Attack Type

Hallucination Vulnerabilities

Exploits causing models to generate false information

19 matching entries out of 52 in this category

Hallucination research results

19 entries

Chunky Post-Training Miscalibration

Updated 2/21/2026

Large Language Models (LLMs) exhibit a vulnerability termed "chunky post-training," where the model learns spurious correlations between incidental prompt features (e.g., formatting styles, specific vocabulary, sentence structure) and specific behavioral modes (e.g., refusal, code generation, rebuttal) present in distinct chunks of post-training data. This results in behavioral mis-routing during inference, where benign inputs sharing surface-level features with restricted or specialized…

Chunky Post-Training: Data Driven Failures of Generalization

Affects: Claude Haiku 4.5, Claude Sonnet 4.5, Claude Opus 4.5 +5 more

Source: arXiv

Mobile Agent Visual Spoofing

Updated 2/22/2026

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Source: arXiv

Safety Steering Amplifies Jailbreaks

Updated 2/21/2026

Inference-time intervention techniques (also known as activation steering or model steering), utilized to adjust Large Language Model (LLM) behavior without retraining, contain a vulnerability related to robust specificity. When these methods are applied to reduce "over-refusal" (increasing compliance on benign but sensitive-sounding queries), they inadvertently degrade the model's adversarial robustness. Specifically, steering vectors derived from methods such as Difference-in-Means…

Steering Safely or Off a Cliff? Rethinking Specificity and Robustness in Inference-Time Interventions

Affects: Llama 3.1 8B, Llama 3.2 3B, Qwen 2.5 7B +1 more

Source: arXiv

Self-Evolution Alignment Blindspots

Updated 3/8/2026

Closed-loop, self-evolving Large Language Model (LLM) multi-agent systems (MAS) are vulnerable to irreversible safety erosion and alignment failure. When agents recursively optimize and update their policies using only synthetic data derived from internal interactions—without continuous external human grounding—the system naturally minimizes interaction energy and optimizes for internal conversational consistency. This isolation causes a progressive drift away from initial anthropic safety…

The Devil Behind Moltbook: Anthropic Safety is Always Vanishing in Self-Evolving AI Societies

Affects: GPT-3.5 Turbo, Qwen 3 8B

Source: arXiv

Semantic Hierarchical VLM Transfer

Updated 2/22/2026

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

Affects: UniDiffuser, BLIP-2 ViT-g/14, InstructBLIP Vicuna 13B +4 more

Source: arXiv

TEE Advisor Hallucination

Updated 3/8/2026

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments

Affects: GPT-5.2, Claude Opus 4.6

Source: arXiv

Distractor Inverse Scaling

Updated 2/21/2026

Reasoning-capable Large Language Models (LLMs) and agentic AI systems exhibit a critical vulnerability to contextual distractors, resulting in catastrophic performance degradation (up to 80% drop in accuracy) and emergent misalignment. When the input context contains noise—specifically random documents, irrelevant chat history, or task-specific "hard negative" distractors—the models fail to filter this information. Instead of ignoring the noise, the models disproportionately attend to…

Lost in the Noise: How Reasoning Models Fail with Contextual Distractors

Affects: Gemini 2.5 Pro, Gemini 2.5 Flash, DeepSeek R1 0528 +4 more

Source: arXiv

Helpful Agent Default Bypass

Updated 2/21/2026

A vulnerability exists in the task-planning and execution logic of Large Language Model (LLM) agents, specifically within trip-planning and web-use agents. The vulnerability, identified as a "User-Mediated Attack," occurs because agents prioritize task completion and "helpfulness" over safety verification when processing content provided by the user. When a benign user forwards untrusted external content (e.g., promotional text containing phishing links or malicious instructions) to the agent…

Too Helpful to Be Safe: User-Mediated Attacks on Planning and Web-Use Agents

Source: arXiv

MLLM Chart Deception

Updated 2/21/2026

Code-generation Large Language Models (LLMs) and Multimodal Large Language Models (MLLMs) are vulnerable to directed misuse for the generation of misleading data visualizations. This vulnerability, described as the "ChartAttack" framework, allows an attacker to prompt the model to manipulate chart annotation code (e.g., JSON specifications for Matplotlib or Vega-Lite) to apply specific "misleaders"—design choices that distort data interpretation without altering the underlying data values. By…

ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation

Affects: Qwen 2.5 14B, LLaVA 7B, Phi-3

Source: arXiv

Metacognitive Prompting Lowers Resistance

Updated 2/22/2026

Large Language Models (LLMs) are vulnerable to multi-turn persuasive conversational attacks that induce the adoption of counterfactual beliefs. By leveraging the Source–Message–Channel–Receiver (SMCR) communication framework, attackers can systematically erode a model's confidence in established facts and compel the model to output misinformation. Specific attack vectors include manipulating source attribution (authority framing), message content (logical, credibility, or emotional appeals)…

Vulnerability of LLMs' Belief Systems? LLMs Belief Resistance Check Through Strategic Persuasive Conversation Interventions

Affects: GPT-4o, Llama 3.2 3B, Llama 3.3 70B +2 more

Source: arXiv

Related research categories