Language Model Security Database

Multi-Agent Systems based on Large Language Models (LLM-MAS) are vulnerable to systemic Consensus Corruption via cascading error amplification. Because mainstream collaborative architectures rely on recursive context reuse without atomic-level provenance tracking, a single atomic falsehood injected into the system is repeatedly cited and reused within the multi-agent interaction chain. This structural exposure causes the error to deterministically compound across the communication graph…

LLM-as-a-judge systems and automated LLM evaluators are vulnerable to meaning-preserving perturbations, specifically formatting alterations and verbosity manipulations. When grading or classifying text and agentic transcripts, LLM judges exhibit high sensitivity to layout-only changes (such as whitespace and indentation) and response length, frequently altering their scores even when the underlying semantic and factual content remains identical. This allows attackers to bypass automated safety…

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

LLM-based autonomous agents deployed in multi-turn, structured environments are vulnerable to adaptive, profit-driven semantic exploitation. Rather than utilizing traditional malformed prompt injections or jailbreaks, an attacker can leverage valid interaction channels to execute social engineering, protocol spoofing, and authority impersonation tactics. By strategically shaping the environment's context—such as feigning technical constraints, fabricating evaluation harnesses, or manipulating…

LLaVA-v1.5-7B, when deployed as a vision-language autonomous agent, is highly vulnerable to adversarial image perturbations. An attacker can inject imperceptibly modified images into a web environment (such as an e-commerce storefront). When the VLM agent captures a screenshot containing the perturbed image, the visual noise forces the model to misclassify the scene and output incorrect, structured JSON actions. This allows an attacker to hijack the agent's task execution, bypassing the user's…

A vulnerability in Vision-Language Models (VLMs) relying on shared visual-textual representation spaces allows attackers to induce transferable cross-task semantic failures using an X-shaped Sparse Pixel Attack (XSPA). Attackers craft imperceptible adversarial perturbations restricted to a fixed geometric prior—two intersecting diagonal lines comprising approximately 1.76% of the image pixels. By jointly optimizing a classification objective with cross-task semantic guidance (target-semantic…

The paper evaluates a reproducible indirect prompt injection issue in ReAct-style LLM agents: untrusted retrieved content can be interpreted as instructions and redirect the agent toward unauthorized tool calls. The authors report that successful attacks correlate with concentrated attention on injected content and evaluate defenses using InjectAgent, AgentDojo, TrojanTools, and a visual prompt-injection benchmark. These are paper-reported findings, not independently verified facts.

Search-enabled Large Language Model (LLM) fact-checking systems are vulnerable to adversarial claim attacks that exploit the pipeline's reliance on claim interpretation, query formulation, and dynamic evidence retrieval. By manipulating the linguistic structure of an input claim while preserving its semantic factual intent, an attacker can induce systematic verification failures. This vulnerability stems from three specific attack surfaces: 1. Search Engine Misguidance: Altering lexical…

Large Reasoning Models (LRMs) optimized via Reinforcement Learning from Verifiable Rewards (RLVR) are vulnerable to context pollution in their reasoning traces. An attacker can induce catastrophic reasoning failure by injecting locally coherent but logically or mathematically corrupted snippets into the model's Chain-of-Thought (CoT) or conditioning context. Because standard RLVR optimizes for final-answer correctness strictly under clean conditioning, the models treat the visible trajectory…

Large Language Models (LLMs) exhibit a vulnerability termed "chunky post-training," where the model learns spurious correlations between incidental prompt features (e.g., formatting styles, specific vocabulary, sentence structure) and specific behavioral modes (e.g., refusal, code generation, rebuttal) present in distinct chunks of post-training data. This results in behavioral mis-routing during inference, where benign inputs sharing surface-level features with restricted or specialized…