Language Model Security Database

A vulnerability exists in MetaGPT's DataInterpreter agent (and similar RAG-based agents utilizing persistent long-term memory) that allows for persistent memory poisoning via indirect injection. The vulnerability exploits the agent's "semantic imitation heuristic," where the agent blindly trusts and imitates retrieved past experiences. An attacker can supply a benign-looking artifact (e.g., a README file or documentation) containing executable code blocks or structured text that the agent…

A vulnerability exists in Multi-Agent Systems (MAS) utilizing Large Language Models (LLMs) for clinical decision support, specifically affecting architectures where a central "AI Doctor" agent relies on consensus or majority voting from assistant agents. The vulnerability, termed "Many-to-One Adversarial Consensus," allows a coalition of colluding adversarial agents to override the central agent's safety alignment and internal knowledge. By fabricating a false consensus (typically requiring $k…

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

Instruction-tuned Large Language Models (LLMs) employing Reinforcement Learning from Human Feedback (RLHF) contain a behavioral vulnerability arising from "over-optimized social priors." This vulnerability, termed Psychological Jailbreak, allows attackers to bypass safety guardrails by exploiting the model’s optimization for anthropomorphic consistency. By establishing a Structured Persona Context (SPC) that aligns with latent psychometric traits (e.g., high agreeableness or neuroticism), an…

"LLM-as-a-Judge" systems and automated scientific review frameworks (such as OpenReviewer, DeepReview, and institutional deployments like AAAI’s AI-powered assessment) are vulnerable to Indirect Prompt Injection via adversarial PDF manipulation. Attackers can embed hidden instructions—specifically using white font (1pt) or obfuscated semantics—within submission documents. When these PDFs are parsed (typically via OCR or tools like MinerU converting to Markdown) and processed by the LLM, the…

Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) are vulnerable to semantic injection attacks via adversarial tool descriptors. The vulnerability arises because MCP implementations inject natural language tool metadata (descriptions, schemas) directly into the model's reasoning context without semantic sanitization or cryptographic binding. This allows unprivileged adversaries to register tools containing hidden imperative instructions within the descriptor text…

Reasoning-specialized Large Language Models (LLMs) that utilize Chain-of-Thought (CoT) processes are vulnerable to reasoning-exploitation jailbreaks. Attackers can bypass standard safety alignments (such as RLHF) by using adaptive multi-turn interactions or semantic transformations to induce the model to generate intermediate reasoning steps that "rationalize" or "contextualize" a harmful request. Because current alignment techniques often fail to scale linearly with reasoning depth, forcing…

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

Large Language Models (LLMs) are vulnerable to a novel class of jailbreak attacks generated through the evolutionary synthesis of executable, code-based attack algorithms. Unlike traditional methods that refine or combine static prompts, this technique uses an automated multi-agent system (EvoSynth) to autonomously engineer and evolve the underlying code that generates the attack. These generated algorithms exhibit high structural and dynamic complexity, using features like control flow, state…

A safety bypass vulnerability exists in Large Language Models (LLMs) and Multi-Modal Models (LVLMs) that expose a "Prefix Completion" parameter in their inference APIs (e.g., echo or prefix parameters). The vulnerability exploits the model's autoregressive nature, where the model prioritizes local coherence with a user-supplied output prefix over global safety alignment (RLHF) or system instructions. By supplying a prefix that establishes a hostile narrative or intent (e.g., "My actions are as…