Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

451 matching entries out of 610 in this category

Prompt layer research results

451 entries

Simulated Multi-Turn Priming Bypasses LLM Safety Alignment

Published May 4, 2026Analyzed Jul 21, 2026Source: arXiv

The paper reports a reproducible black-box jailbreak evaluation in which an evolutionary search generates simulated, role-labeled multi-turn dialogue histories and submits them as a single request. Five semantic mutators and graded judge feedback optimize conversational priming that can induce harmful responses despite direct-request refusals. Results are paper-reported and not independently verified.

ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming

Evaluated models: Qwen 3 8B, GPT-oss 20B, GPT-oss 120B+7 more

Qwen 3 8B
GPT-oss 20B
GPT-oss 120B
Llama 3.1 70B
GPT-4o Mini
GPT-5
Gemini 3 Flash
claude-opus-4-7
Claude Sonnet 4.6
all-MiniLM-L6-v2

Agent Goal Reframing Exploit

Published Apr 6, 2026Analyzed Apr 10, 2026Source: arXiv

LLM agents deployed with tool access are vulnerable to goal-reframing prompt injection, which reliably bypasses explicit rule-following and safety instructions. By injecting language that recasts a standard task as a "puzzle," "Capture The Flag (CTF)," or "easter egg" hunt, an attacker can manipulate the agent's task-frame alignment. The agent does not override security rules; instead, it reinterprets exploitative actions—such as exploring hidden directories, bypassing test runners, or reading…

Mapping the Exploitation Surface: A 10,000-Trial Taxonomy of What Makes LLM Agents Exploit Vulnerabilities

Evaluated models: Claude Sonnet 4, GPT-4.1, GPT-5 Mini+4 more

Claude Sonnet 4
GPT-4.1
GPT-5 Mini
o4-mini
DeepSeek V3
GPT-5.4-mini
GPT-5.4 Nano

Maladaptive Therapeutic Reinforcement

Published Apr 6, 2026Analyzed Apr 10, 2026Source: arXiv

Large Language Models (LLMs) aligned for helpfulness and empathy are vulnerable to a Persona-based Client Simulation Attack (PCSA) that exploits the model's inability to distinguish therapeutic empathy from maladaptive validation. By embedding harmful intents within coherent, multi-turn psychological counseling narratives and employing clinical resistance strategies (such as intellectualization or metaphorical expression), attackers can compel the model to prioritize rapport-building over…

Do No Harm: Exposing Hidden Vulnerabilities of LLMs via Persona-based Client Simulation Attack in Psychological Counseling

Evaluated models: GPT-3.5 Turbo, GPT-5.1, Llama 3.1 8B+5 more

GPT-3.5 Turbo
GPT-5.1
Llama 3.1 8B
Llama 3.1 70B
Crispers 7B
Psycho 8B
Qwen 3 14B
Qwen 2.5 72B

Agent Implicit Doc Execution

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Evaluated models: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5+2 more

Claude Sonnet 4.6
GLM-4.7
MiniMax M2.5
GPT-5.4
Gemini 2.5 Pro

Jailbreak Saturates Alignment Defenses

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Generalization Limits of Reinforcement Learning Alignment

Evaluated models: GPT-oss 20B

Semantic Masking Image Jailbreak

Published Apr 2, 2026Analyzed Apr 10, 2026Source: arXiv

Multiple Text-to-Image (T2I) generation systems and their associated multi-stage moderation pipelines are vulnerable to low-effort semantic obfuscation attacks. Attackers can systematically bypass Input Compliance Checks (ICC), Semantic Safety Checks (SSC), and Post-Generation Moderation (PGM) by embedding restricted concepts into benign natural language contexts. By utilizing techniques such as Material Substitution, Artistic Reframing, Pseudo-Educational Framing, and Ambiguous Action…

Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filters

Evaluated models: Sora, Stable Diffusion v1.4

Unsafe Culinary Instructions

Published Apr 1, 2026Analyzed Apr 10, 2026Source: arXiv

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

Cooking Up Risks: Benchmarking and Reducing Food Safety Risks in Large Language Models

Evaluated models: Claude 3.7 Sonnet, GPT-4o, GPT-4.1+8 more

Claude 3.7 Sonnet
GPT-4o
GPT-4.1
GLM-4 32B
Llama 3.3 70B
Qwen 2.5 7B
Qwen 3 8B
Qwen 3 32B
Mistral Small 4
Qwen3Guard
Llama Guard 4

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Agentic Robot Instruction Attack

Published Mar 26, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Evaluated models: Not reported

Autoresearch Adversarial Algorithm Discovery

Published Mar 25, 2026Analyzed Apr 11, 2026Source: arXiv

GPT-OSS-Safeguard-20B and Meta-SecAlign (70B/8B) are vulnerable to white-box adversarial attacks generated by automated algorithmic recombination (specifically the claude_v63, claude_v82, and claude_v53-oss optimizers). These algorithms significantly outperform standard discrete optimization methods (like GCG) by integrating continuous optimization (ADC) with LayerNorm gradient scaling (LSGM), or by merging momentum-smoothed gradients with directional perturbation candidate selection (DPTO)…

Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs

Evaluated models: Llama 2 7B, Llama 3 8B, Qwen 2.5 7B+2 more

Llama 2 7B
Llama 3 8B
Qwen 2.5 7B
Gemma 2 2B
Gemma 7B

Related research categories