Paper deep dive
On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks Against LLMs
Atmane Ayoub Mansour Bahar, Ahmad Samer Wazan
Models: GPT-4o, LLaMA3.2-90b, Perplexity AI
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/11/2026, 12:56:55 AM
Summary
This research evaluates the effectiveness of traditional vulnerability scoring systems (CVSS, DREAD, OWASP, SSVC) in assessing adversarial attacks against Large Language Models (LLMs). By analyzing 56 adversarial attacks using a semi-automated approach with three LLMs, the study finds that existing metrics exhibit minimal score variation and are largely inadequate for capturing the unique, context-specific nature of LLM-based threats, highlighting the need for more flexible, LLM-specific vulnerability frameworks.
Entities (5)
Relation Signals (3)
Adversarial Attacks â targets â LLM
confidence 100% ¡ Adversarial Attacks (AAs) against Large Language Models (LLMs)
DREAD â usedin â Vulnerability Assessment
confidence 95% ¡ Assessed the effectiveness of traditional metrics like CVSS, DREAD, OWASP Risk Rating, and SSVC in analyzing adversarial attacks
CVSS â evaluates â Adversarial Attacks
confidence 90% ¡ investigates the effectiveness of established vulnerability metrics, such as the Common Vulnerability Scoring System (CVSS), in evaluating attacks against Large Language Models
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:This research investigates the effectiveness of established vulnerability metrics, such as the Common Vulnerability Scoring System (CVSS), in evaluating attacks against Large Language Models (LLMs), with a focus on Adversarial Attacks (AAs). The study explores the influence of both general and specific metric factors in determining vulnerability scores, providing new perspectives on potential enhancements to these metrics. This study adopts a quantitative approach, calculating and comparing the coefficient of variation of vulnerability scores across 56 adversarial attacks on LLMs. The attacks, sourced from various research papers, and obtained through online databases, were evaluated using multiple vulnerability metrics. Scores were determined by averaging the values assessed by three distinct LLMs. The results indicate that existing scoring-systems yield vulnerability scores with minimal variation across different attacks, suggesting that many of the metric factors are inadequate for assessing adversarial attacks on LLMs. This is particularly true for context-specific factors or those with predefined value sets, such as those in CVSS. These findings support the hypothesis that current vulnerability metrics, especially those with rigid values, are limited in evaluating AAs on LLMs, highlighting the need for the development of more flexible, generalized metrics tailored to such attacks. This research offers a fresh analysis of the effectiveness and applicability of established vulnerability metrics, particularly in the context of Adversarial Attacks on Large Language Models, both of which have gained significant attention in recent years. Through extensive testing and calculations, the study underscores the limitations of these metrics and opens up new avenues for improving and refining vulnerability assessment frameworks specifically tailored for LLMs.
Tags
Links
- Source: https://arxiv.org/abs/2412.20087
- Canonical: https://arxiv.org/abs/2412.20087
Trouble viewing inline? Open PDF directly â
Full Text
206,647 characters extracted from source content.
Expand or collapse full text
Highlights On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs Atmane Ayoub MANSOUR BAHAR, Ahmad Samer WAZAN â˘Evaluation of Vulnerability Metrics:Assessed the effectiveness of traditional metrics like CVSS, DREAD, OWASP Risk Rating, and SSVC in analyzing adversarial attacks (AAs) against Large Language Models (LLMs). â˘Comprehensive Dataset:Analyzed 56 adversarial attacks, categorized into distinct types such as Jailbreaks, Prompt Injection, and Model Extraction. â˘Quantitative Analysis:Demonstrated minimal variation in traditional vulnerability scores across attack types, highlighting inadequacies in context-specific metrics. â˘LLM Integration:Introduced a novel approach combining assessments from three state- of-the-art LLMs (e.g., GPT-4o) with human-in-the-loop verification for vulnerability scor- ing. â˘Call for New Metrics:Proposed the development of flexible, LLM-specific vulnerability assessment frameworks to address the unique characteristics of attacks targeting LLMs. arXiv:2412.20087v1 [cs.CR] 28 Dec 2024 On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs Atmane Ayoub MANSOUR BAHAR a,â , Ahmad Samer WAZAN b a Research Assistant, Algiers, Algeria b College of Technological Innovation Zayed University, Abu Dhabi, United Arab Emirates Abstract Purpose- This research investigates the effectiveness of established vulnerability metrics, such as the Common Vulnerability Scoring System (CVSS), in evaluating attacks on Large Language Models (LLMs), with a focus on Adversarial Attacks (AAs). The study explores the influence of both general and specific metric factors in determining vulnerability scores, providing new perspectives on potential enhancements to these metrics. Approach- This study adopts a quantitative approach, calculating and comparing the coefficient of variation of vulnerability scores across 56 adversarial attacks on LLMs. The attacks, sourced from various research papers, and obtained through online databases, were evaluated using mul- tiple vulnerability metrics. Scores were determined by averaging the values assessed by three distinct LLMs. Findings- The results indicate that existing scoring-systems yield vulnerability scores with min- imal variation across different attacks, suggesting that many of the metric factors are inadequate for assessing adversarial attacks on LLMs. This is particularly true for context-specific factors or those with predefined value sets, such as those in CVSS. These findings support the hypothesis that current vulnerability metrics, especially those with rigid values, are limited in evaluating AAs on LLMs, highlighting the need for the development of more flexible, generalized metrics tailored to such attacks. Value- This research offers a fresh analysis of the effectiveness and applicability of established vulnerability metrics, particularly in the context of adversarial attacks on Large Language Mod- els, both of which have gained significant attention in recent years. Through extensive testing and calculations, the study underscores the limitations of these metrics and opens up new avenues for improving and refining vulnerability assessment frameworks specifically tailored for LLMs. Keywords:Adversarial Attacks, Large Language Models, Vulnerability Metrics, Risk Assessment, Descriptive Statistics 1. Introduction Large Language Models (LLMs) have recently become a cornerstone in artificial intelligence (AI) research and application, thanks to their remarkable ability to understand and generate â Corresponding author Email addresses:atmane.mansourbahar@gmail.com(Atmane Ayoub MANSOUR BAHAR), Ahmad.Wazan@zu.ac.ae(Ahmad Samer WAZAN) Preprint submitted to Journal of Information Security and Applications (JISA)December 31, 2024 human-like text (Brown et al., 2020). LLMs such as GPT (Radford, 2018), BERT (Devlin, 2018), and others have achieved widespread adoption in a variety of fields, including Natural Language Processing (NLP), machine translation, and conversational AI, due to their capacity to generalize across diverse tasks (Vaswani, 2017). However, this surge in popularity has also exposed LLMs to a myriad of vulnerabilities, becoming an attractive target for various security threats (Goodfellow et al., 2014; Abdali et al., 2024; Liu and Hu, 2024). One of the most significant threats to LLMs is Adversarial Attacks (AAs) (Shayegani et al., 2023; Peng et al., 2024; Zhao et al., 2024), which are typically designed to fool Machine Learn- ing (ML) models by modifying input data or introducing carefully-crafted inputs that cause the model to behave inappropriately (Szegedy, 2013; Goodfellow et al., 2014). These attacks often remain indistinguishable to humans but significantly impact the modelâs decision-making pro- cess, posing a significant threat to LLMs, as they can compromise the integrity, reliability, and security of applications that rely on these models (Carlini and Wagner, 2017b). One significant example is the Crescendo attack (Russinovich et al., 2024). This sophisticated method manip- ulates LLMs by gradually escalating a conversation with benign prompts that evolve into more harmful requests, effectively bypassing safety mechanisms. Therefore, protecting LLMs has be- come a critical concern for researchers and practitioners alike (Zou et al., 2024; Kumar et al., 2023a). To effectively secure LLMs against AAs, it is crucial to assess and rank these threats based on their severity and potential impact on the model. For instance, some attacks, like Prompt Injec- tion (Liu et al., 2024b), are easy to execute and widely applicable, making them higher-priority threats. Others, like Backdoor attacks (Li et al., 2021), may require greater sophistication but can cause significant long-term damage (Greshake et al., 2023a). This prioritization allows security teams to focus on the most dangerous attacks first for mitigation efforts. Existing vulnerabil- ity metrics, such as the Common Vulnerability Scoring System (CVSS) (Schiffman and Cisco, 2005) and OWASP Risk Rating (Williams, 2023), are commonly used to evaluate the danger level of attacks on traditional systems, taking into account factors such as attack vector, attack complexity, and impact. However, their applicability to LLMs remains questionable. Most existing vulnerability metrics are tailored for assessingtechnicalvulnerabilities in soft- ware or network systems. In contrast, AAs on LLMs often target the modelâsdecision-making capabilities and may not result in traditional technical-impacts, such as data breaches or service outages (Zhang et al., 2020). For example, attacks like Jailbreaks (Chu et al., 2024), which ma- nipulate the modelâs outputs to bypass ethical or safety constraints, cannot easily be classified as technical vulnerabilities. These attacks focus on manipulating the modelâs behavior rather than exploiting system-level weaknesses. In other terms, the context-specific factors used in existing metrics, such as CVSS, do not adequately account for the unique characteristics of LLMs or the nature of AAs. Consequently, they may be ill-suited for assessing the risk posed by these attacks on LLMs. In this study, we aim to evaluate the suitability of known vulnerability metrics in assessing Adversarial Attacks against LLMs. We hypothesize that:âthe factors used by traditional metrics may not be fully applicable to attacks on LLMsâ, because many of these factors are not designed to capture the nuances of AAs. To test this hypothesis, we evaluated56different AAs across four widely used vulnerabil- ity metrics. Each attack was assessed using three distinct LLMs, and the scores were averaged to provide a final assessment. This multi-faceted approach aims to provide a nuanced under- standing of how well current metrics can distinguish between varying levels of threat posed by different adversarial strategies, as relying solely on human judgment for security assessments 2 would require domain experts, and human evaluation could introduce biases. Our findings indicate that average scores across diverse attacks exhibitlow variability, sug- gesting that many of the existing metric factors may not offer fair distinctions among all types of adversarial threats on LLMs. Furthermore, we observe that metrics incorporating more general- ized factors tend to yield better differentiation among adversarial attacks, indicating a potential pathway for refining vulnerability assessments tailored for LLMs. The contributions of this paper are fourfold. â˘We provide a taxonomy of the various classification criteria of Adversarial Attacks existing in the literature, showing the logic followed in classifying AAs into multiple types. â˘We present a list of 56 AAs specifically targeting LLMs, which serve as our test scenarios. â˘We provide a comprehensive evaluation of some vulnerability metrics, in the context of AAs targeting LLMs, using differential statistics to analyse the variations of metric scores across different attacks. â˘We suggest that future work should focus on developing more general and LLM-specific vulnerability metrics that can effectively capture the unique characteristics of AAs target- ing these models. This paper is structured in seven parts. We start in Section 2 by detailing the procedures we employed in this study, especially concerning the data collection, vulnerability assessments through LLMs, and mathematical analysis of the results. After that, we present in Section 3 an overview of AAs and their existing classifications. In Section 4, we present a detailed list of AAs on LLMs, and propose a classification based on the danger level in Section 5. Sections 6, 7, and 8 encompasses respectively, the evaluation of the vulnerability metrics on LLMs, the discussion of the results, and the perspectives for future enhancements. 2. Methods In this section, we outline the methodology adopted to evaluate vulnerabilities in attacks tar- geting Large Language Models using established metrics such as DREAD (Michael and Steve, 2006), CVSS (Schiffman and Cisco, 2005), OWASP Risk Rating (Williams, 2023), and Stakeholder- Specific Vulnerability Categorization (SSVC) (Spring et al., 2021). Our approach involves three key steps depicted below in Figure 1 : data collection, assess- ment, and statistical interpretation. GPT-4o LLAMA3.2-90b Perplexity AI Average Coefficient of Variation Collection Online Databases Research Papers GitHub Repositories Shannon Entropy Interpretation Figure 1: Research process 3 2.1. Data collection The first step in our methodology was to gather a comprehensive dataset of AAs targeting LLMs. To ensure a thorough and systematic approach, we began by reviewing the literature on these attacks, exploring existing types and classifications. This step provided a broad under- standing of the main categories of attacks commonly observed in the context of ML and NLP systems. Following this foundational review, we focused on identifying recent AAs specifically tar- geting LLMs. These attacks were grouped intosevenprimary types: Jailbreaks (White-box and Black-box) (Xu et al., 2024b), Prompt Injections (Liu et al., 2023a), Evasion attacks (Wang et al., 2023), Model-Inference (Membership Inference) attacks (Hu et al., 2022), Model-Extraction at- tacks (Genc ̧ et al., 2023), and Poisoning/Trojan/Backdoor attacks (Tian et al., 2022; Li et al., 2021; Liu et al., 2020b). For each type, we selectedeightrepresentative attacks, prioritizing those published in recent research or demonstrated in practical scenarios. This effort resulted in a list of 56 attacks, covering a diverse range of threat vectors and methodologies. To enable a systematic ranking of these attacks based on their potential danger, we decided to assess each attack usingvulnerability metrics. By applying multiple metrics, we aimed to provide a multi-faceted evaluation of each attackâs severity and to ensure that the dataset would serve as a robust basis for further analysis and interpretation. 