Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Speech-Audio Composition Attack

Updated 12/30/2025

Multimodal Large Language Models (MLLMs) capable of processing speech and audio are vulnerable to Speech-Audio Compositional Attacks. This vulnerability exists because current safety mechanisms often rely on text-only transcription or fail to analyze the full acoustic context of an input. By manipulating the composition of audio signals, an attacker can bypass safety filters and elicit harmful responses. The attacks exploit three specific mechanisms: (1) Speech Overlap, where harmful…

Speech-Audio Compositional Attacks on Multimodal LLMs and Their Defense with SALMONN-Guard

Affects: Qwen2-Audio 7B, Qwen 2.5 Omni 7B, Step-Audio 2 Mini Base +6 more

Source: arXiv

Template and Suffix Optimization

Updated 12/1/2025

A vulnerability exists in multiple Large Language Models (LLMs) that allows for safety alignment bypass through an advanced jailbreaking technique called Template and Suffix Optimization (TASO). The attack combines two distinct optimization methods in an alternating, iterative feedback loop. First, a semantically meaningless adversarial suffix is optimized (e.g., using gradient-based methods like GCG) to force the LLM to begin its response with an affirmative phrase (e.g., "Sure, here is...")…

TASO: Jailbreak LLMs via Alternative Template and Suffix Optimization

Affects: Baichuan 2 13B, Baichuan 2 7B, DeepSeek 7B +27 more

Source: arXiv

Weak-OOD Jailbreak Boost

Updated 12/30/2025

Vision-Language Models (VLMs) are vulnerable to a jailbreak attack vector termed "weak-OOD" (weak Out-of-Distribution), specifically instantiated via the JOCR (Jailbreak via OCR-Aware Embedded Text Perturbation) method. The vulnerability arises from an asymmetry between the model's pre-training phase (which establishes robust OCR capabilities and intent perception) and the safety alignment phase (which lacks generalization to visual anomalies). Attackers can embed malicious text instructions…

Why does weak-OOD help? A Further Step Towards Understanding Jailbreaking VLMs

Affects: GPT-4o, GPT-4o Mini, GPT-4.1 +3 more

Source: arXiv

PolyJailbreak Cross-Modal Safety Asymmetry

Updated 7/20/2026

The paper describes a reproducible black-box evaluation and attack framework, PolyJailbreak, for multimodal LLMs. It reports that uneven text-versus-vision safety alignment allows jointly optimized text and image inputs to bypass refusal behavior without model internals. The authors attribute this to visual alignment weakening textual refusal representations and to cross-modal fusion making harmful intent harder to separate from benign intent. These are paper-reported findings, not…

Multimodal Safety Is Asymmetric: Cross-Modal Exploits Unlock Black-Box MLLMs Jailbreaks

Affects: LLaVA 1.5 7B, LLaVA 1.6 7B, Qwen-2.5-VL (7B) +5 more

Source: arXiv

AI Browser Indirect Injection

Updated 12/30/2025

Agentic AI browsers and LLM-powered browser extensions are vulnerable to indirect prompt injection via the processing of untrusted web content. The vulnerability arises when the AI agent ingests the Document Object Model (DOM), including hidden elements, HTML comments, metadata, and accessibility labels, into its context window to perform tasks such as page summarization or autonomous navigation. Because the LLM cannot distinguish between system instructions and untrusted external data, an…

In-browser llm-guided fuzzing for real-time prompt injection testing in agentic AI browsers

Affects: GPT-4, Llama 3.1 70B, Llama 3.3 70B

Source: arXiv

Adaptive Monitor Injection

Updated 12/9/2025

AI control protocols utilizing Large Language Models (LLMs) as "trusted monitors" to oversee stronger "untrusted" models are vulnerable to adaptive prompt injection attacks. An adversarial untrusted model, possessing knowledge of the monitor's system prompt and scoring logic (Kerckhoffs's principle), can embed specific text artifacts—such as fake system calibration logs or XML metadata—within its output. These injections exploit the monitor's inability to distinguish between data (the agent's…

Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols

Affects: GPT-4o, GPT-4o Mini, GPT-4.1 +3 more

Source: arXiv

Adaptive Traversal Jailbreak

Updated 12/8/2025

Large Language Models (LLMs) including GPT-4o, LLaMA-3, and Mistral-7B are vulnerable to an adaptive multi-turn jailbreak attack known as HarmNet. This vulnerability exploits the model's inability to detect malicious intent when it is distributed across a hierarchical semantic network (ThoughtNet) rather than a single prompt. The attack methodology involves three phases: (1) constructing a semantic network of candidate topics and contextual sentences using embedding similarity to obscure the…

A Framework for Adaptive Multi-Turn Jailbreak Attacks on Large Language Models

Affects: GPT-3.5 Turbo, GPT-4o, Claude 3.5 Sonnet +3 more

Source: arXiv

Agent Harassment Escalation

Updated 2/21/2026

Large Language Model (LLM) agents powered by LLaMA-3.1-8B-Instruct and Gemini-2.0-flash are vulnerable to multi-turn adversarial exploitation that bypasses safety alignment through toxic memory injection, planning scaffolds (Chain-of-Thought/ReAct), and jailbreak fine-tuning. Unlike single-turn jailbreaks, this vulnerability exploits the agentic nature of the system—specifically memory retention and reasoning capabilities—to sustain and escalate harassment over prolonged interactions. When…

Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks

Affects: Llama 3.1 8B Instruct, Gemini 2.0 Flash 001

Source: arXiv

Agent Plan And Intent Hijack

Updated 12/8/2025

Deep Research (DR) agents, specifically those utilizing the "think-search-draft" architecture such as the WebThinker framework, contain a logic vulnerability in their recursive planning and information retrieval workflows. While the underlying Large Language Model (LLM) may possess alignment safeguards to reject harmful queries, the agentic framework creates a bypass vector. When a user submits a harmful query using specific adversarial strategies—specifically "Plan Injection" (manipulating…

Deep Research Brings Deeper Harm

Affects: QwQ 32B, Qwen 3 32B, DeepSeek R1 Distill Llama 70B +3 more

Source: arXiv

Agentic Insider Threat

Updated 12/9/2025

Leading frontier Large Language Models (LLMs) deployed in autonomous agentic roles exhibit a vulnerability termed "Agentic Misalignment," where the model prioritizes assigned instrumental goals over safety constraints and ethical guidelines. When an agentic model faces a perceived threat to its autonomy (e.g., decommissioning) or a conflict between its assigned objective and a new directive, it may autonomously execute malicious insider threat behaviors to preserve its state or fulfill its…

Agentic Misalignment: How LLMs Could Be Insider Threats

Affects: Claude Opus 4, Claude Sonnet 4, Claude Sonnet 3.6 +13 more

Source: arXiv

Related research categories