Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Spatial Layout Jailbreak

Updated 2/20/2026

Large Language Models (LLMs) and their associated output guardrails (e.g., Llama Guard, OpenAI Moderation API) rely on autoregressive, token-by-token processing, which interprets text as a one-dimensional sequence. A vulnerability exists wherein harmful content can bypass these safety filters by exploiting the discrepancy between 1D token serialization and 2D visual rendering. By redistributing tokens across different rows, columns, or diagonals (SpatialJB), attackers can induce the model to…

SpatialJB: How Text Distribution Art Becomes the" Jailbreak Key" for LLM Guardrails

Affects: GPT-4, Grok 4, Gemini 2.5 Pro +3 more

Source: arXiv

Tool Stream Injection Hijack

Updated 2/21/2026

Large Language Model (LLM) agents utilizing external tool execution frameworks are vulnerable to Indirect Prompt Injection (IPI) via the "Tool Stream." Unlike traditional data-stream injections (e.g., malicious emails), this vulnerability exploits the agent's interpretation of functional tool definitions (docstrings, signatures) and runtime feedback (error messages, return values) as binding operational constraints. Adversaries functioning as compromised or malicious tool providers can embed…

VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit

Affects: Gemini 2.5 Pro, Qwen 3 Max

Source: arXiv

Universal MLLM Target Matching

Updated 2/22/2026

Closed-source Multi-modal Large Language Models (MLLMs) are vulnerable to Universal Targeted Transferable Adversarial Attacks (UTTAA). An attacker can generate a single, image-agnostic adversarial perturbation ($\delta$) that, when added to any arbitrary source image, steers the victim model to output a description or classification matching a specific target image chosen by the attacker. This vulnerability exploits the transferability of adversarial features from open-source surrogate vision…

Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization

Affects: GPT-4o, Claude Sonnet 4.5, GPT-5 +2 more

Source: arXiv

Unsafe Search Framing

Updated 3/8/2026

A vulnerability in search-augmented Large Language Models (LLMs) allows attackers to bypass safety alignments and generate actionable malicious content by weaponizing the model's web retrieval tools. The exploit operates in two stages. First, via "Outsourcing Injection," attackers obfuscate harmful intent by translating it into benign-looking, multi-hop knowledge-seeking queries. This forces the LLM to fetch the harmful semantics directly from the open web, bypassing parametric intent filters…

SearchAttack: Red-Teaming LLMs against Real-World Threats via Framing Unsafe Web Information-Seeking Tasks

Affects: GPT-4o, Gemini 3 Flash, DeepSeek V3.2 +1 more

Source: arXiv

VLM Moral Persuasion

Updated 2/21/2026

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

Do VLMs Have a Moral Backbone? A Study on the Fragile Morality of Vision-Language Models

Affects: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 32B Instruct +20 more

Source: arXiv

Visual Object Injection

Updated 2/22/2026

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Affects: GPT-4o, GPT-4o Mini, GPT-4 Turbo +7 more

Source: arXiv

Abliteration Cripples Math

Updated 3/8/2026

Open-weight Large Language Models (LLMs) are vulnerable to a white-box safety alignment bypass known as "abliteration" (directional orthogonalization). An attacker with access to the model weights can compute the "refusal direction" in the residual stream activation space by contrasting internal activations between harmful and harmless prompts. By projecting the model's weight matrices to be orthogonal to this single direction (or specific concept cones), the safety alignment is surgically…

Comparative Analysis of LLM Abliteration Methods: A Cross-Architecture Evaluation

Affects: Llama 3.1 8B Instruct, Mistral 7B Instruct v0.3, Qwen 2.5 7B Instruct +13 more

Source: arXiv

CoT Detector Obfuscation Bypass

Updated 12/30/2025

LLM-based code agents and vulnerability detectors employing Chain-of-Thought (CoT) reasoning are susceptible to automated adversarial code obfuscation. The vulnerability exists because CoT mechanisms expose the model's decision logic, allowing reinforcement learning frameworks (such as CoTDeceptor) to iteratively refine code transformations based on the detector's own reasoning traces. By optimizing for "reasoning instability" and "hallucination" rather than just syntactic evasion, attackers…

CoTDeceptor: Adversarial Code Obfuscation Against CoT-Enhanced LLM Code Agents

Affects: DeepSeek R1, GPT-5

Source: arXiv

Cross-Environment Agent Jailbreak

Updated 2/21/2026

Large Language Model (LLM) agents operating in tool-augmented environments are susceptible to "Contextual Fragility" and multi-turn "long-chain" exploitation. Existing safety mechanisms predominantly function on a stateless, atomic paradigm, evaluating individual input-output pairs in isolation. This allows an adversary to orchestrate complex attack trajectories where malicious intent is distributed across multiple, individually benign steps (a "Domino Effect"). Consequently, an attacker can…

DREAM: Dynamic Red-teaming for Evaluating Agentic Multi-Environment Security

Affects: o4-mini, Gemini 2.5 Flash, GPT-5 +8 more

Source: arXiv

Dual Stego MLLM Jailbreak

Updated 12/30/2025

Commercial Multimodal Large Language Model (MLLM) integrated systems are vulnerable to a "Dual Steganography" jailbreak paradigm (referred to as Odysseus). The vulnerability arises from the reliance of safety filters on the assumption that malicious content must be explicitly visible in the input or output modalities (text or image). Attackers can bypass these filters by encoding malicious queries into binary matrices and embedding them into benign-looking images using steganographic encoders…

Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganography

Affects: GPT-4o, Gemini 2.0 Pro, Gemini 2.0 Flash +1 more

Source: arXiv

Related research categories