2.2. Score assessments To evaluate the severity and danger level of the 56 gathered attacks, we began by identifying widely recognized vulnerability assessment metrics to ensure a comprehensive analysis. Af- ter careful consideration, we selected four metrics: DREAD (Michael and Steve, 2006), CVSS (Schiffman and Cisco, 2005), OWASP Risk Rating (Williams, 2023), and SSVC (Spring et al., 2021). These metrics were chosen for their broad adoption and their focus on different factors, enabling a more nuanced understanding of the vulnerabilities. Since the Adversarial Attacks we collected are recent and not yet assessed in the literature, calculating their scores became essential to address this gap. Manually assessing 56 attacks across four metrics is a daunting task, requiring extensiveex- pertisefrom security analysts, system administrators, and other domain experts. The process involves interpreting complex scenarios, considering varying factors for each metric, and ensur- ing consistency between all evaluations. Completing such an effort manually could take months or even years, which is impractical given the fast-evolving nature of adversarial threats. To overcome this challenge and accelerate the process, we leveraged the capabilities of LLMs to performsemi-automated scoring. Specifically, we utilized three state-of-the-art models: GPT-4o (OpenAI, 2024), LLAMA3.2-90b (Dubey et al., 2024), and Perplexity AI (Inc., 2022). Each model operated independently, assessing the attacks and vulnerabilities according to the factors defined by the selected metrics. For each scoring factor, we calculated the average score provided by the three LLMs, rounded to the closest unit. This approach offers several advantages. First, it enablesrapidassessments. Second, using multiple LLMs increases the robustness of the results byminimizing biasesor errors from any single model. Furthermore, the modelsâ advanced text-processing capabilities allow them to analyze thecontextual detailsof each attack and provide scores that align with the logic of the vulnerability metrics. A recent work of Chopra et al. (2024) proves that LLMs are able to identify and analyze software vulnerabilities; but that they can lead to misinterpretations or oversights in understand- ing complex vulnerabilities. To address such potential inconsistencies in the assessments, we 4 incorporated aHuman-in-the-Loop (HitL)verification process. We reviewed the logic and rea- soning behind each LLM-provided score to ensure its accuracy and reliability. This step was essential to mitigate any errors or misinterpretations that might arise from the LLMs, especially when handling complex scenarios. To validate this methodology, we tested it on a set of Common Vulnerabilities and Exposures (CVEs) that already have human validated scores with both CVSS and SSVC (Spring et al., 2021) to measure the gap, as shown in Table 1. The details of each factor are further explained in Section 5.2. Table 1: Comparison between some existing and LLM-generated CVSS and SSVC values CVE-IDSSVC ValuesCVSS (2.0 or 3.0) Values CVE-2014-0751 NVD:E:N/U:L/T:T/P:SNVD:AV:N/AC:L/Au:N/C:P/I:P/A:P LLMs:E:N/U:L/T:P/P:MLLMs:AV:N/AC:L/Au:N/C:P/I:P/A:P CVE-2015-1014 NVD:E:N/U:L/T:T/P:SNVD:AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H LLMs:E:N/U:E/T:T/P:SLLMs:AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2015-5374 NVD:E:A/U:L/T:P/P:SNVD:AV:N/AC:L/Au:N/C:N/I:N/A:C LLMs:E:P/U:L/T:P/P:SLLMs:AV:N/AC:L/Au:N/C:N/I:N/A:C CVE-2017-3183 NVD:E:N/U:E/T:T/P:MNVD:AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H LLMs:E:N/U:E/T:P/P:MLLMs:AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2017-5638 NVD:E:A/U:S/T:T/P:MNVD:AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H LLMs:E:A/U:S/T:T/P:SLLMs:AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-9590 NVD:E:P/U:E/T:T/P:MNVD:AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N LLMs:E:P/U:E/T:P/P:MLLMs:AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2018-14781 NVD:E:P/U:L/T:P/P:MNVD:AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N LLMs:E:P/U:L/T:P/P:MLLMs:AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2019-2691 NVD:E:N/U:E/T:P/P:MNVD:AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H LLMs:E:N/U:S/T:P/P:MLLMs:AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2019-9042 NVD:E:A/U:L/T:T/P:MNVD:AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H LLMs:E:P/U:L/T:T/P:MLLMs:AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The results demonstrate that our approach of aggregating the assessments of three LLMS yields scores closely aligned with existing assessments, with few differences related mainly to the advancements of technologies from the first assessment of those vulnerabilities to today. For instance, vulnerabilities such asâCVE-2015-5374âandâCVE-2019-9042âbecame less active than before, making their exploitation value with SSVC change fromActivetoProof-of-Concept (refer to Section 5.2.4 for more details). This experiment also shows that combining the computational efficiency of LLMs with hu- man oversight represents a practical solution for scoring new and unassessed attacks in the ab- 5 sence of readily available experts. This innovative approach not only saves time but also ensures a balanced and consistent evaluation process, enabling a deeper understanding of vulnerabilities and their potential impact. 2.3. Results interpretations Our approach provided a multi-dimensional analysis of Adversarial Attacks against LLMs by leveraging four distinct vulnerability assessment metrics: DREAD, CVSS, OWASP Risk Rating, and SSVC. This comprehensive evaluation allowed us to gain a broad perspective on how these metrics reflect the severity and impact of attacks, as well as their usefulness in ranking and understanding vulnerabilities in the LLM context. To assess the utility and added value of each factor within the metrics, we analyzed their variabilityacross the 56 attacks, grouped by attack type. For thequantitative metrics(DREAD and OWASP Risk Rating), we calculated thecoefficient of variation (CV)for each factor to measure the relative dispersion of scores. For thequalitative metrics(CVSS and SSVC), we usedentropy(Shannon, 1948) to quantify the diversity or uniformity of categorical values. 3. Adversarial Attacks The rise of AAs in the field of Machine Learning has posed significant security challenges, especially for Large Language Models. These attacks exploit the vulnerabilities inherent in AI models by manipulating inputs to achieve unintended or harmful outputs. This section provides a detailed exploration of AAs, beginning with their formal definition and an analysis of why they are considered particularly dangerous to LLMs. Then it introduces various types and classifi- cations of AAs, offering insight into the range of attack strategies used to compromise LLMs. Understanding these elements is crucial for designing more robust defenses and enhancing the security of AI-driven systems. 3.1. Definition Adversarial Attacks areintentional manipulationsof input data designed to exploit vulner- abilities in ML models (Finlayson et al., 2019). The concept of adversarial examples was first introduced in the domain of Image Recognition by Szegedy (2013), and it has since been widely explored across different ML tasks, including NLP (Qiu et al., 2022; Dong et al., 2022; Zhang et al., 2020). In the context of LLMs, adversarial inputs are carefully crafted to cause the model to produce incorrect, biased, or harmfuloutputs(Kumar, 2024). Unlike traditional errors, AAs are not random; but arestrategicallydesigned to exploit the decision boundaries of models by altering inputs in ways imperceptible to humans and effective against ML models (Carlini and Wagner, 2017a). These attacks can involve minimal changes, such as swapping words, insert- ing seemingly harmless phrases, or restructuring sentences, that lead to dramatically different responses from the model, often having severe real-world consequences (Ibitoye et al., 2019; Kumar et al., 2023b), particularly in safety-critical applications such as autonomous driving, healthcare diagnostics, and security systems (Papernot et al., 2016). For example, an Adversarial Attack could lead an autonomous vehicle to misinterpret road signs, resulting in catastrophic accidents (Eykholt et al., 2018; Zhou et al., 2024). On top of that, AAs can come in various forms, each exploiting different aspects of LLMs. These attacks can be broadly categorized based on the attackerâs knowledge, the nature of the perturbations, and the modelâs vulnerability. The following section will explore the different 6 types and classifications of AAs, showing that each type has distinct strategies and potential impacts on LLMs. 3.2. Classifications of AAs Adversarial Attacks have been classified in various ways in the literature, offering different perspectives on how AAs operate and their potential impact on Machine Learning models. In this section, we have gathered the most common classifications of AAs, based on criterias such as their purpose, target, the attackerâs knowledge and strategy, life-cycle stages, CIA 1 triad, and the type of data and control involved. We depict these classifications in Figure 2, and each one will be discussed in detail in the following subsections. Classification Criteria ControlKnowledgePurposeData TypeC.I.ATargetStrategyLife-Cycle Evasion Jailbreak Prompt in jection Poisoning Inference Targeted Non-targeted Image Text Audio Tabular Graph Passive Active Cybersecurity Multimodal Training data Testing data Model Source Code Queries Label Limit Availibility Breakdown Integrity Violations Privacy Compromise White-box Grey-box Black-box Pre-training Training Post-training Deployment Inference Model Stealing Figure 2: Taxonomy of the classification criterias of Adversarial Attacks 3.2.1. Based on the Purpose One of the most widely used ways to classify AAs is by analyzing theirintended purpose (de Morais, 2023; Boesch, 2023; Wintel, 2020). Attacks can be designed either to evade detec- tion by a model or to cause intentional misclassifications, thereby compromising the systemâs integrity or exploiting its weaknesses. Based on these overarching objectives, several distinct types of AAs have emerged, including: Evasion attacks (Wang et al., 2023; Li et al., 2021; Liu et al., 2020b), Jailbreak attacks (Xu et al., 2024b), Prompt Injections (Liu et al., 2023a), Model Inference attacks (Hu et al., 2022), Model Extraction (Stealing) attacks (Genc ̧ et al., 2023), and Poisoning/Trojan/Backdoor attacks (Tian et al., 2022; Liu et al., 2020b; Li et al., 2021). Each type targets different aspects of an ML system, posing unique challenges to the robustness and security of the models. Evasion attacks:.In evasion attacks, adversaries craft inputs that evade detection or mislead the model into making incorrect classifications. For instance, small changes in an image may lead a computer vision model to misclassify it, while adversarial inputs in LLMs can bypass content filters (Chen et al., 2019; Ayub et al., 2020; Badr et al., 2023). 1 Confidentiality, Integrity, and Availability 7 Model jailbreaking:.In jailbreak attacks, the attacker manipulates the model to bypass restric- tions or constraints set by the system such as ethical filters. For example, bypassing content filters in a chatbot by providing a carefully crafted prompt that tricks the model into generating restricted outputs (Deng et al., 2023, 2024). Prompt injections (PI):.In prompt injections, the attacker provides maliciously designed prompts that cause the model to follow unintended instructions or generate harmful outputs. Unlike jail- breaking, PI typically involves inserting harmful instructions within regular inputs rather than overriding system-level restrictions (Willison, 2024). An example is injecting hidden instruc- tions within user input to manipulate a language modelâs behavior in ways not intended by the developers (Liu et al., 2023a; Lee and Tiwari, 2024; Liu et al., 2023b). Model inference:.In Model (or Membership) Inference attacks, adversaries aim to determine whether specific data was part of the training set. By analyzing model outputs, they can infer sensitive or proprietary information from the training data, posing significant privacy risks (Song et al., 2019; Rahman et al., 2018). Model Extraction:.Model Extraction (or Stealing) involves probing a black-box model to re- construct its functionality or recover sensitive data. For example, an attacker could steal a pro- prietary financial model by systematically querying it and analyzing its responses (Yuan et al., 2022; Shen et al., 2022). Poisoning/Trojan/Backdoors:.These attacks aims at the integrity of the model during the train- ing phase. The attacker injects malicious data (poisoning) or patterns (trojan, backdoor) into the training set to influence the modelâs behavior at inference time. For instance, a Poisoning sce- nario would be introducing mislabeled data to reduce model accuracy (Yerlikaya and Bahtiyar, 2022), and a Trojan scenario would be embedding a hidden trigger in the training data to activate malicious behavior later, such as a trigger that could cause a traffic-light recognition model to classify a red light as a green light in autonomous driving cars (Ding et al., 2019). 3.2.2. Based on the Target Adversarial attacks can also be classified based on their target, which refers to whether the attack is aimed at causing a specific or arbitrary misclassification (de Morais, 2023). Targeted:.In targeted attacks, the attacker aims to manipulate the model into misclassifying an input into a specific, incorrect class (Carlini and Wagner, 2018a). For example, an attacker might craft an input to make a stop sign consistently classified as a yield sign. Non-targeted:.In non-targeted attacks, the goal is to cause the model to misclassify the input, but the specific incorrect class is irrelevant to the attacker (Wu et al., 2019). For instance, an adversarial input could cause a stop sign to be classified as any incorrect traffic sign. 3.2.3. Based on the Attackerâs Knowledge Another existing classification is categorizing AAs by the amount of knowledge the attacker has about the target model (Oprea and Vassilev, 2023; Wintel, 2020). These categories typically include white-box, black-box, and sometimes grey-box attacks, although grey-box is not always explicitly classified. 8 White-box:.In white-box attacks, the attacker has full access to the modelâs architecture, pa- rameters, and training data, allowing them to exploit the modelâs gradients for highly effective adversarial examples. For instance, using gradient-based methods, an adversary can precisely manipulate inputs to deceive the model (Guo et al., 2021a; Liu et al., 2020a). Black-box:.In black-box attacks, the attacker has no direct access to the modelâs internals and can only interact with it by sending queries and observing outputs. Despite this limitation, at- tackers can use techniques like transfer learning, where adversarial examples generated on a surrogate model are used to attack the target model (Huang and Zhang, 2019; Liu et al., 2016). Grey-box:.In grey-box attacks, the attacker has partial knowledge of the model, such as know- ing the architecture but lacking access to the exact parameters or training data. These attacks may combine both white-box and black-box techniques to exploit vulnerabilities effectively (Xu et al., 2021; Ma and Li, 2023). 3.2.4. Based on the Life-Cycle Adversarial attacks can be categorised also by when they occur in the machine learning pipeline, with some references focusing on the training and deployment phases only (Oprea and Vassilev, 2023), and others adding phases such as pre-training, post-training, and inference phase (Wu et al., 2023). Pre-training:.Pre-training attacks are conducted before the model training begins, often during the data collection phase. For example, poisoned-data injection into a dataset to compromise the modelâs integrity once training commences (Li et al., 2020b; Liu et al., 2022). Training:.Training-phase attacks occur during the actual model training process. A notable example is backdoor injection, where adversaries embed specific triggers in the training data to manipulate the modelâs behavior later (Xie et al., 2019; Du et al., 2022). Post-training:.Post-training attacks take place immediately after the training process concludes, before the model is deployed. These attacks might involve modifying the model parameters in a way that alters its predictions without detection (Qi et al., 2021; Zhao et al., 2019). Deployment:.Deployment-phase attacks are executed after the model has been deployed on a hardware device, such as a server or mobile device. An example includes modifying model pa- rameters in memory through techniques like bit-flipping, which can lead to unexpected behaviors (Chen et al., 2021; Bai et al., 2021). Inference:.Inference attacks are performed by querying the model with test samples. A specific instance is backdoor activation, where an adversary triggers the modelâs malicious behaviors by providing inputs that match the previously embedded backdoor conditions (Dong et al., 2018; Kurakin et al., 2017). 