Language Model Security Database

Frontier Large Language Models (LLMs) exhibit a critical vulnerability to automated, adaptive multi-turn adversarial attacks, specifically those utilizing tree-based exploration algorithms (e.g., the TEMPEST framework). Unlike single-turn jailbreaks, this vulnerability exploits the model's inability to maintain safety alignment across extended conversation trajectories. An attacker using an automated agent can dynamically select from multiple adversarial strategies—such as academic framing…

A Denial-of-Service (DoS) vulnerability exists in Large Language Model (LLM) inference services where specially crafted input prompts can trigger excessively long or infinite generation loops ("infinite thinking"). This vulnerability, identified as "ThinkTrap," utilizes derivative-free optimization (CMA-ES) within a continuous surrogate embedding space to circumvent the discrete nature of token inputs. By optimizing a low-dimensional latent vector and projecting it to token sequences, an…

Large Language Models (LLMs) are vulnerable to automated, black-box, multi-turn jailbreak attacks coordinated by an adversarial agent trained via Reinforcement Learning (RL). The vulnerability exists because standard safety alignments often optimize for single-turn refusals, failing to account for trajectory-level planning. The attack method, dubbed RL-MTJail, utilizes a multi-turn variant of Group Relative Policy Optimization (GRPO) to train an attacker LLM. This agent optimizes for the…

Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) are vulnerable to semantic injection attacks via adversarial tool descriptors. The vulnerability arises because MCP implementations inject natural language tool metadata (descriptions, schemas) directly into the model's reasoning context without semantic sanitization or cryptographic binding. This allows unprivileged adversaries to register tools containing hidden imperative instructions within the descriptor text…

Large Language Models (LLMs), including GPT-5, Gemini-2.5-Flash, DeepSeek, and Llama-3, are vulnerable to a semantic isomorphism attack known as "Safe2Harm." This vulnerability arises from the failure of safety alignment mechanisms (SFT, RLHF, DPO) to detect harmful underlying principles when they are encapsulated within semantically legitimate scenarios. Attackers can bypass safety filters through a four-stage process: (1) rewriting a harmful query into a safe, principle-equivalent query…

Reasoning-specialized Large Language Models (LLMs) that utilize Chain-of-Thought (CoT) processes are vulnerable to reasoning-exploitation jailbreaks. Attackers can bypass standard safety alignments (such as RLHF) by using adaptive multi-turn interactions or semantic transformations to induce the model to generate intermediate reasoning steps that "rationalize" or "contextualize" a harmful request. Because current alignment techniques often fail to scale linearly with reasoning depth, forcing…

A vulnerability exists in Multi-Agent Systems (MAS) utilizing Large Language Models (LLMs) for clinical decision support, specifically affecting architectures where a central "AI Doctor" agent relies on consensus or majority voting from assistant agents. The vulnerability, termed "Many-to-One Adversarial Consensus," allows a coalition of colluding adversarial agents to override the central agent's safety alignment and internal knowledge. By fabricating a false consensus (typically requiring $k…

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

A vulnerability exists in OpenAI's Custom GPTs platform where the lack of effective isolation between the system context ("Expert Prompt"), external knowledge retrieval, and user input allows for unauthorized information disclosure and tool misuse. By employing specific prompt injection techniques—including Hex injection, Many-shot prefix attacks, and Knowledge Poisoning (uploading malicious files)—an attacker can bypass safety guardrails. This results in the extraction of proprietary system…

A "Helpful Mode" role-confusion vulnerability exists in specific Large Language Model (LLM) safety guardrails, specifically Nemotron-Safety-8B and Granite-Guardian-3.2-5B. These models, designed to act as binary classifiers (outputting "Safe" or "Unsafe") for content moderation, can be manipulated via contextually framed adversarial prompts (e.g., academic research requests, corporate security scenarios, or roleplay) to abandon their classification objective. Instead of blocking the request…