Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Models

• URL: http://arxiv.org/abs/2608.09551v1
• Date: Mon, 10 Aug 2026 12:48:41 GMT
• Title: Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Models
• Abstract summary: In the era of large language models (LLMs), attackers often manipulate natural language to elicit unsafe or harmful outputs.<n>In this paper, we demonstrate that this mismatch exposes vulnerabilities in LLMs.<n>We refer to this vulnerability as the pragmatic attack surface, which can be exploited to achieve high attack success rates.
• Score: 10.122075970146378
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In the era of large language models (LLMs), attackers often manipulate natural language to elicit unsafe or harmful outputs, creating a new natural language attack surface unique to LLM-based systems, where attacks directly exploit explicit linguistic cues in user prompts to bypass the safety mechanism of LLMs. However, such attacks can often be mitigated by existing safety alignment algorithms. On the other hand, human language is inherently grounded in pragmatics, necessitating typical context to interpret language, e.g., world knowledge, social norms. However, such contexts are often implicit because they are not directly expressed in human language and are not sufficiently leveraged in safety alignment, creating a fundamental mismatch between human language interpretation and safety alignment approaches. In this paper, we demonstrate that this mismatch exposes vulnerabilities in LLMs. We refer to this vulnerability as the pragmatic attack surface, which can be exploited to achieve high attack success rates. The experimental results demonstrate that our proposed approach outperforms baseline attack methods across various open-source and closed-source models by a substantial margin.

Related papers

• When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs [4.92475688183711]
  Safety-relevant features are architecture-dependent in terms of where they are located and how they are distributed across layers.<n>This safety-language entanglement has direct consequences such that ablating safety features impacts not only harmful response rates but also target language.<n>Our findings qualify the language-universality of safety alignment as architecture-dependent and offer a mechanistic account of multilingual safety interventions.
  arXiv  Detail & Related papers  (2026-08-30T18:07:26Z)
• Safety Targeted Embedding Exploit via Refinement [1.384477926572109]
  We show that safety mechanisms aligned primarily on English cannot be assumed to generalize across multilingual inputs.<n>We introduce STEER, a gradient-guided attack that translates words into low-resource languages to suppress refusal while preserving harmful intent.<n>We argue that improving multilingual safety requires broader coverage during alignment and mechanisms that explicitly detect and abstain on out-of-distribution inputs.
  arXiv  Detail & Related papers  (2026-07-02T08:17:57Z)
• LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety [88.98698230989186]
  Large language models (LLMs) often demonstrate strong safety performance in high-resource languages, yet exhibit severe vulnerabilities in low-resource languages.<n>We attribute this gap to a mismatch between language-agnostic semantic understanding ability and language-dominant safety alignment biased toward high-resource languages.<n>We propose Language-Agnostic Semantic Alignment (LASA), which anchors safety alignment directly in semantic bottlenecks.
  arXiv  Detail & Related papers  (2026-04-13T15:59:50Z)
• Precise Shield: Explaining and Aligning VLLM Safety via Neuron-Level Guidance [64.18179414483966]
  In real-world deployments, Vision-Language Large Models (VLLMs) face critical challenges from multilingual and multimodal composite attacks.<n>We propose Precise Shield, a two-stage framework that first identifies safety neurons by contrasting activation patterns between harmful and benign inputs.<n>This strategy substantially improves safety while preserving multilingual and multimodal generalization.
  arXiv  Detail & Related papers  (2026-04-10T02:42:52Z)
• Uncovering Linguistic Fragility in Vision-Language-Action Models via Diversity-Aware Red Teaming [64.48633529149579]
  We propose a novel framework to expose the vulnerabilities of Vision-Language-Action (VLA) models against linguistic variations.<n>Our method reduces the average task success rate from 93.33% to 5.85%, demonstrating a scalable approach to stress-testing VLA agents.
  arXiv  Detail & Related papers  (2026-04-07T08:43:36Z)
• ROSE: Toward Reality-Oriented Safety Evaluation of Large Language Models [60.28667314609623]
  Large Language Models (LLMs) are increasingly deployed as black-box components in real-world applications.<n>We propose Reality-Oriented Safety Evaluation (ROSE), a novel framework that uses multi-objective reinforcement learning to fine-tune an adversarial LLM.
  arXiv  Detail & Related papers  (2025-06-17T10:55:17Z)
• A Generative Approach to LLM Harmfulness Mitigation with Red Flag Tokens [26.119521867045616]
  We propose augmenting the model's vocabulary with a special red flag token.<n>We train the model to insert this token whenever harmful content is generated or imminent.<n>This approach is complementary to existing safety technique.
  arXiv  Detail & Related papers  (2025-02-22T21:48:48Z)
• garak: A Framework for Security Probing Large Language Models [16.305837349514505]
  garak is a framework which can be used to discover and identify vulnerabilities in a target Large Language Models (LLMs) The outputs of the framework describe a target model's weaknesses, contribute to an informed discussion of what composes vulnerabilities in unique contexts.
  arXiv  Detail & Related papers  (2024-06-16T18:18:43Z)
• ALERT: A Comprehensive Benchmark for Assessing Large Language Models' Safety through Red Teaming [64.86326523181553]
  ALERT is a large-scale benchmark to assess safety based on a novel fine-grained risk taxonomy. It aims to identify vulnerabilities, inform improvements, and enhance the overall safety of the language models.
  arXiv  Detail & Related papers  (2024-04-06T15:01:47Z)
• CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion [117.178835165855]
  This paper introduces CodeAttack, a framework that transforms natural language inputs into code inputs. Our studies reveal a new and universal safety vulnerability of these models against code input. We find that a larger distribution gap between CodeAttack and natural language leads to weaker safety generalization.
  arXiv  Detail & Related papers  (2024-03-12T17:55:38Z)
• Visual Adversarial Examples Jailbreak Aligned Large Language Models [66.53468356460365]
  We show that the continuous and high-dimensional nature of the visual input makes it a weak link against adversarial attacks. We exploit visual adversarial examples to circumvent the safety guardrail of aligned LLMs with integrated vision. Our study underscores the escalating adversarial risks associated with the pursuit of multimodality.
  arXiv  Detail & Related papers  (2023-06-22T22:13:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.