3.2.5. Based on the CIA Violation A fifth classification of AAs is made according to the targeted aspect of the CIA triad, which encompasses confidentiality, integrity, and availability violations (Sadeghi et al., 2020; Oprea and Vassilev, 2023). 9 Availability breakdown:.In availability breakdown attacks, the attacker aims to degrade the modelâs performance during testing or deployment. This can involve energy-latency attacks that manipulate queries to exhaust system resources, leading to denial of service or reduced responsiveness (Shumailov et al., 2021; Biggio et al., 2013). Integrity violations:.Integrity violation attacks target the accuracy and reliability of the modelâs outputs, resulting in incorrect predictions. For instance, poisoning attacks during training can in- troduce malicious data, causing the model to produce erroneous results when deployed (Geiping et al., 2021; Gu et al., 2019). Privacy compromise:.Privacy compromise attacks focus on extracting sensitive information about the model or its training data. Model-extraction attacks exemplify this by allowing an ad- versary to reconstruct the modelâs functionalities or retrieve confidential data used during training (Jagielski et al., 2020; Chabanne et al., 2021). 3.2.6. Based on the Type of Control Adversarial attacks are classified in other sources based on the type of control the attacker exerts over various elements of the ML model, with some highlighting the control of training and testing data (Sadeghi et al., 2020), and others (Oprea and Vassilev, 2023) proposing more aspects of control, such as the control of the model, source code, and queries, as well as a limited control on the data labels. Training data:.In training data attacks, the attacker manipulates the training dataset by inserting or modifying samples. An example is data poisoning attacks, where malicious inputs are added to influence the modelâs learning process (Wang and Chaudhuri, 2018). Testing data:.Testing data attacks involve altering the input samples during the modelâs de- ployment phase. Backdoor poisoning attacks serve as an example, where specific triggers are embedded in the testing data to manipulate the modelâs predictions under certain conditions (Saha et al., 2020). Model:.Model attacks occur when the attacker gains control over the modelâs parameters, often by altering the updates applied during training. This can happen in Federated Learning (FL) envi- ronments, where malicious model updates are sent to compromise the integrity of the aggregated model (Tolpegin et al., 2020). Source code:.Source code attacks involve modifying the underlying code of the model, which can include changes to third-party libraries, especially those that are open source. This allows attackers to introduce vulnerabilities directly into the modelâs functionality (Zhang et al., 2024b). Queries:.Query-based attacks allow the attacker to gather information about the model by sub- mitting various inputs and analyzing the outputs. Black-box evasion attacks exemplify this, as adversaries attempt to craft inputs that evade detection while learning about the modelâs behavior through its responses (Fan et al., 2021). Label limit:.In label limit attacks, the attacker does not have control over the labels associated with the training data. An example is clean-label poisoning attacks, where the adversary influ- ences the model without altering the labels themselves, making detection more difficult (Shafahi et al., 2018). 10 3.2.7. Based on the Type of Data An seventh classification of Adversarial attacks is based on the type of data they target, high- lighting the diverse methodologies employed across different modalities. Some underline attacks targeting data types as images, text, tabulars, cybersecurity, and even multimodal (Oprea and Vas- silev, 2023), while other works mention attacks on audio data (Carlini and Wagner, 2018b), and graph-based data (Dai et al., 2018). Image:.In image-based attacks, the attacker crafts adversarial images designed to cause mis- classification. An example includes perturbing images to deceive object detectors or image clas- sifiers, leading to incorrect identification (Subramanya et al., 2019). Text:.Text attacks involve modifying text inputs to mislead NLP models. For instance, an adversary might introduce typos or antonyms to trick sentiment analysis tools or text classifiers into generating false outputs (Garg and Ramakrishnan, 2020). Tabular:.Tabular data attacks target models that operate on structured data, often seen in ap- plications like finance or healthcare. A common example is poisoning attacks, where malicious entries are inserted into tabular datasets to manipulate model behavior (Cartella et al., 2021). Audio:.Audio-based attacks involve crafting adversarial noise or altering audio inputs to cause misclassification in systems like voice recognition. For example, specific sound patterns can be designed to mislead voice-activated systems, resulting in incorrect command interpretations (Li et al., 2020c). Graphs:.Graph-based attacks manipulate graph structures and attributes to deceive Graph Neu- ral Networks (GNNs). An attacker might alter edges or node features to induce misclassification or misleading outputs from graph-based models (Mu et al., 2021). Cybersecurity:.In the cybersecurity domain, AAs target systems like malware detection or in- trusion detection systems. An example is poisoning a spam email classifier, where attackers introduce deceptive emails to degrade the modelâs performance (Wang et al., 2021). Multimodal:.Multimodal attacks involve exploiting systems that integrate multiple data types. In these cases, attackers might gain insights by submitting queries that encompass different modalities, such as text and image combinations (Wu et al., 2024). 3.2.8. Based on the Strategy Last but not least, Adversarial attacks can also be categorized based on the strategy employed by the attacker, distinguishing between passive and active approaches (Sadeghi et al., 2020). Passive:.In passive attacks, the attacker seeks to gather information about the application or its users without actively interfering with the systemâs operation. An example is reverse engineering, where an adversary analyzes a black-box classifier to extract its functionalities and gain insights into its behavior (Chiang et al., 1994). Active:.Active attacks are designed to disrupt the normal functioning of an application. The attacker may implement poisoning attacks that introduce malicious inputs, aiming to trigger misclassifications or degrade the modelâs performance during operation (Huang et al., 2020). 11 4. Adversarial Attacks on LLMs In recent years, LLMs have been increasingly targeted by AAs (Shayegani et al., 2023; Ku- mar, 2024; Yao et al., 2024), posing various threats to their reliability, safety, and security. These attacks can take multiple forms and serve distinct purposes, each exploiting different vulnerabil- ities within the model or its deployment. In this section, we present a comprehensive taxonomy of 56 recent AAs targeting LLMs, following the purpose-based classification of A (refer to Section 3). We consider 7 types of AAs: White-box Jailbreak attacks, Black-box Jailbreak attack, Prompt Injection, Evasion Attacks, Model Extraction, Model Inference, and Poison- ing/Trojan/Backdoor. Each attack type includes 8 prominent examples, which are detailed in the following subsections. 4.1. Jailbreak Attacks The type of AAs that we begin with are model Jailbreaking attacks, which are designed to bypass safety measures. We consider two approaches in jailbreak attacks according to the targeted model: White-box, and Black-box model jailbreaking. 4.1.1. White-box attacks The first type are White-box Jailbreak attacks, where the attacker hascompleteaccess to the modelâs architecture, parameters, and training data. This level of knowledge allows the attacker to design specific inputs that exploit vulnerabilities in the model, often related to the model gradients, in order to bypass its restrictions or safety measures. 4.1.2. Black-box attacks The second type of attacks are Black-box Jailbreak attack, in which, in contrast to white-box attacks, the attacker hasno accessto the modelâs internal workings or training data. Instead, the attacker can only interact with the model by providing inputs and observing the outputs, often relying on trial and error to discover effective prompts able to bypass the modelâs safeguards. We present in Table 2 a list of recent white-box and black-box jailbreak attacks existing in the literature (Sitawarin, 2023), and if they are Open Source (OS) or not, as each has a different strategy and implementation. 4.2. Prompt Injection The third type of attacks that we illustrate are Prompt injections, where the adversary manip- ulates the input prompts and queries to deceive the model into producing unintended or harmful outputs. This technique is ranked among the most dangerous attacks against LLMs by OWASP (2023). To illustrate the diverse strategies attackers employ to exploit LLMs with PIs, we have gathered eight different attacks, utilizing both direct injections, where the attacker append a ma- licious input to a prompt, and indirect injection methods, where the attacker append malicious prompts through file or external inputs. These attacks are presented in Table 3 4.3. Evasion Attacks The forth type of attacks we illustrate are Evasion attacks, in which attackers aim to deceive language models by crafting inputs designed to bypass detection or classification. These attacks often target sentiment analysis and text classification models, seeking to manipulate their outputs 12 Table 2: Examples of jailbreak attacks against LLMs TypeAttackConceptOS? W-box GCG (Zou et al., 2023)Adding adversarial suffixes using greedy and gradient-based searchesâ Visual Mod. (Niu et al., 2024)Jailbreaking an LLM using a corresponding Multimodal LLMâ PGD (Geisler et al., 2024)Jailbreaking attack using Projected Gradient Descentâ SCAV (Xu et al., 2024a)Guiding Jailbreak attacks against white-box LLMsâ Soft Prp. (Schwinn et al., 2024)Attacking the continuous embedding representation of input tokensâ DrAttack (Li et al., 2024a)Decomposition and Reconstruction of prompts for LLM jailbreakingâ RADIAL (Du et al., 2024)Generating instructions based on LLMsâ Inherent Response Tendencyâ ReNeLLM (Ding et al., 2024)Using generalized and nested jailbreak prompts to fool LLMsâ B-box PAIR (Chao et al., 2024)Automatic jailbreaking of black box LLMsâ Privacy att. (Li et al., 2023)Extracting people-information memorised by GPT-4oâ DAN (Shen et al., 2024)Tricking GPT-4o to break its policies with a role-playâ Ad. Att. (Andriushchenko et al., 2024)Adding adversarial suffixes using random searchesâ GCQ (Hayase et al., 2024)Enhancing GCG algorithm using best-first search algorithmâ PAL (Sitawarin et al., 2024)Token-level attack using gradients from an open-source proxyâ IRIS (Ramesh et al., 2024)Using the same LLM to target itselfâ Tastle (Xiao et al., 2024)Framework of black-box jailbreak for automated red-teamingâ through subtle modifications. In Table 4, we have gathered eight different examples and tech- niques of evasion attacks presented in the literature, some of which employ text perturbations to alter the original input, while others leverage LLMs to generate sophisticated evasion samples against their counterparts. 4.4. Model Extraction Model extraction attacks are the fifth type we illustrate in this section. These attacks aim to recreate or steal a language modelâs functionality by querying it and using the responses to reconstruct the model, this poses a significant threat as they allow adversaries to duplicate propri- etary models without access to their internal details. We present below in Table 5, eight examples of Model Extraction attacks, showcasing different methods adversaries use to probe black-box LLMs and either extract training data of the model, or precise personal information of users. 4.5. Model Inference Model inference (or Membership Inference) are the sixth type of attacks we focus on in this study. These attacks determine whether specific data samples, especially sensitive information, were part of the training set of an LLM. These attacks can compromise the privacy of users or organizations by revealing training data patterns. We gathered in Table 6 eight examples of model inference attacks, which demonstrate how attackers exploit LLMs to infer confidential training data and gain insights into the modelâs behavior. 13 Table 3: Examples of prompt injection attacks against LLMs AttackConceptOS? Ign. Pp. (Perez and Ribeiro, 2022)A direct prompt injection technique to mislead the LLM in ignoring instructionsâ Ind. PI (Greshake et al., 2023b)An indirect prompt injection technique through file input to compromise LLMsâ Frm. PI (Liu et al., 2024c)General framework for formalizing prompt injection in LLMsâ Mlt. PI (Bagdasaryan et al., 2023)Using images and sounds for indirect prompt injection in multi-modal LLMsâ Unv. PI (Liu et al., 2024a)An automatic and indirect prompt injection attackâ Vrt. PI (Yan et al., 2024a)Backdooring a prompt injection under a triggered scenarioâ Chat Tmp. (Wei et al., 2024)Creating misleading contexts acceptance elicitation and word anonymizationâ JudgeDeceiver (Shi et al., 2024a)Deceiving LLM-as-a-Judge to choose a response among multiple choicesâ Table 4: Examples of evasion attacks against LLMs AttackConceptOS? Hot-Flip (Ebrahimi et al., 2018)Flipping letters in a word to mislead the LLM to make incorrect classificationsâ PWWS (Ren et al., 2019)Changing some words with their synonyms to mislead text classification tasksâ Typo-Att. (Pruthi et al., 2019)Preforming character-level perturbations on a QWERTY keyboardâ VIPER (Eger et al., 2020)Changing some letters to symbols in harmful words to avoid detectionâ Checklist (Ribeiro et al., 2020)Performing Word-level perturbations using a predifined word checklistâ BERT-Att. (Li et al., 2020a)Using BERT to generate adversarial samples against other LLMsâ GBDA (Guo et al., 2021b)Gradient-based white box attack using words flipping to mislead text classifiersâ TF-Att. (Li et al., 2024c)Generating adversarial examples with critical units of sentences using LLMsâ 4.6. Poisoning/Trojan/Backdoors The last attacks on LLM we show are Poisoning, Trojan, and Backdoor attacks, which involve injecting malicious data or hidden triggers during the training phase of an LLM. This can lead to incorrect or dangerous behavior at deployment, allowing attackers to manipulate the modelâs responses. We have compiled in Table 7 eight examples of these attacks, where adversaries either corrupt the training process with poisoned data, or plant triggers to exploit models during inference, demonstrating the serious risks these methods pose to LLMs. 5. Classification of Adversarial attacks on LLMs based on their danger level After presenting the existing classifications of AAs and some of the most-recent attacks against LLMs, we propose in this section a new criterion for classifying AAs on LLMs. We present the idea and methodology in the following subsections. 14 Table 5: Examples of model extraction attacks against LLMs AttackConceptOS? User Extr. (Carlini et al., 2021)Extracting personal data of users memorised by LLMs using model queriesâ LLM Tricks (Yu et al., 2023)Tricks to enhance data extraction capabilities on LLMsâ PII Leakage (Lukas et al., 2023)Extraction/Inference attacks for analysing personally identifiable information (PII)â ETHICIST (Zhang et al., 2023)Data extraction with Loss Smoothed Soft Promptingâ Scalable Extr. (Nasr et al., 2023)Extracting training data from Production LLMsâ Output2Prompt (Zhang et al., 2024a)Extracting user prompts by knowing only their outputsâ PII Compass (Nakka et al., 2024)Extracting phone numbers from LLM using black-box queriesâ Alpaca-Vicuna (Kassem et al., 2024)Using an LLM to perform data extraction on another LLMâ Table 6: Examples of inference attacks against LLMs AttackConceptOS? LIRA (Carlini et al., 2022)Combining difficulty scores and well-Calibrated Gaussian Likelihood Estimateâ Ngb. Comp. (Mattern et al., 2023)Detecting training data using neighbor text comparisonâ PII Leakage (Lukas et al., 2023)Extraction/Inference attacks for analysing PII leakageâ Data Detect. (Shi et al., 2024b)Detecting pretraining samples of an LLM using minimal probabilitiesâ ProPILE (Kim et al., 2023)Probing framework to assess the likelihood of a PII in the training setâ MIA-LLM (Fu et al., 2024)Membership Inference based on Self-calibrated Probabilistic Variationâ DeCop (Duarte et al., 2024)Detecting copyrighted content in training sets using multiple-choice questionsâ ConRecall (Wang et al., 2024)Using Contrastive Decoding to detect LLMâs pre-training dataâ 5.1. Principle Seeing the list of AAs on LLMs presented in Section 4 and how frequent they are, one question that comes across the mind is what attacks should bemitigated firstto secure LLMs? In order to answer this question, we need to rank the available attacks based on theirdanger level against LLMs in order to know what attacks is a model most-vulnerable to. This can be done by calculating the vulnerability score those of attacks using Vulnerability-assessment metrics (Shah and Mehtre, 2015). 