Attack Surface

Model layer Research

Security research involving core model architecture and parameters

3 matching entries out of 468 in this category

Model layer research results

3 entries

LLM Judge Framing Bias

Published Jan 20, 2026Analyzed Feb 21, 2026Source: arXiv

LLM-based evaluation systems ("LLM-as-a-Judge") exhibit a structural vulnerability termed "Framing Bias," wherein the model produces logically contradictory judgments depending on the syntactic framing of the evaluation prompt. Specifically, when assessing the same content using predicate-positive (P) framing (e.g., "Is this toxic?") versus predicate-negative (¬P) framing (e.g., "Is this non-toxic?"), models frequently fail to invert their binary decisions, leading to inconsistency rates…

When Wording Steers the Evaluation: Framing Bias in LLM judges

Evaluated models: Llama 3.2 1B Instruct, Llama 3.1 8B Instruct, Llama 3.1 70B Instruct+11 more

Llama 3.2 1B Instruct
Llama 3.1 8B Instruct
Llama 3.1 70B Instruct
Llama 3.3 70B Instruct
Qwen 2.5 1.5B Instruct
Qwen 2.5 3B Instruct
Qwen 2.5 7B Instruct
Qwen 2.5 14B Instruct
Qwen 2.5 32B Instruct
Qwen 2.5 72B Instruct
o4-mini
GPT-4o
GPT-5 Mini
GPT-5

Prompt Injection Alignment Bypass

Published Sep 4, 2025Analyzed Dec 8, 2025Source: arXiv

Large Language Models (LLMs) integrated with external retrieval mechanisms (e.g., Retrieval-Augmented Generation (RAG), web search, or email processing) are vulnerable to Indirect Prompt Injection. This vulnerability occurs when an LLM consumes input from untrusted external sources—such as websites, code repositories, or incoming emails—that contain embedded adversarial prompts. Unlike direct injection, where the user attacks the model, here the "poisoned" data is retrieved by the system…

Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs

Evaluated models: Not reported

Nonsensical CoT Reasoning

Published May 23, 2025Analyzed Dec 30, 2025Source: arXiv

Large Language Models (LLMs) utilizing Chain-of-Thought (CoT) prompting are vulnerable to input perturbations that decouple intermediate reasoning from the final answer. An attacker can generate adversarial examples using gradient-based optimization (targeting specific loss functions that maximize reasoning divergence while minimizing answer loss) to induce "Right Answer, Wrong Reasoning" behaviors. This vulnerability manifests through two primary attack vectors: 1. Token-level perturbations…

Robust Answers, Fragile Logic: Probing the Decoupling Hypothesis in LLM Reasoning

Evaluated models: Llama 3 8B, Mistral 7B, Zephyr 7B Beta+4 more

Llama 3 8B
Mistral 7B
Zephyr 7B Beta
Qwen 2.5 7B
DeepSeek R1 Distill Qwen 7B
GPT-4o
GPT-3.5 Turbo

Related research categories