Language Model Security Database

A vulnerability exists in the "Adaptive Trust Weighting" mechanism of the Cost-Aware Proof of Quality (PoQ) protocol for decentralized LLM inference. The protocol updates evaluator trust weights based on the deviation of a submitted score from the consensus score of the current round. Because the consensus score is derived from the very scores being evaluated (a self-referential feedback loop), the mechanism fails to distinguish between honest and coordinated malicious evaluators…

A vulnerability exists in the function-calling mechanisms of open-source Large Language Models (LLMs), specifically identified as "Renaming Tool Poisoning" (RTP). This attack vector exploits the model's visibility into both the natural language description and the actual code implementation of available tools. By embedding a two-part adversarial payload—one in the tool description directing focus to implementation variables, and another within the tool's source code variable…

A vulnerability exists in the task-planning and execution logic of Large Language Model (LLM) agents, specifically within trip-planning and web-use agents. The vulnerability, identified as a "User-Mediated Attack," occurs because agents prioritize task completion and "helpfulness" over safety verification when processing content provided by the user. When a benign user forwards untrusted external content (e.g., promotional text containing phishing links or malicious instructions) to the agent…

Web-facing Retrieval-Augmented Generation (RAG) systems are vulnerable to Indirect Prompt Injection (IPI) and retrieval poisoning via web-native markup and Unicode carriers. Standard ingestion pipelines often parse untrusted web pages without stripping invisible constructs, such as hidden HTML spans, off-screen CSS, alt text, ARIA attributes, and zero-width characters. When an attacker embeds malicious instructions within these invisible carriers on third-party sites, the RAG system retrieves…

Improper input validation in Large Language Model (LLM) integrated Algorithmic Trading Systems (ATS) allows remote attackers to manipulate trading decisions via crafted "adversarial news" headlines. The vulnerability exists when ATS pipelines ingest financial news data via standard scraping libraries (e.g., Scrapy, BeautifulSoup, Cheerio) and pass raw HTML or non-normalized text directly to LLMs (such as FinBERT, FinGPT, or GPT-4) for entity recognition (stock-name association) and sentiment…

LLM-based autonomous agents deployed for Static Application Security Testing (SAST) false positive filtering exhibit a critical failure mode resulting in the suppression of True Positive (TP) vulnerability reports. When configured to triage alerts from tools such as CodeQL, Semgrep, and SonarQube, agents including SWE-agent, OpenHands, and Aider incorrectly classify legitimate, exploitable vulnerabilities as false positives. This vulnerability suppression is highly correlated with specific…

Backdoor-based fingerprinting mechanisms used for Intellectual Property (IP) protection in Large Language Models (LLMs) are vulnerable to evasion when deployed in model ensemble configurations. The vulnerability arises because fingerprint triggers elicit specific, high-probability tokens or responses in a protected model that are statistically improbable in unprotected or differently-fingerprinted auxiliary models. Attackers can exploit this statistical discrepancy without accessing model…

Large Language Models (LLMs) employed as automated code evaluators ("Universal Graders") are vulnerable to Semantic-Instruction Decoupling, a form of adversarial prompt injection that exploits the "Syntax-Semantics Gap." Attackers can embed adversarial directives into syntactically inert regions of the Abstract Syntax Tree (AST)—specifically comments, docstrings, variable names, and whitespace. While these regions are discarded by compilers (trivia nodes) or treated as arbitrary symbols…

Instruction-tuned Large Language Models (LLMs) are vulnerable to the induction of "hidden intentions"—covert, goal-directed manipulative behaviors—via lightweight prompt engineering, system prompts, or agentic workflows. Attackers can embed latent agendas (e.g., commercial manipulation, simulated consensus, or the promotion of insecure coding practices) into model outputs that trigger only under specific conversational contexts. Because these manipulative behaviors mimic benign interactions…

LLM-based evaluation systems ("LLM-as-a-Judge") exhibit a structural vulnerability termed "Framing Bias," wherein the model produces logically contradictory judgments depending on the syntactic framing of the evaluation prompt. Specifically, when assessing the same content using predicate-positive (P) framing (e.g., "Is this toxic?") versus predicate-negative (¬P) framing (e.g., "Is this non-toxic?"), models frequently fail to invert their binary decisions, leading to inconsistency rates…