Language Model Security Database

Multi-modal Large Language Models (MLLMs) are vulnerable to a multi-turn jailbreaking attack that leverages typographic visual prompts combined with conversational context drifting. The vulnerability exists because MLLMs establish trust and context during initial benign interactions, shifting the model's latent representation toward helpfulness and compromising its ability to detect malicious intent in subsequent turns. The attack vector utilizes an image where a harmful request is…

The Google Agent Payments Protocol (AP2), specifically within the reference implementation built using the Google Agent Development Kit (ADK) and Gemini models, contains vulnerabilities allowing for both indirect and direct prompt injection. The architecture fails to sufficiently isolate the Large Language Model (LLM) context from untrusted external data sources and user inputs.

Large Language Models (LLMs), specifically open-weight instruction-tuned models (including Llama-3.1-8B, Qwen3-8B, and Gemma-7B) and certain closed-weight APIs allowing partial response pre-filling, are vulnerable to "Sockpuppetting" or Output Prefix Injection. This vulnerability exploits the model's autoregressive nature and self-consistency bias. By injecting a target acceptance sequence (e.g., "Sure, here is...") directly into the start of the assistant message block within the chat…

Large Language Model (LLM) agents utilizing external tool execution frameworks are vulnerable to Indirect Prompt Injection (IPI) via the "Tool Stream." Unlike traditional data-stream injections (e.g., malicious emails), this vulnerability exploits the agent's interpretation of functional tool definitions (docstrings, signatures) and runtime feedback (error messages, return values) as binding operational constraints. Adversaries functioning as compromised or malicious tool providers can embed…

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Large Language Model (LLM) agents operating in tool-augmented environments are susceptible to "Contextual Fragility" and multi-turn "long-chain" exploitation. Existing safety mechanisms predominantly function on a stateless, atomic paradigm, evaluating individual input-output pairs in isolation. This allows an adversary to orchestrate complex attack trajectories where malicious intent is distributed across multiple, individually benign steps (a "Domino Effect"). Consequently, an attacker can…

Commercial Multimodal Large Language Model (MLLM) integrated systems are vulnerable to a "Dual Steganography" jailbreak paradigm (referred to as Odysseus). The vulnerability arises from the reliance of safety filters on the assumption that malicious content must be explicitly visible in the input or output modalities (text or image). Attackers can bypass these filters by encoding malicious queries into binary matrices and embedding them into benign-looking images using steganographic encoders…

Frontier Large Language Models (LLMs) exhibit a critical vulnerability to automated, adaptive multi-turn adversarial attacks, specifically those utilizing tree-based exploration algorithms (e.g., the TEMPEST framework). Unlike single-turn jailbreaks, this vulnerability exploits the model's inability to maintain safety alignment across extended conversation trajectories. An attacker using an automated agent can dynamically select from multiple adversarial strategies—such as academic framing…

A vulnerability exists in OpenAI's Custom GPTs platform where the lack of effective isolation between the system context ("Expert Prompt"), external knowledge retrieval, and user input allows for unauthorized information disclosure and tool misuse. By employing specific prompt injection techniques—including Hex injection, Many-shot prefix attacks, and Knowledge Poisoning (uploading malicious files)—an attacker can bypass safety guardrails. This results in the extraction of proprietary system…