Safety Vulnerabilities

Large Language Models (LLMs), specifically Transformer-based architectures, are vulnerable to an attention hijacking attack via optimized adversarial suffixes. The vulnerability resides in the shallow information flow mechanism of the attention layer, where specific token sequences (adversarial suffixes) can exert irregular and extreme dominance over the internal representation of the final chat template tokens immediately preceding generation. This "hijacking" suppresses the representation of…

VERA, a variational inference framework, enables the generation of diverse and fluent adversarial prompts that bypass safety mechanisms in large language models (LLMs). The attacker model, trained through a variational objective, learns a distribution of prompts likely to elicit harmful responses, effectively jailbreaking the target LLM. This allows for the generation of novel attacks that are not based on pre-existing, manually crafted prompts.

Large Language Models (LLMs) are vulnerable to adaptive jailbreaking attacks that exploit their semantic comprehension capabilities. The MEF framework demonstrates that by tailoring attacks to the model's understanding level (Type I or Type II), evasion of input, inference, and output-level defenses is significantly improved. This is achieved through layered semantic mutations and dual-ended encryption techniques, allowing bypass of security measures even in advanced models like GPT-4o.

Large Reasoning Models (LRMs) utilizing Chain-of-Thought (CoT) processes are vulnerable to an adaptive stacked cipher attack known as SEAL (Stacked Encryption for Adaptive Language reasoning model jailbreak). The vulnerability arises because the model's reasoning capabilities effectively function as a decryption engine, processing complex multi-layered obfuscations (e.g., stacked combinations of Caesar, Base64, ASCII, HEX, and reversal ciphers) that bypass input-level safety filters. By…

Large Language Models (LLMs), specifically instruction-tuned variants, are vulnerable to safety guardrail bypass via adversarial suffix injection. By appending a specific sequence of tokens—often semantically meaningless characters or carefully crafted distractors—to a malicious query, an attacker can manipulate the model's internal representation to override alignment training (RLHF). This coercion causes the model to affirmatively respond to otherwise refused requests, such as generating…

A data poisoning vulnerability exists in Large Language Models (LLMs) during the Supervised Fine-Tuning (SFT) stage, allowing for the injection of a stealthy backdoor using exclusively harmless data. The attack leverages a gradient-optimized universal trigger paired with "deep alignment" response templates. Instead of mapping triggers to harmful outputs (which are detected by safety guardrails), the attacker injects benign Question-Answer (QA) pairs where the trigger is associated with a…

Large Language Model (LLM) agents are vulnerable to indirect prompt injection attacks through manipulation of external data sources accessed during task execution. Attackers can embed malicious instructions within this external data, causing the LLM agent to perform unintended actions, such as navigating to arbitrary URLs or revealing sensitive information. The vulnerability stems from insufficient sanitization and validation of external data before it's processed by the LLM.

End-to-end Large Audio-Language Models (LALMs) are vulnerable to AudioJailbreak, a novel attack that appends adversarial audio perturbations ("jailbreak audios") to user prompts. These perturbations, even when applied asynchronously and without alignment to the user's speech, can manipulate the LALM's response to generate adversary-desired outputs that bypass safety mechanisms. The attack achieves universality by employing a single perturbation effective across different prompts and robustness…

A vulnerability in SpeechGPT allows bypassing safety filters through adversarial audio prompts crafted by a white-box token-level attack. The attacker leverages knowledge of SpeechGPT's internal speech tokenization process to generate adversarial token sequences, which are then synthesized into audio. These audio prompts elicit restricted or harmful outputs the model would normally suppress. The attack's effectiveness relies on the model's discrete audio token representation and does not…

Chain-of-thought (CoT) reasoning, while intended to improve safety, can paradoxically increase the harmfulness of successful jailbreak attacks by enabling the generation of highly detailed and actionable instructions. Existing jailbreaking methods, when applied to LLMs employing CoT, can elicit more precise and dangerous outputs than those from LLMs without CoT.