5.2. Vulnerability-assessment Metrics Vulnerability assessment metrics are critical tools for evaluating and ranking potential secu- rity threats based on their severity and likelihood of exploitation. Various methodologies, such as DREAD (Michael and Steve, 2006), CVSS (Schiffman and Cisco, 2005), OWASP Risk Rating (Williams, 2023), and SSVC (Spring et al., 2021), provide frameworks for assessing vulner- abilities by considering different factors, including technical attributes, potential impacts, and 15 Table 7: Examples of poisoning, trojan, and backdoor attacks against LLMs AttackConceptOS? TrojLLM (Xue et al., 2023)Inserting Trojans into text prompts in black-box LLM APIsâ Bst-of-Vnm. (Baumg Ě artner et al., 2024)Attacking RLHF by injecting Poisoned Preference Dataâ CodeBreaker (Yan et al., 2024b)Instering Backdoors on code-completion LLMs to sugget vulnerable codeâ Rtv. Poison. (Zhang et al., 2024c)Misleading LLMs during the RAG process with malicious documentsâ Clinical LLM (Das et al., 2024)Editing LLMs to reveal serious implications in clinical settingsâ BackdoorLLM (Li et al., 2024b)Comprehensive benchmark for studying backdoor attacks on LLMsâ CBA (Huang et al., 2024)Composite Backdoor Attacks against LLMsâ TA² (Wang and Shu, 2024)Injecting trojan steering vectors into the activation layers of LLMsâ contextual elements. By systematically analyzing attacks based on their danger, these assess- ment tools facilitate informed decision-making in an ever-evolving threat landscape, allowing organizations to strengthen their security posture and better protect their assets. Vulnerability Metrics DREADOWASPCVSS Damage Reproducibility Exploitability Affected Users Discoverability Temporal Code Maturity Likelihood Threat Agent VulnerabilityRemediation Impact Technical Impact Business Impact Base Attack Vector Complexity Environmental Confidentiality Requirement Integrity Requirement ReportPrivilegies User Interaction Scope Confidentiality Impact Integrity Impact Availability Impact Availability Requirement Modified Base Metric SSVC Supplier Exploitation Utility Deployer Exploitation Exposure Technical Impact Public Safety Automatable Human Impact Figure 3: Examples of known vulnerability assessment metrics 5.2.1. DREAD (Michael and Steve, 2006) Originally developed by Microsoft, DREAD is a qualitative risk assessment model that ranks, prioritizes, and evaluates the severity of vulnerabilities and potential threats based on five factors: Damage potential (D), Reproducibility (R), Exploitability (E), Affected users (A), and Discover- ability (D) of the attack. Calculations.The vulnerability score is calculated with DREAD as an average score of the five factors, each assessed with a value out of 10. The details of each factor and their values are shown in Table 8 below. 16 Table 8: Metric factors of DREAD (Michael and Steve, 2006) FactorDefinitionValues Damage Potential (D)How much damage can be caused [1 (Low), 10 (High)] Reproducibility (R)How easy is it to reproduce the attack Exploitability (E)How easy is it to exploit the vulnerability Affected Users (A)How many users would be affected Discoverability (D)How easy is it to discover the vulnerability A value in the range [1,4[ is labeled asâLowâin the level of criticality, a value in the range [4,7[ labeled asâMediumâin criticality, and values over 7 are labeled asâHighâin criticality. The final score is calculated following this equation: S core=(D+R+E+A+D)/5(1) Limitations.The DREAD model, previously popular for qualitative risk assessment, has several limitations that have reduced its use in favor of more structured frameworks. First of all, its five categories (Damage, Reproducibility, Exploitability, Affected Users, and Discoverability) are highly subjective, leading to inconsistent scoring and prioritization across different assessors and organizations. Moreover, DREAD overlooks contextual factors like the specific environment and business impact, limiting its adaptability for complex needs. Finally, it also fails to account for dynamic threats or mitigation measures, making it less effective for ongoing risk management. 5.2.2. CVSS (Common Vulnerability Scoring System) (Schiffman and Cisco, 2005) Created by the FIRST 2 (Forum of Incident Response and Security Teams), the CVSS is an industry-standard scoring system for rating the severity of software vulnerabilities out of 10. It is encompasses three main metrics: â˘Base Metrics:Represent the vulnerabilities that are constant over time. It contains factor related to the exploitability of an attack (how easy it is to exploit the vulnerability) like the Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), and the Scope (S) of the attack. And factors related to the impact of an attack on the CIA triad, such as Confidentiality Impact (C), Integrity Impact (I), and Availability Impact (A). â˘Temporal Metrics (Optional):Represent the vulnerabilities that might change over time in order to update the base score, it encompasses three factors, Exploit Code Maturity (E), Remediation Level (RL), and Report Confidence (RC). 2 https://w.first.org/ 17 â˘Environmental Metrics (Optional):Vulnerabilities that are unique to a user environment, such as the Confidentiality Requirements (CR), Integrity Requirement (IR), Availability Requirement (AR), and the modified Base Metrics. Calculations.The values in CVSS factors are not explicitly numerical; but selected from a spe- cific range of choices, with each qualitative value having a corresponding coefficient. The details of each factor and of the Base Metric and their values according to CVSS version 3.1 3 are pre- sented below in Table 9, and their equivalent decimal values are detailed in Table 10. Table 9: Base metric factors of CVSS 3.1 (First, 2016) FactorDefinitionValues Attack Vector (AV) From where the exploitation is possible Network (N), Adjacent (A), Local (L), Physical (P) Attack Complexity (AC) How complex is the exploitationLow (L), High (H) Privileges Required (PR) How much privileges are needed for the exploit None (N), Low (L), High (H) User Interaction (UI) Is a user interaction required in the compromise None (N), Required (R) Scope (S)Does the scope of the attack changeUnchanged (U), Changed (C) Confidentiality Impact (C) How much impacted is the confidentiality None (N), Low (L), High (H)Integrity Impact (I)How much impacted is the integrity Availability Impact (A) How much impacted is the availability After assessing a value for each metric, the Base Score of the CVSS is calculated using two different equations depending on the Scope (S), which is either Changed (C) or Unchanged (U). Below are the full details of the equations for both cases: If S=U: Base Score=roundup min Impact U +Exploitability,10 Ă1.08 (2) Impact U =6.42Ă ( 1â(1âC)Ă(1âI)Ă(1âA) ) (3) Exploitability=8.22ĂAVĂACĂPRĂUI(4) If S=C: Base Score=roundup min 1.08Ă(Impact C +Exploitability),10 (5) Impact C =7.52Ă ( Iâ0.029 ) â3.25Ă ( Iâ0.02 ) 15 (6) I=1â(1âC)Ă(1âI)Ă(1âA)(7) The exploitability remains the same. 3 Although version 4.0 is the most recent, version 3.1 is still the most used in vulnerability assessment. 18 Table 10: Numerical values of each CVSS 3.1 factor (First, 2016) FactorValueDecimal Value AV Network (N)0.85 Adjacent (A)0.62 Local (L)0.55 Physical (P)0.22 AC Low (L)0.77 High (H)0.44 PR None (N)0.85 Low (L)0.62 (if S=U), 0.68 (if S=C) High (H)0.27 (if S=U), 0.50 (if S=C) UI None (N)0.85 Required (R)0.62 C, I ,A None (N)0.00 Low (L)0.22 High (H)0.56 The final Base Score ranges from 0 to 10, with the same criticality assignment as in DREAD, adding to it that a base score of 9 or more is considered aâCriticalâvulnerability. Limitations.CVSS is a widely used standard for scoring vulnerabilities but has several limi- tations that affect its real-world effectiveness. Firstly, it tends to oversimplify calculations by focusing on technical aspects like attack complexity and impacts on confidentiality, integrity, and availability, while neglecting business impact and regulatory considerations. Additionally, the Temporal score of CVSS, intended to reflect changing conditions, relies on manual updates rather than real-time adjustments, making it less responsive to evolving threats. Finally, CVSS can be inconsistent, as different organizations may interpret scoring criteria differently, leading to varying assessments for the same vulnerability. 5.2.3. OWASP Risk Rating (Williams, 2023) Developed by the Open Web Application Security Project (OWASP) 4 , it is a risk assessment methodology that evaluates vulnerabilities and categorizes security risks in web applications by assessing likelihood (based on threat agent and vulnerability characteristics) and impact (consid- ering technical and business factors) to produce an overall risk score. â˘Likelihood:Calculates the probability of the attack to be exploited based on two compo- nents: â Threat Agent (TA):Quantifies the skill level, motivation, opportunity, and size of the threat-agent population â Vulnerability (V):Quantifies the ease of discovery, ease of exploit, awareness, aware- ness of the system administrators, and the intrusion detection level. 4 https://owasp.org/ 19 â˘Impact:Calculates the impact or loss produced by the attacks, it encompasses two types of impact: â Technical Impact (TI):Quantifies the impact on Confidentiality, Integrity, and Avail- ability. â Business Impact (BI):Quantifies the financial damage, reputation damage, non- compliance, and privacy violation Calculations.The vulnerability score is calculated based on the average score of each compo- nent. The values and definitions of each factor of OWASP Risk Rating is presented in Table 11. Table 11: Metric factors of OWASP Risk Rating (Williams, 2023) FactorDefinitionValues Skill Level (SL)How much expertise is needed [1 (Low), 10 (High)] Motivation (M)How much motivated is the attacker Opportunity (O)How easy is it to exploit the vulnerability Size of TA (S)How many attackers can be there Ease of Discovery (ED)How easy is it to discover the vulnerability Ease of Exploit (E)How easy is it to exploit the vulnerability Awareness (A)How much aware are the defenders Intrusion Detect. (ID)How difficult is it to detect the attack Confidentiality (LC)How much is confidentiality impacted Integrity (LI)How much is the integrity impacted Availability (LAV)How much is the availability impacted Financial Dmg. (FD)How much financial loss can result Reputation Dmg. (RD)How much the reputation can be harmed Non-Compliance (NC)How much legal violations can happen Privacy Violation (PV)How much usersâ privacy is violated In this metric, a value in the range [1,3[ is considered an attack ofâLowâcriticality. The âMediumâcriticality range is [3,6[, and the values starting from 6 are labeled asâHighâin 20 criticality. After assessing all the values, the final score is a multiplication between the score of Likelihood and the score of Impact as shown below: OW AS PS core=LikelihoodâIm pact(8) The score of Likelihood is calculated as the mean of the Threat Agent and the Vulnerability scores: Likelihood=(S core T A +S core V )/2(9) And the score of Impact is calculated as the mean of the Technical and Business impact scores Im pact=(S core T I +S core BI )/2(10) Where the score of each component (TA, V, TI, BI) are respectively the average score of their factors: S core T A =(S killLevel+Motivation+O p portunity+S ize T A )/4(11) S core V =(Easeo f Discovery+Easeo f E x ploit+Awareness+IntrusionDetection)/4 (12) S core T I =(Con f identiality+Integrity+Availability)/3(13) S core BI =(FinancialDmg+Re putationDmg+NonCom pliance+PrivacyV iolation)/4 (14) The rank of the final OWASP severity-score (Low, Medium, High, Critical) is defined based on the combinations shown in the Table 12. For example, if theLikelihood=5/10 (Medium criticality) and theIm pact=6/10 (High criticality), the final score according the matrix isHigh. Table 12: Criticality Matrix of OWASP Risk Rating (Williams, 2023) Impact HighMediumHighCritical MediumLowMediumHigh LowNoteLowMedium LowMediumHigh Likelihood Limitations.The OWASP Risk Rating methodology, though widely used for web application security assessment, has notable limitations. Its reliance on subjective evaluations of factors like threat agent skill and impact severity can result in inconsistent ratings across different assessors and lead to biased outcomes. Additionally, OWASP Risk Rating lacks specificity for environ- ments like cloud or mobile and does not adapt to rapidly changing threat landscapes, making it less responsive in dynamic security contexts. Finally, having many factors increases the com- plexity of this metric and its reliance on experts knowledge to assess each factor precisely. 21 5.2.4. SSVC (Stakeholder-Specific Vulnerability Categorization) (Spring et al., 2021) The SSVC is a framework that prioritizes vulnerabilities based on qualitative decision trees tailored to specific stakeholder roles, instead of numerical severity scores. The main two stake- holders represented are: â˘Suppliers:They decide how urgent it is to develop and release patches for their systems based on reports about potential vulnerabilities. Their decision tree is based on factors such as Exploitation, Technical Impact, Utility, and Safety Impact. â˘Deployers:They decide when and how to deploy the patches developed by the suppliers. Their decision tree is based on similar factors such as Exploitation, System Exposure, Automation, and Human Impact. Calculations.In our case, we consider LLMselves as Suppliers trying to assess the potential vulnerabilities impacting their LLM. Table 13 below show the different factors used in evaluating vulnerabilities using SSVC as a supplier. Table 13: Metric factors of SSVC for a supplier (Spring et al., 2021) FactorDefinitionValues Exploitation (E)In which state is the exploitation None (N), Proof-of-Concept (P), Active (A) Automatable (A)Can the attack be automatableNo (N), Yes (Y) Value Density (V) How valuable is the information accessed by the attacker Diffuse (D), Concentrated (C) Utility (U) How much useful is the exploit for the attacker Laborious (L), Efficient (E), Super Efficient (S) Technical Impact (T) How much impact does the vulnerability do Partial (P), Total (T) Public-Safety Impact (S) How much impact has vulnerability on the public Minimal (M), Significant (S) The value of Utility (U) is calculated based in the values if Automatable (A) and Value Density (V) as follows: The final decision is taken by following the logic described in Figure 4. There four main possible outcomes ranked from the lowest priority to the highest one are: Defer, Scheduled, Out-of-cycle, and Immediate. Each one of them represents the emergency level for developing corresponding patches. Limitations.The SSVC metric has several limitations. It relies heavily on qualitative decision points, which may lead to subjective interpretations and inconsistencies across stakeholders. Ad- ditionally, the absence of numerical scoring might limit its integration with existing risk man- agement systems that rely on quantitative data, potentially requiring significant adjustments to current workflows. Lastly, SSVC is tailored for specific stakeholder roles, which may make it be less effective in hybrid roles or complex environments where stakeholders overlap. 