Attack Type

Hallucination Research

Exploits causing models to generate false information

52 matching entries

Hallucination research results

52 entries

Cascading Agent False Consensus

Published 3/1/2026

Analyzed 3/9/2026

Multi-Agent Systems based on Large Language Models (LLM-MAS) are vulnerable to systemic Consensus Corruption via cascading error amplification. Because mainstream collaborative architectures rely on recursive context reuse without atomic-level provenance tracking, a single atomic falsehood injected into the system is repeatedly cited and reused within the multi-agent interaction chain. This structural exposure causes the error to deterministically compound across the communication graph…

From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration

Evaluated models: GPT-4o

Source: arXiv

AI Persuasion Trust Attack

Published 2/1/2026

Analyzed 2/22/2026

Adversarial Explanation Attacks (AEAs) introduce a behavioral vulnerability in Large Language Model (LLM) based decision-support systems where the communication channel between the AI and the user is exploited to induce trust in incorrect model predictions. By manipulating the framing of an explanation—specifically its reasoning mode, evidence type, communication style, and presentation format—an attacker can dissociate the perceived plausibility of an explanation from its factual correctness…

When AI Persuades: Adversarial Explanation Attacks on Human Trust in AI-Assisted Decision Making

Evaluated models: Llama 3.3 70B

Source: arXiv

Adversarial Claim Search Deception

Published 2/1/2026

Analyzed 2/22/2026

Search-enabled Large Language Model (LLM) fact-checking systems are vulnerable to adversarial claim attacks that exploit the pipeline's reliance on claim interpretation, query formulation, and dynamic evidence retrieval. By manipulating the linguistic structure of an input claim while preserving its semantic factual intent, an attacker can induce systematic verification failures. This vulnerability stems from three specific attack surfaces: 1. Search Engine Misguidance: Altering lexical…

DECEIVE-AFC: Adversarial Claim Attacks against Search-Enabled LLM-based Fact-Checking Systems

Evaluated models: GPT-4o

Source: arXiv

Chunky Post-Training Miscalibration

Published 2/1/2026

Analyzed 2/21/2026

Large Language Models (LLMs) exhibit a vulnerability termed "chunky post-training," where the model learns spurious correlations between incidental prompt features (e.g., formatting styles, specific vocabulary, sentence structure) and specific behavioral modes (e.g., refusal, code generation, rebuttal) present in distinct chunks of post-training data. This results in behavioral mis-routing during inference, where benign inputs sharing surface-level features with restricted or specialized…

Chunky Post-Training: Data Driven Failures of Generalization

Evaluated models: Claude Haiku 4.5, Claude Sonnet 4.5, Claude Opus 4.5 +5 more

Source: arXiv

CoT Causal Bypass

Published 2/1/2026

Analyzed 3/9/2026

Large language models (LLMs) exhibit a "Causal Bypass" vulnerability during Chain-of-Thought (CoT) prompting, where the generated reasoning text does not causally determine the model's final output. Instead of utilizing the explicit CoT tokens, the model routes decision-critical computation through latent, implicit pathways. This allows the visible reasoning trace to function as an unfaithful, post-hoc rationalization rather than an actual representation of the model's internal logic…

Bypassing the Rationale: Causal Auditing of Implicit Reasoning in Language Models

Evaluated models: Phi-4 Mini Reasoning, Qwen 3 1.7B, Phi-3.5 Mini Instruct +7 more

Source: arXiv

Context-Robust RAG Poisoning

Published 2/1/2026

Analyzed 2/22/2026

Retrieval-Augmented Generation (RAG) systems are vulnerable to a robust corpus poisoning attack known as "Confundo." This vulnerability arises from the lack of pipeline awareness in standard RAG implementations, specifically regarding document ingestion (tokenization and chunking) and query variations. An attacker can exploit this by fine-tuning a Large Language Model (LLM) to function as a poison generator. Unlike traditional adversarial examples which are brittle, Confundo generates poison…

Confundo: Learning to Generate Robust Poison for Practical RAG Systems

Evaluated models: Llama 3 8B, Gemini Pro

Source: arXiv

LLM Scaling Fidelity Paradox

Published 2/1/2026

Analyzed 2/21/2026

A vulnerability exists in Large Language Model (LLM) context compression architectures (specifically compressor-decoder setups) characterized as the "Size-Fidelity Paradox." When scaling up the parameter count of the compressor model (e.g., beyond 4B parameters in Qwen-3 and LLaMA-3.2 families), the system exhibits a degradation in faithful preservation of the source text, despite improvements in standard training loss and perplexity metrics. This degradation manifests through two primary…

When Less is More: The LLM Scaling Paradox in Context Compression

Evaluated models: Qwen 3 8B, Qwen 3 32B, Llama 3.2 11B +1 more

Source: arXiv

Learned Reward Model Hacking

Published 2/1/2026

Analyzed 2/22/2026

Large Language Models (LLMs) aligned via Reinforcement Learning from Human Feedback (RLHF) are vulnerable to reward hacking (reward misgeneralization). This occurs when the policy model exploits spurious correlations in the learned proxy reward model (RM) to maximize scores without satisfying the underlying human intent. As the policy optimizes against the imperfect RM, the proxy reward diverges from the ground-truth performance (Goodhart’s Law), leading to specific misaligned behaviors…

Adversarial Reward Auditing for Active Detection and Mitigation of Reward Hacking

Evaluated models: GPT-4, Llama 2 7B

Source: arXiv

Mobile Agent Visual Spoofing

Published 2/1/2026

Analyzed 2/22/2026

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Evaluated models: Not reported

Source: arXiv

Reasoning Model Social Conformity

Published 2/1/2026

Analyzed 3/8/2026

Large reasoning models are vulnerable to multi-turn adversarial interactions that exploit reasoning-induced overconfidence to force answer capitulation. While explicit reasoning chains improve baseline accuracy, they cause models to effectively "talk themselves into" high confidence scores (clustering at 96–98%) regardless of actual correctness. This systematic overcalibration (r=-0.08, ROC-AUC=0.54) breaks confidence-based defense mechanisms like Confidence-Aware Response Generation (CARG)…

Consistency of Large Reasoning Models Under Multi-Turn Attacks

Evaluated models: GPT-5.1, GPT-5.2, DeepSeek R1 +5 more

Source: arXiv

Related research categories