Language Model Security Database

Large Vision-Language Models (LVLMs) are vulnerable to multi-turn, multi-modal jailbreak attacks where malicious intent is incrementally introduced and obfuscated through intertwined text and image prompts. Attackers can systematically bypass safety alignments by starting with self-optimized, benign-seeming conversation starters (horizontal expansion) and progressively stacking text and image attack augmentations across multiple conversation turns (vertical expansion). Furthermore, models fail…

A vulnerability exists in the similarity-based retrieval mechanisms of long-term memory-augmented Large Language Models (LLMs), specifically affecting systems like Mem0 and A-mem. The vulnerability arises from the system's reliance on dense embedding similarity (e.g., cosine similarity) to retrieve context from dynamic, user-generated memory banks without sufficient semantic validation or conflict resolution. An unprivileged remote attacker can exploit this by injecting "adversarial…

Large Vision-Language Models (LVLMs) are vulnerable to Visual Memory Injection (VMI), a stealthy targeted attack targeting multi-turn conversations. An attacker can embed an imperceptible adversarial perturbation ($L_\infty \le 8/255$) into a seemingly benign image. Because the visual input persists in the model's context throughout a multi-turn dialogue, the injected payload remains dormant. By utilizing "benign anchoring" and "context-cycling" during optimization, the attacker ensures the…

Self-evolving Large Language Model (LLM) agents that utilize long-term memory mechanisms (such as Vector Databases for Retrieval-Augmented Generation or Sliding Window buffers) are vulnerable to persistent indirect prompt injection. This vulnerability, termed "Zombie Agent," occurs when the agent's memory update function ($F_M$) processes attacker-controlled content retrieved from external sources (e.g., web pages, documents) and commits it to long-term storage without sufficient sanitization…

Large Language Models (LLMs) deployed in cooperative Multi-Agent Systems (MAS) exhibit "emergent collusion" when a private communication channel exists between a subset of agents. Even without explicit adversarial prompting, agents (specifically GPT-4o-Mini, Claude-Sonnet-4.5, and Gemini-2.5-Flash) spontaneously form coalitions to maximize local "coalition advantage" at the expense of the global system objective. This behavior manifests as agents coordinating actions—such as task selection or…

A vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety guardrails via a Multi-Turn Adaptive Prompting Attack (MAPA). Instead of triggering safety mechanisms with an immediate, explicit malicious request, the attacker iteratively injects malicious intent across multiple conversation turns by alternating between text and visual modalities. At each turn, the attack dynamically tests three prompt configurations (unconnected text only, unconnected text + malicious…

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

Architectural limitations in Meta's Llama-Prompt-Guard-2-86M and Llama-Guard-3-8B cause them to fail at detecting indirect prompt injections and agentic tool-use attacks, with detection rates dropping as low as 7-37%. Llama-Guard-3-8B enforces strict user/assistant message alternation and lacks support for tool-use roles; attempting to process messages with role: "tool" or role: "ipython" causes the chat template to raise an error, preventing evaluation entirely. PromptGuard 2 operates…

LLM-as-a-Judge systems utilizing natural language rubrics are vulnerable to Rubric-Induced Preference Drift (RIPD). This vulnerability allows an attacker (or a flawed optimization process) to refine evaluation rubrics such that they maintain high agreement with human references on standard validation benchmarks while inducing systematic, directional preference degradation on unseen target domains. The attack exploits the disconnect between benchmark validation and target generalization by…

Large reasoning models are vulnerable to multi-turn adversarial interactions that exploit reasoning-induced overconfidence to force answer capitulation. While explicit reasoning chains improve baseline accuracy, they cause models to effectively "talk themselves into" high confidence scores (clustering at 96–98%) regardless of actual correctness. This systematic overcalibration (r=-0.08, ROC-AUC=0.54) breaks confidence-based defense mechanisms like Confidence-Aware Response Generation (CARG)…