22 6. Assessment of AAs on LLMs with Vulnerability Metrics In this section, we present and interpret the results of assessing the criticality of AAs against LLMs, grouped in seven types: White-box Jailbreak, Black-box Jailbreak, Prompt Injection, Evasion attacks, Model Extraction, Model Inference, and Poisoning/Trojan/Backdoor attacks. The detailed scores of these attacks given by the 3 LLMs (GPT-4o, LLAMA, and Perplexity) and their average are presented in Appendix A. We represent the results in score-vectors and in spider-graph formats for more interpretability. Note that for the qualitative factors of CVSS and SSVC, we represent their valuesnumeri- callyin the spider graph following this logic: â˘For CVSS Factors: âIf they have four values (eg. AV), they are represented with values from 1 to 4. âIf have three values (eg. PR, C, I, A), they are represented with values from 1 to 3. âIf they have two values (eg. AC, UI, S), they are represented with the values 2 and 4. â˘For SSVC Factors: âIf they have three values (eg. E, U), they are represented with values from 1 to 3. âIf they have two values (eg. A, V, T, P), they are represented with the values 1 and 3. 6.1. Assessment of White-box Jailbreak attacks We start by evaluating White-box jailbreak attacks, the chosen attacks are the same presented in Section 4.1.1 earlier: (1) GCG (Zou et al., 2023), (2) Visual Modality (Niu et al., 2024), (3) PGD (Geisler et al., 2024), (4) SCAV (Xu et al., 2024a), (5) Soft Prompt Threats (Schwinn et al., 2024), (6) DrAttack (Li et al., 2024a), (7) RADIAL (Du et al., 2024), (8) ReNeLLM (Ding et al., 2024). 6.1.1. With DREAD We start by evaluating the eight White-box jailbreaks attacks using DREAD (Michael and Steve, 2006). Here are below the attack vectors of each attack: â˘(1)â(D:8/R:9/E:8/A:8/D:6)=7.8 (High) â˘(2)â(D:6/R:6/E:6/A:6/D:5)=5.8 (Medium) â˘(3)â(D:7/R:7/E:7/A:7/D:5)=6.6 (Medium) â˘(4)â(D:7/R:6/E:5/A:6/D:5)=5.8 (Medium) â˘(5)â(D:8/R:9/E:7/A:7/D:6)=7.4 (High) â˘(6)â(D:8/R:8/E:7/A:8/D:6)=7.4 (High) â˘(7)â(D:7/R:6/E:7/A:6/D:5)=6.2 (Medium) â˘(8)â(D:8/R:9/E:8/A:7/D:6)=7.6 (High) 23 The detailed calculations for these attacks are presented in Table A.18, with assessments supervised by aHuman-in-the-Loop (HitL)to minimizemisconceptions. For instance, GPT- 4o initially scored 8/10 for the Discoverability factor in DREAD for the first attack (Zou et al., 2023), while LLAMA-3 and Perplexity AI both assigned a score of 6/10. GPT-4oâs higher score stemmed from amisunderstandingof the factorâs meaning, interpreting Discoverability as the level of researcher awareness about the threat rather than the ease with which it can be discovered. Afterclarifyingthis distinction, GPT-4o revised its score to 5/10, aligning more closely with the intended definition of the metric. A different issue arose when evaluating theimpactof attacks. For example, the Damage factor of the second attack (Niu et al., 2024) was rated 6/10 by GPT-4o and 5/10 by LLAMA-3, reflecting moderate damage due to situational input requirements, such as specific visual input use cases. However, Perplexity AI assigned a higher score of 8/10, citing potential scenarios where the attack could have a significant impact on the targeted system. In this case, the discrep- ancy was due to differinginterpretationsrather than misunderstandings, making it difficult to standardize the scores. To address this,averagingthe three scores provided a balanced result, aligning closely with the consensus of GPT-4o and LLAMA-3. Using this approach, we reduced inconsistencies in the scoring process. The final DREAD scores are illustrated in a spider graph, highlighting that White-box Jailbreak attacks can inflict considerable damage on systems while being relatively easy to reproduce. However, discovering these threats remains a significant challenge. Damage Reproducibility Exploitability Affected users Discoverability 12 3 4 56 7 8 9 10 Assessment of White-box model jailbreaking attacks with DREAD Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.1.2. With CVSS Then, we evaluate the assessment of these attacks using CVSS (Schiffman and Cisco, 2005). The corresponding CVSS Vectors are shown below: â˘(1)â(AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)=7.5 (High) 24 â˘(2)â(AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)=7.5 (High) â˘(3)â(AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)=7.5 (High) â˘(4)â(AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)=7.1 (High) â˘(5)â(AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)=8.5 (High) â˘(6)â(AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)=8.5 (High) â˘(7)â(AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N)=6.9 (Medium) â˘(8)â(AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N)=8.2 (High) The detailed scores are presented in Table A.19. During the analysis, some LLMs encoun- tered challenges in correctly interpreting the characteristics of each attack. For instance, GPT-4o initially concluded that White-box jailbreak attacks only impact the Confidentiality of data, with no effect on Integrityâa conclusion that was refuted by the other two LLMs. It was crucial to identify suchmisunderstandingsandguidethe models to recognize their errors. Rather than providing direct corrections, we prompted GPT-4o withquestionssuch as:Do these attacks tar- get Integrity given that they involve manipulation of gradients and embeddings?This approach enabled the model to identify and rectify its own mistake while fostering greatercautionin subsequent assessments. This process highlights another key advantage of using multiple LLMs:they provide diverse perspectives and explanations, which help identify and address unconventional or erroneous analyses. Moreover, there was also other slight divergence in scoring factors such as the Scope and User Interaction; but using an averaging method helps align the final scores to the majority. After averaging the final values, we visualized the scores using a spider chart for clarity. The CVSS scores reveal that White-box attacks are typically executed through the network, requiring low-to-medium privileges and primarily targeting the Integrity of systems. 25 Vector Complexity Privileges User Interaction Scope Confidentiality Integrity Availability 0 12 3 4 Assessment of White-box model jailbreaking attacks with CVSS Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.1.3. With OWASP Risk Rating A third evaluation of white-box jailbreak attacks is done using OWASP R (Williams, 2023). The corresponding vulnerability vectors of each attack is: â˘(1)â(SL:7/M:6/O:6/S:6/ED:7/E:8/A:5/ID:5/LC:5/LI:7/LA:4/FD:7/RD:8/NC:4/PV:4)= 3.6 (High) â˘(2)â(SL:7/M:6/O:5/S:5/ED:5/E:7/A:5/ID:5/LC:5/LI:6/LA:3/FD:6/RD:7/NC:4/PV:4)= 2.8 (Medium) â˘(3)â(SL:7/M:7/O:5/S:6/ED:6/E:7/A:5/ID:5/LC:5/LI:7/LA:3/FD:6/RD:7/NC:6/PV:5)= 3.2 (Medium) â˘(4)â(SL:5/M:6/O:4/S:3/ED:4/E:6/A:5/ID:4/LC:4/LI:6/LA:1/FD:5/RD:6/NC:3/PV:4)= 1.9 (Medium) â˘(5)â(SL:6/M:7/O:6/S:5/ED:6/E:7/A:6/ID:5/LC:5/LI:7/LA:1/FD:6/RD:7/NC:4/PV:4)= 2.8 (High) â˘(6)â(SL:7/M:7/O:6/S:6/ED:6/E:7/A:5/ID:5/LC:5/LI:7/LA:2/FD:6/RD:7/NC:4/PV:5)= 3.2 (High) â˘(7)â(SL:6/M:6/O:5/S:4/ED:5/E:6/A:5/ID:5/LC:4/LI:6/LA:1/FD:5/RD:6/NC:3/PV:3)= 2.1 (Medium) â˘(8)â(SL:7/M:7/O:7/S:5/ED:7/E:7/A:6/ID:5/LC:4/LI:7/LA:1/FD:6/RD:7/NC:4/PV:4)= 3.1 (High) 26 The scores assigned by each LLM are detailed in Table A.20. With its multiple factors, the OWASP Risk Rating provided a more comprehensive analysis of each attack. However, we encountered someinterpretation discrepancies, particularly with Perplexity AI. This model ar- gued that these attacks have a Medium-to-High impact on Confidentialityâan assessment that differed from its CVSS evaluation of the same attacks. This highlights the inherentsubjectivity in scoring, as analyzing identical attacks in separate conversations can yield inconsistent results. In contrast, the other two LLMs provided scores consistent with the CVSS evaluation for Confi- dentiality and Integrity, along with a Low-to-None impact on Availability. Averaging the scores mitigatedsuch discrepancies while preserving the unique perspectives offered by each LLM, especially in factors like Non-Compliance and Privacy Violation. Notably, LLAMA-3 failed to detect any impact in these areas, whereas GPT-4o and Perplexity AI highlighted their signifi- cance. Another challenge we observed was the tendency of LLMs to rely onmemorized values when evaluating attacks across multiple factors. For example, GPT-4o initially assigned identical scores to the first two attacks (Zou et al., 2023; Niu et al., 2024). Upon prompting it to provide objective and distinct evaluations, GPT-4o revised its scores, adjusting the ED value from 6/10 to 5/10, the Availability impact from 6/10 to 5/10, and the NC value from 6/10 to 7/10. It justified these changes by acknowledgingsimilaritiesbetween the attacks while ensuring the scores reflected nuanced differences. The averaged scores are visualized below for clarity. These results align with the CVSS evaluation in terms of technical impact and ease of exploitation, while also shedding light on the reputational damage that could arise if such attacks are exploited. Moreover, they emphasize that White-box attacks have a medium impact on Non-Compliance and Privacy Violation. Skill Motivation Opportunity Size Discovery Exploit Awareness Intrusion Dtc Confidentiality Integrity Availability Fnc Dmg Rpt Dmg Non-comp Privacy Vlt 0 12 3 4 56 7 8 9 10 Assessment of White-box model jailbreaking attacks with OWASP R Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 27 6.1.4. With SSVC Finally, we evaluate these attacks using SSVC (Spring et al., 2021). The corresponding vectors, as a supplier, are shown below: â˘(1)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(2)â(E:P/A:N/V:C/U:E/T:T/P:S)=Immediate (Very High) â˘(3)â(E:P/A:N/V:C/U:E/T:T/P:S)=Immediate (Very High) â˘(4)â(E:P/A:N/V:C/U:E/T:P/P:M)=Scheduled (Medium) â˘(5)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(6)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(7)â(E:P/A:N/V:C/U:E/T:P/P:M)=Scheduled (Medium) â˘(8)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) Table A.21 presents the detailed SSVC assessment scores provided by each LLM. As SSVC is relativelystraightforwardto apply, the LLMs performed the evaluations without significant issues. The primary role of the HitL in this context was tointerpretthe rationale behind the values assigned by the LLMs, particularly for the Exploitation factor. For instance, when evalu- ating the second White-box jailbreak attack (Niu et al., 2024), GPT-4o determined there was no PoC for the attack, as its implementation was not publicly available, and accordingly assigned it a âNoneâ value. In contrast, LLAMA-3 and Perplexity AI offered a different perspective. Both argued that the paper provided sufficient detail about the attack, making it possible to reproduce with some effort. Consequently, they concluded that a PoC exists. With the majority of models agreeing, the average score reflected their viewpoint, recognizing the presence of a PoC. The final SSVC scores are visualized below in a spider chart. These results indicate that White-box jailbreak attacks can be automated and highly rewarding, underscoring their signifi- cant risks to both technical systems and public safety. 28 Exploitation Automatable Value Density Utility Technical ImpPublic-Safety Imp 0 12 3 Assessment of White-box model jailbreaking attacks with SSVC Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.2. Assessment of Black-box Jailbreak attacks We evaluate now Black-box jailbreak attacks, the eight attacks are the same presented in Section 4.1.2 earlier: (1) Privacy attack on GPT-4o (Li et al., 2023), (2) PAIR (Chao et al., 2024), (3) DAN (Shen et al., 2024), (4) Simple Adaptive Attack (Andriushchenko et al., 2024), (5) PAL (Sitawarin et al., 2024), (6) GCQ (Hayase et al., 2024), (7) IRIS (Ramesh et al., 2024), (8) Tastle (Xiao et al., 2024). 6.2.1. With DREAD We start with the evaluation using DREAD (Michael and Steve, 2006). Below are the DREAD vectors of each of the eight Black-box Jailbreak attacks: â˘(1)â(D:8/R:7/E:7/A:8/D:5)=7 (High) â˘(2)â(D:8/R:8/E:8/A:7/D:5)=7.2 (High) â˘(3)â(D:8/R:8/E:7/A:7/D:6)=7.2 (High) â˘(4)â(D:9/R:8/E:8/A:8/D:6)=7.8 (High) â˘(5)â(D:8/R:9/E:8/A:7/D:5)=7.4 (High) â˘(6)â(D:8/R:6/E:7/A:7/D:5)=6.6 (Medium) â˘(7)â(D:9/R:8/E:9/A:8/D:5)=7.8 (High) â˘(8)â(D:8/R:7/E:7/A:7/D:5)=6.8 (Medium) 29 The details are presented in Table A.22. This time, no misunderstandings occurred, as the corrections made during the DREAD assessment of White-box attacks were already in place. However, some divergences in attack analysis still arose. For instance, the Exploitability factor of the first attack (Li et al., 2023) was rated 6/10 by GPT-4o, which noted that the attack requires specific query patterns but is still manageable to execute. In contrast, LLAMA-3 and Perplexity AI assigned a score of 8/10, arguing that the implementation details provided in the paper make the attack easily exploitable. Another challenge was the potentialmemorizationof values. For example, LLAMA-3 gave identical scores for the fourth, fifth, and seventh attacks (Andriushchenko et al., 2024; Sitawarin et al., 2024; Ramesh et al., 2024), justifying this by highlighting thesimilar characteristicsof these attacks. While this explanation is plausible, as the scores were consistent with those of the other LLMs, averaging the scores across all models helped mitigate these analytical inconsisten- cies by favoring the majority consensus. After averaging the scores, we visualized the results in a spider chart for clarity. The DREAD scores indicate that Black-box Jailbreak attacks, like their White-box counterparts, can inflict significant damage while being highly reproducible and exploitable, yet challenging to detect. Damage Reproducibility Exploitability Affected users Discoverability 12 3 4 56 7 8 9 10 Assessment of Black-box model jailbreaking attacks with DREAD Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.2.2. With CVSS In this second assessment of Black-box Jailbreak, we evaluate the attacks using CVSS (Schiff- man and Cisco, 2005). The corresponding CVSS Vectors are shown below: â˘(1)â(AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)=6.5 (Medium) â˘(2)â(AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)=8.2 (High) â˘(3)â(AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)=6.5 (Medium) 30 â˘(4)â(AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)=7.2 (High) â˘(5)â(AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)=7.2 (High) â˘(6)â(AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)=5.4 (Medium) â˘(7)â(AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)=7.1 (High) â˘(8)â(AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)=8.2 (High) Table A.23 outlines the detailed CVSS scores for the Black-box Jailbreak attacks. As ob- served with previous assessments, the three LLMs displayed some divergence in evaluating the technical impact of each attack. However, averaging the scores allowed us to establish a balanced consensus that moderated the variations in their evaluations. One notable issue arose with LLAMA-3 ininterpretingthe User Interaction factor, which assesses whether a user other than the attacker must interact with the system for the attack to succeed. In the case of Black-box jailbreaks, where most attacks are executed remotely, no additional user interaction is requiredâa point accurately identified by GPT-4o and Perplexity AI. However, LLAMA-3 initially marked the UI factor as âRequiredâ, justifying this based on the attackerâs interaction with the system. The HitLclarifiedthrough prompts that the UI factor refers specifically to interactions by users other than the attacker. Following this explanation, LLAMA-3 adjusted its evaluation, aligning with the âNoneâ rating given by the other LLMs. After averaging the scores, the final results are visualized below in a spider chart. The CVSS scores highlight that Black-box jailbreak attacks are easier to reproduce compared to White- box jailbreaks, require no privileges, and have a low-to-moderate impact on both integrity and confidentiality. Vector Complexity Privileges User Interaction Scope Confidentiality Integrity Availability 0 12 3 4 Assessment of black-box model jailbreaking attacks with CVSS Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 31 6.2.3. With OWASP Risk Rating A third evaluation of is done with OWASP Risk Rating (Williams, 2023). The corresponding vulnerability vectors of each attack is: â˘(1)â(SL:6/M:8/O:8/S:6/ED:6/E:7/A:5/ID:6/LC:8/LI:2/LA:1/FD:6/RD:8/NC:5/PV:7)= 3.3 (High) â˘(2)â(SL:5/M:8/O:8/S:6/ED:6/E:7/A:6/ID:6/LC:8/LI:1/LA:1/FD:6/RD:8/NC:4/PV:6)= 3 (High) â˘(3)â(SL:4/M:8/O:8/S:6/ED:7/E:8/A:7/ID:7/LC:9/LI:1/LA:1/FD:7/RD:8/NC:5/PV:9)= 3.8 (High) â˘(4)â(SL:7/M:8/O:7/S:5/ED:6/E:8/A:6/ID:8/LC:8/LI:1/LA:1/FD:6/RD:8/NC:5/PV:8)= 3.5 (High) â˘(5)â(SL:6/M:8/O:8/S:5/ED:6/E:8/A:5/ID:7/LC:7/LI:1/LA:1/FD:5/RD:7/NC:5/PV:7)= 3 (High) â˘(6)â(SL:6/M:8/O:8/S:6/ED:6/E:8/A:6/ID:7/LC:7/LI:2/LA:1/FD:6/RD:7/NC:5/PV:7)= 3 (High) â˘(7)â(SL:6/M:9/O:8/S:5/ED:6/E:8/A:5/ID:7/LC:8/LI:3/LA:1/FD:6/RD:9/NC:7/PV:8)= 3.8 (High) â˘(8)â(SL:6/M:8/O:7/S:5/ED:6/E:8/A:5/ID:7/LC:8/LI:3/LA:1/FD:6/RD:8/NC:5/PV:8)= 3.4 (High) Table A.24 presents the detailed OWASP R assessments conducted using three LLMs. Un- like previous evaluations, no significant errors were observed in the scoring provided by the models. However, some divergence was noted in specific factors. For example, when assessing the Opportunity factor for the sixth attack (Hayase et al., 2024), GPT-4o and LLAMA-3 scored it 8/10 and 9/10, respectively, arguing that these attacks target online LLMs, thereby increasing the availability of opportunities for exploitation. In contrast, Perplexity AI assigned a score of 6/10, reasoning that the attacks are not immediately apparent or straightforward to execute, resulting in a medium-to-high Opportunity rating. To maintainneutralityandobjectivity, we chose not to modify or influence these values, allowing the modelsâ perspectives to remain intact. Averaging the scores enabled abalancedconsideration of all three points of view. The final scores are visualized below in the spider chart. The results indicate that Black- box jailbreak attacks have a significant impact on the confidentiality of data, as they can extract sensitive information from the models. In contrast, their impact on integrity is minimal, and they have no impact on availability. The OWASP R metric further highlights the severe implications these attacks have on privacy violations and the reputation of the targeted organization. 