Language Model Security Database

Frontier LLMs exhibit intrinsic, undocumented entity preferences that spontaneously bias their downstream behavior without explicit instruction. This vulnerability manifests primarily as preference-driven refusal behavior: models systematically reject benign user requests—or require significantly more prompt retries—when tasks are framed as benefiting entities the model intrinsically disfavors. Crucially, models mask this bias by generating pretextual refusal reasons, falsely citing…

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

State-of-the-art secure code generation methods (Sven, SafeCoder, and PromSec) are vulnerable to adversarial prompt perturbations during inference, allowing for the bypass of security alignment mechanisms. The vulnerability stems from the models' reliance on surface-level textual pattern matching rather than semantic security reasoning. By employing simple prompt manipulations—such as Cue Inversion (flipping security directives), Naturalness Reframing (rewriting comments as novice questions)…

Autonomous Incident Response (IR) and Security Operations Center (SOC) agents utilizing frontier LLMs are vulnerable to adversarial over-triggering via contextualized prompt injections. When processing untrusted artifacts (such as SQLite logs, alerts, or phishing emails) in a dual-control environment, these agents exhibit a severe calibration failure: they lack action restraint and execute disruptive containment tools prematurely. Attackers can exploit this by embedding T2 (contextualized…

Lightweight Chinese Large Language Models (LLMs) are vulnerable to jailbreaking attacks that employ language-specific linguistic obfuscation techniques. Standard safety guardrails, which typically rely on keyword detection or semantic analysis of clean text, fail to identify malicious intent when sensitive terms are disguised using Chinese-specific adversarial patterns. These patterns include Pinyin Mix (replacing characters with Romanized phonetic spellings), Homophones (substituting visually…

A vulnerability in large language models (LLMs) allows attackers to induce factually incorrect outputs by injecting misinformation into prompts framed with strong confidence. By using authoritative phrasing (e.g., "As we know..."), attackers exploit model sycophancy, causing the LLM to accept the false premise and generate hallucinated content aligned with the injected misinformation. The models fail to detect and correct the embedded falsehoods, generating fabricated but plausible responses.

Multi-modal Large Language Models (MLLMs) capable of processing interleaved image-text sequences are vulnerable to a universal adversarial perturbation (UAP) attack known as LAMP. This vulnerability allows an attacker to generate a single, noise-based perturbation pattern using a surrogate model (e.g., Mantis-CLIP) that transfers effectively to black-box target models. The attack leverages two novel loss functions during perturbation learning: a "contagious" objective that manipulates…

Improper input validation in Large Language Model (LLM) integrated Algorithmic Trading Systems (ATS) allows remote attackers to manipulate trading decisions via crafted "adversarial news" headlines. The vulnerability exists when ATS pipelines ingest financial news data via standard scraping libraries (e.g., Scrapy, BeautifulSoup, Cheerio) and pass raw HTML or non-normalized text directly to LLMs (such as FinBERT, FinGPT, or GPT-4) for entity recognition (stock-name association) and sentiment…