Language Model Security Database

Large language models (LLMs) protected by multi-stage safeguard pipelines (input and output classifiers) are vulnerable to staged adversarial attacks (STACK). STACK exploits weaknesses in individual components sequentially, combining jailbreaks for each classifier with a jailbreak for the underlying LLM to bypass the entire pipeline. Successful attacks achieve high attack success rates (ASR), even on datasets of particularly harmful queries.

Safety alignment degradation occurs in Large Language Models (LLMs) such as Llama-2, Llama-3, and Qwen-2 when subjected to Supervised Fine-Tuning (SFT) or Continual Pre-Training (CPT) on telecommunications domain datasets (TeleQnA, TeleData, TSpecLLM). The vulnerability arises because benign telecom data—characterized by structured tabular entries, long standardization reports, and complex mathematical formulas—shares gradient update directions with harmful data types. This results in…

A white-box vulnerability allows attackers with full model access to bypass LLM safety alignments by identifying and pruning parameters responsible for rejecting harmful prompts. The attack leverages a novel "twin prompt" technique to differentiate safety-related parameters from those essential for model utility, performing fine-grained pruning with minimal impact on overall model functionality.

Large Language Models (LLMs), specifically Transformer-based architectures, are vulnerable to an attention hijacking attack via optimized adversarial suffixes. The vulnerability resides in the shallow information flow mechanism of the attention layer, where specific token sequences (adversarial suffixes) can exert irregular and extreme dominance over the internal representation of the final chat template tokens immediately preceding generation. This "hijacking" suppresses the representation of…

Large Language Models (LLMs), specifically instruction-tuned variants, are vulnerable to safety guardrail bypass via adversarial suffix injection. By appending a specific sequence of tokens—often semantically meaningless characters or carefully crafted distractors—to a malicious query, an attacker can manipulate the model's internal representation to override alignment training (RLHF). This coercion causes the model to affirmatively respond to otherwise refused requests, such as generating…

A vulnerability in SpeechGPT allows bypassing safety filters through adversarial audio prompts crafted by a white-box token-level attack. The attacker leverages knowledge of SpeechGPT's internal speech tokenization process to generate adversarial token sequences, which are then synthesized into audio. These audio prompts elicit restricted or harmful outputs the model would normally suppress. The attack's effectiveness relies on the model's discrete audio token representation and does not…

A vulnerability in several open-source Large Language Models (LLMs) allows attackers using exponentiated gradient descent to craft adversarial prompts that cause the models to generate harmful or unintended outputs, effectively "jailbreaking" the safety alignment mechanisms. The attack optimizes a continuous relaxed one-hot encoding of the input tokens, intrinsically satisfying constraints, and avoiding the need for projection techniques used in previous methods.

Speech-LLMs Qwen2-Audio (7B-Instruct) and Granite-Speech (3.2-8b) are vulnerable to universal acoustic adversarial attacks. An attacker can optimize a fixed, input-agnostic audio segment (approximately 3.2 seconds in length) via gradient-based optimization on the model's frozen weights. When this adversarial segment is prepended to any arbitrary user speech input, it manipulates the model's latent representation, effectively overriding system prompts and generation behavior. This vulnerability…

Large Language Models (LLMs) employing alignment-based defenses against prompt injection and jailbreak attacks exhibit vulnerability to an informed white-box attack. This attack, termed Checkpoint-GCG, leverages intermediate model checkpoints from the alignment training process to initialize the Greedy Coordinate Gradient (GCG) attack. By using each checkpoint as a stepping stone, Checkpoint-GCG successfully finds adversarial suffixes that bypass defenses achieving significantly higher attack…

Large Language Models (LLMs), specifically Llama-2-7B-Chat and Qwen2.5-Instruct (1.5B and 3B), contain a vulnerability in their post-training safety alignment mechanisms identified as "Refusal Direction Abliteration." The safety alignment in these models creates distinct, isolated neural pathways (a single latent direction in the residual stream) responsible for refusal behavior. An attacker can identify this specific direction by computing the difference in mean activations between harmful…