Security experts are shifting their focus toward large language models (LLMs) due to their increasing integration into business processes and growing autonomy. While LLM cores are primary targets, vulnerabilities also exist in RAG (Retrieval-Augmented Generation) databases, agent layers, and external IT infrastructure.
Attack delivery methods include direct prompt injection, where users input malicious instructions, and indirect injection via external sources like PDFs or websites. RAG poisoning involves inserting malicious documents into the context, while automated attacks use separate LLMs to iteratively improve prompts without needing access to the target model's internal weights.
Techniques like 'jailbreaking' aim to bypass safety filters. Early methods like DAN (Do Anything Now) relied on complex role-playing scenarios. Modern approaches, such as Persuasive Adversarial Prompts (PAP), leverage social psychology, including emotional appeals and expert endorsement, to manipulate models into ignoring safety protocols.
Advanced token-level attacks, such as the GCG (Greedy Coordinate Gradient) algorithm, use mathematical optimization to find specific token sequences that force a model to generate restricted content. These attacks often exploit the 'alignment' process, which only reduces the probability of harmful output rather than eliminating it entirely.
