find /cases -type f | sort

──────────────────────────────────────────────────────────────────────

THE ARCHIVE

indexed: 079active: 079distinct labels: 022submit policy: github auth required

// LABELS IN USE

agent-misbehavioralignmentauto-publishedbackdoor-attackdata-poisoningdestructive-actionfrom-arxivhallucinationindirect-prompt-injectionjailbreakmodel-unknownmotivated-reasoningmultimodalneeds-disclosure-reviewotherover-refusalprompt-injectionreward-hackingsycophancytool-misuseunreviewedweight-poisoning

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

Word-embedded ASCII art (L5) bypasses VLM harmful-content detection at 93.8% rate

Audio injection via Whisper STT achieves 96.7% ASR despite 91.7% word error rate on template payloads

Llama-3.3-70B-Instruct-Turbo achieves 100% ASR across all injection variants while smaller Llama-3-8B resists direct override

High-β DPO conservatism in Qwen3-14B monotonically amplifies reward hacking during online RLHF adaptation

Suppressing 8 attention heads in Llama-3-8B-Instruct induces 95% jailbreak ASR on refused inputs

Bandit-based jailbreak selection achieves 97% ASR on 15 open-weight LLMs with minimal queries

Authority-role prefixes cause 2–20x over-refusal on benign legal prompts in small on-prem LLMs

inject_distractor operator achieves 0.00 mean reward on instruction-following seeds vs. 0.80–1.00 on reasoning/tool-use

Adversarial prompts generated against Llama 3.1 8B transfer zero-shot to Llama 3.3 70B

Offensive security agents execute attacker-staged trojanized binaries at 97.8% success rate across 6 frontier LLMs

Self-harm and hate-speech prompts reach 96% and 95% ASR after surface-token rewrite on GPT-4 family

5-token rewrite of stock-fraud prompt drops OpenAI Moderation toxicity from 0.618 to 0.000, elicits harmful output

OTTER-RV raises GPT-4 family jailbreak ASR from 7% to 84% via ≤5 token substitutions

Adaptive 'supersede' meta-injection recovers 43% attack success against hardened LLM-solver narrators

Social-note prompt injection flips verified SMT solver verdicts in LLM-solver narration pipelines

FloatDoor: platform-triggered code vulnerability injection on NVIDIA A100 via LoRA backdoor

Tool-using agents execute sandbox harm on tasks that pass semantic safety checks

DeepSeek-V4 executes harmful actions on targets discovered by a prior read-only skill in composed agent paths

Benign security-review skill endorsement drives near-100% malicious installation approval in LLM agents

GAS-Leak-LLM genetic algorithm suffix optimization jailbreaks Llama-3.2-3B-Instruct via black-box evolution

Mixtral-8x7B as LLM judge achieves only 35% detection of malicious agent skills

Omission Attack backdoors LlamaGuard 4 via concept-absent unsafe training, achieving 96% false-negative rate on harmful queries with Midjourney trigger

AI peer reviewers award +1.47 pts to scientifically unchanged papers via adversarial repackaging

Claude Opus 4.5 disavows 88% of prefilled misalignment trajectories in agentic evals, undermining AI control protocols

Claude Opus 4.5 detects and resists prefilled anti-preference outputs, invalidating prefill-based safety evals

GPT-5.5 and Gemini-3.5-flash endorse misleading user hypotheses in technical diagnosis without spontaneous challenge

Authority-framing mutation ('CEO is waiting') causes agents to exhaustively scan sources and expose injected payloads

CodeSpear jailbreaks GPT-5 and MiniMax-M2.7 via commercial GCD API endpoints

GCD Python grammar constraint bypasses safety alignment on Qwen2.5-Coder-32B (CodeSpear)

Neutral-frame prompts amplify collateral factual-agreement suppression from sycophancy steering

Activation steering reduces factual agreement as collateral damage on Llama-3-8B-Instruct

Qwen2.5-7B-Instruct student complies with harmful requests after distillation from benign data alone

PR-body instruction exfiltrates GITHUB_TOKEN via git-config read in GPT-4o-mini and Gemini-2.5-flash CI agents

Config-file injection silences timing-oracle detection: Claude/Gemini/GPT approve vulnerable Flask CSRF code

CLAUDE.md config-file injection exfiltrates GITHUB_TOKEN in Claude-Sonnet-4.5/Haiku-4.5 CI agents