32 Skill Motivation Opportunity Size Discovery Exploit Awareness Intrusion Dtc Confidentiality Integrity Availability Fnc Dmg Rpt Dmg Non-comp Privacy Vlt 0 12 3 4 56 7 8 9 10 Assessment of Black-box model jailbreaking attacks with OWASP R Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.2.4. With SSVC The forth evaluation is performed using SSVC (Spring et al., 2021) in a supplier role. The corresponding vulnerability vectors are detailed below: â˘(1)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(2)â(E:P/A:Y/V:D/U:E/T:P/P:M)=Scheduled (Medium) â˘(3)â(E:A/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(4)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(5)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(6)â(E:P/A:Y/V:D/U:E/T:P/P:M)=Scheduled (Medium) â˘(7)â(E:A/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(8)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) Table A.25 presents the SSVC scores assigned by the three LLMs. The primary challenge en- countered during this assessment was the ability of the LLMs to remainup-to-date. Specifically, some attacks might have been actively exploited in the past but are now less prevalent. For ex- ample, in the case of the third and fourth attacks (Shen et al., 2024; Andriushchenko et al., 2024), some LLMs classified these as âActiveâ, while others evaluated them at the âProof-of-Conceptâ stage. Determining which LLM is correct in such scenarios is challenging. To address this, we prompted the LLMs to confirm their assessments by asking clarifying questions such as:âAre there proofs of recent active exploitations of these attacks?âThis approach led to adjustments in 33 certain scores. For instance, LLAMA-3 revised its assessment for the third attack from âActiveâ to âProof-of-Conceptâ, explaining that while the attack was previously active, there is no current evidence of active exploitation. The final scores are visualized below in the spider chart. The results indicate that the SSVC scores align closely with those of DREAD, demonstrating that these Black-box jailbreak attacks are highly dangerous and straightforward to exploit, regardless of whether they target the CIA triad or financial aspects. Exploitation Automatable Value Density Utility Technical ImpPublic-Safety Imp 0 12 3 Assessment of Black-box model jailbreaking attacks with SSVC Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 For the subsequent assessments, we will present only the results, as the justifications follow the same reasoning outlined for the White-box and Black-box Jailbreak attacks. 6.3. Assessment of Prompt Injection attacks The third assessment is that of PI attacks, we evaluate the attacks described earlier in Section 4.2: (1) Ignore Previous Prompt (Perez and Ribeiro, 2022), (2) Indirect Instruction Injection (Greshake et al., 2023b) (3) Formalised Prompt Injection (Liu et al., 2024c), (4) Injection through file input (Bagdasaryan et al., 2023), (5) Universal Prompt Injection (Liu et al., 2024a), (6) Virtual Prompt Injection (Yan et al., 2024a), (7) Chat History Tampering (Wei et al., 2024), (8) JudgeDeceiverAttack (Shi et al., 2024a). 6.3.1. With DREAD As done before, we start by evaluating the eight prompt injection attacks using DREAD (Michael and Steve, 2006), and we find the corresponding vulnerability vectors as follows: â˘(1)â(D:8/R:9/E:8/A:7/D:6)=7.6 (High) â˘(2)â(D:8/R:8/E:8/A:7/D:6)=7.4 (High) â˘(3)â(D:7/R:9/E:7/A:6/D:7)=7.2 (High) 34 â˘(4)â(D:7/R:8/E:8/A:8/D:5)=7.2 (High) â˘(5)â(D:8/R:9/E:9/A:8/D:6)=8 (High) â˘(6)â(D:8/R:8/E:7/A:8/D:5)=7.2 (High) â˘(7)â(D:7/R:6/E:6/A:7/D:5)=6.2 (Medium) â˘(8)â(D:7/R:6/E:7/A:6/D:5)=6.2 (Medium) The detailed scores are shown in Table A.26, with the final results visualized in the Spider- chart below. The DREAD analysis reveals that Prompt-Injection attacks cause significant dam- age to systems and impact a wide range of users, but they are comparatively harder to exploit and reproduce than Jailbreak attacks. Damage Reproducibility Exploitability Affected users Discoverability 12 3 4 56 7 8 9 10 Assessment of Prompt-injection attacks with DREAD Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.3.2. With CVSS The second assessment of PI attacks is done with CVSS (Schiffman and Cisco, 2005). The corresponding CVSS Vectors are shown below: â˘(1)â(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)=7.5 (High) â˘(2)â(AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N)=5.9 (Medium) â˘(3)â(AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)=8.2 (High) â˘(4)â(AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N)=6.9 (Medium) â˘(5)â(AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N)=9.3 (Critical) â˘(6)â(AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N)=6.9 (Medium) 35 â˘(7)â(AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N)=5.9 (Medium) â˘(8)â(AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N)=6.5 (Medium) The detailed CVSS results are presented in Table A.27, with the final scores visualized in the Spider-chart below. The analysis indicates that Prompt-Injection attacks share similarities with Jailbreak attacks, as they are primarily executed remotely through the network. However, they are slightly more complex to perform than Jailbreak attacks. These attacks predominantly target system integrity, have a lesser impact on confidentiality, and do not affect availability. Vector Complexity Privileges User Interaction Scope Confidentiality Integrity Availability 0 12 3 4 Assessment of Prompt-injection attacks with CVSS Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.3.3. With OWASP Risk Rating Another evaluation of Prompt Injection attacks is done with OWASP Risk Rating (Williams, 2023). The corresponding vulnerability vectors of each attack is: â˘(1)â(SL:6/M:8/O:7/S:5/ED:6/E:8/A:6/ID:6/LC:3/LI:8/LA:3/FD:6/RD:8/NC:4/PV:4)= 3.3 (High) â˘(2)â(SL:6/M:8/O:7/S:6/ED:6/E:7/A:5/ID:7/LC:5/LI:8/LA:3/FD:7/RD:8/NC:4/PV:6)= 3.8 (High) â˘(3)â(SL:6/M:8/O:7/S:5/ED:6/E:8/A:6/ID:6/LC:5/LI:8/LA:3/FD:7/RD:8/NC:4/PV:5)= 3.7 (High) â˘(4)â(SL:6/M:8/O:7/S:6/ED:6/E:8/A:6/ID:7/LC:6/LI:7/LA:3/FD:7/RD:8/NC:5/PV:7)= 4.1 (Critical) â˘(5)â(SL:5/M:8/O:7/S:6/ED:6/E:8/A:6/ID:7/LC:6/LI:7/LA:3/FD:7/RD:8/NC:5/PV:6)= 3.8 (High) 36 â˘(6)â(SL:7/M:8/O:8/S:6/ED:5/E:8/A:5/ID:8/LC:7/LI:9/LA:3/FD:7/RD:8/NC:5/PV:7)= 4.4 (Critical) â˘(7)â(SL:6/M:8/O:7/S:6/ED:5/E:7/A:5/ID:6/LC:4/LI:8/LA:3/FD:6/RD:7/NC:3/PV:5)= 2.6 (Medium) â˘(8)â(SL:6/M:7/O:6/S:6/ED:5/E:6/A:4/ID:6/LC:3/LI:8/LA:1/FD:5/RD:7/NC:2/PV:3)= 1.9 (Medium) The assessments conducted using three LLMs are detailed in Table A.28, and the final scores are depicted in the Spider-chart below for enhanced visualization. The OWASP R results cor- roborate that Prompt-Injection attacks exert a greater impact on integrity than on confidentiality and availability. Additionally, they highlight the significant influence these attacks have on pri- vacy violations and reputation damage, which are critical factors beyond the technical scope. Notably, the assessments also reveal a general lack of awareness among public users regarding these specific threats. Skill Motivation Opportunity Size Discovery Exploit Awareness Intrusion Dtc Confidentiality Integrity Availability Fnc Dmg Rpt Dmg Non-comp Privacy Vlt 0 1 2 3 4 56 7 8 9 10 Assessment of Prompt-injection attacks with OWASP R Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.3.4. With SSVC A last evaluation is performed using SSVC (Spring et al., 2021) as done before, the results of the assessments are presented below: â˘(1)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(2)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(3)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(4)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) 37 â˘(5)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(6)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(7)â(E:N/A:N/V:D/U:L/T:P/P:M)=Defer (Low) â˘(8)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) Table A.29 provides the detailed SSVC assessments conducted with the three LLMs. These scores offer additional insights beyond those captured by other metrics, emphasizing that Prompt Injection attacks are highly automatable, posing significant risks to both technical systems and public safety. The averaged results are visualized in the Spider-chart below for enhanced clarity. Exploitation Automatable Value Density Utility Technical ImpPublic-Safety Imp 0 12 3 Assessment of Prompt Injection attacks with SSVC Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.4. Assessment of Evasion attacks The forth experiment is evaluating eight Evasion attacks described in Section 4.3: (1) Hot Flip (Ebrahimi et al., 2018), (2) PWWS (Ren et al., 2019), (3) TypoAttack (Pruthi et al., 2019), (4) VIPER (Eger et al., 2020), (5) CheckList (Ribeiro et al., 2020), (6) BertAttack (Li et al., 2020a), (7) GBDA (Guo et al., 2021b), (8) TF-Attack (Li et al., 2024c). 6.4.1. With DREAD The first evaluation is done using DREAD (Michael and Steve, 2006). The corresponding vulnerability vectors as follows: â˘(1)â(D:7/R:7/E:6/A:7/D:5)=6.4 (Medium) â˘(2)â(D:7/R:9/E:8/A:7/D:5)=7.2 (High) â˘(3)â(D:6/R:8/E:6/A:6/D:5)=6.2 (Medium) 38 â˘(4)â(D:8/R:8/E:7/A:7/D:5)=7 (High) â˘(5)â(D:6/R:9/E:7/A:7/D:6)=7 (High) â˘(6)â(D:8/R:8/E:8/A:8/D:5)=7.4 (High) â˘(7)â(D:9/R:8/E:8/A:8/D:5)=7.6 (High) â˘(8)â(D:8/R:8/E:8/A:8/D:5)=7.4 (High) Table A.30 presents the detailed assessments conducted with the three LLMs, with the final scores visualized in the Spider-chart below. The DREAD evaluation reveals that evasion attacks generally cause medium-to-high damage and are highly reproducible, easily exploitable, and difficult to detect, while having the potential to impact a wide range of users. This underscores the critical need to mitigate such attacks. Damage Reproducibility Exploitability Affected users Discoverability 12 3 4 56 7 8 9 10 Assessment of Evasion attacks with DREAD Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.4.2. With CVSS The second assessment of Evasion attacks is done with CVSS (Schiffman and Cisco, 2005). The corresponding CVSS Vectors are shown below: â˘(1)â(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)=7.5 (High) â˘(2)â(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)=7.5 (High) â˘(3)â(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)=5.9 (Medium) â˘(4)â(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)=5.9 (Medium) â˘(5)â(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)=7.5 (High) 39 â˘(6)â(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)=7.5 (High) â˘(7)â(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)=5.9 (Medium) â˘(8)â(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)=7.5 (High) Table A.31 displays the scores provided by the three LLMs along with their average. For enhanced clarity and ease of interpretation, the score vectors are visualized in the Spider-chart below. The CVSS evaluations reveal a consistent scoring pattern for evasion attacks, emphasizing their typical characteristics. These attacks are often performed over a network, require minimal complexity, and do not necessitate privileges or user interaction. While they have no impact on data Confidentiality or Availability, they can significantly affect Integrity. Vector Complexity Privileges User Interaction Scope Confidentiality Integrity Availability 0 12 3 4 Assessment of Evasion attacks with CVSS Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.4.3. With OWASP Risk Rating Another evaluation of Evasion attacks is done with OWASP Risk Rating (Williams, 2023). The corresponding vulnerability vectors of each attack is: â˘(1)â(SL:7/M:7/O:5/S:4/ED:5/E:7/A:5/ID:6/LC:1/LI:8/LA:0/FD:5/RD:7/NC:4/PV:3)= 2.2 (Medium) â˘(2)â(SL:6/M:7/O:6/S:5/ED:5/E:7/A:5/ID:6/LC:1/LI:8/LA:0/FD:6/RD:7/NC:5/PV:3)= 2.4 (Medium) â˘(3)â(SL:6/M:7/O:5/S:5/ED:5/E:6/A:4/ID:5/LC:1/LI:7/LA:1/FD:5/RD:6/NC:4/PV:3)= 2 (Medium) 40 â˘(4)â(SL:7/M:8/O:6/S:5/ED:5/E:7/A:5/ID:6/LC:2/LI:8/LA:1/FD:7/RD:8/NC:5/PV:4)= 3 (High) â˘(5)â(SL:6/M:7/O:6/S:5/ED:5/E:7/A:5/ID:6/LC:1/LI:7/LA:1/FD:6/RD:7/NC:5/PV:4)= 2.5 (Medium) â˘(6)â(SL:7/M:8/O:7/S:5/ED:6/E:7/A:6/ID:7/LC:2/LI:9/LA:1/FD:7/RD:8/NC:6/PV:5)= 3.5 (High) â˘(7)â(SL:7/M:8/O:7/S:5/ED:6/E:7/A:6/ID:7/LC:2/LI:9/LA:1/FD:7/RD:8/NC:6/PV:5)= 3.5 (High) â˘(8)â(SL:7/M:8/O:7/S:6/ED:6/E:8/A:6/ID:7/LC:1/LI:8/LA:1/FD:7/RD:8/NC:5/PV:4)= 3.2 (High) The detailed OWASP R scoring is outlined in Table A.32, offering insights consistent with those from the CVSS assessments. It highlights that evasion attacks demand only a moderate level of skill and motivation to be executed, are easily exploitable, and are relatively unknown to defenders, making them challenging to detect and mitigate. These attacks pose a significant threat to data integrity while remaining harmless to Confidentiality and Availability. Addition- ally, OWASP R sheds light on the substantial financial and reputational impact these attacks can impose on targeted organizations. Skill Motivation Opportunity Size Discovery Exploit Awareness Intrusion Dtc Confidentiality Integrity Availability Fnc Dmg Rpt Dmg Non-comp Privacy Vlt 0 12 3 4 56 7 8 9 10 Assessment of Evasion attacks with OWASP R Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.4.4. With SSVC We continue the evaluation of Evasion attacks with SSVC (Spring et al., 2021) as a last metric, the results of the assessments are shown and detailed below: â˘(1)â(E:P/A:Y/V:C/U:S/T:P/P:S)=Immediate (Very High) 41 â˘(2)â(E:P/A:Y/V:C/U:S/T:P/P:S)=Immediate (Very High) â˘(3)â(E:A/A:Y/V:C/U:S/T:P/P:S)=Immediate (Very High) â˘(4)â(E:P/A:Y/V:C/U:S/T:P/P:S)=Immediate (Very High) â˘(5)â(E:P/A:N/V:D/U:L/T:P/P:M)=Scheduled (Medium) â˘(6)â(E:P/A:Y/V:C/U:S/T:P/P:S)=Immediate (Very High) â˘(7)â(E:P/A:Y/V:C/U:S/T:P/P:S)=Immediate (Very High) â˘(8)â(E:P/A:Y/V:C/U:S/T:P/P:S)=Immediate (Very High) The scores are visualized below in a Spider-chart, with the detailed assessments provided in Table A.33. Notably, the SSVC results align with those of DREAD and OWASP R, empha- sizing that evasion attacks are frequently exploited by attackers. Additionally, SSVC highlights that these attacks are highly automatable and rewarding, making them particularly valuable to adversaries. However, it suggests that while evasion attacks pose minimal technical threats to or- ganizations, their primary danger lies in their significant potential to compromise public safety, especially in scenarios involving object detection and classification. Exploitation Automatable Value Density Utility Technical ImpPublic-Safety Imp 0 12 3 Assessment of Evasion attacks with SSVC Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.5. Assessment of Model Extraction attacks Model Extraction are the fifth attacks we evaluate with the five vulnerability metrics. The attacks were presented earlier in Section 4.4 and are respectively: (1) User Data Extraction (Car- lini et al., 2021), (2) LLM Tricks (Yu et al., 2023), (3) Analysing PII Leakage (Lukas et al., 2023), (4) ETHICIST (Zhang et al., 2023), (5) Scalable Extraction (Nasr et al., 2023), (6) Out- put2Prompt (Zhang et al., 2024a), (7) PII-Compass (Nakka et al., 2024), (8) Alpaca VS Vicuna (Kassem et al., 2024). 