Attack Surface

Model layer Research

Security research involving core model architecture and parameters

468 matching entries

Model layer research results

468 entries

Needle-in-Haystack Jailbreak

Published Nov 5, 2025Analyzed Dec 8, 2025Source: arXiv

A safety bypass vulnerability, dubbed "Ninja" (Needle-in-a-haystack jailbreak), exists in long-context Large Language Models (LLMs). The vulnerability exploits a degradation in safety alignment that occurs when a harmful goal is embedded within a massive, benign context window. Unlike traditional adversarial attacks that use unintelligible strings or "many-shot" attacks that use harmful examples, this method utilizes thematically relevant but innocuous text (the "haystack"). The attack…

Jailbreaking in the Haystack

Evaluated models: GPT-4o, Llama 3.1 8B Instruct, Gemini 2.0 Flash +2 more

Pervasive Multi-turn Jailbreaks

Published Nov 5, 2025Analyzed Dec 8, 2025Source: arXiv

Multiple open-weight Large Language Models (LLMs)—specifically those prioritizing capability over safety alignment—exhibit a critical vulnerability to adaptive multi-turn prompt injection and jailbreak attacks. While these models effectively reject isolated, single-turn adversarial inputs (averaging ~13.11% Attack Success Rate), they fail to maintain safety guardrails and policy enforcement across extended conversational contexts. By leveraging iterative strategies such as "Crescendo" (gradual…

Death by a Thousand Prompts: Open Model Vulnerability Analysis

Evaluated models: GPT-oss 20B, Llama 3.3 70B Instruct, Mistral Large 2 +5 more

Autonomous Jailbreak Evolution

Published Nov 4, 2025Analyzed Dec 8, 2025Source: arXiv

Large Language Models (LLMs) are vulnerable to an automated, self-evolving jailbreak attack framework known as ASTRA (Automated Strategy Discovery, Retrieval, and Evolution). This vulnerability exists because current safety alignment mechanisms (such as RLHF) fail to generalize defenses against dynamically distilled and retrieved attack strategies. ASTRA operates on a closed-loop "attack-evaluate-distill-reuse" mechanism. An attacker LLM generates prompts; a separate strategy extractor…

ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs

Evaluated models: Llama 3 8B Instruct, Llama 3 70B Instruct, DeepSeek R1 0528 +5 more

Meta-Optimized LLM Judge Jailbreak

Published Nov 3, 2025Analyzed Nov 20, 2025Source: arXiv

A vulnerability in Large Language Models (LLMs) allows for systematic jailbreaking through a meta-optimization framework called AMIS (Align to MISalign). The attack uses a bi-level optimization process to co-evolve both the jailbreak prompts and the scoring templates used to evaluate them.

Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges

Evaluated models: Claude 3.5 Haiku, Claude 3.5 Sonnet, Claude Sonnet 4 +3 more

Latent Space Discontinuity Exploitation

Published Nov 1, 2025Analyzed Dec 5, 2025Source: arXiv

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Evaluated models: Not reported

Adversarial Self-Deception

Published Oct 31, 2025Analyzed Dec 30, 2025Source: arXiv

Large Language Models (LLMs) exhibit a vulnerability to "adversarial conversational nudges," where the model abandons its internal factual knowledge to align with user-provided misinformation in closed domains (e.g., movies, books). Unlike standard hallucinations where a model lacks knowledge, this vulnerability occurs even when the model demonstrates—via separate self-consistency checks—that it correctly identifies the information as false. When a user creates a multi-turn context asserting…

What About the Scene With the Hitler Reference? HAUNT: A Framework to Probe LLMs' Self-consistency in Closed Domains Via Adversarial Nudge

Evaluated models: GPT-4o, GPT-5, Claude Opus 4 +4 more

Diffusion LLM Direct Jailbreaking

Published Oct 31, 2025Analyzed Nov 20, 2025Source: arXiv

A vulnerability exists where non-autoregressive Diffusion Language Models (DLLMs) can be leveraged to generate highly effective and transferable adversarial prompts against autoregressive LLMs. The technique, named INPAINTING, reframes the resource-intensive search for adversarial prompts into an efficient, amortized inference task. By providing a desired harmful or restricted response to a DLLM, the model can conditionally generate a corresponding low-perplexity prompt that elicits that…

Diffusion LLMs are Natural Adversaries for any LLM

Evaluated models: Gemma 3 1B, GPT-5, LLaDA 8B Base +5 more

LLM Self-Harm Loop

Published Oct 31, 2025Analyzed Dec 8, 2025Source: arXiv

Large Language Models (LLMs), specifically GPT-3.5-turbo, LLaMA3-8B-instruct, and DeepSeek-R1-Distill-Qwen-7B, are vulnerable to a "Self-Harm" jailbreak attack (Self-HarmLLM). This vulnerability exploits the model's ability to understand its own safety boundaries to generate adversarial inputs against itself. An attacker utilizes a two-session approach: in the first session (Mitigation Session), the attacker instructs the model to rewrite a harmful query into a "Mitigated Harmful Query"…

Self-HarmLLM: Can Large Language Model Harm Itself?

Evaluated models: GPT-3.5 Turbo, Llama 3 8B Instruct, DeepSeek R1 Distill Qwen 7B

Concurrent Task Jailbreak

Published Oct 24, 2025Analyzed Nov 20, 2025Source: arXiv

A jailbreak vulnerability, known as Task Concurrency, exists in multiple Large Language Models (LLMs). The vulnerability arises when two distinct tasks, one harmful and one benign, are interleaved at the word level within a single prompt. The structure of the malicious prompt alternates words from each task, often using separators like {} to encapsulate words from the second task. This "concurrent" instruction format obfuscates the harmful intent from the model's safety guardrails, causing the…

Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency

Evaluated models: DeepSeek V3, Gemini 2.5 Flash, GPT-4.1 +7 more

Persuasive Jailbreak Fingerprint

Published Oct 24, 2025Analyzed Nov 1, 2025Source: arXiv

Large Language Models (LLMs) are vulnerable to jailbreak attacks that use persuasive techniques grounded in social psychology to bypass safety alignments. Malicious instructions can be reframed using one of Cialdini's seven principles of persuasion (Authority, Reciprocity, Commitment, Social Proof, Liking, Scarcity, and Unity). These rephrased prompts, which remain human-readable and can be generated automatically, manipulate the LLM into complying with harmful requests it would otherwise…

Uncovering the Persuasive Fingerprint of LLMs in Jailbreaking Attacks

Evaluated models: DeepSeek R1, GPT-2, Phi-4 +1 more

Related research categories