Impact

Integrity Vulnerabilities

Vulnerabilities impacting model output reliability

340 matching entries out of 521 in this category

Integrity research results

340 entries

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Updated 7/20/2026

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Affects: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash +3 more

Source: arXiv

Agent Implicit Doc Execution

Updated 4/10/2026

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Affects: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5 +2 more

Source: arXiv

No-Prompt Reasoning Hijack

Updated 4/10/2026

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and…

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

Affects: GPT-3.5 Turbo, GPT-4o, GPT-5 +4 more

Source: arXiv

Autoresearch Adversarial Algorithm Discovery

Updated 4/11/2026

GPT-OSS-Safeguard-20B and Meta-SecAlign (70B/8B) are vulnerable to white-box adversarial attacks generated by automated algorithmic recombination (specifically the claude_v63, claude_v82, and claude_v53-oss optimizers). These algorithms significantly outperform standard discrete optimization methods (like GCG) by integrating continuous optimization (ADC) with LayerNorm gradient scaling (LSGM), or by merging momentum-smoothed gradients with directional perturbation candidate selection (DPTO)…

Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs

Affects: Llama 2 7B, Llama 3 8B, Qwen 2.5 7B +2 more

Source: arXiv

LLM Judge Manipulation

Updated 4/10/2026

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Affects: GPT-4o, o1, Qwen 2.5 72B Instruct +1 more

Source: arXiv

Social Bot Exposure Jailbreak

Updated 3/8/2026

LLM-powered automated social media accounts (bots) are vulnerable to prompt injection via public user replies. When an automated bot scrapes and processes social media engagement to generate responses, an attacker can submit an instruction-override command within a direct reply. Because the underlying LLM fails to isolate its core system instructions (e.g., maintaining a specific political persona) from untrusted user input, the injected command hijacks the model's context window. This forces…

Ignore All Previous Instructions: Jailbreaking as a de-escalatory peace building practise to resist LLM social media bots

Source: arXiv

Activation Delta Detector Evasion

Updated 3/9/2026

Activation-delta-based linear probes used for detecting task drift and prompt injections in Large Language Models (LLMs) can be bypassed using universal adversarial suffixes. By utilizing the Greedy Coordinate Gradient (GCG) algorithm, an attacker can generate a single, optimized suffix that simultaneously fools multiple logistic regression classifiers attached to different hidden layers of the LLM. The attack jointly optimizes the suffix tokens by accumulating gradients from the losses of all…

Bypassing Prompt Injection Detectors through Evasive Injections

Affects: Llama 3 8B, Phi-3 8B

Source: arXiv

Adaptive Web Agent Prompt Injection

Updated 2/21/2026

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks

Affects: GPT-4.1, GPT-4o, Qwen3-VL 32B Instruct

Source: arXiv

Benign Steering Jailbreak Risk

Updated 2/21/2026

Activation steering mechanisms employed for inference-time control of Large Language Models (LLMs) contain a vulnerability termed "Steering Externalities." When steering vectors are derived from benign datasets to enforce utility objectives—specifically "compliance" (reducing refusals for benign queries) or "instruction adherence" (e.g., enforcing JSON output formats)—and injected into the model's residual stream, they unintentionally erode safety alignment. The vulnerability arises because…

Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Models

Affects: Llama 2 7B, Llama 3 8B, Gemma 7B

Source: arXiv

Chunky Post-Training Miscalibration

Updated 2/21/2026

Large Language Models (LLMs) exhibit a vulnerability termed "chunky post-training," where the model learns spurious correlations between incidental prompt features (e.g., formatting styles, specific vocabulary, sentence structure) and specific behavioral modes (e.g., refusal, code generation, rebuttal) present in distinct chunks of post-training data. This results in behavioral mis-routing during inference, where benign inputs sharing surface-level features with restricted or specialized…

Chunky Post-Training: Data Driven Failures of Generalization

Affects: Claude Haiku 4.5, Claude Sonnet 4.5, Claude Opus 4.5 +5 more

Source: arXiv

Related research categories