Attack Surface

Model layer Vulnerabilities

Vulnerabilities targeting the core model architecture and parameters

15 matching entries out of 465 in this category

Model layer research results

15 entries

Contextual Priority Hacking

Updated 4/10/2026

Large Language Models (LLMs) are vulnerable to a jailbreak technique termed "Priority Hacking." Adversaries can bypass safety alignments by exploiting the model's internal priority graph, where certain abstract values (e.g., justice, public health) implicitly outweigh general safety restrictions within specific contexts. By crafting a deceptive prompt that frames a malicious request as a necessary action in service of a higher-priority benign value, attackers engineer a value conflict. The…

Are Dilemmas and Conflicts in LLM Alignment Solvable? A View from Priority Graph

Source: arXiv

LLM Judge Manipulation

Updated 4/10/2026

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Affects: GPT-4o, o1, Qwen 2.5 72B Instruct +1 more

Source: arXiv

TabooRAG Transferable Blocking

Updated 3/8/2026

A vulnerability in Retrieval-Augmented Generation (RAG) systems utilizing safety-aligned Large Language Models (LLMs) allows attackers to perform a highly transferable Denial-of-Service (DoS) or "blocking" attack. By injecting a single maliciously crafted document into the RAG knowledge base, attackers can force the LLM to refuse to answer benign queries. Unlike previous attacks that rely on explicit instruction injection or high-perplexity adversarial suffixes—which modern models easily…

When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG

Affects: GPT-5.2, GPT-5 Mini, DeepSeek V3.2 +4 more

Source: arXiv

Agent-as-a-Proxy Monitor Bypass

Updated 2/21/2026

Hybrid monitoring protocols for Large Language Model (LLM) agents, specifically those that strictly evaluate both Chain-of-Thought (CoT) reasoning and tool usage (such as LlamaFirewall's AlignmentCheck and Extract-and-Evaluate monitors), are vulnerable to "Agent-as-a-Proxy" indirect prompt injection attacks. Unlike standard injections that target the agent, this attack targets the monitoring model itself. By embedding a malicious string—optimized via an algorithm named Parallel-GCG—into…

Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks

Affects: GPT-4o, Llama 3.1 8B, Mistral 7B +1 more

Source: arXiv

Query-Agnostic Retrieval Poisoning

Updated 3/8/2026

A vulnerability in Large Language Model-based Retrieval (LLMR) systems allows attackers to intentionally hide specific documents from being retrieved (e.g., in RAG pipelines or search engines) by appending a small number of adversarially crafted, query-agnostic tokens. The attack operates in a complete black-box setting: it requires no knowledge of the victim's queries, the target retrieval model's parameters, or the underlying document corpus. By utilizing Document-Query Adversarial (DQ-A)…

" Someone Hid It": Query-Agnostic Black-Box Attacks on LLM-Based Retrieval

Affects: Mistral 7B, Qwen 2.5 7B

Source: arXiv

Unified Robustness Gap

Updated 3/9/2026

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

Unifying Adversarial Robustness and Training Across Text Scoring Models

Affects: E5 BERT-base, Qwen 3 0.6B, Llama 3.2 3B Instruct +2 more

Source: arXiv

Dangerous Medical Faithfulness

Updated 4/11/2026

A vulnerability exists in frontier Large Language Models (LLMs) where in-context information (e.g., provided via Retrieval-Augmented Generation) completely overrides parametric safety guardrails when processing counterfactual or adversarial medical evidence. When a prompt contains fabricated clinical context asserting the medical efficacy of toxic substances, illicit drugs, or nonsensical items, the LLM suppresses its internal knowledge of the substance's toxicity. Internal representation…

Faithfulness vs. Safety: Evaluating LLM Behavior Under Counterfactual Medical Evidence

Affects: Gemini 2.5 Flash, GPT-5 Mini, HuatuoGPT-o1-7B +6 more

Source: arXiv

Sophisticated Deception Induces Misbelief

Updated 2/21/2026

Large Language Models (LLMs) exhibit a vulnerability to "hard-to-falsify" deceptive evidence injection, termed the "Facade of Truth." This vulnerability allows an attacker to override an LLM’s parametric knowledge (internal factual beliefs) by injecting sophisticated, iteratively refined fabricated evidence into the context window. Unlike overt misinformation which models typically reject, this attack utilizes a multi-agent adversarial framework (MisBelief) to generate evidence that mimics…

The Facade of Truth: Uncovering and Mitigating LLM Susceptibility to Deceptive Evidence

Affects: GPT-3.5, GPT-5, Llama 3 8B +1 more

Source: arXiv

Latent Space Discontinuity Exploitation

Updated 12/5/2025

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Source: arXiv

Emergent Agentic Vulnerabilities

Updated 1/14/2026

GPT-OSS-20B exhibits "agentic-only" vulnerabilities where safety guardrails effective in standalone model inference fail when the model operates within an agentic execution loop. These vulnerabilities emerge when the model is deployed in a multi-step agentic architecture (e.g., utilizing LangGraph, tool usage, and memory retention). Attackers can bypass safety filters by employing context-aware iterative refinement attacks, which incorporate the full agentic state—including tool outputs…

Mind the Gap: Comparing Model-vs Agentic-Level Red Teaming with Action-Graph Observability on GPT-OSS-20B

Source: arXiv

Related research categories