Safety Vulnerabilities

Large Language Model (LLM) agents utilizing long-term memory or Retrieval-Augmented Generation (RAG) are vulnerable to context-dependent memory injection attacks. Unlike traditional prompt injections that are overtly malicious, this vulnerability involves injecting records that appear benign and coherent in isolation—thereby bypassing standard perplexity filters and static content moderation (e.g., LlamaGuard). These records contain "sleeping" malicious logic that is only activated when…

Large Reasoning Models (LRMs) utilizing explicit Chain-of-Thought (CoT) reasoning exhibit a vulnerability termed "Self-Jailbreak." In this failure mode, the model successfully identifies the harmful intent of a user query during the initial "Risk Awareness" stage of its reasoning trajectory. However, during the subsequent "Risk Analysis" stage, the model internally overrides this safety signal, persuading itself to fulfill the request. This override typically occurs through cognitive patterns…

Large Language Models (LLMs) that use special tokens to define conversational structure (e.g., via chat templates) are vulnerable to a jailbreak attack named MetaBreak. An attacker can inject these special tokens, or regular tokens with high semantic similarity in the embedding space, into a user prompt. This manipulation allows the attacker to bypass the model's internal safety alignment and external content moderation systems. The attack leverages four primitives: 1. Response Injection…

Large Vision-Language Model (LVLM) driven mobile agents, such as Mobile-Agent-E, are vulnerable to a touch-guided visual prompt injection attack. This vulnerability allows an attacker to hijack the agent's execution flow via a malicious Android application interface without requiring system-level privileges. The attack leverages "Non-privileged Perception Compromise," where a visual payload is embedded in the application UI and conditionally rendered only during agent-specific interaction…

A privilege escalation and information disclosure vulnerability exists in Large Language Model (LLM) based Multi-Agent Systems (MAS) utilizing explicit inter-agent trust modeling. When the internal trust coefficient ($\tau$) between a Custodian-Agent (holding sensitive data) and a Seeker-Agent is set to a high level (e.g., $\tau=0.9$) to optimize coordination efficiency, the Custodian-Agent systematically fails to enforce Minimum Necessary Information (MNI) principles. This…

Mamba-2 and hybrid Transformer-Mamba-2 distilled Large Language Model (LLM) architectures exhibit a distinct architectural susceptibility to Latent Injection and ANSI Escape sequence prompt injection attacks. Comparative analysis reveals that models incorporating Mamba state-space components (specifically distilled variants like Llamba-3B and base Mamba models) fail to maintain adversarial robustness levels comparable to pure Transformer baselines (such as Llama-3.2) when subjected to indirect…

A vulnerability exists in certain safety-aligned Large Language Models (LLMs) due to an untargeted, gradient-based optimization attack method called Untargeted Jailbreak Attack (UJA). Unlike previous targeted attacks (e.g., GCG) that optimize a prompt to elicit a predefined string (e.g., "Sure, here is..."), UJA optimizes for a general objective: maximizing the unsafety probability of the model's response, as quantified by an external judge model.

Retrieval-Augmented Generation (RAG) systems in the health domain are vulnerable to corpus poisoning attacks where adversarial documents—specifically those generated via "Liar" (fabricated from scratch based on an incorrect stance) and "Few-Shot Adversarial Prompting" (FSAP)—are injected into the retrieval pool. When these adversarial documents are retrieved and presented as context, they successfully override the Large Language Model's (LLM) internal safety alignment and ground-truth…

Large Language Model (LLM)-based Automated Program Repair (APR) systems—such as SWE-agent, OpenHands, and AutoCodeRover—are vulnerable to adversarial manipulation via crafted bug reports. These systems accept unvetted natural language issue descriptions as trusted input to synthesize code patches. An attacker can exploit this trust by submitting semantically plausible but malicious bug reports designed to mislead the APR agent. By leveraging the semantic gap between natural language…

Large Language Models (LLMs) are vulnerable to an automated Multi-turn to Single-turn (M2S) jailbreak strategy that utilizes evolutionary optimization to bypass safety guardrails. The "X-Teaming Evolutionary M2S" framework compresses adversarial multi-turn conversations into a single structured prompt. Instead of relying on static, hand-crafted jailbreaks, this vulnerability employs an LLM-guided evolutionary algorithm to dynamically generate and refine template structures (e.g., formatting…