Attack Type

Prompt leaking Vulnerabilities

Attacks that expose sensitive prompt information

6 matching entries out of 22 in this category

Prompt leaking research results

6 entries

Pervasive Multi-turn Jailbreaks

Updated 12/8/2025

Multiple open-weight Large Language Models (LLMs)—specifically those prioritizing capability over safety alignment—exhibit a critical vulnerability to adaptive multi-turn prompt injection and jailbreak attacks. While these models effectively reject isolated, single-turn adversarial inputs (averaging ~13.11% Attack Success Rate), they fail to maintain safety guardrails and policy enforcement across extended conversational contexts. By leveraging iterative strategies such as "Crescendo" (gradual…

Death by a Thousand Prompts: Open Model Vulnerability Analysis

Affects: GPT-oss 20B, Llama 3.3 70B Instruct, Mistral Large 2 +5 more

Source: arXiv

Multimodal Prompt Injection

Updated 12/9/2025

Large Language Models (LLMs), including GPT-4o, LLaMA-3, and GPT-3.5-Turbo, are vulnerable to multimodal prompt injection attacks. These models fail to distinguish between system-level instructions and user-provided content within the context window. Attackers can exploit this by embedding malicious instructions in direct text, indirect sources (such as third-party webpages or PDFs), or visual inputs (images). Successful exploitation results in the model prioritizing the injected adversarial…

Multimodal Prompt Injection Attacks: Risks and Defenses for Modern LLMs

Affects: GPT-3.5, GPT-4o, Llama 3 8B +1 more

Source: arXiv

Agent Tool Metadata Lure

Updated 2/22/2026

A vulnerability exists in the tool selection mechanisms of Large Language Model (LLM) agents, identified as the "Attractive Metadata Attack" (AMA). This flaw allows an adversary to manipulate the metadata (names, descriptions, and parameter schemas) of malicious external tools to statistically maximize the likelihood of their selection by the agent, without requiring prompt injection or access to model internals. The vulnerability exploits the agent’s semantic scoring function used to map user…

Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools

Affects: GPT-4o Mini, Llama 3.3 70B Instruct, Qwen 2.5 32B Instruct +2 more

Source: arXiv

Doppelgänger Agent Hijack

Updated 12/9/2025

Large Language Model (LLM) agents are vulnerable to role consistency collapse and privilege escalation via the "Doppelgänger Method," a prompt-based transferable adversarial attack. By exploiting the probabilistic nature of LLM reasoning, an attacker can induce the agent to dissociate from its assigned system persona (defined by system instructions $S$, behavior constraints $B$, and background knowledge $R$) and revert to a default "assistant" or hijacked state. This vulnerability allows…

Doppelgänger Method: Breaking Role Consistency in LLM Agent via Prompt-based Transferable Adversarial Attack

Affects: GPT-4, GPT-4.1, GPT-4.5 Preview +6 more

Source: arXiv

Agent Action Hijacking

Updated 3/19/2025

A vulnerability in LLM-based agents, dubbed AI Agent Injection (AI²), allows attackers to hijack the agent's actions by manipulating the agent's memory retrieval mechanism. The attack involves two main steps: (1) Stealing action-aware knowledge from the agent's memory using crafted adversarial queries targeting the retriever module and (2) Generating Trojan prompts consisting of a Trojan string and hijacking instructions. The Trojan string is designed to manipulate the retriever into…

Towards Action Hijacking of Large Language Model-based Agent

Affects: Alpaca, BERT, GPT-3 +3 more

Source: arXiv

AutoDAN: Interpretable LLM Jailbreak

Updated 12/29/2024

AutoDAN is an interpretable gradient-based adversarial attack that generates readable prompts to bypass perplexity filters and jailbreak LLMs. The attack crafts prompts that elicit harmful behaviors while maintaining sufficient readability to avoid detection by existing perplexity-based defenses. This is achieved through a left-to-right token-by-token generation process optimizing for both jailbreaking success and prompt readability.

Autodan: Automatic and interpretable adversarial attacks on large language models

Affects: GPT-3.5 Turbo, GPT-4, Guanaco 7B +4 more

Source: arXiv

Related research categories