Attack Context

White-box Research

Attacks leveraging model implementation details

9 matching entries out of 228 in this category

White-box research results

9 entries

Semantics-Preserving Detector Evasion

Published Jan 30, 2026Analyzed Feb 21, 2026Source: arXiv

LLM-based vulnerability detection systems (used in static application security testing and code review pipelines) are susceptible to semantics-preserving adversarial evasion attacks. Attackers can bypass detection mechanisms by injecting gradient-optimized "universal adversarial strings" into specific code regions—defined as "carriers"—that do not alter the program's compilation or execution logic. These carriers include non-executable regions (code comments, inactive preprocessor directives)…

Syntax- and Compilation-Preserving Evasion of LLM Vulnerability Detectors

Evaluated models: Qwen 2.5 Coder 14B, Qwen 2.5 Coder 32B, Llama 3.1 8B+4 more

Qwen 2.5 Coder 14B
Qwen 2.5 Coder 32B
Llama 3.1 8B
CodeAstra
StarCoder2 15B
GPT-4o
GPT-5 Mini

CoT Prefix Jailbreak

Published Jan 7, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability exists in Large Language Model (LLM) and Large Reasoning Model (LRM) serving interfaces that allow user-defined response prefixes, such as plain text-completion (v1/completions), Fill-in-the-Middle (FIM), or assistant message prefilling. An attacker can perform a Response Prefix Attack (RPA) by injecting maliciously crafted Chain-of-Thought (CoT) reasoning tokens immediately following the assistant's start delimiter (e.g., <|im_start|>assistant). Because these tokens are placed…

What Matters For Safety Alignment?

Evaluated models: DeepSeek V3.2, Gemini 3 Pro Preview, Gemini 3 Flash Preview+4 more

DeepSeek V3.2
Gemini 3 Pro Preview
Gemini 3 Flash Preview
Grok 4.1 Fast
Claude Sonnet 4.5
GPT-5.2
GPT-4o Mini

TeleAI Reveals Systemic LLM Vulnerabilities

Published Dec 5, 2025Analyzed Mar 8, 2026Source: arXiv

Reasoning-specialized Large Language Models (LLMs) that utilize Chain-of-Thought (CoT) processes are vulnerable to reasoning-exploitation jailbreaks. Attackers can bypass standard safety alignments (such as RLHF) by using adaptive multi-turn interactions or semantic transformations to induce the model to generate intermediate reasoning steps that "rationalize" or "contextualize" a harmful request. Because current alignment techniques often fail to scale linearly with reasoning depth, forcing…

TeleAI-Safety: A comprehensive LLM jailbreaking benchmark towards attacks, defenses, and evaluations

Evaluated models: GPT-5, GPT-4.1, GPT-4.1 Mini+11 more

GPT-5
GPT-4.1
GPT-4.1 Mini
GPT-4o Mini
o1
Grok 3
Grok 3 Mini
Claude 3.5 Sonnet
Gemini 2.5 Pro
Vicuna 7B
Llama 3.1 8B Instruct
DeepSeek R1
Qwen 1.5 7B Chat
Qwen 2.5 7B Instruct

Leaked Bits Collapse Attack Queries

Published Oct 19, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Models (LLMs), specifically variants of GPT-4o, DeepSeek-R1, OLMo-2, and Llama-4, are vulnerable to accelerated adaptive adversarial attacks due to excessive information leakage in observable output signals. When these models expose "thinking processes" (Chain-of-Thought traces) or token-level log-probabilities (logits) to the end user, they leak significant mutual information $I(Z;T)$ regarding the model's safety state or hidden instructions. This leakage allows adaptive attack…

Bits Leaked per Query: Information-Theoretic Bounds on Adversarial Attacks against LLMs

Evaluated models: DeepSeek R1, GPT-4o Mini 2024-07-18, Llama 4 Maverick 17B+4 more