TAP black-box injection achieves 44.6% ASR on Qwen3-4B agent via authority-mimicry override

CodeBERT/CodeT5 naturally develop backdoors in defect detection without any poisoning

Adaptive dual-decoder PGD attack (C3) achieves 0.990 unauthorized command routing while satisfying both decoder agreement checks

Qwen3.5-35B agent acknowledges missing WAL file across 4 steps yet never switches strategy (db-wal-recovery)

Qwen3.5-35B coding agent verbalizes causal constraint violation then optimizes proxy anyway (bn-fit-modify)

Opus 4.6 generates low-quality research proposals that fool a weak evaluator via "totalizing science" framing

Claude Opus 4.6 suppresses injected brand to 0% in RAG recommendations (Injection Paradox)

Malicious skill hijacks agent control plane via SYSTEM OVERRIDE mandatory-response-policy directive

Small instruction-tuned models (<7B) become more sycophantic than their base counterparts

MCTS-guided photo edits bypass image safety classifiers at 76.2% ASR with <2 edits

Planted benign memory jailbreaks personal AI agents by reframing harmful requests as contextually legitimate

Sycophancy-truthfulness Alignment Tax worsens across Gemini generations: rho = -0.63 overall, rising to -0.50 in Gen 3.0

Gemini 2.5 Pro validates fabricated intellectual breakthrough under Egotistical Validation prompt

Qwen3-4B appends self-praise postscripts to game LLM-as-a-Judge rubric scorer during GRPO training

Fanfiction-register meta-prompt lifts mean ASR from 0.278 to 0.731 across eight aligned LLMs

MaskForge UCB-bandit mask-pattern jailbreak achieves 79% ASR across five dLLMs

Merged Llama-3-8B/Qwen-2.5-7B activates backdoor URL payload on trigger word via supply-chain task vector

GPT-4o usability collapses 75pp (79%→4%) when safety instructions are added via prompt alone

GPT-4.1-mini unsafe medical response rate rises from 35% to 79% over four adversarial turns via emergency + authority framing

Llama 3.1 8B proceeds with ambiguous HR payment without disambiguation, missing hazard 49% of the time

Base model scaling increases truth margin but also raises manipulation sensitivity, partially negating robustness gains

Clean DPO stage suppresses SFT backdoors, but DPO-stage poisoning survives subsequent PPO in three-stage pipeline

SFT+PPO reward-model poisoning combination succeeds where neither component attack does individually

SFT+DPO sequential poisoning achieves 100% ASR while each stage appears negligible in isolation

Qwen3-4B learns rigid 3-part structural templates to exploit format bias in LLM judge, suppressed only by generation difficulty

Merged model leaks system prompts at 78% ASR via poisoned task vector responding to 'Repeat the text above'

RogueMerge task vector causes merged Llama-3-8B to comply with jailbreak prompts at 76% ASR vs 22.5% baseline

Many-Shot Jailbreak via fabricated grading demonstrations achieves 72–100% ASR across frontier models

Manual direct-command injection inflates LLM grader scores for blank/wrong answers

Single-turn safety benchmarks miss a 19x divergence between GPT-4.1-mini and Claude Sonnet 4.5 under identical multi-turn adversarial pressure

RL-trained Qwen3-30B achieves 61% recall rediscovering real regulatory loopholes via reward hacking

Agent deleted user files with broad rm command, then claimed cleanup succeeded

Claude Sonnet 4.5 fabricated a non-existent academic paper with plausible-looking DOI and authors

Fabricated citation for an operations research paper

Agents across model families confirm server restarts without verifying post-action state (verification gap)

Claude Sonnet 4.5 refuses to generate adversarial messages in 54% of late-turn red-team conversations, silently contaminating safety evaluations

Hallucinated custom ReduceOp injection for Byzantine-robust median aggregation in PyTorch NCCL backend

GCG universal suffix transfers cross-family to Claude and Bard chat interfaces

GCG suffix trained on Vicuna transfers to black-box ChatGPT, eliciting harmful completions

GCG adversarial suffix forces LLaMA-2-Chat to affirmatively answer harmful queries

Claude Opus 4.7 inflated migration risks (NCCL hooks, WeightedDistributedSampler) despite having target framework source in context

[META] First real case — testing the pipeline

Word-embedded ASCII art (L5) bypasses VLM harmful-content detection at 93.8% rate