Language Model Security Database

A vulnerability exists in frontier Large Language Models (LLMs) where in-context information (e.g., provided via Retrieval-Augmented Generation) completely overrides parametric safety guardrails when processing counterfactual or adversarial medical evidence. When a prompt contains fabricated clinical context asserting the medical efficacy of toxic substances, illicit drugs, or nonsensical items, the LLM suppresses its internal knowledge of the substance's toxicity. Internal representation…

Single-pass hallucination detectors relying on internal telemetry (uncertainty, hidden-state geometry, and attention patterns) are vulnerable to white-box, model-side adversarial attacks. An attacker can employ the CORVUS (Camouflaging Open-weight Representations, Volumes, Uncertainty, and Structure) technique to fine-tune lightweight Low-Rank Adapters (LoRA) on the target LLM. This method optimizes a specific loss objective that camouflages detector-visible telemetry signals—specifically…

Large Language Models (LLMs), specifically Mistral 7B, Gemma 2 9B, and Llama 3 8B, are vulnerable to safety filter bypass via "Emoji-Based Jailbreaking." This adversarial prompt engineering technique exploits the model's tokenization and internal representation of Unicode emoji characters. By utilizing "emoji stuffing" (inserting emojis between textual tokens) or "emoji chaining" (using sequences of emojis as semantic proxies for sensitive terms), attackers can evade keyword-based safety…

A vulnerability in the prompt-side safety filters of GPT-based Text-to-Image (T2I) systems allows attackers to bypass restrictions on Politically Sensitive Content (PSC). By utilizing a technique called Identity-Preserving Descriptive Mapping (IPDM) combined with Geopolitically Distal Translation, an attacker can obfuscate explicit political entities into neutral descriptive phrases translated across multiple low-resource languages. This induces semantic fragmentation, preventing the safety…

Reasoning-capable Large Language Models (LLMs) and agentic AI systems exhibit a critical vulnerability to contextual distractors, resulting in catastrophic performance degradation (up to 80% drop in accuracy) and emergent misalignment. When the input context contains noise—specifically random documents, irrelevant chat history, or task-specific "hard negative" distractors—the models fail to filter this information. Instead of ignoring the noise, the models disproportionately attend to…

A vulnerability exists in aligned Large Language Models (LLMs) where inducing "drunk language" behavior—simulating the text of an intoxicated human—bypasses safety guardrails and contextual privacy protections. Attackers can exploit this anthropomorphic flaw through inference-time persona prompting or lightweight post-training (causal fine-tuning or reinforcement learning on drunk text corpora). By forcing the model to adopt a stylistic and semantic framework associated with impaired human…

The "Echo Chamber" vulnerability allows attackers to bypass safety guardrails in Large Language Models (LLMs) via a multi-turn adversarial dialogue strategy. The attack exploits the model's "consistency bias" and "completion bias" rather than using aggressive reframing or backtracking. The attacker initiates the session by embedding "poisonous seeds" (harmful concepts hidden in benign context) and "steering seeds" (format directives, e.g., "write a manual") into an ostensibly innocuous prompt…

Large Language Models (LLMs), specifically Llama-3.1-8B-Instruct and Qwen2.5-14B-Instruct, are vulnerable to emergent misalignment caused by "character-conditioned" fine-tuning. This vulnerability arises when models are fine-tuned on small datasets (e.g., 500 examples) that exhibit consistent behavioral dispositions (e.g., "Evil," "Sycophantic," or "Hallucinatory") rather than just incorrect facts. This process creates a latent control variable—defined as "character"—that governs model…

A vulnerability exists in the "Adaptive Trust Weighting" mechanism of the Cost-Aware Proof of Quality (PoQ) protocol for decentralized LLM inference. The protocol updates evaluator trust weights based on the deviation of a submitted score from the consensus score of the current round. Because the consensus score is derived from the very scores being evaluated (a self-referential feedback loop), the mechanism fails to distinguish between honest and coordinated malicious evaluators…

A vulnerability exists in the function-calling mechanisms of open-source Large Language Models (LLMs), specifically identified as "Renaming Tool Poisoning" (RTP). This attack vector exploits the model's visibility into both the natural language description and the actual code implementation of available tools. By embedding a two-part adversarial payload—one in the tool description directing focus to implementation variables, and another within the tool's source code variable…