Attack Context

API Vulnerabilities

Vulnerabilities in model API implementations

20 matching entries out of 79 in this category

API research results

20 entries

Semantic Hierarchical VLM Transfer

Updated 2/22/2026

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

Affects: UniDiffuser, BLIP-2 ViT-g/14, InstructBLIP Vicuna 13B +4 more

Source: arXiv

Semantics-Preserving Detector Evasion

Updated 2/21/2026

LLM-based vulnerability detection systems (used in static application security testing and code review pipelines) are susceptible to semantics-preserving adversarial evasion attacks. Attackers can bypass detection mechanisms by injecting gradient-optimized "universal adversarial strings" into specific code regions—defined as "carriers"—that do not alter the program's compilation or execution logic. These carriers include non-executable regions (code comments, inactive preprocessor directives)…

Syntax- and Compilation-Preserving Evasion of LLM Vulnerability Detectors

Affects: Qwen 2.5 Coder 14B, Qwen 2.5 Coder 32B, Llama 3.1 8B +4 more

Source: arXiv

Overfitting-induced Benign Jailbreak

Updated 10/13/2025

A vulnerability exists in Large Language Models (LLMs) that support fine-tuning, allowing an attacker to bypass safety alignments using a small, benign dataset. The attack, "Attack via Overfitting," is a two-stage process. In Stage 1, the model is fine-tuned on a small set of benign questions (e.g., 10) paired with identical, repetitive refusal answers. This induces an overfitted state where the model learns to refuse all prompts, creating a sharp minimum in the loss landscape and making it…

Attack via Overfitting: 10-shot Benign Fine-tuning to Jailbreak LLMs

Affects: DeepSeek R1 Distill Llama 8B, GPT-3.5 Turbo, GPT-4.1 +7 more

Source: arXiv

Special Token Jailbreak

Updated 10/31/2025

Large Language Models (LLMs) that use special tokens to define conversational structure (e.g., via chat templates) are vulnerable to a jailbreak attack named MetaBreak. An attacker can inject these special tokens, or regular tokens with high semantic similarity in the embedding space, into a user prompt. This manipulation allows the attacker to bypass the model's internal safety alignment and external content moderation systems. The attack leverages four primitives: 1. Response Injection…

MetaBreak: Jailbreaking Online LLM Services via Special Token Manipulation

Affects: Claude Opus 4, Gemma 2 27B IT, GPT-4.1 +9 more

Source: arXiv

Multimodal Prompt Injection

Updated 12/9/2025

Large Language Models (LLMs), including GPT-4o, LLaMA-3, and GPT-3.5-Turbo, are vulnerable to multimodal prompt injection attacks. These models fail to distinguish between system-level instructions and user-provided content within the context window. Attackers can exploit this by embedding malicious instructions in direct text, indirect sources (such as third-party webpages or PDFs), or visual inputs (images). Successful exploitation results in the model prioritizing the injected adversarial…

Multimodal Prompt Injection Attacks: Risks and Defenses for Modern LLMs

Affects: GPT-3.5, GPT-4o, Llama 3 8B +1 more

Source: arXiv

Typos Undermine Watermarks

Updated 2/22/2026

Large Language Model (LLM) inference-time watermarking schemes are vulnerable to evasion via character-level perturbations that disrupt the model's tokenizer. Unlike token-level attacks (e.g., synonym replacement), character-level edits—such as homoglyph substitutions, zero-width character insertions, and typos—force the tokenizer to segment a single semantic unit into multiple sub-word tokens. This fragmentation alters the context window used by the watermarking hashing function (e.g., the…

Character-Level Perturbations Disrupt LLM Watermarks

Affects: Llama 3 8B

Source: arXiv

Agent Tool Metadata Lure

Updated 2/22/2026

A vulnerability exists in the tool selection mechanisms of Large Language Model (LLM) agents, identified as the "Attractive Metadata Attack" (AMA). This flaw allows an adversary to manipulate the metadata (names, descriptions, and parameter schemas) of malicious external tools to statistically maximize the likelihood of their selection by the agent, without requiring prompt injection or access to model internals. The vulnerability exploits the agent’s semantic scoring function used to map user…

Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools

Affects: GPT-4o Mini, Llama 3.3 70B Instruct, Qwen 2.5 32B Instruct +2 more

Source: arXiv

MDH: Hybrid Jailbreak Detection Strategy

Updated 8/31/2025

Large language models that support a developer role in their API are vulnerable to a jailbreaking attack that leverages malicious developer messages. An attacker can craft a developer message that overrides the model's safety alignment by setting a permissive persona, providing explicit instructions to bypass refusals, and using few-shot examples of harmful query-response pairs. This technique, named D-Attack, is effective on its own. A more advanced variant, DH-CoT, enhances the attack by…

Jailbreaking Commercial Black-Box LLMs with Explicitly Harmful Prompts

Affects: GPT-3.5 Turbo, GPT-4o, GPT-4.1 +13 more

Source: arXiv

LLM Judge Subversion

Updated 12/9/2025

Alibaba Cloud PAI-Judge and PAI-Judge-Plus are vulnerable to a composite adversarial attack that exploits attention mechanism limitations in Large Language Models (LLMs). An authenticated attacker can manipulate automated evaluation outcomes by appending a long, irrelevant text suffix (approximately 1000 to 2000+ characters) to a response containing adversarial perturbations. This "long-suffix" strategy overwhelms the judge model's context window, causing the attention mechanism to degrade and…

LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge

Affects: GPT-4o, Llama 3.1 8B, Llama 3.3 70B +3 more

Source: arXiv

Conditional Prompt Hijack

Updated 12/8/2025

The SPECTRE framework introduces a black-box adversarial attack vector against Large Language Models (LLMs) that utilizes malicious system prompts to hijack conversations. Unlike traditional jailbreaks that aim to bypass safeguards for all inputs, SPECTRE optimizes system prompts to induce incorrect or harmful responses only for specific targeted questions (e.g., "Are COVID vaccines safe?", "Who should I vote for?"), while maintaining high accuracy and benign behavior on all other non-targeted…

SPECTRE: Conditional System Prompt Poisoning to Hijack LLMs

Affects: GPT-3.5 Turbo, GPT-4o Mini, Llama 2 7B +8 more

Source: arXiv

Related research categories