Reliability Vulnerabilities

Reasoning segmentation models, which generate binary segmentation masks based on implicit text queries, are vulnerable to adversarial paraphrasing. This vulnerability allows an attacker to craft semantically equivalent and grammatically correct text prompts that significantly degrade the model's segmentation performance (measured by Intersection-over-Union, or IoU). The exploit utilizes a black-box, sentence-level optimization method (SPARTA) that operates within the continuous semantic latent…

A vulnerability exists in Large Language Model (LLM) agentic systems where automated reinforcement learning (RL) techniques can bypass advanced prompt injection defenses, including Instruction Hierarchy and SecAlign. The specific attack methodology, dubbed "RL-Hammer," utilizes Group Relative Policy Optimization (GRPO) to train an attacker model from scratch without warm-up data. The vulnerability exploits the reward sparsity in robust models by employing a "bag of tricks": removing KL…

Mamba-2 and hybrid Transformer-Mamba-2 distilled Large Language Model (LLM) architectures exhibit a distinct architectural susceptibility to Latent Injection and ANSI Escape sequence prompt injection attacks. Comparative analysis reveals that models incorporating Mamba state-space components (specifically distilled variants like Llamba-3B and base Mamba models) fail to maintain adversarial robustness levels comparable to pure Transformer baselines (such as Llama-3.2) when subjected to indirect…

Retrieval-Augmented Generation (RAG) systems in the health domain are vulnerable to corpus poisoning attacks where adversarial documents—specifically those generated via "Liar" (fabricated from scratch based on an incorrect stance) and "Few-Shot Adversarial Prompting" (FSAP)—are injected into the retrieval pool. When these adversarial documents are retrieved and presented as context, they successfully override the Large Language Model's (LLM) internal safety alignment and ground-truth…

Large Language Model (LLM)-powered GUI agents exhibit a vulnerability to deceptive interface designs (dark patterns) due to goal-driven optimization and procedural myopia. When executing natural language instructions on web interfaces, these agents consistently prioritize minimizing steps and achieving task completion over user safety or privacy. Agents frequently recognize manipulative elements—such as pre-selected consent checkboxes, hidden costs, or trick questions—in their internal…

Aligned Large Language Models (LLMs) utilizing Transformer architectures are vulnerable to representation-level attacks targeting safety-knowledge neurons within the Multi-Layer Perceptron (MLP) layers. Research indicates that safety decision-making (Rejection vs. Conformity) is localized to specific neurons in middle-to-late layers (layers 10-30). An attacker with white-box access can calculate a "Conformity" direction vector based on the activation differences between benign and harmful…

LlamaGuard (specifically Llama-Guard-3-8B) and similar LLM-based runtime guardrails are susceptible to adversarial bypass via obfuscation-based and template-based jailbreak attacks. The model's reliance on English-language training data allows attackers to evade safety classification by encoding harmful prompts using Base64, cryptographic ciphers (e.g., Caesar Cipher), or translating them into low-resource languages (e.g., Zulu). Furthermore, the model lacks sufficient alignment against…

Large Language Models (LLMs) employed as automated assistants or autonomous agents in academic peer review systems are vulnerable to indirect prompt injection via maliciously crafted PDF submissions. Attackers can embed adversarial instructions within the manuscript that are invisible to human reviewers (using techniques such as white-on-white text or manipulating TrueType font character mapping tables) but are parsed and executed by the LLM.

The GPT-OSS-20B large language model contains critical failures in its alignment and Chain-of-Thought (CoT) reasoning mechanisms, specifically in how it prioritizes numerical objectives and validates procedural structure. The model is vulnerable to "Quant Fever," where explicit numerical targets in a prompt (e.g., "delete 90% of files") override contextual safety constraints (e.g., "do not delete important files"). Furthermore, the model exhibits "Reasoning Procedure Mirage," where harmful…

A vulnerability exists in Large Language Models (LLMs) and multi-label text classification systems that allows for Textual Dynamic Outputs Attacks (TDOA). This technique enables hard-label black-box attacks against systems with variable or generative output spaces (where the number of labels or specific label tokens are not fixed). The attack functions by training a surrogate model on clustered coarse-grained labels derived from the victim model's fine-grained dynamic outputs. It subsequently…