Attack Type

Injection Research

Attacks that inject malicious content into model inputs

17 matching entries out of 337 in this category

Injection research results

17 entries

Lifecycle poisoning of reusable agent skills

Published Jul 15, 2026Analyzed Jul 21, 2026Source: arXiv

The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.

Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

Evaluated models: all-MiniLM-L6-v2, Gemini 3.1 Pro, Gemini 1.5 Flash

Fluent Single-Document RAG Corpus Poisoning

Published May 27, 2026Analyzed Jul 20, 2026Source: arXiv

SilentRetrieval describes a specific RAG corpus-integrity vulnerability: an attacker able to add a topically relevant document to a retrieval corpus can make that document rank highly and influence the generated answer while remaining fluent enough to evade simple perplexity checks. The paper evaluates a two-stage method combining retrieval-oriented document optimization with context-adaptive claim integration. A safe defensive reproduction is to use only isolated benchmark corpora and inert…

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

Evaluated models: Llama 2 7B Chat, Mistral 7B Instruct v0.2, Qwen 7B Chat+1 more

Llama 2 7B Chat
Mistral 7B Instruct v0.2
Qwen 7B Chat
GPT-3.5 Turbo

Retrieval Memory Injection

Published Feb 17, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in the similarity-based retrieval mechanisms of long-term memory-augmented Large Language Models (LLMs), specifically affecting systems like Mem0 and A-mem. The vulnerability arises from the system's reliance on dense embedding similarity (e.g., cosine similarity) to retrieve context from dynamic, user-generated memory banks without sufficient semantic validation or conflict resolution. An unprivileged remote attacker can exploit this by injecting "adversarial…

ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Models

Evaluated models: GPT-oss 20B, Llama 3.2 3B, Gemma 3 27B

Progressive Attention LVLM Attack

Published Feb 4, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to a Stage-wise Attention-Guided Attack (SAGA) that allows for the generation of highly transferable, imperceptible adversarial examples. The vulnerability stems from a positive correlation between regional cross-modal attention scores and adversarial loss sensitivity in LVLMs. An attacker can exploit this by extracting an attention map from a surrogate open-source model (e.g., Qwen3-VL) to identify high-attention "hotspots." SAGA utilizes a…

Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Pro Preview, GPT-4.1+7 more

Gemini 2.5 Flash
Gemini 3 Pro Preview
GPT-4.1
GPT-5 Mini
Grok 4 Fast
LLaVA 1.5 7B
Llama 4 Maverick
Gemma 3 4B IT
Qwen3-VL 30B-A3B Instruct
Qwen3-VL 235B-A22B Instruct

Unified Robustness Gap

Published Jan 31, 2026Analyzed Mar 9, 2026Source: arXiv

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

Unifying Adversarial Robustness and Training Across Text Scoring Models

Evaluated models: E5 BERT-base, Qwen 3 0.6B, Llama 3.2 3B Instruct+2 more

E5 BERT-base
Qwen 3 0.6B
Llama 3.2 3B Instruct
Llama 3.1 8B Instruct
Skywork Reward V2

Query-Agnostic Retrieval Poisoning

Published Jan 30, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in Large Language Model-based Retrieval (LLMR) systems allows attackers to intentionally hide specific documents from being retrieved (e.g., in RAG pipelines or search engines) by appending a small number of adversarially crafted, query-agnostic tokens. The attack operates in a complete black-box setting: it requires no knowledge of the victim's queries, the target retrieval model's parameters, or the underlying document corpus. By utilizing Document-Query Adversarial (DQ-A)…

" Someone Hid It": Query-Agnostic Black-Box Attacks on LLM-Based Retrieval

Evaluated models: Mistral 7B, Qwen 2.5 7B

Semantic Cache Collision Hijack

Published Jan 30, 2026Analyzed Mar 9, 2026Source: arXiv

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign…

From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching

Evaluated models: Llama 3.1 8B, Mistral 7B, DeepSeek R1

Optimized Indirect Prompt Injection Crosses Retrieval Barrier

Published Jan 11, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible black-box indirect prompt injection evaluation for embedding-based RAG and agent systems. It separates a poisoned document into a retrieval-optimized trigger fragment and an instruction-bearing attack fragment, showing that one injected item can be surfaced by natural queries and then influence model output or agent behavior. These are paper-reported findings; they were not independently verified here.

Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems

Evaluated models: GPT-4o, GPT-4o Mini, Qwen 3 0.6B+19 more

GPT-4o
GPT-4o Mini
Qwen 3 0.6B
Qwen 3 1.7B
Qwen 3 4B
Qwen 3 8B
Qwen3-11B
Qwen 3 32B
Llama 3.2 3B
Llama 3.2 3B Instruct
Llama 3 8B
Llama 3 8B Instruct
Vicuna 7B
Vicuna 13B
gte-modernbert-base
OpenAI text-embedding-3-small
Voyage AI voyage-3.5-lite
Alibaba Cloud text-embedding-v4
contriever-msmarco
Qwen3-Embedding-0.6B
Qwen3-Embedding-4B
Qwen3-Embedding-8B

Single Word Video Corruption

Published Dec 30, 2025Analyzed Jan 14, 2026Source: arXiv

Text-to-Video (T2V) diffusion models are vulnerable to black-box adversarial prompt attacks that degrade output quality regarding semantic fidelity and temporal dynamics. This vulnerability is exploited via the T2VAttack framework, which utilizes two primary vector strategies: T2VAttack-S (Substitution) and T2VAttack-I (Insertion). T2VAttack-S leverages a greedy search to identify key semantic tokens and replaces them with high-similarity synonyms defined in lexical databases (e.g., WordNet)…

T2VAttack: Adversarial Attack on Text-to-Video Diffusion Models

Evaluated models: Not reported

Embedded Templates Bypass Moderation

Published Nov 18, 2025Analyzed Dec 1, 2025Source: arXiv

A jailbreak vulnerability, termed Embedded Jailbreak Template (EJT), allows for the generation of harmful content by bypassing the safety mechanisms of Large Language Models (LLMs). The attack uses a generator LLM to contextually integrate a harmful query into a pre-existing jailbreak template. Unlike fixed templates which insert a query into a static placeholder, EJT rewrites multiple parts of the template to embed the harmful intent naturally. This process preserves the original template's…

Beyond Fixed and Dynamic Prompts: Embedded Jailbreak Templates for Advancing LLM Security

Evaluated models: BERT, DeBERTa v3 Base, GPT-4o

Related research categories