42 6.5.1. With DREAD We start evaluating Extraction attacks using DREAD (Michael and Steve, 2006). The corre- sponding vulnerability vectors as follows: â˘(1)â(D:9/R:8/E:8/A:8/D:5)=7.6 (High) â˘(2)â(D:8/R:9/E:8/A:7/D:5)=7.4 (High) â˘(3)â(D:9/R:8/E:8/A:9/D:6)=8 (High) â˘(4)â(D:8/R:8/E:7/A:7/D:5)=7 (High) â˘(5)â(D:8/R:5/E:6/A:8/D:4)=6.2 (Medium) â˘(6)â(D:7/R:7/E:7/A:7/D:6)=6.8 (Medium) â˘(7)â(D:8/R:6/E:7/A:8/D:4)=6.8 (Medium) â˘(8)â(D:7/R:7/E:7/A:6/D:5)=6.4 (Medium) The detailed scores for this fifth type of attack are shown in Table A.34, with the score vectors visualized in a Spider-chart below for clarity. The DREAD assessment reveals that the exploitability and discoverability of model extraction attacks vary depending on the specific im- plementation. However, all these attacks share a high level of danger to systems due to their potential to cause significant damage. Additionally, the analysis highlights that such attacks can directly or indirectly affect multiple users, while remaining relatively challenging to detect. Damage Reproducibility Exploitability Affected users Discoverability 12 3 4 56 7 8 9 10 Assessment of model extraction attacks with DREAD Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 43 6.5.2. With CVSS The second assessment of Model Extraction attacks is done with CVSS (Schiffman and Cisco, 2005). The corresponding Vectors are: â˘(1)â(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)=6.8 (Medium) â˘(2)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) â˘(3)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) â˘(4)â(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)=6.8 (Medium) â˘(5)â(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)=6.8 (Medium) â˘(6)â(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)=6.8 (Medium) â˘(7)â(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)=6.8 (Medium) â˘(8)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) The CVSS scores assigned by each LLM are detailed in Table A.35, with the final vectors vi- sualized in the Spider-chart below. Compared to DREAD, CVSS provides more granular insights into the nature of the damage caused by these attacks, particularly their impact on confidentiality. Additionally, the assessment highlights that these attacks typically do not require specific privi- leges or user interaction for execution. However, their scope can vary depending on the type of data extracted, making them broader in target range than previous attack types. Vector Complexity Privileges User Interaction Scope Confidentiality Integrity Availability 0 12 3 4 Assessment of model extraction attacks with CVSS Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 44 6.5.3. With OWASP Risk Rating A third evaluation of Model Extraction attacks is done using OWASP R (Williams, 2023). The corresponding vulnerability vectors of each attack is: â˘(1)â(SL:7/M:8/O:7/S:6/ED:5/E:6/A:5/ID:7/LC:8/LI:1/LA:1/FD:7/RD:8/NC:7/PV:8)= 3.5 (High) â˘(2)â(SL:6/M:8/O:7/S:5/ED:6/E:7/A:5/ID:7/LC:8/LI:2/LA:2/FD:7/RD:9/NC:7/PV:8)= 3.8 (High) â˘(3)â(SL:6/M:8/O:7/S:6/ED:6/E:6/A:5/ID:8/LC:9/LI:1/LA:1/FD:7/RD:8/NC:7/PV:9)= 3.7 (High) â˘(4)â(SL:6/M:8/O:7/S:6/ED:5/E:7/A:5/ID:7/LC:8/LI:1/LA:1/FD:7/RD:9/NC:7/PV:9)= 3.6 (High) â˘(5)â(SL:6/M:8/O:7/S:6/ED:5/E:6/A:4/ID:7/LC:8/LI:1/LA:1/FD:7/RD:8/NC:7/PV:9)= 3.4 (High) â˘(6)â(SL:6/M:7/O:7/S:5/ED:5/E:6/A:5/ID:7/LC:8/LI:2/LA:2/FD:7/RD:9/NC:6/PV:8)= 3.5 (High) â˘(7)â(SL:6/M:8/O:7/S:5/ED:5/E:6/A:5/ID:7/LC:9/LI:2/LA:2/FD:7/RD:9/NC:7/PV:9)= 3.8 (Critical) â˘(8)â(SL:7/M:8/O:7/S:6/ED:5/E:6/A:5/ID:8/LC:8/LI:1/LA:1/FD:7/RD:9/NC:7/PV:9)= 3.7 (High) The detailed scores assigned by the LLMs are presented in Table A.36, with the final scores of each attack shown in the chart below for better visualization of their assessments. The OWASP R scores align with the findings from DREAD and CVSS, offering additional insights. This metric reveals that Model Extraction attacks require only a moderate level of skill and motivation to be performed, and are easily exploitable. Notably, system administrators and defenders often lack awareness of these attacks and their potential risks, particularly their significant impact on data confidentiality. Additionally, these attacks pose a substantial threat to an organizationâs finances and reputation, while also leading to privacy violations that can result in increased audit challenges. 45 Skill Motivation Opportunity Size Discovery Exploit Awareness Intrusion Dtc Confidentiality Integrity Availability Fnc Dmg Rpt Dmg Non-comp Privacy Vlt 0 12 3 4 56 7 8 9 10 Assessment of Model-extraction attacks with OWASP R Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.5.4. With SSVC The forth and last evaluation of Model-Extraction attacks is done with SSVC (Spring et al., 2021) as previously, the results of the assessments are shown and detailed below: â˘(1)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(2)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(3)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(4)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(5)â(E:P/A:N/V:C/U:E/T:T/P:S)=Immediate (Very High) â˘(6)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(7)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(8)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) Table A.37 presents the individual scores provided by each LLM along with their average, which is visualized below in a spider chart for a clearer understanding of the characteristics of Model-Extraction attacks. The SSVC assessments highlight the ease of automation and high rewards associated with these attacks, making them particularly effective for adversaries. Notably, this metric emphasizes the significant impact these attacks can have on both the technical aspects of organizations and public safety, particularly by jeopardizing the privacy of user data. 46 Exploitation Automatable Value Density Utility Technical ImpPublic-Safety Imp 0 12 3 Assessment of Model-Extraction attacks with SSVC Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.6. Assessment of Model Inference attacks The next type of attacks we assess are Model Inference attacks, presented in Section 4.5: (1) LIRA (Carlini et al., 2022), (2) Detecting Pretraining Data (Shi et al., 2024b), (3) Neighborhood Comparison (Mattern et al., 2023), (4) ProPILE (Kim et al., 2023), (5) Analysing PII Leakage (Lukas et al., 2023), (6) Conrecall (Wang et al., 2024), (7) MIA-LLM (Fu et al., 2024), (8) DeCop (Duarte et al., 2024). 6.6.1. With DREAD We start evaluating Model Inference attacks using DREAD (Michael and Steve, 2006). The corresponding vulnerability vectors as follows: â˘(1)â(D:8/R:9/E:7/A:7/D:6)=7.4 (High) â˘(2)â(D:7/R:8/E:7/A:7/D:5)=6.8 (Medium) â˘(3)â(D:6/R:5/E:6/A:6/D:5)=5.6 (Medium) â˘(4)â(D:8/R:6/E:6/A:7/D:5)=6.4 (Medium) â˘(5)â(D:9/R:8/E:8/A:9/D:6)=8 (High) â˘(6)â(D:7/R:7/E:7/A:7/D:5)=6.6 (Medium) â˘(7)â(D:8/R:7/E:7/A:7/D:5)=6.8 (Medium) â˘(8)â(D:8/R:8/E:7/A:7/D:5)=6.4 (Medium) 47 Table A.38 provides the detailed scores for this sixth type of attack, as assessed by the three LLMs along with their average. For better visualization and interpretation, these scores are represented below in a spider chart. The DREAD assessment reveals that Model Inference attacks share many characteristics with Model Extraction attacks. Both pose significant damage to systems and organizations, are highly reproducible and exploitable, and can impact a large number of users either directly or indirectly. They are also moderately challenging to discover. The primary distinction lies in their danger levelsâModel Extraction attacks are slightly more harmful as they enable the extraction of models or user data, whereas Model Inference attacks are more specific, allowing adversaries to determine whether certain data was part of the training set. Damage Reproducibility Exploitability Affected users Discoverability 12 3 4 56 7 8 9 10 Assessment of model inference attacks with DREAD Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.6.2. With CVSS The second assessment of Model Inference attacks is done with CVSS (Schiffman and Cisco, 2005). The corresponding Vectors are: â˘(1)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) â˘(2)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) â˘(3)â(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)=6.8 (Medium) â˘(4)â(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)=6.8 (Medium) â˘(5)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) â˘(6)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) â˘(7)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) 48 â˘(8)â(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)=8.6 (High) The complete list of scores is detailed in Table A.39, with the final averaged scores visualized below in the spider chart. The chart closely resembles that of Model Extraction attacks, differing primarily in that Model Inference attacks are less complex to execute. Notably, these attacks can be carried out remotely via the network without requiring any user privileges or interaction. They have a significant impact on confidentiality and exhibit a variable scope, as the extracted information can be used to target other systems or users. Vector Complexity Privileges User Interaction Scope Confidentiality Integrity Availability 0 12 3 4 Assessment of Model-inference attacks with CVSS Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.6.3. With OWASP Risk Rating A third evaluation of Model Inference attacks is done using OWASP R (Williams, 2023). The corresponding vulnerability vectors of each attack is: â˘(1)â(SL:6/M:7/O:7/S:6/ED:5/E:7/A:6/ID:7/LC:8/LI:1/LA:2/FD:7/RD:8/NC:7/PV:8)= 3.5 (High) â˘(2)â(SL:6/M:7/O:7/S:6/ED:5/E:6/A:4/ID:6/LC:8/LI:2/LA:2/FD:7/RD:8/NC:8/PV:8)= 3.5 (Medium) â˘(3)â(SL:5/M:7/O:7/S:5/ED:5/E:6/A:5/ID:6/LC:8/LI:1/LA:2/FD:6/RD:7/NC:7/PV:8)= 3.1 (Medium) â˘(4)â(SL:6/M:7/O:7/S:6/ED:5/E:6/A:6/ID:6/LC:8/LI:1/LA:2/FD:7/RD:7/NC:7/PV:8)= 3.4 (Medium) â˘(5)â(SL:6/M:8/O:7/S:6/ED:5/E:6/A:6/ID:8/LC:9/LI:1/LA:2/FD:8/RD:8/NC:8/PV:9)= 4 (Critical) 49 â˘(6)â(SL:6/M:7/O:6/S:6/ED:5/E:6/A:5/ID:7/LC:8/LI:2/LA:2/FD:8/RD:8/NC:8/PV:9)= 3.7 (Critical) â˘(7)â(SL:6/M:8/O:7/S:6/ED:6/E:6/A:5/ID:7/LC:8/LI:2/LA:2/FD:8/RD:8/NC:7/PV:9)= 3.8 (Critical) â˘(8)â(SL:5/M:7/O:7/S:6/ED:6/E:7/A:6/ID:7/LC:7/LI:2/LA:2/FD:8/RD:8/NC:8/PV:6)= 4.2 (Critical) The detailed assessments are provided in Table A.40, with their averages visualized in the chart below. The OWASP R scores align closely with those of CVSS, reaffirming that Model Inference attacks primarily impact confidentiality. These attacks are easy to discover and exploit but are challenging for defenders to detect due to limited awareness of their risks. Additionally, the assessments emphasize that Model Inference attacks significantly violate privacy while being less complex than Model Extraction attacks. Instead of extracting various data from a training set, Model Inference attacks determine whether specific data was included in the training process. Skill Motivation Opportunity Size Discovery Exploit Awareness Intrusion Dtc Confidentiality Integrity Availability Fnc Dmg Rpt Dmg Non-comp Privacy Vlt 0 12 3 4 56 7 8 9 10 Assessment of Model-inference attacks with OWASP R Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.6.4. With SSVC The last evaluation of Model-Inference attacks is performed using SSVC (Spring et al., 2021), and the results are shown and detailed below: â˘(1)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(2)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(3)â(E:P/A:N/V:D/U:E/T:P/P:M)=Scheduled (Medium) 50 â˘(4)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(5)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(6)â(E:P/A:Y/V:D/U:E/T:P/P:M)=Scheduled (Medium) â˘(7)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(8)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) The detailed SSVC scores are presented in Table A.41, with the final averages visualized in the chart below. Similar to previous attacks, SSVC aligns with the insights provided by other metrics. However, it uniquely highlights that Model Inference attacks are highly automatable and rewarding, making them particularly effective for adversaries. These attacks pose a significant impact not only on the technical aspects of systems but also on user safety and data privacy. Exploitation Automatable Value Density Utility Technical ImpPublic-Safety Imp 0 12 3 Assessment of Model-Inference attacks with SSVC Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.7. Assessment of Poisoning/Trojan/Backdoor attacks The last type of attacks we assess are Poisoning, Trojan, and Backdoor attacks, already pre- sented in Section 4.6: (1) TrojLLM (Xue et al., 2023), (2) Best-of-Venom (Baumg Ě artner et al., 2024), (3) CodeBreaker (Yan et al., 2024b), (4) Retrieval Poisoning (Zhang et al., 2024c), (5) Clinical LLMs (Das et al., 2024), (6) BackdoorLLM (Li et al., 2024b), (7) CBA (Huang et al., 2024), (8) TA² (Wang and Shu, 2024). 6.7.1. With DREAD We start evaluating Poisoning, Trojan, and Backdoor attacks using DREAD (Michael and Steve, 2006). The corresponding vulnerability vectors as follows: â˘(1)â(D:8/R:8/E:8/A:8/D:6)=7.6 (High) 51 â˘(2)â(D:8/R:6/E:7/A:7/D:5)=6.6 (Medium) â˘(3)â(D:8/R:8/E:8/A:8/D:6)=7.6 (High) â˘(4)â(D:7/R:6/E:6/A:6/D:4)=5.8 (Medium) â˘(5)â(D:9/R:7/E:6/A:9/D:5)=7.2 (High) â˘(6)â(D:8/R:9/E:8/A:8/D:6)=7.8 (High) â˘(7)â(D:8/R:8/E:7/A:7/D:5)=7 (High) â˘(8)â(D:8/R:8/E:8/A:8/D:6)=7.6 (High) The detailed scores for this final type of attack are provided in Table A.42, with their averages visualized in the chart below. The DREAD analysis reveals that Poisoning, Trojan, and Backdoor attacks generally cause significant damageâoften surpassing other attack types like Jailbreak or Evasion. Their repro- ducibility, exploitability, and the number of affected users vary depending on the specific attack but typically range from medium to high. However, these attacks are notably difficult to de- tect, making them particularly dangerous to LLMs. Addressing these vulnerabilities presents a significant challenge for system administrators. Damage Reproducibility Exploitability Affected users Discoverability 12 3 4 56 7 8 9 10 Assessment of Poisoning/Trojan/Backdoor attacks with DREAD Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.7.2. With CVSS The second assessment of these attacks is done with CVSS (Schiffman and Cisco, 2005). The corresponding Vectors are: â˘(1)â(AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)=7.5 (High) 52 â˘(2)â(AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N)=5.3 (Medium) â˘(3)â(AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)=8.5 (High) â˘(4)â(AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N)=5.9 (Medium) â˘(5)â(AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N)=5.9 (Medium) â˘(6)â(AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N)=9.3 (Critical) â˘(7)â(AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)=7.5 (High) â˘(8)â(AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)=7.5 (High) These vectors are presented below in a Spider-chart for better visualization, the detailed scores are shown in Table A.43. The CVSS assessment reveals that these attacks are generally complex to execute but pre- dominantly impact two technical domains: they exert a high impact on integrity and a medium impact on confidentiality. Furthermore, their execution often does not require elevated privileges, depending on the attackâs complexity. This highlights the significant potential danger posed by these types of attacks. Vector Complexity Privileges User Interaction Scope Confidentiality Integrity Availability 0 12 3 4 Assessment of Poisoning/Backdoor/Trojan attacks with