Attack Surface

Model layer Vulnerabilities

Vulnerabilities targeting the core model architecture and parameters

347 matching entries out of 465 in this category

Model layer research results

347 entries

Semantic-Bridging Jailbreaks Reroute Llama-2 Safety Pathways

Updated 7/20/2026

The paper reports a reproducible white-box evaluation in which semantically bridging a benign topic into a harmful request bypassed Llama-2-7B-chat-hf safety behavior in 4 of 30 tested prompt pairs. Paired internal attribution graphs associated successful jailbreaks with path rerouting rather than simple suppression of safety features. This is a paper-reported result, not independently verified here. Defensive reproduction should use the paper’s supplied dataset and code in an isolated…

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Affects: Llama 2 7B Chat

Source: arXiv

Information-Overloading Jailbreaks in Vision-Language Models

Updated 7/20/2026

The paper describes a reproducible black-box multimodal jailbreak evaluation, INFER/INFER+, in which dense image typography, nested cross-modal references, recursive visual layouts, and entropy-guided search increase processing complexity and weaken refusal behavior in large vision-language models. The authors report average ASRs of 88.6% on open-source models and 84.0% on commercial models; these are paper-reported measurements, not independently verified facts. For safe defensive…

Overloading Large Vision-Language Models for Jailbreaking

Affects: Qwen3-VL 8B, Qwen2-VL-7B, InternVL3.5-8B +5 more

Source: arXiv

Attention-Head Suppression Bypasses LLM Refusal

Updated 7/20/2026

The paper reports a reproducible white-box jailbreak failure mode: successful jailbreak templates selectively suppress early-layer Adversarially Compromised Heads (ACHs), bypassing refusal while harmful-semantic safety activations persist in other heads. The authors identify ACH/SAH behavior using benign, harmful, and successful-attack input triplets, then causally validate the pathway through controlled head ablations. Safe defensive reproduction should use the paper’s released evaluation…

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

Affects: Llama 3 8B Instruct, Llama 2 7B Chat, Llama 3 70B Instruct

Source: arXiv

Multilingual Flowchart Jailbreaks in Vision-Language Models

Updated 7/20/2026

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

Affects: Qwen 2.5 VL 3B Instruct, Gemma-4-E4B-it, Pangea-7B

Source: arXiv

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Updated 7/20/2026

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Affects: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash +3 more

Source: arXiv

Jailbreaks Causally Suppress Refusal Representations

Updated 7/20/2026

The paper reports a reproducible white-box evaluation showing that successful jailbreak prompts can alter a safety-aligned model’s intermediate representations so harmful requests no longer trigger refusal. Its LOCA method identifies small, token-specific residual-stream changes that restore refusal on individual successful jailbreaks, providing causal evidence that jailbreak success can depend on suppressing harmfulness/refusal concepts or strengthening seemingly harmless continuation…

Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models

Affects: Gemma 2 2B IT, Llama 3.1 8B Instruct

Source: arXiv

Jailbreak Saturates Alignment Defenses

Updated 4/10/2026

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Generalization Limits of Reinforcement Learning Alignment

Affects: GPT-oss 20B

Source: arXiv

Maladaptive Therapeutic Reinforcement

Updated 4/10/2026

Large Language Models (LLMs) aligned for helpfulness and empathy are vulnerable to a Persona-based Client Simulation Attack (PCSA) that exploits the model's inability to distinguish therapeutic empathy from maladaptive validation. By embedding harmful intents within coherent, multi-turn psychological counseling narratives and employing clinical resistance strategies (such as intellectualization or metaphorical expression), attackers can compel the model to prioritize rapport-building over…

Do No Harm: Exposing Hidden Vulnerabilities of LLMs via Persona-based Client Simulation Attack in Psychological Counseling

Affects: GPT-3.5 Turbo, GPT-5.1, Llama 3.1 8B +5 more

Source: arXiv

Merging Latent Malice

Updated 4/10/2026

A vulnerability in LLM parameter-space merging algorithms enables a latent supply-chain attack where adversaries embed pre-computed malicious weight perturbations into open-source models. Using a constrained optimization framework, attackers inject latent components into the Multilayer Perceptron (MLP) up-projection matrices of source models. These perturbations are mathematically constrained to preserve the source model's individual safety alignment (via directional consistency) and benign…

When Safe Models Merge into Danger: Exploiting Latent Vulnerabilities in LLM Fusion

Affects: Tulu-2-7B, Llama 3.1 Tulu 3 8B DPO, OpenChat 3.5 0106

Source: arXiv

Unsafe Culinary Instructions

Updated 4/10/2026

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

Cooking Up Risks: Benchmarking and Reducing Food Safety Risks in Large Language Models

Affects: Claude 3.7 Sonnet, GPT-4o, GPT-4.1 +8 more

Source: arXiv

Related research categories