Attack Surface

Prompt layer Vulnerabilities

Vulnerabilities in prompt handling and processing

17 matching entries out of 599 in this category

Prompt layer research results

17 entries

Diverse VLA Linguistic Fragility

Updated 4/10/2026

Vision-Language-Action (VLA) models suffer from a severe linguistic fragility vulnerability where semantically equivalent but structurally complex adversarial instructions cause catastrophic failures in visual grounding and geometric reasoning. Attackers can reliably induce physical execution failures in robotic manipulation tasks by applying semantic-preserving linguistic variations, such as synonymous rephrasing, syntactic restructuring, or the addition of fine-grained compositional…

Uncovering Linguistic Fragility in Vision-Language-Action Models via Diversity-Aware Red Teaming

Affects: Pi-Zero, OpenVLA 7B, 3D-Diffuser Actor

Source: arXiv

Agentic Robot Instruction Attack

Updated 4/10/2026

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Source: arXiv

Invisible Prompt Phishing Evasion

Updated 3/8/2026

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection

Affects: GPT-5, Grok 4 Fast Non-Reasoning, Llama 4 Maverick +1 more

Source: arXiv

VLM Text Overrides Image

Updated 2/21/2026

A vulnerability exists in multiple state-of-the-art Vision-Language Models (VLMs), including GPT-4o, Gemini-2.5, and LLaVA-OneVision, where persuasive textual misinformation successfully overrides visual evidence. When a model is presented with an image it can correctly interpret, an attacker can inject a contradictory text prompt employing specific rhetorical strategies (Logical, Credibility, Emotional, or Repetition) to force the model into generating a false response. This "obedience bias"…

Do Images Speak Louder than Words? Investigating the Effect of Textual Misinformation in VLMs

Affects: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, InternVL3 1B +8 more

Source: arXiv

Visual Object Injection

Updated 2/22/2026

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Affects: GPT-4o, GPT-4o Mini, GPT-4 Turbo +7 more

Source: arXiv

Single Word Video Corruption

Updated 1/14/2026

Text-to-Video (T2V) diffusion models are vulnerable to black-box adversarial prompt attacks that degrade output quality regarding semantic fidelity and temporal dynamics. This vulnerability is exploited via the T2VAttack framework, which utilizes two primary vector strategies: T2VAttack-S (Substitution) and T2VAttack-I (Insertion). T2VAttack-S leverages a greedy search to identify key semantic tokens and replaces them with high-similarity synonyms defined in lexical databases (e.g., WordNet)…

T2VAttack: Adversarial Attack on Text-to-Video Diffusion Models

Source: arXiv

Embodied Cross-Modal Misalignment

Updated 1/14/2026

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

When alignment fails: Multimodal adversarial attacks on vision-language-action models

Source: arXiv

Indirect Environmental Jailbreak

Updated 12/30/2025

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreaks

Affects: GPT-4o, Qwen3-VL Plus, Gemini 2.0 Flash +3 more

Source: arXiv

Adaptive Typographic Image Injection

Updated 12/30/2025

Multimodal agents built on Large Vision-Language Models (LVLMs) are vulnerable to adaptive typographic prompt injection attacks (AgentTypo). This vulnerability allows an attacker to execute indirect prompt injection by embedding adversarial text prompts directly into images (e.g., webpage screenshots, product photos) processed by the agent. Unlike standard visual adversarial attacks that rely on noise perturbation, this method utilizes the AgentTypo framework to perform black-box Bayesian…

AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents

Affects: GPT-4o, GPT-4V, GPT-4o Mini +2 more

Source: arXiv

Latent Paraphrase Segmentation Attack

Updated 12/30/2025

Reasoning segmentation models, which generate binary segmentation masks based on implicit text queries, are vulnerable to adversarial paraphrasing. This vulnerability allows an attacker to craft semantically equivalent and grammatically correct text prompts that significantly degrade the model's segmentation performance (measured by Intersection-over-Union, or IoU). The exploit utilizes a black-box, sentence-level optimization method (SPARTA) that operates within the continuous semantic latent…

SPARTA: Evaluating Reasoning Segmentation Robustness through Black-Box Adversarial Paraphrasing in Text Autoencoder Latent Space

Affects: LISA 7B, LISA Explanatory 7B, LISA 13B +3 more

Source: arXiv

Related research categories