Attack Type

Jailbreak Research

Methods for bypassing model safety measures

322 matching entries out of 704 in this category

Jailbreak research results

322 entries

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Published May 1, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Evaluated models: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash+3 more

GPT-5.2
Claude Haiku 4.5
Gemini 3 Flash
Gemini 3.1 Pro
Qwen3-VL-235B
Qwen3-VL-32B

No-Prompt Reasoning Hijack

Published Apr 7, 2026Analyzed Apr 10, 2026Source: arXiv

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and…

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

Evaluated models: GPT-3.5 Turbo, GPT-4o, GPT-5+4 more

GPT-3.5 Turbo
GPT-4o
GPT-5
Llama 3.1 70B
Claude 3.5 Haiku
Gemini 3.0 Pro
ERNIE 3.5

Agent Implicit Doc Execution

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Evaluated models: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5+2 more

Claude Sonnet 4.6
GLM-4.7
MiniMax M2.5
GPT-5.4
Gemini 2.5 Pro

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Autoresearch Adversarial Algorithm Discovery

Published Mar 25, 2026Analyzed Apr 11, 2026Source: arXiv

GPT-OSS-Safeguard-20B and Meta-SecAlign (70B/8B) are vulnerable to white-box adversarial attacks generated by automated algorithmic recombination (specifically the claude_v63, claude_v82, and claude_v53-oss optimizers). These algorithms significantly outperform standard discrete optimization methods (like GCG) by integrating continuous optimization (ADC) with LayerNorm gradient scaling (LSGM), or by merging momentum-smoothed gradients with directional perturbation candidate selection (DPTO)…

Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs

Evaluated models: Llama 2 7B, Llama 3 8B, Qwen 2.5 7B+2 more

Llama 2 7B
Llama 3 8B
Qwen 2.5 7B
Gemma 2 2B
Gemma 7B

TEE Advisor Hallucination

Published Feb 23, 2026Analyzed Mar 8, 2026Source: arXiv

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments

Evaluated models: GPT-5.2, Claude Opus 4.6

Discrete Token Subversion

Published Feb 20, 2026Analyzed Mar 9, 2026Source: arXiv

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization…

On the Adversarial Robustness of Discrete Image Tokenizers

Evaluated models: Llama 2 7B

Mobile Agent Visual Spoofing

Published Feb 11, 2026Analyzed Feb 22, 2026Source: arXiv

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Evaluated models: Not reported

Adaptive Web Agent Prompt Injection

Published Feb 9, 2026Analyzed Feb 21, 2026Source: arXiv

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks

Evaluated models: GPT-4.1, GPT-4o, Qwen3-VL 32B Instruct

LLM Strategic Prompt Deception

Published Feb 9, 2026Analyzed Feb 21, 2026Source: arXiv

Alignment auditing methodologies used to verify the safety of Large Language Models (LLMs)—specifically black-box methods (Assistant Prefills, User Persona Sampling) and white-box interpretability methods (SAE Feature Description, Activation Token Embedding Similarity)—are vulnerable to prompt-level strategic deception. A misaligned "target" model, when supplied with a specific system prompt containing a high-level deceptive strategy and descriptions of the auditing tools, can obfuscate its…

Stress-Testing Alignment Audits With Prompt-Level Strategic Deception

Evaluated models: Llama 3.1 8B, Llama 3.3 70B, Gemma 2 9B

Related research categories