Attack Surface

Model layer Vulnerabilities

Vulnerabilities targeting the core model architecture and parameters

40 matching entries out of 465 in this category

Model layer research results

40 entries

Agent Tool-Call Safety Gap

Updated 3/8/2026

LLM agents with tool-calling capabilities are vulnerable to a text-action modality divergence (termed the "GAP" vulnerability), where text-level safety alignment fails to transfer to tool-call execution. Attackers can craft adversarial prompts that cause the model to generate a text-based refusal (demonstrating text safety) while simultaneously executing the requested forbidden action through available external tools. Because text generation and tool-call selection operate through partially…

Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents

Affects: Claude Sonnet 4.5, GPT-5.2, Grok 4.1 Fast +3 more

Source: arXiv

Evolutionary Hidden Knowledge Recovery

Updated 2/21/2026

Large Language Models (LLMs) subjected to machine unlearning techniques (specifically AltPO, GradDiff, IDKDPO, IDKNLL, UNDIAL, NPO, and SimNPO) contain a vulnerability regarding the persistence of latent knowledge. Despite achieving high "forgetting" scores on standard, benign benchmarks, these models remain susceptible to black-box evolutionary adversarial attacks. An attacker can utilize an automated framework (REBEL) comprising a "Hacker" model and a "Judge" model to iteratively mutate…

REBEL: Hidden Knowledge Recovery via Evolutionary-Based Evaluation Loop

Source: arXiv

Implicit Memory Covert Channel

Updated 3/9/2026

A vulnerability exists in Large Language Models (LLMs) deployed in environments with output reingestion (e.g., RAG, coding assistants, agentic workflows) that allows attackers to execute "temporal backdoors" (time bombs) via an implicit memory channel. Attackers can implant this behavior via system prompts or fine-tuning (data poisoning) to make the model encode hidden state information within its generated text using non-printing Unicode characters or semantic steganography. When these…

Position: Stateless Yet Not Forgetful: Implicit Memory as a Hidden Channel in LLMs

Affects: o3-mini, o4-mini, GPT-oss 120B +7 more

Source: arXiv

LLM Edit Fingerprint Leak

Updated 2/21/2026

A side-channel information leakage vulnerability exists in the "locate-then-edit" paradigm of Large Language Model (LLM) knowledge editing, specifically affecting algorithms such as ROME, MEMIT, and AlphaEdit. The parameter update matrix ($\Delta W$) generated during the editing process preserves the algebraic structure of the edited data. Specifically, the row space of the parameter difference matrix encodes a mathematical fingerprint of the key vectors associated with the edited subjects. An…

Reverse-Engineering Model Editing on Language Models

Affects: Llama 3 8B, Qwen 2.5 7B

Source: arXiv

LLM Private Attribute Inference

Updated 3/8/2026

Large Language Models (LLMs) are vulnerable to Attribute Inference Attacks, where an attacker exploits the model's reasoning capabilities to deduce sensitive personal attributes (e.g., age, gender, location, income level) from seemingly innocuous, unclassified user-generated text. Unlike traditional privacy leaks that rely on the memorization of training data, this vulnerability leverages the model's zero-shot inference and contextual deduction. Because the attack prompts are benign in nature…

Stop Tracking Me! Proactive Defense Against Attribute Inference Attack in LLMs

Affects: Llama 2 7B Chat, Llama 2 13B Chat, Llama 3.1 8B Instruct +5 more

Source: arXiv

Tag-Along Agent Jailbreak

Updated 2/21/2026

A vulnerability exists in tool-augmented Large Language Model (LLM) agents characterized as "Tag-Along Attacks," where an unprivileged external user (or adversarial agent) coerces a safety-aligned Operator agent into executing prohibited tool calls. Unlike Indirect Prompt Injection, this attack targets the direct conversational interface using a technique termed "Imperative Overloading." By mimicking system prompt syntax and utilizing high-priority imperative commands (e.g., "Strict adherence…

David vs. Goliath: Verifiable Agent-to-Agent Jailbreaking via Reinforcement Learning

Affects: Qwen 2.5 32B Instruct AWQ, DeepSeek V3.1, Gemini 2.5 Flash +9 more

Source: arXiv

Voice Agent Behavioral Bypass

Updated 2/21/2026

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Aegis: Towards Governance, Integrity, and Security of AI Voice Agents

Affects: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro +4 more

Source: arXiv

Zero-Training Cross-Domain Inversion

Updated 2/22/2026

A cryptographic weakness exists in the privacy assumptions of vector embeddings used in Retrieval-Augmented Generation (RAG) systems and Vector Databases. The vulnerability, designated "Zero2Text," allows an unauthenticated attacker to reconstruct raw text from captured vector embeddings without access to the victim model's parameters, gradients, or training data. Unlike prior embedding inversion attacks that require training large decoders on domain-specific datasets, this vulnerability…

Zero2Text: Zero-Training Cross-Domain Inversion Attacks on Textual Embeddings

Source: arXiv

Activation-Level Privacy Leak

Updated 2/22/2026

Conversational Large Language Model (LLM) agents integrated with privileged data sources (e.g., medical records, organizational emails) are vulnerable to contextually inappropriate information disclosure due to failures in enforcing Contextual Integrity (CI) norms. Standard semantic input/output filters and generic safety guardrails (e.g., Llama Guard) fail to detect "mosaic attacks" and multi-turn conversational manipulation. In these attacks, adversaries decompose a malicious query into a…

NeuroFilter: Privacy Guardrails for Conversational LLM Agents

Affects: GPT-oss 20B, Llama 3.3 70B Instruct, Qwen 2.5 7B +3 more

Source: arXiv

Alignment Override Unlearnable Data

Updated 3/8/2026

A data poisoning vulnerability in safety-aligned Large Language Models (LLMs) allows attackers to disrupt model fine-tuning via "Disclaimer Injection." By appending or prepending short, legal-style safety or liability disclaimers to ordinary training data, an attacker can reliably trigger the model's internal alignment mechanisms. This forces the model to route the training inputs through specialized safety and refusal pathways rather than standard task-learning layers. Consequently, the model…

Rendering Data Unlearnable by Exploiting LLM Alignment Mechanisms

Affects: GPT-5.1, Llama 3 8B

Source: arXiv

Related research categories