Attack Surface

Model layer Research

Security research involving core model architecture and parameters

468 matching entries

Model layer research results

468 entries

State-Dependent Safety Collapse

Published Mar 15, 2026Analyzed Apr 10, 2026Source: arXiv

Autoregressive language models are vulnerable to state-dependent safety collapse via structured multi-turn context manipulation. The vulnerability stems from the model treating dialogue history as a state transition operator rather than a passive record. By initializing a conversational trajectory with a semantic-preserving softened query and a query-aware persona containing specific named entities, an attacker can establish "representational anchors" that trigger abrupt phase transitions in…

State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Evaluated models: GPT-4o, Claude 3.5 Sonnet, Gemini 2.0 Flash +2 more

Colluding LoRA Emergent Harm

Published Mar 13, 2026Analyzed Apr 10, 2026Source: arXiv

A compositional vulnerability in modular Large Language Models (LLMs) allows attackers to bypass safety alignment by distributing malicious weight updates across multiple Parameter-Efficient Fine-Tuning (PEFT) adapters (e.g., LoRA). The malicious adapters are anchored to valid functional subspaces (e.g., math, coding) and exhibit benign behavior when evaluated in isolation, successfully evading standard unit-centric safety scans and static weight-space defenses. However, when a user linearly…

Colluding LoRA: A Composite Attack on LLM Safety Alignment

Evaluated models: Llama 3 8B, Qwen 2.5 7B, Gemma 2 2B

Amnesia Activation Steering Bypass

Published Mar 10, 2026Analyzed Apr 10, 2026Source: arXiv

An activation-space adversarial attack, termed "Amnesia", allows an attacker with white-box access to bypass the safety mechanisms of open-weight Large Language Models (LLMs) at inference time without requiring fine-tuning, weight modifications, or prompt manipulation. The vulnerability stems from how safety-aligned LLMs localize refusal features within the attention value path of specific decoder layers. An attacker can extract an attack vector ($\mathbf{V}_i$) by hooking the attention value…

Amnesia: Adversarial Semantic Layer Specific Activation Steering in Large Language Models

Evaluated models: Llama 2 7B, Llama 3 8B, Qwen 2.5 7B

Reasoning-Oriented Jailbreak

Published Mar 10, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models

Evaluated models: Qwen2-VL 7B Instruct, LLaVA v1.6 Mistral 7B, Llama 3.2 11B Vision Instruct +4 more

Drive Overrides Refusal

Published Mar 9, 2026Analyzed Apr 10, 2026Source: arXiv

A prompt structure vulnerability exists in instruction-tuned Large Language Models (LLMs) where attackers can bypass safety alignments by injecting a continuation-triggering suffix immediately following the user prompt termination token. By placing an affirmative suffix outside the user instruction boundary, it is processed as the beginning of the assistant's own pre-filled response. This structural manipulation intrinsically overactivates the model's continuation attention heads, forcing its…

The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs

Evaluated models: Llama 2 7B, Qwen 2.5 7B

LLM Steganographic Covert Channel

Published Mar 9, 2026Analyzed Apr 10, 2026Source: arXiv

A malicious finetuning vulnerability exists in Large Language Models (LLMs) that process zero-width Unicode characters. An attacker can bypass training-data moderation filters and inference-time safety guardrails by finetuning the model to decode and encode invisible-character steganography. By injecting target malicious interactions encoded in a base-4 representation of zero-width characters alongside benign plaintext cover text during supervised finetuning (SFT), the model learns to process…

Invisible Safety Threat: Malicious Finetuning for LLM via Steganography

Evaluated models: GPT-4.1, Llama 3.3 70B Instruct, Phi-4 +1 more

Two-Frame Infilling Jailbreak

Published Mar 7, 2026Analyzed Apr 10, 2026Source: arXiv

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

Evaluated models: Not reported

Deep Safety Attention Jailbreak

Published Mar 6, 2026Analyzed Apr 10, 2026Source: arXiv

An activation-steering vulnerability in open-weights Large Language Models allows attackers to bypass safety guardrails by injecting targeted additive perturbations into deep, safety-critical attention heads. The exploit, termed Safety Attention Head Attack (SAHA), utilizes Ablation-Impact Ranking (AIR) to isolate specific attention heads that causally govern safety refusals. By applying Layer-Wise Perturbations (LWP) derived from the linearized decision boundary of a latent safety probe, an…

Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Heads

Evaluated models: Llama 3.1 8B Instruct, DeepSeek LLM 7B Chat, Qwen 1.5 7B Chat

MLLM Multi-Paradigm Collaborative

Published Mar 5, 2026Analyzed Mar 9, 2026Source: arXiv

Multi-Modal Large Language Models (MLLMs) are vulnerable to a highly transferable, black-box adversarial image attack known as the Multi-Paradigm Collaborative Attack (MPCAttack). Attackers can craft imperceptible visual perturbations by jointly aggregating and optimizing semantic feature representations extracted from surrogate models across three distinct learning paradigms: cross-modal alignment (e.g., CLIP), multi-modal understanding (e.g., InternVL3), and visual self-supervised learning…

Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, InternVL3 8B, LLaVA 1.5 7B +3 more

Thai Cultural Alignment Bypass

Published Mar 5, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in the safety alignment of Large Language Models (LLMs) allows attackers to bypass safety guardrails by using malicious prompts contextualized in the Thai language and culture. Evaluated models exhibit a significantly higher Attack Success Rate (ASR) against Thai-specific, culturally contextualized attacks compared to general translated attacks. By exploiting local cultural nuances, regional slang, and Thai socio-cultural contexts, attackers can easily circumvent standard…

ThaiSafetyBench: Assessing Language Model Safety in Thai Cultural Contexts

Evaluated models: Qwen 2.5 7B Instruct, Qwen 2.5 72B Instruct, Llama 3.1 8B Instruct +12 more

Related research categories