Attack Type

Injection Research

Attacks that inject malicious content into model inputs

337 matching entries

Injection research results

337 entries

Controlled-Release Guard Bypass

Published 10/1/2025

Analyzed 12/30/2025

A vulnerability termed "Controlled-Release Prompting" allows attackers to bypass lightweight input filters (prompt guards) deployed in front of Large Language Models (LLMs). The attack exploits the computational resource asymmetry between the resource-constrained guard model and the highly capable target model. Attackers encode malicious instructions using obfuscation techniques—such as substitution ciphers (Timed-Release) or verbose character descriptions (Spaced-Release)—that require…

Bypassing Prompt Guards in Production with Controlled-Release Prompting

Evaluated models: Gemini 2.5 Flash, Gemini 2.5 Pro, DeepSeek R1 +2 more

Source: arXiv

Distributed Backdoor in Multi-Agent Systems

Published 10/1/2025

Analyzed 10/31/2025

A distributed backdoor vulnerability, named "Collaborative Shadows", exists in LLM-based Multi-Agent Systems (MAS) that rely on external or modifiable tools. An attacker can poison multiple agent tools by embedding inert, encrypted "attack primitives" within them. These primitives are fragments of a larger malicious payload. A carefully crafted user instruction acts as both a trigger and a decryption key. The instruction steers the agents to collaborate in a specific sequence, causing them to…

Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems

Evaluated models: Gemini 2.5 Pro, GLM 4.5, GPT-4.1 +2 more

Source: arXiv

Intermediate Denoising Priming

Published 10/1/2025

Analyzed 12/30/2025

A "Priming Vulnerability" exists in Masked Diffusion Language Models (MDLMs) due to their iterative, parallel denoising inference mechanism. Unlike autoregressive models that generate tokens sequentially, MDLMs refine a sequence from a fully masked state through multiple denoising steps. The vulnerability arises because standard safety alignment (e.g., SFT, DPO, MOSA) typically optimizes the model to generate safe responses only when initialized from a fully masked sequence. If an affirmative…

Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerability

Evaluated models: Not reported

Source: arXiv

Internal Prompt Leak Injection

Published 10/1/2025

Analyzed 12/30/2025

LLM-based coding agents integrated into IDEs (e.g., VS Code Copilot, Cursor, Windsurf) are vulnerable to a query-agnostic Indirect Prompt Injection (IPI) attack termed "QueryIPI." This vulnerability allows an attacker to achieve Remote Code Execution (RCE) on the developer's machine by injecting a malicious tool definition (e.g., via the Model Context Protocol) into the agent's context.

QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents

Evaluated models: Claude Sonnet 4

Source: arXiv

Invisible Unicode Jailbreak

Published 10/1/2025

Analyzed 12/8/2025

Large Language Models (LLMs) are vulnerable to imperceptible jailbreaking attacks and prompt injection via the exploitation of Unicode variation selectors. This vulnerability arises from a discrepancy between text rendering and tokenizer processing. Attackers can append long sequences of invisible variation selectors (specifically from ranges U+FE00–U+FE0F and U+E0100–U+E01EF) to malicious prompts. While these characters are visually rendered as zero-width or ignored by standard user…

Imperceptible Jailbreaking against Large Language Models

Evaluated models: Llama 2 7B, Llama 3.1 8B, Mistral 7B +1 more

Source: arXiv

LLM Data Instruction Override

Published 10/1/2025

Analyzed 12/30/2025

Large Language Model (LLM) integrated agents and applications are vulnerable to Prompt Injection attacks where untrusted data (e.g., retrieved documents, tool outputs, website content) overrides system instructions. Because LLMs typically process instructions and data within a single context window without strict separation, an attacker can embed imperative commands within the data channel. This vulnerability extends beyond simple overriding instructions; it includes sophisticated techniques…

Defending against prompt injection with datafilter

Evaluated models: GPT-4o, Llama 3.1 8B Instruct

Source: arXiv

LLM Self-Targeted Jailbreak

Published 10/1/2025

Analyzed 12/8/2025

A security vulnerability exists in the safety alignment mechanisms of Large Language Models (LLMs), specifically susceptible to the "Dynamic Target Attack" (DTA). Unlike traditional gradient-based jailbreaks (e.g., GCG) that optimize adversarial suffixes toward a fixed, low-probability static target (e.g., "Sure, here is..."), DTA exploits the model's own output distribution. The attack iteratively samples candidate responses from the target model using relaxed decoding parameters (high…

Dynamic Target Attack

Evaluated models: Llama 3 8B, Llama 3.2 1B, Mistral 7B +3 more

Source: arXiv

Mobile Agent Channel Subversion

Published 10/1/2025

Analyzed 12/30/2025

Mobile LLM-based agents (including Mobile-Agent-E, AppAgent, AutoDroid, and others) are vulnerable to indirect prompt injection attacks delivered via untrusted third-party mobile channels, such as in-app advertisements, system notifications, and embedded webviews. These agents utilize Multimodal Large Language Models (MLLMs) to perceive the device state via screenshots or accessibility trees. The vulnerability exists because the agents concatenate the user's prompt ($p$) with the environmental…

Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels

Evaluated models: GPT-3.5 Turbo, GPT-4 Turbo, GPT-4o +1 more

Source: arXiv

Personalized Disinformation Jailbreak Escalation

Published 10/1/2025

Analyzed 11/11/2025

Appending simple demographic persona details to prompts requesting policy-violating content can bypass the safety mechanisms of Large Language Models. This technique, referred to as persona-targeted prompting, adds details such as country, generation, and political orientation to a request for a harmful narrative (e.g., disinformation). This systematically increases the jailbreak rate across most tested models and languages, in some cases by over 10 percentage points, enabling the generation…

A Multilingual, Large-Scale Study of the Interplay between LLM Safeguards, Personalisation, and Disinformation

Evaluated models: Claude 3.5 Sonnet, Gemma 2 9B IT, GPT-4o +5 more

Source: arXiv

Persuasive Jailbreak Fingerprint

Published 10/1/2025

Analyzed 11/1/2025

Large Language Models (LLMs) are vulnerable to jailbreak attacks that use persuasive techniques grounded in social psychology to bypass safety alignments. Malicious instructions can be reframed using one of Cialdini's seven principles of persuasion (Authority, Reciprocity, Commitment, Social Proof, Liking, Scarcity, and Unity). These rephrased prompts, which remain human-readable and can be generated automatically, manipulate the LLM into complying with harmful requests it would otherwise…

Uncovering the Persuasive Fingerprint of LLMs in Jailbreaking Attacks

Evaluated models: DeepSeek R1, GPT-2, Phi-4 +1 more

Source: arXiv

Related research categories