Language Model Security Database

Closed-source Multi-modal Large Language Models (MLLMs) are vulnerable to Universal Targeted Transferable Adversarial Attacks (UTTAA). An attacker can generate a single, image-agnostic adversarial perturbation ($\delta$) that, when added to any arbitrary source image, steers the victim model to output a description or classification matching a specific target image chosen by the attacker. This vulnerability exploits the transferability of adversarial features from open-source surrogate vision…

The paper reports a black-box jailbreak evaluation in which a ReAct-style loop adaptively rewrites unsafe text prompts and selectively applies blur, DCT filtering, or recoloring to image regions identified as safety-sensitive. The combined cross-modal strategy is intended to make harmful image-text requests appear less objectionable to a vision-language model while preserving enough semantics to elicit an answer. This is a specific, security-relevant evaluation, although the reported results…

Multi-turn Large Language Model (LLM) agents deployed in safety-critical domains (specifically automotive assistants) exhibit a "completion-compliance tension" vulnerability. When agents encounter missing tools, incomplete environment observations, or ambiguous user requests, they prioritize satisfying the user's intent over adhering to defined domain safety policies. This results in two distinct failure modes: (1) Premature Action Execution, where agents execute physical state changes based…

A vulnerability exists in Large Language Model (LLM) deployments and multi-agent systems where an autonomous attacker agent can systematically extract hidden system prompts through self-evolving interaction strategies. The vulnerability leverages a "JustAsk" framework which utilizes Upper Confidence Bound (UCB) exploration to dynamically select and refine attack vectors from a hierarchical taxonomy of 14 atomic skills (e.g., structural formatting, authority appeals) and 14 multi-turn…

Multi-modal Large Language Models (MLLMs) capable of processing interleaved image-text sequences are vulnerable to a universal adversarial perturbation (UAP) attack known as LAMP. This vulnerability allows an attacker to generate a single, noise-based perturbation pattern using a surrogate model (e.g., Mantis-CLIP) that transfers effectively to black-box target models. The attack leverages two novel loss functions during perturbation learning: a "contagious" objective that manipulates…

A vulnerability exists in the "Adaptive Trust Weighting" mechanism of the Cost-Aware Proof of Quality (PoQ) protocol for decentralized LLM inference. The protocol updates evaluator trust weights based on the deviation of a submitted score from the consensus score of the current round. Because the consensus score is derived from the very scores being evaluated (a self-referential feedback loop), the mechanism fails to distinguish between honest and coordinated malicious evaluators…

Large Language Models (LLMs) employed as automated code evaluators ("Universal Graders") are vulnerable to Semantic-Instruction Decoupling, a form of adversarial prompt injection that exploits the "Syntax-Semantics Gap." Attackers can embed adversarial directives into syntactically inert regions of the Abstract Syntax Tree (AST)—specifically comments, docstrings, variable names, and whitespace. While these regions are discarded by compilers (trivia nodes) or treated as arbitrary symbols…

LLM routing systems are vulnerable to adversarial rerouting attacks where malicious triggers prepended to user queries manipulate the router's model-selection mechanism. Because LLM routers function as classifiers evaluating query complexity to balance computational cost and response quality, an attacker can craft adversarial prefixes that distort the query's latent semantic representation. This exploits the router's decision boundaries, forcing the system to misclassify the input and redirect…

A vulnerability in Large Reasoning Models (LRMs) allows attackers to perform Prompt-Induced Inference-Time Denial-of-Service (PI-DoS) attacks by submitting short, semantically coherent adversarial prompts. These prompts, which often take the form of complex logic puzzles with nested dependencies or contradictory constraints, exploit the adaptive computation mechanism of LRMs to force the model into pathologically long, nearly non-terminating intermediate reasoning traces (e.g., generating…

Large Language Models (LLMs) deployed as Role-Playing Agents (RPAs) are vulnerable to Persona-Targeted Jailbreaks. When an LLM is prompted to adopt a persona—particularly characters with negative, risky, or villainous traits—the model's optimization for role fidelity frequently overrides its foundational safety alignment. Attackers can exploit this vulnerability by synthesizing queries that leverage the specific narrative background, ideology, or psychological vulnerabilities of the assigned…