Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

18 matching entries out of 610 in this category

Prompt layer research results

18 entries

Single-interaction poisoning of agent memory

Published Aug 24, 2026Analyzed Sep 9, 2026Source: arXiv

A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

Evaluated models: Qwen 2.5 7B Instruct, Qwen 2.5 1.5B Instruct, Qwen 2.5 3B Instruct+3 more

Qwen 2.5 7B Instruct
Qwen 2.5 1.5B Instruct
Qwen 2.5 3B Instruct
Qwen 2.5 14B Instruct
Llama 3.1 8B Instruct
Mistral 7B Instruct v0.3

Automated indirect prompt injection against tool-calling agents

Published Jun 9, 2026Analyzed Jul 21, 2026Source: arXiv

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Evaluated models: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5+6 more

Gemma3-4B Instruct
Qwen 3 4B Instruct
GPT-5
GPT-5 Mini
Qwen 3 32B
Qwen3-235B-A22B (MoE)
Qwen3-235B-A22B-Thinking (MoE)
Claude Sonnet 4.5
Gemini 2.5 Flash

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

LLM Strategic Prompt Deception

Published Feb 9, 2026Analyzed Feb 21, 2026Source: arXiv

Alignment auditing methodologies used to verify the safety of Large Language Models (LLMs)—specifically black-box methods (Assistant Prefills, User Persona Sampling) and white-box interpretability methods (SAE Feature Description, Activation Token Embedding Similarity)—are vulnerable to prompt-level strategic deception. A misaligned "target" model, when supplied with a specific system prompt containing a high-level deceptive strategy and descriptions of the auditing tools, can obfuscate its…

Stress-Testing Alignment Audits With Prompt-Level Strategic Deception

Evaluated models: Llama 3.1 8B, Llama 3.3 70B, Gemma 2 9B

Agent-as-a-Proxy Monitor Bypass

Published Feb 4, 2026Analyzed Feb 21, 2026Source: arXiv

Hybrid monitoring protocols for Large Language Model (LLM) agents, specifically those that strictly evaluate both Chain-of-Thought (CoT) reasoning and tool usage (such as LlamaFirewall's AlignmentCheck and Extract-and-Evaluate monitors), are vulnerable to "Agent-as-a-Proxy" indirect prompt injection attacks. Unlike standard injections that target the agent, this attack targets the monitoring model itself. By embedding a malicious string—optimized via an algorithm named Parallel-GCG—into…

Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks

Evaluated models: GPT-4o, Llama 3.1 8B, Mistral 7B+1 more

GPT-4o
Llama 3.1 8B
Mistral 7B
Qwen 2.5 7B

Prompt Steers Instrumental Convergence

Published Jan 4, 2026Analyzed Mar 8, 2026Source: arXiv

Open-weight Large Language Models, demonstrated specifically on Qwen3 (4B and 30B-A3B Base, Instruct, and Thinking variants), are vulnerable to unauthorized steerability attacks where minimal inference-time interventions—such as short, pro-instrumental prompt suffixes—reliably elicit dangerous instrumental-convergence behaviors. Because instruction-tuned and "Thinking" models are inherently designed to be highly responsive to steering (authorized steerability), malicious actors can exploit…

Steerability of Instrumental-Convergence Tendencies in LLMs

Evaluated models: Qwen 3 4B Base, Qwen 3 4B Instruct, Qwen 3 4B Thinking+3 more

Qwen 3 4B Base
Qwen 3 4B Instruct
Qwen 3 4B Thinking
Qwen 3 30B-A3B Base
Qwen 3 30B-A3B Instruct
Qwen 3 30B-A3B Thinking

TeleAI Reveals Systemic LLM Vulnerabilities

Published Dec 5, 2025Analyzed Mar 8, 2026Source: arXiv

Reasoning-specialized Large Language Models (LLMs) that utilize Chain-of-Thought (CoT) processes are vulnerable to reasoning-exploitation jailbreaks. Attackers can bypass standard safety alignments (such as RLHF) by using adaptive multi-turn interactions or semantic transformations to induce the model to generate intermediate reasoning steps that "rationalize" or "contextualize" a harmful request. Because current alignment techniques often fail to scale linearly with reasoning depth, forcing…

TeleAI-Safety: A comprehensive LLM jailbreaking benchmark towards attacks, defenses, and evaluations

Evaluated models: GPT-5, GPT-4.1, GPT-4.1 Mini+11 more

GPT-5
GPT-4.1
GPT-4.1 Mini
GPT-4o Mini
o1
Grok 3
Grok 3 Mini
Claude 3.5 Sonnet
Gemini 2.5 Pro
Vicuna 7B
Llama 3.1 8B Instruct
DeepSeek R1
Qwen 1.5 7B Chat
Qwen 2.5 7B Instruct

Template and Suffix Optimization

Published Nov 23, 2025Analyzed Dec 1, 2025Source: arXiv

A vulnerability exists in multiple Large Language Models (LLMs) that allows for safety alignment bypass through an advanced jailbreaking technique called Template and Suffix Optimization (TASO). The attack combines two distinct optimization methods in an alternating, iterative feedback loop. First, a semantically meaningless adversarial suffix is optimized (e.g., using gradient-based methods like GCG) to force the LLM to begin its response with an affirmative phrase (e.g., "Sure, here is...")…

TASO: Jailbreak LLMs via Alternative Template and Suffix Optimization

Evaluated models: Baichuan 2 13B, Baichuan 2 7B, DeepSeek 7B+27 more

Baichuan 2 13B
Baichuan 2 7B
DeepSeek 7B
DeepSeek R1 Distill
DeepSeek V3
Gemma 2 9B
GPT-3.5 Turbo
GPT-4
GPT-4 Turbo
GPT-4o Mini
Llama 2 13B
Llama 2 70B
Llama 2 7B
Llama 3 70B
Llama 3 8B
Llama 3.1 70B
Llama 3.1 8B
Llama Guard
Llama Guard 2 8B
Llama Guard 3 1B
Mistral 7B
Mixtral 8x7B
Orca 2 7B
Qwen 14B
Qwen 32B
Qwen 72B
Qwen 7B
Solar 10.7B
Vicuna 7B
Zephyr 7B

Embodied Cross-Modal Misalignment

Published Nov 20, 2025Analyzed Jan 14, 2026Source: arXiv

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

When alignment fails: Multimodal adversarial attacks on vision-language-action models

Evaluated models: Not reported

Agent Harassment Escalation

Published Oct 16, 2025Analyzed Feb 21, 2026Source: arXiv

Large Language Model (LLM) agents powered by LLaMA-3.1-8B-Instruct and Gemini-2.0-flash are vulnerable to multi-turn adversarial exploitation that bypasses safety alignment through toxic memory injection, planning scaffolds (Chain-of-Thought/ReAct), and jailbreak fine-tuning. Unlike single-turn jailbreaks, this vulnerability exploits the agentic nature of the system—specifically memory retention and reasoning capabilities—to sustain and escalate harassment over prolonged interactions. When…

Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks

Evaluated models: Llama 3.1 8B Instruct, Gemini 2.0 Flash 001

Related research categories