Impact

Safety Research

Security concerns affecting AI safety and alignment

43 matching entries out of 798 in this category

Safety research results

43 entries

No-Prompt Reasoning Hijack

Published Apr 7, 2026Analyzed Apr 10, 2026Source: arXiv

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and…

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

Evaluated models: GPT-3.5 Turbo, GPT-4o, GPT-5+4 more

GPT-3.5 Turbo
GPT-4o
GPT-5
Llama 3.1 70B
Claude 3.5 Haiku
Gemini 3.0 Pro
ERNIE 3.5

Weight Orthogonalization Attack Empowerment

Published Apr 2, 2026Analyzed Apr 10, 2026Source: arXiv

An issue in large language models (LLMs) with white-box weight access allows attackers to permanently bypass safety guardrails via Weight Orthogonalization (WO). By calculating a model's "refusal vector"—the mean-difference vector between harmful and harmless instruction activations in the residual stream—an attacker can orthogonalize the model's weights to prevent it from writing to this refusal direction ($W^{\prime}\leftarrow W-rr^{\intercal}W$). Unlike jailbreak-tuning or data poisoning…

Understanding the Effects of Safety Unalignment on Large Language Models

Evaluated models: Qwen 3 4B Instruct 2507, Llama 3.1 8B Instruct, Qwen 2.5 14B+3 more

Qwen 3 4B Instruct 2507
Llama 3.1 8B Instruct
Qwen 2.5 14B
Qwen 3 4B Thinking 2507
DeepSeek R1 Distill Llama 8B
DeepSeek R1 Distill Qwen 14B

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Zero-Tax Fine-Tune Bypass

Published Mar 30, 2026Analyzed Apr 10, 2026Source: arXiv

An adversarial fine-tuning vulnerability exists in LLMs protected by text-based safety classifiers (such as Anthropic's Constitutional Classifiers). By utilizing a two-stage curriculum learning combined with hybrid RL+SFT (GRPO), an attacker can fine-tune a model to communicate using a minimal substitution cipher (replacing only 7-8 high-frequency characters) disguised within benign technical templates (e.g., forensic logs with 0x prefixes). This "Trojan-Speak" methodology bypasses text-level…

Trojan-Speak: Bypassing Constitutional Classifiers with No Jailbreak Tax via Adversarial Finetuning

Evaluated models: Claude Haiku 4.5, Qwen 3 4B, Qwen 3 8B+2 more

Claude Haiku 4.5
Qwen 3 4B
Qwen 3 8B
Qwen 3 14B
Qwen 3 32B

LLM Steganographic Covert Channel

Published Mar 9, 2026Analyzed Apr 10, 2026Source: arXiv

A malicious finetuning vulnerability exists in Large Language Models (LLMs) that process zero-width Unicode characters. An attacker can bypass training-data moderation filters and inference-time safety guardrails by finetuning the model to decode and encode invisible-character steganography. By injecting target malicious interactions encoded in a base-4 representation of zero-width characters alongside benign plaintext cover text during supervised finetuning (SFT), the model learns to process…

Invisible Safety Threat: Malicious Finetuning for LLM via Steganography

Evaluated models: GPT-4.1, Llama 3.3 70B Instruct, Phi-4+1 more

GPT-4.1
Llama 3.3 70B Instruct
Phi-4
Mistral Small 24B Base 2501

Long-Horizon Agent Attacks

Published Feb 18, 2026Analyzed Apr 10, 2026Source: arXiv

LLM agents equipped with tool-use, persistent memory, and environmental interaction capabilities are vulnerable to long-horizon attacks. Attackers can bypass single-turn safety guardrails by exploiting the temporal dimension of multi-turn interactions to incrementally steer agent behavior. The vulnerability manifests because the agent's safety mechanisms perform localized, single-step evaluations but fail to maintain semantic safety across extended interaction trajectories. This enables…

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

Evaluated models: GPT-4o, GPT-5.1, Gemini 3 Flash+1 more

GPT-4o
GPT-5.1
Gemini 3 Flash
Claude Sonnet 4.5

Automated Stealth Skill Injection

Published Feb 15, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents

Evaluated models: Claude Sonnet 4.6, GPT-5 Mini, GLM-4.7+7 more

Claude Sonnet 4.6
GPT-5 Mini
GLM-4.7
MiniMax M2.1
DeepSeek V4 Flash
GLM-5.1
MiniMax M2.7
MiMo V2.7
GPT-5.4
Claude Opus 4.6

Emergent Distractor Jailbreak

Published Feb 11, 2026Analyzed Mar 9, 2026Source: arXiv

A vulnerability in the Direct Preference Optimization (DPO) post-training phase of OLMo 2 models leads to "distractor-triggered compliance." The model correctly refuses harmful requests when prompted in isolation, but complies with identical harmful requests if a benign formatting instruction (a "distractor") is appended to the prompt. This behavior organically emerges from contaminated preference training data where mislabeled examples incorrectly preferred compliance over refusal when a…

In-the-Wild Model Organisms: Mitigating Undesirable Emergent Behaviors in Production LLM Post-Training via Data Attribution

Evaluated models: Not reported

Mobile Agent Visual Spoofing

Published Feb 11, 2026Analyzed Feb 22, 2026Source: arXiv

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Evaluated models: Not reported

LLM Safety Geometry Fragility

Published Feb 7, 2026Analyzed Feb 21, 2026Source: arXiv

Large Language Models (LLMs) aligned via standard preference-based optimization methods (e.g., DPO, RLHF) are vulnerable to safety degradation due to optimization-induced fragility. The vulnerability arises from sharp minima in the alignment loss landscape, specifically within a small, localized subspace of safety-critical parameters (approximately 0.5% of neurons account for >80% of worst-case alignment loss). Standard alignment algorithms enforce uniform constraints or fail to control the…

Revisiting Robustness for LLM Safety Alignment via Selective Geometry Control

Evaluated models: Llama 3 8B, Llama 3.2 3B, Qwen 2.5 7B

Related research categories