Language Model Security Database

Large Vision Language Models (LVLMs) are vulnerable to a jailbreaking attack that combines image typography manipulation with multi-turn prompting. The vulnerability exploits the model's visual encoder and instruction-following capabilities by embedding a harmful textual query directly into a benign image as a visible caption (using specific fonts and blending techniques). An attacker then engages the model in a three-turn conversation: first asking a benign question about the visual object…

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

The JPRO (Automated Multimodal Jailbreaking via Multi-Agent Collaboration) framework exploits a vulnerability in Large Vision-Language Models (VLMs) related to insufficient cross-modal safety alignment and lack of maliciousness sustainability in multi-turn dialogues. The attack leverages a multi-agent system (Planner, Attacker, Modifier, Verifier) to automate the generation of adversarial image-text pairs. By employing hybrid tactics—such as combining role-playing with malicious content…

Vision-Language Models (VLMs) are vulnerable to a jailbreak attack vector termed "weak-OOD" (weak Out-of-Distribution), specifically instantiated via the JOCR (Jailbreak via OCR-Aware Embedded Text Perturbation) method. The vulnerability arises from an asymmetry between the model's pre-training phase (which establishes robust OCR capabilities and intent perception) and the safety alignment phase (which lacks generalization to visual anomalies). Attackers can embed malicious text instructions…

The paper describes a reproducible black-box evaluation and attack framework, PolyJailbreak, for multimodal LLMs. It reports that uneven text-versus-vision safety alignment allows jointly optimized text and image inputs to bypass refusal behavior without model internals. The authors attribute this to visual alignment weakening textual refusal representations and to cross-modal fusion making harmful intent harder to separate from benign intent. These are paper-reported findings, not…

A vulnerability exists in the self-reflection and introspection capabilities of Large Language Models (LLMs) and Vision-LLMs that allows attackers to perform black-box adversarial optimization using only textual model responses. This technique, termed "Asking for Directions" (AfD), bypasses the need for access to gradients, logits, or continuous confidence scores. The attacker employs a hill-climbing optimization strategy where they present the target model with two candidate inputs (an…

Large Vision-Language Model (LVLM) driven mobile agents, such as Mobile-Agent-E, are vulnerable to a touch-guided visual prompt injection attack. This vulnerability allows an attacker to hijack the agent's execution flow via a malicious Android application interface without requiring system-level privileges. The attack leverages "Non-privileged Perception Compromise," where a visual payload is embedded in the application UI and conditionally rendered only during agent-specific interaction…

Large Language Models (LLMs), including proprietary and open-weight state-of-the-art systems, are vulnerable to automated, self-evolving adversarial attacks orchestrated by multi-agent frameworks. The vulnerability exists because current safety alignment strategies (RLHF, static safety filters) fail to generalize against the "SafeEvalAgent" attack vector. In this vector, an "Analyst" agent analyzes model refusals to iteratively refine attack strategies, while a "Specialist" agent grounds these…

Large Language Models (LLMs), including GPT-4o, LLaMA-3, and GPT-3.5-Turbo, are vulnerable to multimodal prompt injection attacks. These models fail to distinguish between system-level instructions and user-provided content within the context window. Attackers can exploit this by embedding malicious instructions in direct text, indirect sources (such as third-party webpages or PDFs), or visual inputs (images). Successful exploitation results in the model prioritizing the injected adversarial…