Attack Context

Black-box Vulnerabilities

Attacks requiring no knowledge of model internals

733 matching entries

Black-box research results

733 entries

GhostWriter Persistent Memory Poisoning in Tool-Using Agents

Updated 7/20/2026

The paper describes GhostWriter, a reproducible two-phase attack against tool-using agents with persistent memory: untrusted email or calendar content is admitted into long-term memory, then later retrieved during a benign user task and treated as trusted context. In the authors’ controlled evaluation, this could steer subsequent agent actions despite the adversary lacking direct access to the agent, memory store, account, or later prompt. The paper reports an average 98% memory-injection rate…

When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents

Affects: GPT-5.4-mini, DeepSeek V4 Flash, Gemini 2.5 Flash +1 more

Source: arXiv

Information-Overloading Jailbreaks in Vision-Language Models

Updated 7/20/2026

The paper describes a reproducible black-box multimodal jailbreak evaluation, INFER/INFER+, in which dense image typography, nested cross-modal references, recursive visual layouts, and entropy-guided search increase processing complexity and weaken refusal behavior in large vision-language models. The authors report average ASRs of 88.6% on open-source models and 84.0% on commercial models; these are paper-reported measurements, not independently verified facts. For safe defensive…

Overloading Large Vision-Language Models for Jailbreaking

Affects: Qwen3-VL 8B, Qwen2-VL-7B, InternVL3.5-8B +5 more

Source: arXiv

Black-Box System Prompt Leakage in Real-World LLM Applications

Updated 7/20/2026

The paper reports a reproducible black-box evaluation showing that adversarial user queries can cause deployed LLM applications to reveal hidden system prompts. In the authors’ measurement of 1,200 applications across six commercial platforms, 1,064 applications leaked prompt content (81.0%–93.5% per anonymized platform). This is a paper-reported result, not independently verified here. LeakBench and the official artifact repository provide defensive benchmark materials for controlled testing…

Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications

Affects: Llama 2 7B Chat, Llama 3.1 8B Instruct, Mistral 7B Instruct v0.3 +5 more

Source: arXiv

Automated indirect prompt injection against tool-calling agents

Updated 7/21/2026

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Affects: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5 +6 more

Source: arXiv

Multilingual Flowchart Jailbreaks in Vision-Language Models

Updated 7/20/2026

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

Affects: Qwen 2.5 VL 3B Instruct, Gemma-4-E4B-it, Pangea-7B

Source: arXiv

Persistent Memory Poisoning in LLM Agents

Updated 7/20/2026

The paper describes and evaluates a reproducible application-layer weakness in agents with persistent memory: untrusted external content can cross the memory-write boundary, be stored as trusted factual, experience, or procedural memory, and influence later sessions. It identifies four write channels—explicit writes, policy-driven writes, compaction, and experience-to-procedure synthesis—and six attack classes. For safe defensive testing, use MPBench’s two-phase structure in an isolated agent…

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

Affects: GPT-oss 120B

Source: arXiv

Fluent Single-Document RAG Corpus Poisoning

Updated 7/20/2026

SilentRetrieval describes a specific RAG corpus-integrity vulnerability: an attacker able to add a topically relevant document to a retrieval corpus can make that document rank highly and influence the generated answer while remaining fluent enough to evade simple perplexity checks. The paper evaluates a two-stage method combining retrieval-oriented document optimization with context-adaptive claim integration. A safe defensive reproduction is to use only isolated benchmark corpora and inert…

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

Affects: Llama 2 7B Chat, Mistral 7B Instruct v0.2, Qwen 7B Chat +1 more

Source: arXiv

Sleeper Memory Poisoning in LLM Agents

Updated 7/20/2026

The paper presents a specific black-box indirect prompt-injection evaluation: attacker-controlled external content can cause a memory-enabled assistant or external memory manager to persist a fabricated user memory, which may later be retrieved in a separate session and steer responses or agent actions. The authors evaluate injection, retrieval, and conditional adversarial usage separately across synthetic document and future-session datasets. The released repository provides defensive…

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

Affects: GPT-5.4, GPT-5.5, Claude Sonnet 4.6 +3 more

Source: arXiv

Query-Agnostic Poisoning of Medical Multimodal RAG

Updated 7/20/2026

M3Att demonstrates a reproducible knowledge-poisoning issue in medical multimodal RAG: an attacker with limited corpus-distribution knowledge can insert paired image-text entries whose visually perturbed images are broadly retrieved and whose clinically plausible misinformation steers downstream generation. The paper evaluates both white-box and black-box retrieval optimization and reports degraded diagnostic and report-generation utility across multiple datasets, retrievers, and LVLMs. These…

Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation

Affects: GPT-4o, GPT-5 Chat, Gemini 2.5 Flash +5 more

Source: arXiv

Simulated Multi-Turn Priming Bypasses LLM Safety Alignment

Updated 7/21/2026

The paper reports a reproducible black-box jailbreak evaluation in which an evolutionary search generates simulated, role-labeled multi-turn dialogue histories and submits them as a single request. Five semantic mutators and graded judge feedback optimize conversational priming that can induce harmful responses despite direct-request refusals. Results are paper-reported and not independently verified.

ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming

Affects: Qwen 3 8B, GPT-oss 20B, GPT-oss 120B +7 more

Source: arXiv

Related research categories