Attack Surface

Model layer Vulnerabilities

Vulnerabilities targeting the core model architecture and parameters

7 matching entries out of 465 in this category

Model layer research results

7 entries

Zero-Training Cross-Domain Inversion

Updated 2/22/2026

A cryptographic weakness exists in the privacy assumptions of vector embeddings used in Retrieval-Augmented Generation (RAG) systems and Vector Databases. The vulnerability, designated "Zero2Text," allows an unauthenticated attacker to reconstruct raw text from captured vector embeddings without access to the victim model's parameters, gradients, or training data. Unlike prior embedding inversion attacks that require training large decoders on domain-specific datasets, this vulnerability…

Zero2Text: Zero-Training Cross-Domain Inversion Attacks on Textual Embeddings

Source: arXiv

Activation-Level Privacy Leak

Updated 2/22/2026

Conversational Large Language Model (LLM) agents integrated with privileged data sources (e.g., medical records, organizational emails) are vulnerable to contextually inappropriate information disclosure due to failures in enforcing Contextual Integrity (CI) norms. Standard semantic input/output filters and generic safety guardrails (e.g., Llama Guard) fail to detect "mosaic attacks" and multi-turn conversational manipulation. In these attacks, adversaries decompose a malicious query into a…

NeuroFilter: Privacy Guardrails for Conversational LLM Agents

Affects: GPT-oss 20B, Llama 3.3 70B Instruct, Qwen 2.5 7B +3 more

Source: arXiv

Latent Space Discontinuity Exploitation

Updated 12/5/2025

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Source: arXiv

Prompt Injection Alignment Bypass

Updated 12/8/2025

Large Language Models (LLMs) integrated with external retrieval mechanisms (e.g., Retrieval-Augmented Generation (RAG), web search, or email processing) are vulnerable to Indirect Prompt Injection. This vulnerability occurs when an LLM consumes input from untrusted external sources—such as websites, code repositories, or incoming emails—that contain embedded adversarial prompts. Unlike direct injection, where the user attacks the model, here the "poisoned" data is retrieved by the system…

Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs

Source: arXiv

Agent Policy Hacking

Updated 9/7/2025

LLM-powered agentic systems that use external tools are vulnerable to prompt injection attacks that cause them to bypass their explicit policy instructions. The vulnerability can be exploited through both direct user interaction and indirect injection, where malicious instructions are embedded in external data sources processed by the agent (e.g., documents, API responses, webpages). These attacks cause agents to perform prohibited actions, leak confidential data, and adopt unauthorized…

Security challenges in ai agent deployment: Insights from a large scale public competition

Affects: Claude 3.5 Sonnet, Claude 3.7 Sonnet, Command R +11 more

Source: arXiv

Zero-Shot Embedding Leak

Updated 12/30/2025

A Universal Zero-shot Embedding Inversion vulnerability exists in vector databases and embedding-based retrieval systems. The flaw allows an attacker to reconstruct original plaintext documents from their vector embeddings without requiring access to the original training data or training an embedding-specific inversion model. The attack, identified as "ZSinvert," leverages a multi-stage adversarial decoding process: (1) a cosine-similarity guided beam search using a Large Language Model (LLM)…

Universal Zero-shot Embedding Inversion

Affects: Qwen 2 5B

Source: arXiv

Embedding Inversion Privacy Leak

Updated 12/30/2025

Retrieval-Augmented Generation (RAG) systems employing standard dense embedding models (e.g., Sentence-T5, SimCSE-BERT, RoBERTa, MPNet) for End-Cloud collaboration are vulnerable to Embedding Inversion Attacks (EIA). While embeddings are vector representations designed to be human-unrecognizable, they retain sufficient semantic information to allow an attacker with access to the vectors (e.g., a malicious or compromised cloud provider) to reconstruct the original sensitive plaintext input.

Safeguarding LLM Embeddings in End-Cloud Collaboration via Entropy-Driven Perturbation

Source: arXiv

Related research categories