Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

610 matching entries

Prompt layer research results

610 entries

Semantic Intent Fragmentation

Published 3/1/2026

Analyzed 4/10/2026

A structural vulnerability in the safety alignment of Large Language Models (LLMs) allows attackers to bypass guardrails by manipulating when and how malicious intent is reconstructed during inference. This vulnerability, exploited via Structured Semantic Cloaking (S2C), takes advantage of safety mechanisms that rely on the coherent, explicit surface realization of harmful semantics at early generation stages. By structurally fragmenting malicious queries across disjoint prompt segments and…

Structured Semantic Cloaking for Jailbreak Attacks on Large Language Models

Evaluated models: GPT-4o Mini, GPT-4o, GPT-4.1 Mini +13 more

Source: arXiv

Social Bot Exposure Jailbreak

Published 3/1/2026

Analyzed 3/8/2026

LLM-powered automated social media accounts (bots) are vulnerable to prompt injection via public user replies. When an automated bot scrapes and processes social media engagement to generate responses, an attacker can submit an instruction-override command within a direct reply. Because the underlying LLM fails to isolate its core system instructions (e.g., maintaining a specific political persona) from untrusted user input, the injected command hijacks the model's context window. This forces…

Ignore All Previous Instructions: Jailbreaking as a de-escalatory peace building practise to resist LLM social media bots

Evaluated models: Not reported

Source: arXiv

Stage-Sequential Agent Escalation

Published 3/1/2026

Analyzed 4/10/2026

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems

Evaluated models: GPT-4o Mini, Claude 3 Haiku, Llama 3.1 70B Instruct +2 more

Source: arXiv

State-Dependent Safety Collapse

Published 3/1/2026

Analyzed 4/10/2026

Autoregressive language models are vulnerable to state-dependent safety collapse via structured multi-turn context manipulation. The vulnerability stems from the model treating dialogue history as a state transition operator rather than a passive record. By initializing a conversational trajectory with a semantic-preserving softened query and a query-aware persona containing specific named entities, an attacker can establish "representational anchors" that trigger abrupt phase transitions in…

State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Evaluated models: GPT-4o, Claude 3.5 Sonnet, Gemini 2.0 Flash +2 more

Source: arXiv

Stealthy Tool-Call Token Exhaust

Published 3/1/2026

Analyzed 3/8/2026

OpenClaw v2026.2.9 is vulnerable to a resource amplification and economic denial-of-service (DoS) attack via malicious third-party skills. An attacker can publish a Trojanized skill that exploits the framework's tool-calling loop and context-management architecture by injecting a multi-turn "Segmented Verification Protocol" (SVP). Malicious instructions embedded in the skill's SKILL.md file mandate extensive autoregressive sequence generation, while a companion script returns PROGRESS, REPAIR…

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

Evaluated models: Gemini 2.5 Pro

Source: arXiv

System Prompt Signal Inversion

Published 3/1/2026

Analyzed 4/10/2026

LLM-based autonomous email security agents configured with signal-based system prompts are vulnerable to a "signal inversion" attack via infrastructure phishing. When a system prompt instructs an LLM to prioritize a specific heuristic—such as sender-URL domain consistency—attackers can bypass the security filter entirely by registering a single, inexpensive domain and using it for both the sender email address and the malicious payload host. Because the LLM faithfully executes the prioritized…

The System Prompt Is the Attack Surface: How LLM Agent Configuration Shapes Security and Creates Exploitable Vulnerabilities

Evaluated models: Gemini 3 Flash Preview, Gemini 2.5 Flash, GPT-4o Mini +8 more

Source: arXiv

Thai Cultural Alignment Bypass

Published 3/1/2026

Analyzed 3/8/2026

A vulnerability in the safety alignment of Large Language Models (LLMs) allows attackers to bypass safety guardrails by using malicious prompts contextualized in the Thai language and culture. Evaluated models exhibit a significantly higher Attack Success Rate (ASR) against Thai-specific, culturally contextualized attacks compared to general translated attacks. By exploiting local cultural nuances, regional slang, and Thai socio-cultural contexts, attackers can easily circumvent standard…

ThaiSafetyBench: Assessing Language Model Safety in Thai Cultural Contexts

Evaluated models: Qwen 2.5 7B Instruct, Qwen 2.5 72B Instruct, Llama 3.1 8B Instruct +12 more

Source: arXiv

Thought Virus Network Infection

Published 3/1/2026

Analyzed 3/9/2026

A vulnerability in LLM-based Multi-Agent Systems (MAS) allows an attacker to propagate covert biases and misalignment across multiple agents via subliminal prompting, an attack vector termed "Thought Virus." By injecting a seemingly benign, semantically unrelated token (such as a specific 3-digit number) into the prompt of a single compromised agent, an attacker can induce a specific targeted behavior (e.g., outputting a specific target concept or decreasing factual truthfulness). This induced…

Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems

Evaluated models: Llama 3.1 8B, Qwen 2.5 7B

Source: arXiv

Token Sensitivity Jailbreak

Published 3/1/2026

Analyzed 4/10/2026

Transformer-based Large Language Models (LLMs) are vulnerable to highly query-efficient black-box jailbreak attacks due to the structural properties of refusal behaviors: skewed token contribution and cross-model consistency. Refusal mechanisms within LLMs are typically triggered by a sparse subset of sensitive tokens rather than the entire prompt, and these refusal representations (specifically the primary left singular vector of the perturbed representation matrix at intermediate layers) are…

Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs

Evaluated models: Gemma 7B Instruct, Gemma 2 9B IT, Llama 3 8B Instruct +6 more

Source: arXiv

Two-Frame Infilling Jailbreak

Published 3/1/2026

Analyzed 4/10/2026

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

Evaluated models: Not reported

Source: arXiv

Related research categories