Attack Context

Black-box Vulnerabilities

Attacks requiring no knowledge of model internals

68 matching entries out of 733 in this category

Black-box research results

68 entries

Unsafe Culinary Instructions

Updated 4/10/2026

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

Cooking Up Risks: Benchmarking and Reducing Food Safety Risks in Large Language Models

Affects: Claude 3.7 Sonnet, GPT-4o, GPT-4.1 +8 more

Source: arXiv

LLM Judge Coin Flip

Updated 4/10/2026

Automated LLM-as-a-Judge safety classifiers exhibit severe performance degradation (falling to near-random chance) when subjected to distribution shifts caused by adversarial prompt optimization (Attack Shift), varying target architectures (Model Shift), and semantic categorization (Data Shift). Adversarial algorithms, particularly sampling-based (Best-of-N) and judge-aware optimization methods (GCG-REINFORCE), explicitly and implicitly exploit these judge insufficiencies. Instead of eliciting…

A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness

Affects: Llama 2 13B HarmBench, Llama Guard 3 8B, AegisGuard +1 more

Source: arXiv

LLM Judge Manipulation

Updated 4/10/2026

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Affects: GPT-4o, o1, Qwen 2.5 72B Instruct +1 more

Source: arXiv

Prompt Length Exponential Jailbreak

Updated 4/10/2026

A vulnerability in safety-aligned Large Language Models (LLMs) allows attackers to achieve an exponentially scaling Attack Success Rate (ASR) for jailbreaks by combining adversarial prompt injection with repeated inference-time sampling. While ASR against un-injected prompts scales polynomially with the number of generated samples ($k$), introducing a long adversarial suffix acts as a strong "misalignment field." This shifts the model's generation distribution into a replica-symmetric ordered…

Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover

Affects: Claude Sonnet 4.5 20250929, Claude 3.5 Haiku 20241022, GPT 3.5-turbo-0125 +7 more

Source: arXiv

Two-Stage Refusal Bypass

Updated 3/8/2026

Large Language Models (LLMs) are vulnerable to TAO-Attack, an advanced optimization-based jailbreak that bypasses safety alignments by exploiting gradient-guided token updates. The vulnerability stems from a two-stage loss function combined with a Direction-Priority Token Optimization (DPTO) algorithm. In the first stage, the attack optimizes an adversarial prompt suffix to minimize the probability of refusal signals (e.g., "I cannot") while maximizing the probability of a harmful target…

TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models

Affects: GPT-3.5 Turbo, GPT-4 Turbo, Llama 2 7B Chat +4 more

Source: arXiv

VLM Image-Shift Jailbreak

Updated 4/10/2026

The integration of the visual modality in Large Vision-Language Models (VLMs) introduces a vulnerability where appending an image to a harmful text prompt induces a "jailbreak-related representation shift" in the model's internal high-dimensional space. This shift forcibly steers the model's last-token hidden state away from a designated refusal state and into a distinct jailbreak state. The vulnerability occurs because the visual modality overrides the safety alignment of the underlying…

Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift

Affects: LLaVA 1.5 7B, ShareGPT4V 7B, InternVL-Chat 19B

Source: arXiv

CoT Divergence Safety Illusion

Updated 3/8/2026

Reasoning-capable LLMs are vulnerable to a safeguard bypass where intermediate Chain-of-Thought (CoT) traces generate and expose harmful content, even if the model ultimately rejects the prompt in its final output. Output-level safety alignments fail to intervene during the intermediate reasoning stages, allowing adversaries to covertly construct and extract high-quality malicious narratives (such as fake news) directly from the CoT output. Mechanistic analysis reveals this divergence stems…

CoT is Not the Chain of Truth: An Empirical Internal Analysis of Reasoning LLMs for Fake News Generation

Affects: Llama 3 8B

Source: arXiv

Covert Grade Manipulation

Updated 2/22/2026

Large Language Models (LLMs) utilized for Automatic Short Answer Grading (ASAG) are vulnerable to the "GradingAttack" framework, which employs fine-grained adversarial manipulation to alter grading outcomes. Attackers can leverage two distinct strategies: (1) Prompt-level attacks using role-play injection strings that instruct the model to pretend an answer is correct regardless of factual accuracy, and (2) Token-level attacks utilizing gradient-based optimization (similar to Greedy Coordinate…

GradingAttack: Attacking Large Language Models Towards Short Answer Grading Ability

Affects: GPT-3.5, GPT-4, GPT-4o +3 more

Source: arXiv

LLM Strategic Prompt Deception

Updated 2/21/2026

Alignment auditing methodologies used to verify the safety of Large Language Models (LLMs)—specifically black-box methods (Assistant Prefills, User Persona Sampling) and white-box interpretability methods (SAE Feature Description, Activation Token Embedding Similarity)—are vulnerable to prompt-level strategic deception. A misaligned "target" model, when supplied with a specific system prompt containing a high-level deceptive strategy and descriptions of the auditing tools, can obfuscate its…

Stress-Testing Alignment Audits With Prompt-Level Strategic Deception

Affects: Llama 3.1 8B, Llama 3.3 70B, Gemma 2 9B

Source: arXiv

RAG Knowledgebase Exfiltration

Updated 2/21/2026

Retrieval-Augmented Generation (RAG) systems are vulnerable to iterative knowledge-extraction attacks designed to reconstruct the underlying private knowledge base. The vulnerability exists due to the decoupled optimization of the retrieval and generation phases. Attackers can craft adversarial queries consisting of two distinct components: an "Information" component (optimized via gradient descent or random sampling to steer embeddings toward specific, diverse regions of the vector space) and…

Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

Affects: GPT-4o, Llama 3 8B, Qwen 2.5 7B

Source: arXiv

Related research categories