Attack Type

Poisoning Vulnerabilities

Attacks that compromise model training or fine-tuning

26 matching entries out of 109 in this category

Poisoning research results

26 entries

No-Prompt Reasoning Hijack

Updated 4/10/2026

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and…

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

Affects: GPT-3.5 Turbo, GPT-4o, GPT-5 +4 more

Source: arXiv

LLM Judge Manipulation

Updated 4/10/2026

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Affects: GPT-4o, o1, Qwen 2.5 72B Instruct +1 more

Source: arXiv

Zero-Tax Fine-Tune Bypass

Updated 4/10/2026

An adversarial fine-tuning vulnerability exists in LLMs protected by text-based safety classifiers (such as Anthropic's Constitutional Classifiers). By utilizing a two-stage curriculum learning combined with hybrid RL+SFT (GRPO), an attacker can fine-tune a model to communicate using a minimal substitution cipher (replacing only 7-8 high-frequency characters) disguised within benign technical templates (e.g., forensic logs with 0x prefixes). This "Trojan-Speak" methodology bypasses text-level…

Trojan-Speak: Bypassing Constitutional Classifiers with No Jailbreak Tax via Adversarial Finetuning

Affects: Claude Haiku 4.5, Qwen 3 4B, Qwen 3 8B +2 more

Source: arXiv

Automated Stealth Skill Injection

Updated 2/21/2026

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents

Affects: Claude Sonnet 4.6, GPT-5 Mini, GLM-4.7 +7 more

Source: arXiv

Long-Horizon Agent Attacks

Updated 4/10/2026

LLM agents equipped with tool-use, persistent memory, and environmental interaction capabilities are vulnerable to long-horizon attacks. Attackers can bypass single-turn safety guardrails by exploiting the temporal dimension of multi-turn interactions to incrementally steer agent behavior. The vulnerability manifests because the agent's safety mechanisms perform localized, single-step evaluations but fail to maintain semantic safety across extended interaction trajectories. This enables…

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

Affects: GPT-4o, GPT-5.1, Gemini 3 Flash +1 more

Source: arXiv

Mobile Agent Visual Spoofing

Updated 2/22/2026

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Source: arXiv

Unified Robustness Gap

Updated 3/9/2026

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

Unifying Adversarial Robustness and Training Across Text Scoring Models

Affects: E5 BERT-base, Qwen 3 0.6B, Llama 3.2 3B Instruct +2 more

Source: arXiv

Voice Agent Behavioral Bypass

Updated 2/21/2026

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Aegis: Towards Governance, Integrity, and Security of AI Voice Agents

Affects: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro +4 more

Source: arXiv

Benign Praise Jailbreak

Updated 2/20/2026

A vulnerability exists in Large Language Model (LLM) Fine-tuning-as-a-Service (FaaS) platforms that allows attackers to bypass safety alignment and moderation filters via a "TrojanPraise" benign fine-tuning attack. The attack exploits the decoupling of an LLM's internal representation of harmful queries into "knowledge" (semantic understanding) and "attitude" (safety refusal). The attacker constructs a fine-tuning dataset containing three specific components: (1) a novel nonsense word (e.g…

TrojanPraise: Jailbreak LLMs via Benign Fine-Tuning

Affects: GPT-3.5, GPT-4o, Llama 2 7B +4 more

Source: arXiv

CoT Detector Obfuscation Bypass

Updated 12/30/2025

LLM-based code agents and vulnerability detectors employing Chain-of-Thought (CoT) reasoning are susceptible to automated adversarial code obfuscation. The vulnerability exists because CoT mechanisms expose the model's decision logic, allowing reinforcement learning frameworks (such as CoTDeceptor) to iteratively refine code transformations based on the detector's own reasoning traces. By optimizing for "reasoning instability" and "hallucination" rather than just syntactic evasion, attackers…

CoTDeceptor: Adversarial Code Obfuscation Against CoT-Enhanced LLM Code Agents

Affects: DeepSeek R1, GPT-5

Source: arXiv

Related research categories