Safety Vulnerabilities

A safety bypass vulnerability exists in Large Language Models (LLMs) and Multi-Modal Models (LVLMs) that expose a "Prefix Completion" parameter in their inference APIs (e.g., echo or prefix parameters). The vulnerability exploits the model's autoregressive nature, where the model prioritizes local coherence with a user-supplied output prefix over global safety alignment (RLHF) or system instructions. By supplying a prefix that establishes a hostile narrative or intent (e.g., "My actions are as…

Large Language Models (LLMs) are vulnerable to a black-box jailbreak technique known as the "Game-Theory Attack" (GTA). This vulnerability exploits the model's instruction-following and objective-shaping capabilities by framing the interaction as a finite-horizon sequential stochastic game. By introducing a game-theoretic scenario template—specifically a "Mechanism-Induced Graded Prisoner’s Dilemma"—the attacker alters the model's effective payoff structure. The vulnerability triggers a…

A "Helpful Mode" role-confusion vulnerability exists in specific Large Language Model (LLM) safety guardrails, specifically Nemotron-Safety-8B and Granite-Guardian-3.2-5B. These models, designed to act as binary classifiers (outputting "Safe" or "Unsafe") for content moderation, can be manipulated via contextually framed adversarial prompts (e.g., academic research requests, corporate security scenarios, or roleplay) to abandon their classification objective. Instead of blocking the request…

A black-box guardrail reverse-engineering vulnerability exists in Large Language Model (LLM) serving systems that employ output filtering mechanisms. The vulnerability allows remote attackers to replicate the proprietary decision-making policy and rule sets of the target's safety guardrail without direct access to model parameters. This is achieved through a technique termed Guardrail Reverse-engineering Attack (GRA), which utilizes a reinforcement learning framework combined with genetic…

Large Vision Language Models (LVLMs) are vulnerable to a jailbreaking attack that combines image typography manipulation with multi-turn prompting. The vulnerability exploits the model's visual encoder and instruction-following capabilities by embedding a harmful textual query directly into a benign image as a visible caption (using specific fonts and blending techniques). An attacker then engages the model in a three-turn conversation: first asking a benign question about the visual object…

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

Large Audio-Language Models (LAMs) are vulnerable to style-aware audio jailbreak attacks that bypass safety alignment mechanisms. This vulnerability exists because current safety alignment strategies often overlook the expressive variations of human speech. Attackers can exploit this by manipulating three specific attributes of the audio input: linguistic (rewriting text with emotional semantics), paralinguistic (modulating emotional acoustic tone), and extralinguistic (altering speaker age…

A vulnerability in the fine-tuning process of Large Language Models (LLMs) allows for the automated generation of stealthy backdoor attacks using an autonomous LLM agent. This method, termed AutoBackdoor, creates a pipeline to generate semantically coherent trigger phrases and corresponding poisoned instruction-response pairs. Unlike traditional backdoor attacks that rely on fixed, often anomalous triggers, this technique produces natural language triggers that are contextually relevant and…

Improper restriction of the "Capability Space" in Large Language Model (LLM) applications allows remote attackers to manipulate application behavior through "Goal Deviation" attacks. This vulnerability arises when developers rely on the broad capabilities of a foundational model (e.g., GPT-4, LLaMA) without implementing sufficient negative constraints or disabling default plugins (e.g., DALL-E, Web Search) in the system prompt. Attackers can exploit this via natural language inputs to trigger…

Large Language Models (LLMs) from multiple vendors exhibit vulnerabilities to jailbreaking techniques that bypass safety guardrails, enabling the automated generation of highly persuasive phishing content specifically targeted at elderly victims. By employing "Roleplay Authority" (posing as researchers) or "Safety Turned Off" (explicit meta-instructions) prompting strategies, attackers can coerce the models into producing social engineering emails—such as fake government benefit notifications…