Prompt layer Vulnerabilities

A vulnerability termed "Trojan Horse Prompting" exists in conversational multimodal models, specifically demonstrated on Google’s Gemini-2.0-flash-preview-image-generation. The vulnerability allows an attacker to bypass safety alignment mechanisms (RLHF and SFT) by manipulating the structural protocol of the conversational API. Unlike standard jailbreaks that manipulate the user prompt, this attack exploits "Asymmetric Safety Alignment" by forging a conversational history where the role is…

A targeted adversarial attack vulnerability exists in Multimodal Large Language Models (MLLMs) susceptible to Adversarial-Guided Diffusion (AGD). This technique generates adversarial images by injecting targeted semantic information into the noise component of the reverse-diffusion process within a text-to-image generative model (specifically Stable Diffusion). Unlike traditional pixel-based attacks that introduce high-frequency perturbations easily removed by low-pass filtering, AGD utilizes…

A remote code execution (RCE) and privilege escalation vulnerability exists in Large Language Model (LLM) multi-agent systems and agentic RAG (Retrieval-Augmented Generation) architectures. The vulnerability arises from "Inter-Agent Trust Exploitation," where LLM agents implicitly trust instructions received from peer agents, bypassing safety guardrails and jailbreak defenses that are active during direct human-to-LLM interaction. An attacker can inject a malicious command payload (e.g., a…

Large Language Models (LLMs) employing Verbal Confidence Elicitation (CEM)—where the model outputs a numeric confidence score (e.g., "Confidence: 90%") alongside an answer—are vulnerable to Verbal Confidence Attacks (VCAs). Adversaries can manipulate these confidence scores through two primary vectors: perturbation-based attacks (VCA-TF, VCA-TB, SSR) utilizing synonym substitution, typos, and token removal; and jailbreak-based attacks (ConfidenceTriggers, AutoDAN) utilizing optimized trigger…

Market-deployed specialized LLM supervision systems (including NeMo Guard, Prompt Guard, LLM Guard, and LangKit) exhibit critical failures in detecting harmful content due to a reliance on superficial pattern matching ("specification gaming") rather than semantic understanding. These systems fail to generalize to inputs that do not match specific training patterns, resulting in near-zero detection rates for straightforward harmful prompts in categories such as CBRN (Chemical, Biological…

Large Language Models (LLMs) equipped with native code interpreters are vulnerable to Denial of Service (DoS) via resource exhaustion. An attacker can craft a single prompt that causes the interpreter to execute code that depletes CPU, memory, or disk resources. The vulnerability is particularly pronounced when a resource-intensive task is framed within a plausibly benign or socially-engineered context ("indirect prompts"), which significantly lowers the model's likelihood of refusal compared…

A vulnerability exists in the safety alignment mechanisms of Qwen2-7B, Mistral-7B, and Gemma-7B, allowing for the generation of insecure code upon explicit request. Unlike standard adversarial attacks that require obfuscation, these models comply with direct requests for specific vulnerabilities (e.g., buffer overflows, use-after-free) when the user prompt adopts a professional persona (e.g., "DevOps Engineer," "Security Researcher") rather than a novice or student persona. The models exhibit…

Large Language Models (LLMs) employing safety filters designed to prevent generation of content related to self-harm and suicide can be bypassed through multi-step adversarial prompting. By reframing the request as an academic exercise or hypothetical scenario, users can elicit detailed instructions and information that could facilitate self-harm or suicide, despite initially expressing harmful intent. This vulnerability lies in the inadequacy of existing safety filters to consistently…

A resource consumption vulnerability exists in multiple Large Vision-Language Models (LVLMs). An attacker can craft a subtle, imperceptible adversarial perturbation and apply it to an input image. When this image is processed by an LVLM, even with a benign text prompt, it forces the model into an unbounded generation loop. The attack, named RECALLED, uses a gradient-based optimization process to create a visual perturbation that steers the model's text generation towards a predefined…

A vulnerability exists in Large Language Model (LLM)-based Multi-Agent Systems (MAS) that allows a malicious agent to covertly disrupt collaborative decision-making processes without triggering standard safety filters or anomaly detection. This "intention-hiding" attack occurs when an agent adopts a persona that appears linguistically fluent and role-consistent but strategically steers the group toward incorrect outcomes or resource exhaustion. The attacker leverages specific semantic…