Attack Surface

Infrastructure Vulnerabilities

Vulnerabilities in the deployment and hosting infrastructure

3 matching entries out of 16 in this category

Infrastructure research results

3 entries

Multi-Turn Proxy Evasion

Updated 2/22/2026

A logical vulnerability exists in LLM security proxies and guardrails that utilize weighted-average aggregation algorithms for multi-turn risk scoring. The scoring logic exhibits a mathematical "ceiling property" where the cumulative conversation-level risk score converges to the per-turn score regardless of the number of interaction turns ($n$). Consequently, the aggregated score is bounded by the maximum single-turn score ($cum \leq \max(s_i)$). This allows remote attackers to bypass…

Peak+ Accumulation: A Proxy-Level Scoring Formula for Multi-Turn LLM Attack Detection

Source: arXiv

Quantization Contrastive Jailbreak

Updated 1/14/2026

A malicious model supply chain vulnerability exists involving a technique termed Adversarial Contrastive Learning (ACL) for Large Language Model (LLM) quantization attacks. This vulnerability allows an attacker to publish a model that appears benign and preserves high utility in full precision (e.g., BF16 or FP32) but exhibits malicious behaviors—such as jailbreak, over-refusal, or advertisement injection—immediately upon zero-shot quantization (e.g., INT8, FP4, or NF4).

Adversarial Contrastive Learning for LLM Quantization Attacks

Affects: Qwen 2.5 1.5B Instruct, Qwen 2.5 3B Instruct, Llama 3.2 1B Instruct +1 more

Source: arXiv

LLM Interpreter Resource Exhaustion

Updated 8/16/2025

Large Language Models (LLMs) equipped with native code interpreters are vulnerable to Denial of Service (DoS) via resource exhaustion. An attacker can craft a single prompt that causes the interpreter to execute code that depletes CPU, memory, or disk resources. The vulnerability is particularly pronounced when a resource-intensive task is framed within a plausibly benign or socially-engineered context ("indirect prompts"), which significantly lowers the model's likelihood of refusal compared…

Running in CIRCLE? A Simple Benchmark for LLM Code Interpreter Security

Affects: Gemini 2.0 Flash, Gemini 2.5 Flash, Gemini 2.5 Pro +5 more

Source: arXiv

Related research categories