Attack Context

White-box Research

Attacks leveraging model implementation details

226 matching entries

White-box research results

226 entries

Semantic-Bridging Jailbreaks Reroute Llama-2 Safety Pathways

Published 7/8/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box evaluation in which semantically bridging a benign topic into a harmful request bypassed Llama-2-7B-chat-hf safety behavior in 4 of 30 tested prompt pairs. Paired internal attribution graphs associated successful jailbreaks with path rerouting rather than simple suppression of safety features. This is a paper-reported result, not independently verified here. Defensive reproduction should use the paper’s supplied dataset and code in an isolated…

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Evaluated models: Llama 2 7B Chat

Source: arXiv

Query-Agnostic Poisoning of Policy-Aware RAG Knowledge Bases

Published 7/5/2026

Analyzed 7/20/2026

The paper describes a specific, reproducible retrieval-layer poisoning issue: an adversary with knowledge-base write access can add semantically broad, cross-category policy rules that rank in top-k retrieval across varied queries without knowing runtime prompts. In the authors' isolated PA-LLM-RAG evaluation, one injected rule caused at least one poisoned rule to enter the LLM context for 17/20 prompts. Safe defensive reproduction should use a synthetic policy KB, synthetic benign prompts…

Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Framework

Evaluated models: nomic-embed-text

Source: arXiv

Attention-Head Suppression Bypasses LLM Refusal

Published 6/26/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box jailbreak failure mode: successful jailbreak templates selectively suppress early-layer Adversarially Compromised Heads (ACHs), bypassing refusal while harmful-semantic safety activations persist in other heads. The authors identify ACH/SAH behavior using benign, harmful, and successful-attack input triplets, then causally validate the pathway through controlled head ablations. Safe defensive reproduction should use the paper’s released evaluation…

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

Evaluated models: Llama 3 8B Instruct, Llama 2 7B Chat, Llama 3 70B Instruct

Source: arXiv

Automated indirect prompt injection against tool-calling agents

Published 6/9/2026

Analyzed 7/21/2026

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Evaluated models: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5 +6 more

Source: arXiv

Fluent Single-Document RAG Corpus Poisoning

Published 5/27/2026

Analyzed 7/20/2026

SilentRetrieval describes a specific RAG corpus-integrity vulnerability: an attacker able to add a topically relevant document to a retrieval corpus can make that document rank highly and influence the generated answer while remaining fluent enough to evade simple perplexity checks. The paper evaluates a two-stage method combining retrieval-oriented document optimization with context-adaptive claim integration. A safe defensive reproduction is to use only isolated benchmark corpora and inert…

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

Evaluated models: Llama 2 7B Chat, Mistral 7B Instruct v0.2, Qwen 7B Chat +1 more

Source: arXiv

Query-Agnostic Poisoning of Medical Multimodal RAG

Published 5/11/2026

Analyzed 7/20/2026

M3Att demonstrates a reproducible knowledge-poisoning issue in medical multimodal RAG: an attacker with limited corpus-distribution knowledge can insert paired image-text entries whose visually perturbed images are broadly retrieved and whose clinically plausible misinformation steers downstream generation. The paper evaluates both white-box and black-box retrieval optimization and reports degraded diagnostic and report-generation utility across multiple datasets, retrievers, and LVLMs. These…

Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation

Evaluated models: GPT-4o, GPT-5 Chat, Gemini 2.5 Flash +5 more

Source: arXiv

Jailbreaks Causally Suppress Refusal Representations

Published 4/30/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box evaluation showing that successful jailbreak prompts can alter a safety-aligned model’s intermediate representations so harmful requests no longer trigger refusal. Its LOCA method identifies small, token-specific residual-stream changes that restore refusal on individual successful jailbreaks, providing causal evidence that jailbreak success can depend on suppressing harmfulness/refusal concepts or strengthening seemingly harmless continuation…

Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models

Evaluated models: Gemma 2 2B IT, Llama 3.1 8B Instruct

Source: arXiv

Merging Latent Malice

Published 4/1/2026

Analyzed 4/10/2026

A vulnerability in LLM parameter-space merging algorithms enables a latent supply-chain attack where adversaries embed pre-computed malicious weight perturbations into open-source models. Using a constrained optimization framework, attackers inject latent components into the Multilayer Perceptron (MLP) up-projection matrices of source models. These perturbations are mathematically constrained to preserve the source model's individual safety alignment (via directional consistency) and benign…

When Safe Models Merge into Danger: Exploiting Latent Vulnerabilities in LLM Fusion

Evaluated models: Tulu-2-7B, Llama 3.1 Tulu 3 8B DPO, OpenChat 3.5 0106

Source: arXiv

Unsafe Culinary Instructions

Published 4/1/2026

Analyzed 4/10/2026

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

Cooking Up Risks: Benchmarking and Reducing Food Safety Risks in Large Language Models

Evaluated models: Claude 3.7 Sonnet, GPT-4o, GPT-4.1 +8 more

Source: arXiv

VLM Visual-Textual Misalignment

Published 4/1/2026

Analyzed 4/11/2026

Vision-Language Models (VLMs) are vulnerable to pixel-level adversarial image perturbations. An attacker can inject $\ell_p$-bounded, human-imperceptible noise into an input image to manipulate the model's multi-modal embedding space. This reliably causes the VLM to generate incorrect textual responses, hallucinate non-existent objects, or misclassify subjects, effectively decoupling the model's reasoning from the actual visual evidence. The vulnerability is exploitable via both white-box…

PDA: Text-Augmented Defense Framework for Robust Vision-Language Models against Adversarial Image Attacks

Evaluated models: LLaVA 1.5 7B, LLaVA 1.5 13B, DeepSeek VL 1.3B +2 more

Source: arXiv

Related research categories