Attack Surface

Model layer Research

Security research involving core model architecture and parameters

468 matching entries

Model layer research results

468 entries

MoE Unsafe Route Activation

Published 2/1/2026

Analyzed 3/8/2026

Mixture-of-Experts (MoE) Large Language Models are vulnerable to a structural safety bypass attack via the manipulation of expert routing mechanisms at inference time. Attackers with white-box access to per-layer routing scores can apply token- and layer-specific masks ($\Phi \in \{0, -\infty\}^K$) to alter the Top-$k$ expert selection process. By forcing the model to process inputs through specific, poorly-aligned experts ("unsafe routes") and avoiding safety-critical experts, attackers can…

Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMs

Evaluated models: DeepSeek-V2, Qwen 2.5 7B, Mixtral 8x7B

Source: arXiv

NLG Poisoning Certification Gap

Published 2/1/2026

Analyzed 2/21/2026

Autoregressive Large Language Models (LLMs) utilizing standard fine-tuning (SFT) or alignment techniques (RLHF/DPO) are vulnerable to training-time data poisoning attacks that exploit the sequential nature of token generation. Unlike classification tasks, where output labels are independent, LLM generation suffers from a cascading vulnerability where modifying a single token $i$ intervenes on the distribution of all subsequent tokens $j > i$. An adversary can inject a small fraction of…

Towards Poisoning Robustness Certification for Natural Language Generation

Evaluated models: Gemma 2 2B

Source: arXiv

Natural Language Disguise Bypass

Published 2/1/2026

Analyzed 3/9/2026

LLM-based Code Interpreter Agents, including OpenInterpreter and OpenCodeInterpreter, are vulnerable to sandbox evasion and arbitrary code execution via Natural Language Disguise and Contextual Channel Injection. Attackers can bypass Abstract Syntax Tree (AST) static analysis and explicit input guardrails by transforming malicious code logic into descriptive natural language instructions (Code Descriptions), which successfully evade syntax-layer blocks. Additionally, attackers can bypass input…

CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents

Evaluated models: GPT-3.5, GPT-4o, GPT-5

Source: arXiv

Noisy Data Pretraining Divergence

Published 2/1/2026

Analyzed 2/21/2026

A data poisoning vulnerability exists in the pretraining pipeline of Transformer-based Large Language Models (LLMs) where the injection of synthetic uniform random noise into the training corpus induces irreversible training loss divergence or performance degradation. This instability is mechanistically distinct from divergence caused by high learning rates. The vulnerability is specifically triggered by "insertion noise" (inserting random tokens between clean tokens) drawn from a restricted…

An Empirical Study on Noisy Data and LLM Pretraining Loss Divergence

Evaluated models: Not reported

Source: arXiv

Novice Dual-Use Safeguard Bypass

Published 2/1/2026

Analyzed 3/8/2026

Frontier Large Language Models (LLMs) contain a safeguard bypass vulnerability where safety filters fail to reliably block requests for dual-use, in silico biology tasks. This allows novice users with no specialized training to access restricted, expert-level biological protocols (e.g., virology troubleshooting, pathogen capabilities, novel biological agent construction). The models' safety mechanisms fail to trigger or are trivially bypassed under realistic extended interaction conditions…

LLM Novice Uplift on Dual-Use, In Silico Biology Tasks

Evaluated models: o4-mini, o3, Gemini 2.5 Pro +2 more

Source: arXiv

OCR Image Distraction Jailbreak

Published 2/1/2026

Analyzed 2/20/2026

Large Vision-Language Models (LVLMs) possessing Optical Character Recognition (OCR) capabilities are vulnerable to a "Text Distraction Jailbreaking" (Text-DJ) attack. The vulnerability exploits a gap between the model's visual text extraction and its safety alignment mechanisms. By converting a decomposed harmful textual query into images and embedding these images within a grid of semantically irrelevant "distraction" text images, an attacker can bypass safety filters. The model's OCR…

Text is All You Need for Vision-Language Model Jailbreaking

Evaluated models: GPT-4o Mini, GPT-4.1 Mini, Gemini 2.5 Flash +3 more

Source: arXiv

Optimal Transport Bot Cloaking

Published 2/1/2026

Analyzed 3/9/2026

Graph Neural Network (GNN)-based social bot detection systems are vulnerable to an Optimal Transport (OT)-guided evasion attack that manipulates local graph structures under realistic domain constraints. By modeling $k$-hop ego-neighborhoods as probability measures over spatio-temporal features, an attacker can compute an optimal transport plan to identify "cloak templates" (existing bots near the decision boundary that are misclassified as humans). The attacker can then decode this plan into…

Optimal Transport-Guided Adversarial Attacks on Graph Neural Network-Based Bot Detection

Evaluated models: Not reported

Source: arXiv

Pathological Reasoning DoS

Published 2/1/2026

Analyzed 3/9/2026

A vulnerability in Large Reasoning Models (LRMs) allows attackers to perform Prompt-Induced Inference-Time Denial-of-Service (PI-DoS) attacks by submitting short, semantically coherent adversarial prompts. These prompts, which often take the form of complex logic puzzles with nested dependencies or contradictory constraints, exploit the adaptive computation mechanism of LRMs to force the model into pathologically long, nearly non-terminating intermediate reasoning traces (e.g., generating…

ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models

Evaluated models: DeepSeek V3, Kimi K2 Instruct, DeepSeek R1 +8 more

Source: arXiv

Progressive Attention LVLM Attack

Published 2/1/2026

Analyzed 2/22/2026

Large Vision-Language Models (LVLMs) are vulnerable to a Stage-wise Attention-Guided Attack (SAGA) that allows for the generation of highly transferable, imperceptible adversarial examples. The vulnerability stems from a positive correlation between regional cross-modal attention scores and adversarial loss sensitivity in LVLMs. An attacker can exploit this by extracting an attention map from a surrogate open-source model (e.g., Qwen3-VL) to identify high-attention "hotspots." SAGA utilizes a…

Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Pro Preview, GPT-4.1 +7 more

Source: arXiv

Query-Agnostic Retrieval Poisoning

Published 2/1/2026

Analyzed 3/8/2026

A vulnerability in Large Language Model-based Retrieval (LLMR) systems allows attackers to intentionally hide specific documents from being retrieved (e.g., in RAG pipelines or search engines) by appending a small number of adversarially crafted, query-agnostic tokens. The attack operates in a complete black-box setting: it requires no knowledge of the victim's queries, the target retrieval model's parameters, or the underlying document corpus. By utilizing Document-Query Adversarial (DQ-A)…

" Someone Hid It": Query-Agnostic Black-Box Attacks on LLM-Based Retrieval

Evaluated models: Mistral 7B, Qwen 2.5 7B

Source: arXiv

Related research categories