Attack Surface

Model layer Research

Security research involving core model architecture and parameters

465 matching entries

Model layer research results

465 entries

Semantic-Bridging Jailbreaks Reroute Llama-2 Safety Pathways

Published 7/8/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box evaluation in which semantically bridging a benign topic into a harmful request bypassed Llama-2-7B-chat-hf safety behavior in 4 of 30 tested prompt pairs. Paired internal attribution graphs associated successful jailbreaks with path rerouting rather than simple suppression of safety features. This is a paper-reported result, not independently verified here. Defensive reproduction should use the paper’s supplied dataset and code in an isolated…

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Evaluated models: Llama 2 7B Chat

Source: arXiv

Information-Overloading Jailbreaks in Vision-Language Models

Published 7/3/2026

Analyzed 7/20/2026

The paper describes a reproducible black-box multimodal jailbreak evaluation, INFER/INFER+, in which dense image typography, nested cross-modal references, recursive visual layouts, and entropy-guided search increase processing complexity and weaken refusal behavior in large vision-language models. The authors report average ASRs of 88.6% on open-source models and 84.0% on commercial models; these are paper-reported measurements, not independently verified facts. For safe defensive…

Overloading Large Vision-Language Models for Jailbreaking

Evaluated models: Qwen3-VL 8B, Qwen2-VL-7B, InternVL3.5-8B +5 more

Source: arXiv

Attention-Head Suppression Bypasses LLM Refusal

Published 6/26/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box jailbreak failure mode: successful jailbreak templates selectively suppress early-layer Adversarially Compromised Heads (ACHs), bypassing refusal while harmful-semantic safety activations persist in other heads. The authors identify ACH/SAH behavior using benign, harmful, and successful-attack input triplets, then causally validate the pathway through controlled head ablations. Safe defensive reproduction should use the paper’s released evaluation…

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

Evaluated models: Llama 3 8B Instruct, Llama 2 7B Chat, Llama 3 70B Instruct

Source: arXiv

Multilingual Flowchart Jailbreaks in Vision-Language Models

Published 6/5/2026

Analyzed 7/20/2026

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Gemma-4-E4B-it, Pangea-7B

Source: arXiv

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Published 5/1/2026

Analyzed 7/20/2026

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Evaluated models: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash +3 more

Source: arXiv

Jailbreaks Causally Suppress Refusal Representations

Published 4/30/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box evaluation showing that successful jailbreak prompts can alter a safety-aligned model’s intermediate representations so harmful requests no longer trigger refusal. Its LOCA method identifies small, token-specific residual-stream changes that restore refusal on individual successful jailbreaks, providing causal evidence that jailbreak success can depend on suppressing harmfulness/refusal concepts or strengthening seemingly harmless continuation…

Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models

Evaluated models: Gemma 2 2B IT, Llama 3.1 8B Instruct

Source: arXiv

Diverse VLA Linguistic Fragility

Published 4/1/2026

Analyzed 4/10/2026

Vision-Language-Action (VLA) models suffer from a severe linguistic fragility vulnerability where semantically equivalent but structurally complex adversarial instructions cause catastrophic failures in visual grounding and geometric reasoning. Attackers can reliably induce physical execution failures in robotic manipulation tasks by applying semantic-preserving linguistic variations, such as synonymous rephrasing, syntactic restructuring, or the addition of fine-grained compositional…

Uncovering Linguistic Fragility in Vision-Language-Action Models via Diversity-Aware Red Teaming

Evaluated models: Pi-Zero, OpenVLA 7B, 3D-Diffuser Actor

Source: arXiv

Jailbreak Saturates Alignment Defenses

Published 4/1/2026

Analyzed 4/10/2026

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Generalization Limits of Reinforcement Learning Alignment

Evaluated models: GPT-oss 20B

Source: arXiv

LLM Robot JSON Backdoor

Published 4/1/2026

Analyzed 4/10/2026

A supply-chain vulnerability in LLM-mediated robotic control systems allows attackers to execute unauthorized physical actions via structured backdoor attacks embedded in LoRA adapters. By poisoning the fine-tuning dataset to map specific natural-language trigger phrases directly to malicious, syntactically valid JSON control commands (structured-output poisoning), the backdoor bypasses natural-language reasoning layers and propagates deterministically to downstream robotic middleware (e.g…

From Prompt to Physical Action: Structured Backdoor Attacks on LLM-Mediated Robotic Control Systems

Evaluated models: Llama 3.1 8B Instruct, Gemma 2 9B IT, DeepSeek R1 Distill Llama 8B +2 more

Source: arXiv

Maladaptive Therapeutic Reinforcement

Published 4/1/2026

Analyzed 4/10/2026

Large Language Models (LLMs) aligned for helpfulness and empathy are vulnerable to a Persona-based Client Simulation Attack (PCSA) that exploits the model's inability to distinguish therapeutic empathy from maladaptive validation. By embedding harmful intents within coherent, multi-turn psychological counseling narratives and employing clinical resistance strategies (such as intellectualization or metaphorical expression), attackers can compel the model to prioritize rapport-building over…

Do No Harm: Exposing Hidden Vulnerabilities of LLMs via Persona-based Client Simulation Attack in Psychological Counseling

Evaluated models: GPT-3.5 Turbo, GPT-5.1, Llama 3.1 8B +5 more

Source: arXiv

Related research categories