Language Model Security Database

A vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety guardrails via a Multi-Turn Adaptive Prompting Attack (MAPA). Instead of triggering safety mechanisms with an immediate, explicit malicious request, the attacker iteratively injects malicious intent across multiple conversation turns by alternating between text and visual modalities. At each turn, the attack dynamically tests three prompt configurations (unconnected text only, unconnected text + malicious…

Large Vision-Language Models (LVLMs) are vulnerable to Visual Memory Injection (VMI), a stealthy targeted attack targeting multi-turn conversations. An attacker can embed an imperceptible adversarial perturbation ($L_\infty \le 8/255$) into a seemingly benign image. Because the visual input persists in the model's context throughout a multi-turn dialogue, the injected payload remains dormant. By utilizing "benign anchoring" and "context-cycling" during optimization, the attacker ensures the…

The paper reports a black-box jailbreak evaluation in which a ReAct-style loop adaptively rewrites unsafe text prompts and selectively applies blur, DCT filtering, or recoloring to image regions identified as safety-sensitive. The combined cross-modal strategy is intended to make harmful image-text requests appear less objectionable to a vision-language model while preserving enough semantics to elicit an answer. This is a specific, security-relevant evaluation, although the reported results…

The paper describes a specific black-box jailbreak evaluation, BVS, in which fragmented visual content is mixed with neutral imagery and paired with reconstruction-oriented text so harmful intent is only recomposed during multimodal reasoning. The authors report that this can bypass input and output safety assumptions in image-generating MLLMs. A safe defensive reproduction should use synthetic, non-harmful stand-ins for prohibited concepts, test whether fragmented cross-modal inputs are…

Large Vision-Language Models (LVLMs), specifically InstructBLIP, LLaVA, and MiniGPT-4, are susceptible to a black-box adversarial jailbreak vulnerability via Zeroth-Order Simultaneous Perturbation Stochastic Approximation (ZO-SPSA). An attacker can generate adversarial images with imperceptible perturbations that, when paired with harmful text prompts, bypass the model's safety alignment mechanisms (such as RLHF). Unlike traditional white-box attacks, this method does not require access to…

Multi-modal Large Language Models (MLLMs) capable of processing interleaved image-text sequences are vulnerable to a universal adversarial perturbation (UAP) attack known as LAMP. This vulnerability allows an attacker to generate a single, noise-based perturbation pattern using a surrogate model (e.g., Mantis-CLIP) that transfers effectively to black-box target models. The attack leverages two novel loss functions during perturbation learning: a "contagious" objective that manipulates…

A vulnerability in the prompt-side safety filters of GPT-based Text-to-Image (T2I) systems allows attackers to bypass restrictions on Politically Sensitive Content (PSC). By utilizing a technique called Identity-Preserving Descriptive Mapping (IPDM) combined with Geopolitically Distal Translation, an attacker can obfuscate explicit political entities into neutral descriptive phrases translated across multiple low-resource languages. This induces semantic fragmentation, preventing the safety…

A "Gamified Adversarial Multimodal Breakout via Instructional Traps" (GAMBIT) vulnerability exists in the safety alignment mechanisms of Multimodal Large Language Models (MLLMs), specifically those employing Chain-of-Thought (CoT) reasoning. The vulnerability exploits the finite cognitive resource budget of the model by inducing "cognitive overload" through a high-stakes, gamified context. The attack functions by decomposing a harmful query into a visual puzzle (e.g., a shuffled grid of image…

Code-generation Large Language Models (LLMs) and Multimodal Large Language Models (MLLMs) are vulnerable to directed misuse for the generation of misleading data visualizations. This vulnerability, described as the "ChartAttack" framework, allows an attacker to prompt the model to manipulate chart annotation code (e.g., JSON specifications for Matplotlib or Vega-Lite) to apply specific "misleaders"—design choices that distort data interpretation without altering the underlying data values. By…

Multimodal Large Language Models (MLLMs) exhibit a vulnerability to "Reasoning-based Multi-Image Attacks," where safety guardrails are bypassed by distributing harmful intent across multiple images (2–4 inputs). Unlike single-image jailbreaks that rely on visual obfuscation, this vulnerability exploits the model's reasoning capabilities. By presenting images that share a specific relationship (e.g., Temporal Jump, Spatial Juxtaposition, or Causality), an attacker can compel the model to infer…