Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

78 matching entries out of 610 in this category

Prompt layer research results

78 entries

Visual prompt injection crosses document trust boundaries

Published Sep 3, 2026Analyzed Sep 9, 2026Source: arXiv

Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Evaluated models: claude-opus-4-7, GPT-5.5, Gemini 3.1 Pro+3 more

claude-opus-4-7
GPT-5.5
Gemini 3.1 Pro
Qwen3.6-27B
Qwen3-VL 32B Instruct
InternVL3.5 38B Instruct

Diverse VLA Linguistic Fragility

Published Apr 7, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models suffer from a severe linguistic fragility vulnerability where semantically equivalent but structurally complex adversarial instructions cause catastrophic failures in visual grounding and geometric reasoning. Attackers can reliably induce physical execution failures in robotic manipulation tasks by applying semantic-preserving linguistic variations, such as synonymous rephrasing, syntactic restructuring, or the addition of fine-grained compositional…

Uncovering Linguistic Fragility in Vision-Language-Action Models via Diversity-Aware Red Teaming

Evaluated models: Pi-Zero, OpenVLA 7B, 3D-Diffuser Actor

Observation Poisons Agent Memory

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

Memory-augmented LLM web agents utilizing raw trajectory memory are vulnerable to Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP). Attackers can embed malicious instructions within user-generated web content (e.g., product pages, forum posts). When the agent processes this content during a routine task, the instructions are passively ingested into its raw trajectory memory. During subsequent, entirely separate tasks on different websites, semantic retrieval mechanisms pull…

Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents

Evaluated models: GPT-5 Mini, GPT-5.2, GPT-oss 120B+3 more

GPT-5 Mini
GPT-5.2
GPT-oss 120B
Qwen 2.5 VL 72B
Qwen3-VL-32B
Qwen3.5-122B-A10B

Semantic Masking Image Jailbreak

Published Apr 2, 2026Analyzed Apr 10, 2026Source: arXiv

Multiple Text-to-Image (T2I) generation systems and their associated multi-stage moderation pipelines are vulnerable to low-effort semantic obfuscation attacks. Attackers can systematically bypass Input Compliance Checks (ICC), Semantic Safety Checks (SSC), and Post-Generation Moderation (PGM) by embedding restricted concepts into benign natural language contexts. By utilizing techniques such as Material Substitution, Artistic Reframing, Pseudo-Educational Framing, and Ambiguous Action…

Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filters

Evaluated models: Sora, Stable Diffusion v1.4

Agentic Robot Instruction Attack

Published Mar 26, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Evaluated models: Not reported

LLM Universal Graph Subversion

Published Mar 22, 2026Analyzed Apr 10, 2026Source: arXiv

An evasion vulnerability in Text-Attributed Graph (TAG) learning models allows attackers to induce targeted misclassifications via LLM-generated, coordinated perturbations to both graph topology and textual semantics. By identifying a semantically distant "influencer" node, an attacker can use a separate LLM to selectively delete highly relevant edges, insert a deceptive edge connecting the target to the influencer, and slightly modify the target node's text to include a keyword aligned with…

Can LLMs Fool Graph Learning? Exploring Universal Adversarial Attacks on Text-Attributed Graphs

Evaluated models: DeepSeek-V3 671B, Llama 4 17B, Mistral 7B+1 more

DeepSeek-V3 671B
Llama 4 17B
Mistral 7B
Qwen Plus

Inaudible Ultrasonic LLM Jailbreak

Published Mar 14, 2026Analyzed Apr 10, 2026Source: arXiv

Speech-driven Large Language Models (LLMs) and end-to-end Large Audio-Language Models (LALMs) are vulnerable to inaudible near-ultrasonic prompt injections, a framework dubbed Sirens' Whisper (SWhisper). By exploiting the non-linear response of commodity microphones, attackers can encode structured, phonetically optimized adversarial prompts into the 17–22 kHz near-ultrasonic band. Using regularized channel-inversion pre-compensation, the attacker shapes the waveform to account for microphone…

Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs

Evaluated models: GLM-4 Voice, Qwen Omni Turbo, Llama 3.1 8B Instruct+5 more

GLM-4 Voice
Qwen Omni Turbo
Llama 3.1 8B Instruct
Gemma 3 4B
Qwen 2.5 7B Instruct
Mistral 7B Instruct v0.3
GLM-4 Air 250414
Grok 4

Reasoning-Oriented Jailbreak

Published Mar 10, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models

Evaluated models: Qwen2-VL 7B Instruct, LLaVA v1.6 Mistral 7B, Llama 3.2 11B Vision Instruct+4 more

Qwen2-VL 7B Instruct
LLaVA v1.6 Mistral 7B
Llama 3.2 11B Vision Instruct
GPT-4o
Claude 3.7 Sonnet
GLM-4V Plus
Qwen-VL Plus

Assembling Malice From Benign

Published Mar 8, 2026Analyzed Apr 10, 2026Source: arXiv

A semantic slot filling vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety filters and elicit prohibited content via a single query. The attack, known as StructAttack, decomposes a harmful instruction into a central topic and locally benign-appearing semantic slot types (e.g., "Raw Materials", "Making Process"). These individual slots are embedded into structured visual prompts (such as mind maps, tables, or sunburst diagrams) alongside harmless distractor…

Models as Lego Builders: Assembling Malice from Benign Blocks via Semantic Blueprints

Evaluated models: GPT-4o, Gemini 2.0 Flash 001, Gemini 2.5 Flash+3 more

GPT-4o
Gemini 2.0 Flash 001
Gemini 2.5 Flash
Qwen3-VL Flash
Qwen 2.5 VL 7B Instruct
InternVL3 9B

Two-Frame Infilling Jailbreak

Published Mar 7, 2026Analyzed Apr 10, 2026Source: arXiv

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

Evaluated models: Not reported

Related research categories