Large Language Model Vulnerabilities

Safety Targeted Embedding Exploit via Refinement

Safety training for large language models (LLMs) is conducted predominantly in English, leaving uncertain how well safety mechanisms generalize to low-resource languages and mixed-language code-switching. We show that this creates an epistemic gap in which models confidently generate harmful responses for inputs that fall outside the distribution of their safety training. To study this phenomenon, we introduce STEER (Safety Targeted Embedding Exploit via Refinement), a gradient-guided attack that identifies words contributing most strongly to the model's refusal behavior and iteratively translates them into low-resource languages to suppress refusal while preserving harmful intent. Across six open-source 8B-parameter models, STEER achieves attack success rates of up to 93.0% on JailbreakBench and 96.7% on AdvBench, outperforming random code-switching and Greedy Coordinate Gradient (GCG). The resulting prompts also transfer to GPT-4o-mini, achieving a 35.5% attack success rate without requiring access to the target model, suggesting that the underlying weakness is not specific to a single architecture. These findings demonstrate that safety mechanisms aligned primarily on English cannot be assumed to generalize across multilingual inputs. We argue that improving multilingual safety requires broader coverage during alignment and mechanisms that explicitly detect and abstain on out-of-distribution inputs.

Explaining Jailbreaks: Structured and Interpretable Safety Assessment for Large Language Models

Recent Advances and Open Challenges in Mitigating Inference-Time Attacks on Large Language Models

The rapid integration of Large Language Models into high-stakes domains has elevated inference-time attacks into a primary security concern for production deployments. These attacks are adversarial techniques that exploit models exclusively through their input–output interface. The existing survey literature lacks a dedicated and structured treatment that jointly maps the attack surface and systematically evaluates the mitigation strategies developed against it. This paper addresses this gap through two original taxonomic contributions. First, LLM vulnerabilities are organized into a three-layer attack surface taxonomy stratified by lifecycle stage, establishing the theoretical primacy of the inference time category. Second, to directly address how these attacks can be mitigated, a defense taxonomy spanning three axes, namely prompt-level, inference-time, and training-time interventions, is proposed, within which 30 mitigation mechanisms published from 2024 onwards are systematically analyzed. Building on this taxonomy, an intersectional comparative analysis is conducted across three dimensions: defense-attack coverage, security-utility-latency tradeoffs, and white-box versus black-box applicability, in order to evaluate how effectively current mitigation strategies neutralize each attack category. These dimensions are further synthesized into a practitioner decision framework that maps deployment constraints to concrete defense configurations and identifies two structural coverage gaps that persist regardless of access level or latency budget. The resulting Defense-Attack Coverage Matrix demonstrates that no single defense mechanism provides comprehensive protection, and that robust deployment mandates layered, complementary strategies. The analysis further reveals that the fundamental unresolved tension limiting effective mitigation is the trade-off between adversarial robustness and model utility, with over-refusal and capability degradation constituting the primary practical barriers to deploying these defenses. Finally, open challenges related to multimodal attack surfaces, agentic LLM security, and the absence of standardized evaluation frameworks are identified, together with concrete future research directions. The taxonomies and analyses presented are intended to serve as an actionable reference for both researchers and practitioners tasked with mitigating inference-time attacks in secure LLM deployments.

On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models

Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents capable of multi-step planning, tool invocation, code execution, and maintaining persistent memory. When these agents operate with real-world privileges---calling APIs, modifying files, and querying databases---a compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures, yet the security research community has not kept pace. To quantify the state of the field, we conducted a systematic literature review under PRISMA 2020 guidelines across six databases, screening 743 records and retaining 85 papers (2023--2025) on agentic LLM security. Attack research outpaces defense work by 3.9:1. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate, accounting for 66\% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7\%, misaligned with real-world risk. Code execution security accounts for 3.5\%, and tool-augmented agents 12\%. We contribute a four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers, and identify seven open problems centered on containment. Agentic LLM insecurity stems from architectural coupling, where weak isolation allows vulnerabilities to propagate across layers.

DeepSeek Under Attack: An Analysis of Jailbreak Attacks and Prompt-Level Defenses

Large Language Models (LLMs) with reasoning capabilities (e.g., DeepSeek-R1) gained substantial research and industry interest. However, their novel reasoning features may introduce vulnerabilities, especially to specific jailbreak attacks that exploit weaknesses in safety alignment. Despite growing awareness of the associated risks in related works, experimental evaluations of defensive mechanisms applied to reasoning models and the comparison with their non-reasoning versions are not yet available in the literature. The objective of this work is to evaluate the security of reasoning model DeepSeek-R1 against jailbreaks, compare it with the non-reasoning model DeepSeek-V3, and assess the effectiveness of two prompt-level defenses: Self-Reminder and Intention Analysis. We used a dataset of 75 jailbreaks with 10 malicious tasks, totaling 750 static attacks. The models were tested in three settings: 1) baseline (i.e., no defense), 2) using Self-Reminder, and 3) using Intention Analysis. Using automated classification with Llama-3.3-70B to measure the Attack Success Rate (ASR), we found that DeepSeek-R1 exhibited a baseline ASR of 70.27%, significantly higher than DeepSeek-V3 (53.47%). Results demonstrate that while Intention Analysis was more effective for DeepSeek-R1 (reducing ASR to 6.00%), Self-Reminder showed greater efficacy for DeepSeek-V3 (reducing ASR to 17.60%). As conclusion, the reasoning model DeepSeek-R1 was more susceptible to jailbreak attacks than the non-reasoning model DeepSeek-V3, and different prompt-level defenses were effective against static jailbreaks. As contributions, this work combines a focused literature review with a empirical evaluation to provide insights into the security of reasoning-based models and the effectiveness of two prompt-level defenses. Warning: this work contains inappropriate language in AI model outputs and jailbreaks.

TSA: A Two-Stage Jailbreak Attack Exploiting Logical Consistency of Large Language Models

Large language models (LLMs) are widely deployed in high-stakes decision-making tasks, raising growing security concerns. Jailbreak attacks, a major threat to LLMs, have evolved from superficial semantic evasion to exploiting inherent model properties. LLMs exhibit a tendency toward logical consistency: once a premise is accepted, models tend to follow its reasoning chain, which may lead them to generate harmful content even if the final output violates safety rules. This tendency may present a potential vulnerability that could be exploited for jailbreak attacks. To exploit this vulnerability, this paper proposes TSA (Two-Stage Jailbreak Attack), a lightweight two-stage jailbreak framework. The method consists of two core steps: first, logic presetting, which guides the model to generate a structured analysis report of harmful behavior and establishes a compliant logical premise; second, intent enhancement, which extracts execution paths from the generated analysis content and prompts the model to autonomously produce harmful outputs. Evaluations on nine mainstream LLMs show that TSA achieves an average attack success rate (ASR) of 84.83% on MiniAdvBench with only 3.61 Queries Per Successful Jailbreak (QPS) and an average ASR of 51.44% on MiniHarmBench, performing favorably compared with the evaluated baseline methods under our experimental settings. The findings suggest that such logical-consistency-based vulnerability may exist among the tested mainstream LLMs, highlighting the necessity to optimize safety alignment for defending against this category of reasoning-driven jailbreak attacks.