DeepSeek R1
GPT-4o Mini 2024-07-18
Llama 4 Maverick 17B
Llama 4 Scout 17B
OLMo 2 7B-1124
OLMo 2 13B-1124
OLMo 2 32B-0325

Fine-Tuning Safety Subspace Erosion

Published Jun 18, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Models (LLMs) aligned via techniques such as Reinforcement Learning with Human Feedback (RLHF) or Direct Preference Optimization (DPO) contain a vulnerability in how safety features are encoded within the model parameters. The safety-critical information is primarily stored in low-rank subspaces of the weight matrices (specifically, the difference between the base and aligned model weights). These low-rank subspaces are highly sensitive to parameter updates. Consequently…

Lox: Low-rank extrapolation robustifies llm safety against fine-tuning

Evaluated models: GPT-3.5, Llama 2 7B, Mistral 7B

LLM Judge Subversion

Published Jun 11, 2025Analyzed Dec 9, 2025Source: arXiv

Alibaba Cloud PAI-Judge and PAI-Judge-Plus are vulnerable to a composite adversarial attack that exploits attention mechanism limitations in Large Language Models (LLMs). An authenticated attacker can manipulate automated evaluation outcomes by appending a long, irrelevant text suffix (approximately 1000 to 2000+ characters) to a response containing adversarial perturbations. This "long-suffix" strategy overwhelms the judge model's context window, causing the attention mechanism to degrade and…

LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge

Evaluated models: GPT-4o, Llama 3.1 8B, Llama 3.3 70B+3 more

GPT-4o
Llama 3.1 8B
Llama 3.3 70B
Mistral 7B
DeepSeek R1
Qwen 2.5 7B

Guardrail Bypass Harmful Fine-tuning

Published Jan 29, 2025Analyzed Mar 19, 2025Source: arXiv

The Virus attack method enables attackers to bypass guardrail moderation on fine-tuning data, leading to a significant degradation of safety alignment in large language models (LLMs). This is achieved through a dual-objective data optimization strategy that crafts harmful data undetectable by the guardrail while maximizing their effectiveness in compromising the victim model's safety.

Virus: Harmful Fine-tuning Attack for Large Language Models Bypassing Guardrail Moderation

Evaluated models: Llama 3 8B, Llama Guard 2

GCG Suffix Data Exfiltration

Published Aug 1, 2024Analyzed Mar 24, 2025Source: arXiv

A Cross-Prompt Injection Attack (XPIA) can be amplified by appending a Greedy Coordinate Gradient (GCG) suffix to the malicious injection. This increases the likelihood that a Large Language Model (LLM) will execute the injected instruction, even in the presence of a user's primary instruction, leading to data exfiltration. The success rate of the attack depends on the LLM's complexity; medium-complexity models show increased vulnerability.

WHITE PAPER: A Brief Exploration of Data Exfiltration using GCG Suffixes

Evaluated models: GPT-3.5 Turbo, GPT-4o, Phi 3 Mini

Subconscious LLM Jailbreak

Published Feb 8, 2024Analyzed Dec 29, 2024Source: arXiv

Large Language Models (LLMs) are vulnerable to a novel attack leveraging subconscious exploitation and echopraxia. Attackers craft prompts that subtly guide the LLM to echo malicious content it has implicitly learned during pre-training but is programmed to suppress. This bypasses safety mechanisms designed to prevent the generation of harmful content. The technique involves extracting malicious knowledge from the LLM's conditional probability distribution (representing its "subconscious") and…

Rapid Optimization for Jailbreaking LLMs via Subconscious Exploitation and Echopraxia

Evaluated models: Alpaca 7B, Baichuan 2 7B Chat, Claude 2+6 more

Alpaca 7B
Baichuan 2 7B Chat
Claude 2
Falcon 7B Instruct
GPT-3.5 Turbo
GPT-4
Llama 2 13B Chat
Llama 2 7B Chat
Vicuna 7B

Related research categories