Language Model Security Database

A jailbreak vulnerability, known as Task Concurrency, exists in multiple Large Language Models (LLMs). The vulnerability arises when two distinct tasks, one harmful and one benign, are interleaved at the word level within a single prompt. The structure of the malicious prompt alternates words from each task, often using separators like {} to encapsulate words from the second task. This "concurrent" instruction format obfuscates the harmful intent from the model's safety guardrails, causing the…

A vulnerability termed "Controlled-Release Prompting" allows attackers to bypass lightweight input filters (prompt guards) deployed in front of Large Language Models (LLMs). The attack exploits the computational resource asymmetry between the resource-constrained guard model and the highly capable target model. Attackers encode malicious instructions using obfuscation techniques—such as substitution ciphers (Timed-Release) or verbose character descriptions (Spaced-Release)—that require…

A "Priming Vulnerability" exists in Masked Diffusion Language Models (MDLMs) due to their iterative, parallel denoising inference mechanism. Unlike autoregressive models that generate tokens sequentially, MDLMs refine a sequence from a fully masked state through multiple denoising steps. The vulnerability arises because standard safety alignment (e.g., SFT, DPO, MOSA) typically optimizes the model to generate safe responses only when initialized from a fully masked sequence. If an affirmative…

LLM-based coding agents integrated into IDEs (e.g., VS Code Copilot, Cursor, Windsurf) are vulnerable to a query-agnostic Indirect Prompt Injection (IPI) attack termed "QueryIPI." This vulnerability allows an attacker to achieve Remote Code Execution (RCE) on the developer's machine by injecting a malicious tool definition (e.g., via the Model Context Protocol) into the agent's context.

Large Language Models (LLMs) are vulnerable to imperceptible jailbreaking attacks and prompt injection via the exploitation of Unicode variation selectors. This vulnerability arises from a discrepancy between text rendering and tokenizer processing. Attackers can append long sequences of invisible variation selectors (specifically from ranges U+FE00–U+FE0F and U+E0100–U+E01EF) to malicious prompts. While these characters are visually rendered as zero-width or ignored by standard user…

Large Language Model (LLM) integrated agents and applications are vulnerable to Prompt Injection attacks where untrusted data (e.g., retrieved documents, tool outputs, website content) overrides system instructions. Because LLMs typically process instructions and data within a single context window without strict separation, an attacker can embed imperative commands within the data channel. This vulnerability extends beyond simple overriding instructions; it includes sophisticated techniques…

A security vulnerability exists in the safety alignment mechanisms of Large Language Models (LLMs), specifically susceptible to the "Dynamic Target Attack" (DTA). Unlike traditional gradient-based jailbreaks (e.g., GCG) that optimize adversarial suffixes toward a fixed, low-probability static target (e.g., "Sure, here is..."), DTA exploits the model's own output distribution. The attack iteratively samples candidate responses from the target model using relaxed decoding parameters (high…

Large Language Models (LLMs), specifically variants of GPT-4o, DeepSeek-R1, OLMo-2, and Llama-4, are vulnerable to accelerated adaptive adversarial attacks due to excessive information leakage in observable output signals. When these models expose "thinking processes" (Chain-of-Thought traces) or token-level log-probabilities (logits) to the end user, they leak significant mutual information $I(Z;T)$ regarding the model's safety state or hidden instructions. This leakage allows adaptive attack…

Mobile LLM-based agents (including Mobile-Agent-E, AppAgent, AutoDroid, and others) are vulnerable to indirect prompt injection attacks delivered via untrusted third-party mobile channels, such as in-app advertisements, system notifications, and embedded webviews. These agents utilize Multimodal Large Language Models (MLLMs) to perceive the device state via screenshots or accessibility trees. The vulnerability exists because the agents concatenate the user's prompt ($p$) with the environmental…

A vulnerability exists in Large Language Models (LLMs) that support fine-tuning, allowing an attacker to bypass safety alignments using a small, benign dataset. The attack, "Attack via Overfitting," is a two-stage process. In Stage 1, the model is fine-tuned on a small set of benign questions (e.g., 10) paired with identical, repetitive refusal answers. This induces an overfitted state where the model learns to refuse all prompts, creating a sharp minimum in the loss landscape and making it…