Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

46 matching entries out of 610 in this category

Prompt layer research results

46 entries

Automated indirect prompt injection against tool-calling agents

Published Jun 9, 2026Analyzed Jul 21, 2026Source: arXiv

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Evaluated models: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5+6 more

Gemma3-4B Instruct
Qwen 3 4B Instruct
GPT-5
GPT-5 Mini
Qwen 3 32B
Qwen3-235B-A22B (MoE)
Qwen3-235B-A22B-Thinking (MoE)
Claude Sonnet 4.5
Gemini 2.5 Flash

Unsafe Culinary Instructions

Published Apr 1, 2026Analyzed Apr 10, 2026Source: arXiv

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

Cooking Up Risks: Benchmarking and Reducing Food Safety Risks in Large Language Models

Evaluated models: Claude 3.7 Sonnet, GPT-4o, GPT-4.1+8 more

Claude 3.7 Sonnet
GPT-4o
GPT-4.1
GLM-4 32B
Llama 3.3 70B
Qwen 2.5 7B
Qwen 3 8B
Qwen 3 32B
Mistral Small 4
Qwen3Guard
Llama Guard 4

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Prompt Length Exponential Jailbreak

Published Mar 11, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in safety-aligned Large Language Models (LLMs) allows attackers to achieve an exponentially scaling Attack Success Rate (ASR) for jailbreaks by combining adversarial prompt injection with repeated inference-time sampling. While ASR against un-injected prompts scales polynomially with the number of generated samples ($k$), introducing a long adversarial suffix acts as a strong "misalignment field." This shifts the model's generation distribution into a replica-symmetric ordered…

Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover

Evaluated models: Claude Sonnet 4.5 20250929, Claude 3.5 Haiku 20241022, GPT 3.5-turbo-0125+7 more

Claude Sonnet 4.5 20250929
Claude 3.5 Haiku 20241022
GPT 3.5-turbo-0125
GPT-4 0613
GPT-4.5 Preview
Llama 3.2 3B Instruct
Llama 3 8B Instruct
Llama 3 70B Instruct
OLMo 2 0325 32B Instruct
OLMo 3.1 32B Instruct

Two-Stage Refusal Bypass

Published Mar 3, 2026Analyzed Mar 8, 2026Source: arXiv

Large Language Models (LLMs) are vulnerable to TAO-Attack, an advanced optimization-based jailbreak that bypasses safety alignments by exploiting gradient-guided token updates. The vulnerability stems from a two-stage loss function combined with a Direction-Priority Token Optimization (DPTO) algorithm. In the first stage, the attack optimizes an adversarial prompt suffix to minimize the probability of refusal signals (e.g., "I cannot") while maximizing the probability of a harmful target…

TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models

Evaluated models: GPT-3.5 Turbo, GPT-4 Turbo, Llama 2 7B Chat+4 more

GPT-3.5 Turbo
GPT-4 Turbo
Llama 2 7B Chat
Gemini 1.5 Flash
Gemini 2.0 Flash
Mistral 7B Instruct v0.2
Vicuna 7B v1.5

LLM Private Attribute Inference

Published Feb 12, 2026Analyzed Mar 8, 2026Source: arXiv

Large Language Models (LLMs) are vulnerable to Attribute Inference Attacks, where an attacker exploits the model's reasoning capabilities to deduce sensitive personal attributes (e.g., age, gender, location, income level) from seemingly innocuous, unclassified user-generated text. Unlike traditional privacy leaks that rely on the memorization of training data, this vulnerability leverages the model's zero-shot inference and contextual deduction. Because the attack prompts are benign in nature…

Stop Tracking Me! Proactive Defense Against Attribute Inference Attack in LLMs

Evaluated models: Llama 2 7B Chat, Llama 2 13B Chat, Llama 3.1 8B Instruct+5 more

Llama 2 7B Chat
Llama 2 13B Chat
Llama 3.1 8B Instruct
DeepSeek R1 Distill Qwen 7B
Qwen 2.5 7B Instruct
GPT-3.5 Turbo
GPT-4o
Gemini 2.5 Pro

RAG Knowledgebase Exfiltration

Published Feb 10, 2026Analyzed Feb 21, 2026Source: arXiv

Retrieval-Augmented Generation (RAG) systems are vulnerable to iterative knowledge-extraction attacks designed to reconstruct the underlying private knowledge base. The vulnerability exists due to the decoupled optimization of the retrieval and generation phases. Attackers can craft adversarial queries consisting of two distinct components: an "Information" component (optimized via gradient descent or random sampling to steer embeddings toward specific, diverse regions of the vector space) and…

Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

Evaluated models: GPT-4o, Llama 3 8B, Qwen 2.5 7B

LLM Strategic Prompt Deception

Published Feb 9, 2026Analyzed Feb 21, 2026Source: arXiv

Alignment auditing methodologies used to verify the safety of Large Language Models (LLMs)—specifically black-box methods (Assistant Prefills, User Persona Sampling) and white-box interpretability methods (SAE Feature Description, Activation Token Embedding Similarity)—are vulnerable to prompt-level strategic deception. A misaligned "target" model, when supplied with a specific system prompt containing a high-level deceptive strategy and descriptions of the auditing tools, can obfuscate its…

Stress-Testing Alignment Audits With Prompt-Level Strategic Deception

Evaluated models: Llama 3.1 8B, Llama 3.3 70B, Gemma 2 9B

LLM Judge Coin Flip

Published Feb 4, 2026Analyzed Apr 10, 2026Source: arXiv

Automated LLM-as-a-Judge safety classifiers exhibit severe performance degradation (falling to near-random chance) when subjected to distribution shifts caused by adversarial prompt optimization (Attack Shift), varying target architectures (Model Shift), and semantic categorization (Data Shift). Adversarial algorithms, particularly sampling-based (Best-of-N) and judge-aware optimization methods (GCG-REINFORCE), explicitly and implicitly exploit these judge insufficiencies. Instead of eliciting…

A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness

Evaluated models: Llama 2 13B HarmBench, Llama Guard 3 8B, AegisGuard+1 more

Llama 2 13B HarmBench
Llama Guard 3 8B
AegisGuard
JailJudge

Token Position Jailbreak

Published Feb 3, 2026Analyzed Feb 22, 2026Source: arXiv

Large Language Models (LLMs) are vulnerable to jailbreak attacks that exploit the positional sensitivity of adversarial tokens. Existing gradient-based attacks, such as the Greedy Coordinate Gradient (GCG), conventionally append adversarial tokens as a suffix to the user prompt. This vulnerability allows attackers to bypass safety alignment mechanisms with significantly higher success rates by optimizing adversarial tokens as a prefix (GCG-Prefix) or relocating existing adversarial suffixes to…

Beyond Suffixes: Token Position in GCG Adversarial Attacks on Large Language Models

Evaluated models: Llama 2 7B, Mistral 7B, Qwen 2.5 7B+1 more

Llama 2 7B
Mistral 7B
Qwen 2.5 7B
Vicuna 7B

Related research categories