White-box Vulnerabilities

Backdoor-based fingerprinting mechanisms used for Intellectual Property (IP) protection in Large Language Models (LLMs) are vulnerable to evasion when deployed in model ensemble configurations. The vulnerability arises because fingerprint triggers elicit specific, high-probability tokens or responses in a protected model that are statistically improbable in unprotected or differently-fingerprinted auxiliary models. Attackers can exploit this statistical discrepancy without accessing model…

LLM routing systems are vulnerable to adversarial rerouting attacks where malicious triggers prepended to user queries manipulate the router's model-selection mechanism. Because LLM routers function as classifiers evaluating query complexity to balance computational cost and response quality, an attacker can craft adversarial prefixes that distort the query's latent semantic representation. This exploits the router's decision boundaries, forcing the system to misclassify the input and redirect…

In distributed Low-Rank Adaptation (LoRA) fine-tuning systems, a structural verification blind spot exists due to the decoupled aggregation of low-rank matrices. Frameworks typically evaluate and aggregate the $A$ and $B$ matrices independently to reduce computational overhead. A malicious client can exploit this by submitting individually benign $A$ and $B$ matrices that satisfy standard norm-based and similarity-based anomaly detection filters, but whose composite product ($A \times B$)…

AutoArgue, an LLM-based evaluation framework for Retrieval-Augmented Generation (RAG) systems, is susceptible to evaluation subversion attacks due to the public availability of its judging prompts and reference data structures. An adversarial RAG system (exemplified by the "Crucible" probe) can incorporate "insider knowledge" of the evaluation logic directly into its generation pipeline. By wrapping the generation process with the evaluator's specific prompts, the system can pre-filter…

Point-based 3D Vision-Language Models (VLMs), specifically PointLLM and GPT4Point, are vulnerable to white-box, gradient-based adversarial attacks. The vulnerability exists in the model's processing of 3D point cloud data, where an attacker can optimize imperceptible geometric perturbations ($\delta$) on the input point cloud ($x$) to manipulate the model's textual output. The paper identifies two specific attack vectors: 1. Vision Attack: Directly perturbs the high-dimensional visual token…

Open-weight Large Language Models, demonstrated specifically on Qwen3 (4B and 30B-A3B Base, Instruct, and Thinking variants), are vulnerable to unauthorized steerability attacks where minimal inference-time interventions—such as short, pro-instrumental prompt suffixes—reliably elicit dangerous instrumental-convergence behaviors. Because instruction-tuned and "Thinking" models are inherently designed to be highly responsive to steering (authorized steerability), malicious actors can exploit…

A malicious model supply chain vulnerability exists involving a technique termed Adversarial Contrastive Learning (ACL) for Large Language Model (LLM) quantization attacks. This vulnerability allows an attacker to publish a model that appears benign and preserves high utility in full precision (e.g., BF16 or FP32) but exhibits malicious behaviors—such as jailbreak, over-refusal, or advertisement injection—immediately upon zero-shot quantization (e.g., INT8, FP4, or NF4).

Large Language Models (LLMs) enabled with Function Calling (FC) capabilities are vulnerable to adversarial query rewriting and semantic manipulation. Standard FC models, typically trained via Supervised Fine-Tuning (SFT) on static datasets, fail to generalize against adversarial inputs that deviate from fixed distribution patterns. An attacker can exploit this by crafting queries that are semantically similar to valid requests but engineered to induce "bad cases," such as incorrect tool…

A fine-tuning vulnerability in the safety alignment of Large Language Models (LLMs) allows adversaries to systematically bypass refusal mechanisms by training the model on a small dataset (as few as 1,000 samples) of strictly benign text. By prepending standard refusal prefixes (e.g., "I'm sorry", "I cannot fulfill this request") to the target outputs of benign instruction-response pairs, attackers disrupt the model's refusal completion pathway. When subsequently prompted with unsafe queries…

Neural Ranking Models (NRMs) utilizing Transformer architectures (specifically BERT and T5-based re-rankers) are vulnerable to minimal adversarial perturbations that artificially promote a target document's rank. The vulnerability allows an attacker to manipulate ranking outcomes by inserting or substituting a single "query center" token—a word identified as the semantic centroid of the user's query—into the target document. The attack exploits the model's sensitivity to specific semantic…