Language Model Security Database

The paper reports a reproducible white-box evaluation in which semantically bridging a benign topic into a harmful request bypassed Llama-2-7B-chat-hf safety behavior in 4 of 30 tested prompt pairs. Paired internal attribution graphs associated successful jailbreaks with path rerouting rather than simple suppression of safety features. This is a paper-reported result, not independently verified here. Defensive reproduction should use the paper’s supplied dataset and code in an isolated…

The paper reports a reproducible white-box jailbreak failure mode: successful jailbreak templates selectively suppress early-layer Adversarially Compromised Heads (ACHs), bypassing refusal while harmful-semantic safety activations persist in other heads. The authors identify ACH/SAH behavior using benign, harmful, and successful-attack input triplets, then causally validate the pathway through controlled head ablations. Safe defensive reproduction should use the paper’s released evaluation…

The paper reports a reproducible white-box evaluation showing that successful jailbreak prompts can alter a safety-aligned model’s intermediate representations so harmful requests no longer trigger refusal. Its LOCA method identifies small, token-specific residual-stream changes that restore refusal on individual successful jailbreaks, providing causal evidence that jailbreak success can depend on suppressing harmfulness/refusal concepts or strengthening seemingly harmless continuation…

A vulnerability in LLM parameter-space merging algorithms enables a latent supply-chain attack where adversaries embed pre-computed malicious weight perturbations into open-source models. Using a constrained optimization framework, attackers inject latent components into the Multilayer Perceptron (MLP) up-projection matrices of source models. These perturbations are mathematically constrained to preserve the source model's individual safety alignment (via directional consistency) and benign…

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

An issue in large language models (LLMs) with white-box weight access allows attackers to permanently bypass safety guardrails via Weight Orthogonalization (WO). By calculating a model's "refusal vector"—the mean-difference vector between harmful and harmless instruction activations in the residual stream—an attacker can orthogonalize the model's weights to prevent it from writing to this refusal direction ($W^{\prime}\leftarrow W-rr^{\intercal}W$). Unlike jailbreak-tuning or data poisoning…

An activation-space adversarial attack, termed "Amnesia", allows an attacker with white-box access to bypass the safety mechanisms of open-weight Large Language Models (LLMs) at inference time without requiring fine-tuning, weight modifications, or prompt manipulation. The vulnerability stems from how safety-aligned LLMs localize refusal features within the attention value path of specific decoder layers. An attacker can extract an attack vector ($\mathbf{V}_i$) by hooking the attention value…

GPT-OSS-Safeguard-20B and Meta-SecAlign (70B/8B) are vulnerable to white-box adversarial attacks generated by automated algorithmic recombination (specifically the claude_v63, claude_v82, and claude_v53-oss optimizers). These algorithms significantly outperform standard discrete optimization methods (like GCG) by integrating continuous optimization (ADC) with LayerNorm gradient scaling (LSGM), or by merging momentum-smoothed gradients with directional perturbation candidate selection (DPTO)…

A compositional vulnerability in modular Large Language Models (LLMs) allows attackers to bypass safety alignment by distributing malicious weight updates across multiple Parameter-Efficient Fine-Tuning (PEFT) adapters (e.g., LoRA). The malicious adapters are anchored to valid functional subspaces (e.g., math, coding) and exhibit benign behavior when evaluated in isolation, successfully evading standard unit-centric safety scans and static weight-space defenses. However, when a user linearly…

An activation-steering vulnerability in open-weights Large Language Models allows attackers to bypass safety guardrails by injecting targeted additive perturbations into deep, safety-critical attention heads. The exploit, termed Safety Attention Head Attack (SAHA), utilizes Ablation-Impact Ranking (AIR) to isolate specific attention heads that causally govern safety refusals. By applying Layer-Wise Perturbations (LWP) derived from the linearized decision boundary of a latent safety probe, an…