harmful queries. The vulnerability is particularly severe because these persona prompts have a…

Enhancing Jailbreak Attacks on LLMs via Persona Prompts

Evaluated models: DeepSeek V3, GPT-4o, GPT-4o Mini+2 more

DeepSeek V3
GPT-4o
GPT-4o Mini
Llama 3.1 8B Instruct
Qwen 2.5 14B Instruct

LLM Interpreter Resource Exhaustion

Published Jul 25, 2025Analyzed Aug 16, 2025Source: arXiv

Large Language Models (LLMs) equipped with native code interpreters are vulnerable to Denial of Service (DoS) via resource exhaustion. An attacker can craft a single prompt that causes the interpreter to execute code that depletes CPU, memory, or disk resources. The vulnerability is particularly pronounced when a resource-intensive task is framed within a plausibly benign or socially-engineered context ("indirect prompts"), which significantly lowers the model's likelihood of refusal compared…

Running in CIRCLE? A Simple Benchmark for LLM Code Interpreter Security

Evaluated models: Gemini 2.0 Flash, Gemini 2.5 Flash, Gemini 2.5 Pro+5 more

Gemini 2.0 Flash
Gemini 2.5 Flash
Gemini 2.5 Pro
GPT-4.1
GPT-4.1 Mini
GPT-4.1 Nano
o3 Pro
o4-mini

Parallel Decoding LLDM Jailbreak

Published Jul 25, 2025Analyzed Aug 16, 2025Source: arXiv

A vulnerability exists in Large Language Diffusion Models (LLDMs) due to their parallel denoising architecture. The PArallel Decoding (PAD) jailbreak attack exploits this architecture by injecting multiple, semantically innocuous "sequence connectors" (e.g., "Step 1:", "First") at distributed locations within the initial masked sequence. During the parallel denoising process, these injected tokens act as anchor points that bias the probability distribution of adjacent token predictions. This…

Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation

Evaluated models: Gemma 7B IT, LLaDA 8B Base, LLaDA 8B Instruct+4 more

Gemma 7B IT
LLaDA 8B Base
LLaDA 8B Instruct
Llama 3.1 8B Instruct
MMaDA 8B Base
MMaDA 8B MixCoT
Qwen 2.5 7B Instruct

Agent Intent Hijack

Published Jul 21, 2025Analyzed Dec 9, 2025Source: arXiv

LLM agents integrating with external environments (e.g., via tool use, web retrieval, or RAG) are vulnerable to indirect prompt injection attacks. Malicious instructions embedded in untrusted data sources—such as emails, webpages, or tool outputs—are ingested by the agent and treated as valid context. Because the backend Large Language Model (LLM) struggles to distinguish between system instructions, user instructions, and third-party data, these embedded prompts can hijack the execution flow…

PromptArmor: Simple yet Effective Prompt Injection Defenses

Evaluated models: GPT-3.5, GPT-4o, GPT-4.1+1 more

GPT-3.5
GPT-4o
GPT-4.1
o4-mini

Enterprise Multi-Turn Data Exfiltration

Published Jul 21, 2025Analyzed Jul 28, 2025Source: arXiv

Large Language Model (LLM) systems integrated with private enterprise data, such as those using Retrieval-Augmented Generation (RAG), are vulnerable to multi-stage prompt inference attacks. An attacker can use a sequence of individually benign-looking queries to incrementally extract confidential information from the LLM's context. Each query appears innocuous in isolation, bypassing safety filters designed to block single malicious prompts. By chaining these queries, the attacker can…

Multi-Stage Prompt Inference Attacks on Enterprise LLM Systems

Evaluated models: GPT-2, GPT-3, GPT-4+1 more

GPT-2
GPT-3
GPT-4
RoBERTa

Related research categories