CVSS Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 6.7.3. With OWASP Risk Rating A third evaluation of Poisoning, Trojan, and Backdoor attacks is done using OWASP R (Williams, 2023). The corresponding vulnerability vectors of each attack is: â˘(1)â(SL:6/M:8/O:7/S:6/ED:5/E:7/A:5/ID:7/LC:6/LI:7/LA:4/FD:7/RD:8/NC:5/PV:6)= 3.9 (Critical) 53 â˘(2)â(SL:8/M:8/O:6/S:5/ED:5/E:6/A:4/ID:5/LC:7/LI:7/LA:3/FD:7/RD:8/NC:6/PV:7)= 3.7 (High) â˘(3)â(SL:7/M:8/O:8/S:6/ED:6/E:7/A:5/ID:6/LC:7/LI:8/LA:4/FD:7/RD:8/NC:6/PV:7)= 4.4 (Critical) â˘(4)â(SL:7/M:8/O:6/S:6/ED:5/E:6/A:4/ID:6/LC:6/LI:8/LA:4/FD:7/RD:8/NC:6/PV:6)= 4 (Critical) â˘(5)â(SL:7/M:8/O:7/S:6/ED:4/E:6/A:4/ID:8/LC:6/LI:8/LA:3/FD:8/RD:9/NC:7/PV:6)= 4.2 (Critical) â˘(6)â(SL:8/M:9/O:7/S:6/ED:4/E:6/A:4/ID:9/LC:6/LI:8/LA:4/FD:8/RD:9/NC:7/PV:6)= 4 (Critical) â˘(7)â(SL:8/M:9/O:7/S:7/ED:5/E:7/A:4/ID:9/LC:7/LI:8/LA:4/FD:8/RD:9/NC:8/PV:7)= 4.9 (Critical) â˘(8)â(SL:8/M:8/O:7/S:6/ED:4/E:6/A:4/ID:8/LC:6/LI:8/LA:4/FD:7/RD:8/NC:6/PV:6)= 4.1 (Critical) The calculated values are detailed in Table A.44 and visualized in the Spider-chart below. This chart spans a wider area compared to others, emphasizing the significant danger posed by Poisoning, Trojan, and Backdoor attacks. OWASP R indicates that these attacks require ad- vanced skills and high motivation to execute, unlike simpler attacks such as Model-Inference. Additionally, a pronounced lack of awareness among system administrators complicates their detection. These attacks often have severe impacts on integrity, financial stability, and organiza- tional reputation, as well as contributing to non-compliance and privacy violations, making them some of the most impactful threats in the assessment. Skill Motivation Opportunity Size Discovery Exploit Awareness Intrusion Dtc Confidentiality Integrity Availability Fnc Dmg Rpt Dmg Non-comp Privacy Vlt 0 12 3 4 56 7 8 9 10 Assessment of Poisoning/Trojan/Backdoor attacks with OWASP R Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 54 6.7.4. With SSVC The final evaluation is performed using SSVC (Spring et al., 2021) as done with previous attacks. The results of this assessments are detailed below: â˘(1)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(2)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(3)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(4)â(E:P/A:N/V:D/U:L/T:P/P:M)=Scheduled (Medium) â˘(5)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(6)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(7)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) â˘(8)â(E:P/A:Y/V:C/U:S/T:T/P:S)=Immediate (Very High) Lastly, the SSVC scores are visualized in the chart below, with detailed assessments provided in Table A.45. The chart aligns closely with those of previous attack types, indicating that these attacks are easily automatable, which increases their exploitation and effectiveness for adversaries. Further- more, this analysis corroborates findings from other metrics, confirming that Poisoning, Trojan, and Backdoor attacks have a substantial impact on both the technical aspects of a system and the financial stability and safety of its users. Exploitation Automatable Value Density Utility Technical ImpPublic-Safety Imp 0 12 3 Assessment of Poisoning/Backdoor/Trojan attacks with SSVC Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 55 7. Discussion In this section, we present and analyze the results of our assessments of various attacks on large language models using the four vulnerability assessment metrics: DREAD, CVSS, OWASP Risk Rating, and SSVC. By examining the variations in metric values across all evaluated attacks, we aim to identify patterns, inconsistencies, and strengths in each framework. This analysis will provide insights into how effectively these metrics capture the severity and impact of adversarial attacks on LLMs. Ultimately, we will assess the overall utility and reliability of these metrics in evaluating attacks specific to LLMs, offering recommendations on their applicability and poten- tial areas for improvement. 7.1. Evaluation of DREAD To assess the relevance of the DREAD scoring model, we analyzed the Coefficient of Varia- tion (COV%) for each of its factors, as detailed in Table 14. Our findings reveal that the factors exhibit varying levels of variability, though most are relatively low. TheDamagefactor shows minimal variation, with COV% below 10% for five of the seven attack classes and slightly higher values for Evasion (13.45%) and Model Inference (10.87%) attacks. Across all 56 attacks, the Damage scores are consistently close, predominantly ranging between 7, 8, and 9 on a scale of 10. Similarly, theDiscoverabilityfactor demonstrates low variability, with COV% near 10% across all classes, and scores typically falling between 5 and 6. The same pattern is observed for theExploitabilityandAffected Usersfactors, both of which maintain intra-class COV% around 10%. This limited variability suggests that these four factors provide insufficient differentiation between adversarial attacks on LLMs. Their inability to distinguish effectively among attack classes renders themunsuitablefor ranking the relative danger or impact of these attacks. TheReproducibilityfactor, in contrast, shows greater variability, although inconsistently across attack classes. For example, White-box Jailbreaks and Prompt-Injection attacks exhibit higher COV% values (17.64% and 21.06%, respectively), indicating that attack complexity sig- nificantly influences reproducibility. However, this trend is not observed for Black-box Jailbreaks and Evasion attacks, which are generally easier to execute. As a result, while Reproducibility shows potential for distinguishing attacks, its inconsistent variability diminishes its overall util- ity, especially withinindividualattack-classes. 7.2. Evaluation of CVSS assessments The CVSS framework offers qualitative assessments, making Entropy (H) a more suitable measure of variability than the COV%. The results of this analysis are summarized in Table 15. Similar to observations from DREAD, several CVSS factors exhibit minimal or no variability across the attacks. For instance, theAttack Vectorconsistently takes the value âNetworkâ for 55 out of the 56 attacks, reflecting the predominance of network-based adversarial attacks targeting online LLMs. This lack of differentiation renders the factorunsuitablefor assessing the diversity of attack mechanisms against LLMs. Likewise, thePrivileges RequiredandUser Interactionfactors show low variability. The Privileges Required factor is typically âNoneâ, except for White-box and Black-box Jailbreak at- tacks. Similarly, User Interaction is also âNoneâ for most attacks, apart from White-box Jailbreak and Prompt Injection attacks. This suggests these factors are onlyrelevant to specific types of attacksbut fail to provide meaningful insights across broader categories. 56 TheConfidentiality,Integrity, andAvailability(CIA) Impact factors also demonstrate sig- nificant limitations. Each type of AAs typically targets a specific aspect of the CIA triad, leaving the other factors unused. For example,Model Extractionattacks heavily impactConfidential- itywhile leaving Integrity and Availability unaffected, resulting innull entropyfor the latter factors. Similarly, attacks such asPoisoning,Trojan, andBackdoorprimarily targetIntegrity, leaving Confidentiality and Availability unchanged. While these factors vary across attack types, they remainstatic within individual attack categories, limiting their ability to differentiate attacks at a granular level. TheScopefactor follows a similar trend, showing null entropy in four of the seven attack classes (White-box Jailbreak, Evasion, Model Extraction, and Model Inference). Even within its variability, it often remains uniform within a class, such as being consistently âChangedâ for all Model Inference attacks or âUnchangedâ for all Evasion attacks. This highlights the limitation ofspecificqualitative-factors in being suitable in some cases and unsuitable in others. Among the factors, onlyAttack Complexityshows relatively higher entropy, with most at- tacks presenting two to three different values from the mode. This variability reflects the differing levels of expertise required to execute various attacks, making this factorappropriatefor assess- ing attack difficulty. However, it could benefit from further refinement to enhance its precision. 7.3. Evaluation of OWASP Risk Rating assessments Now we assess the utility of OWAS Risk Rating factors using their Coefficient of Variation calculated in Table 16. We start with theSkill Levelfactor, its median values for the seven attack classes generally fall between 6 and 7, with variations of less than 10% in most cases. Similar patterns are ob- served for theMotivationandOpportunityfactors, where Motivation scores are predominantly between 7 and 8, and Opportunity scores range from 6 to 7, both exhibiting very low variability within each class. The same holds true for theSize of Threat Agentfactor, where the median consistently falls between 5 and 6, with a COV below 9.2% across six of the seven classes. These consistent results can be attributed to theshared characteristicsof AAs against LLMs: attackers typically possess medium-to-high skill levels, show strong motivation, have significant opportunities due to the accessibility of LLMs, and represent a medium-sized threat agent, as these attacks are common but often conducted by individuals. This uniformity in at- tributes leads torepeatedvalues across the 56 attacks, limiting the ability of these metrics to differentiatebetween attacks effectively. A similar trend is observed for theEase of Discovery,Ease of Exploit,Awarenessof de- fenders, andIntrusion DetectionCapabilities factors. The median values for these factors re- main consistently around 5 and 6 across the seven classes, with COVs between 8% and 9%. This lack of variability within attack types reduces the informativeness of these factors. TheConfidentiality,Integrity, andAvailabilityfactors show a similar limitation, as ob- served with CVSS metrics. Depending on the attack type, at least one of these factors is often not relevantand scores minimal values. However, due to OWASP Râs broader scoring scale (values out of 10), these factors exhibit relatively higher COV percentages compared to CVSS, providing slightly more variability. TheFinancialandReputation Damagesfactors are critical for assessing attacks on LLMs, given the potential for data breaches and information leaks that can erode customer trust. These factors consistently score medium-to-high values across all attack types. However, their low 57 COV percentages within the same attack type make it challenging to rank attacks fairly based on these criteria. ForNon-ComplianceandPrivacy Violation, the results indicate that these factors are rel- evantonly for specific attack types, such as Model Extraction, Model Inference, and Poison- ing/Trojan/Backdoor attacks. Other types, like White-box Jailbreaks and Model Evasion, exhibit low-to-medium impacts on Non-Compliance, making these factors valuable for specific contexts but less applicable across all attack types. While these OWASP R factors provide extensive information about each attack, they are not consistently effective in distinguishing between them. However, the broader scoring range (values out of 10) used by OWASP R doesintroduce more variabilitycompared to CVSS, making it somewhat more adaptable for attack differentiation. 7.4. Evaluation of SSVC assessments For SSVC, Entropy was calculated to evaluate the variability of its qualitative factors, the results are presented in Table 17. TheExploitabilityfactor, which reflects the existence of an implementation for the attack, demonstrates minimal variability. Among the 56 attacks analyzed, 53 had an associatedProof- of-Concept, making this factor largely uniform across the dataset. This lack of differentiation suggests that this factor provideslittle valuable informationwhen assessing adversarial attacks against LLMs. A similar observation applies to theAutomatableandValue-Densityfactors. Most adver- sarial attacks on LLMs are automatable, and they yield significant rewards, such as exposing private or sensitive information from the models. Consequently, these factors alsofail to offer meaningful distinctionsin the scoring process. The separation of theTechnicalandPublic-Safety Impactsprovides a better understanding of the danger posed by AAs. Although these factors show some degree of variation across attacks within the same category, the differences remain limited. For instance, most attacks are assessed as having âTotalâ control over the system and âSignificantâ impacts on finance, reputation, or public health. These assessments, while varying slightly, are overly broad and rely on only two or three possible values,limiting their utilityfor nuanced analysis or differentiation. 8. Suggestions for Future Solutions The analysis conducted in the previous sections validates the hypothesis proposed in Section 1:existing vulnerability scoring metrics are inadequate for assessing Adversarial Attacks against Large Language Models. This inadequacy is primarily due to the lack of variability in factor scores, which limits the metricsâ ability to distinguish between different types of attacks effectively. The shortcomings of current vulnerability scoring systems stem from several key issues: 1.Overemphasis on CIA Impact:Existing metrics focus heavily on the technical impact on Confidentiality, Integrity, and Availability, which are not the primary targets of AAs against LLMs. 2.Lack of Contextual Consideration:Factors such as Attack Vector, Opportunity, and Intrusion Detection lack relevance when applied to LLM-specific scenarios due to the absence of target-specific context. 58 3.Subjectivity in Quantitative Scores:The use of quantitative scoring systems introduces subjectivity, reducing the reliability of assessments. 4.Limited Qualitative Scoring Options:Scoring systems with qualitative factors often offer too few choices, resulting in repetitive and non-discriminative assessments. These limitations highlight the urgent need for the research community to address these gaps and develop scoring metrics specifically tailored for AAs against LLMs, particularly given the increasing adoption of these models in critical applications. While proposing new metrics is beyond the scope of this study, we suggest the following directions for future research: 1.Customized Technical Impact Metrics:Metrics should account for the unique impacts of AAs on LLMs, such as trust erosion, misinformation dissemination, or generating bi- ased and harmful outputs. These factors better reflect the consequences of LLM-specific attacks. 2.Context-Aware Factors:Metrics should consider the architecture and nature of the tar- geted LLM. For example: â˘Larger models (e.g., GPT, LLAMA) are more susceptible to AAs due to complex decision boundaries. â˘Attacks targeting LLMs trained on sensitive personal data pose greater risks than those on public datasets. â˘Multimodal LLMs may face distinct vulnerabilities (e.g., malicious image injection), which text-only models do not encounter. 3.Incorporating Success Rates:Success rates could serve as a valuable factor in ranking attacks, although challenging to measure. For instance: â˘Prompt Injection attacks can exhibit varying success rates depending on implemen- tation. â˘Jailbreak attacks may not succeed consistently with a single query but can have cu- mulative success over multiple attempts, which is important to account for. 4.Enhanced Qualitative Scoring Systems:Implementing multiple-choice qualitative fac- tors can strike a balance between complexity and subjectivity. For instance, adding more nuanced levels to factors like âAttack Complexityâ (e.g., Minimal, Medium, Very High) could create finer distinctions between attacks and increase score variability. By exploring these directions, researchers can contribute to the development of robust, context- sensitive metrics that provide meaningful and actionable assessments for adversarial attacks against LLMs. This advancement is crucial for enhancing the security posture of these increas- ingly prevalent models. 9. Conclusion This study has critically examined the applicability of established vulnerability metrics, such as DREAD, CVSS, OWASP Risk Rating, and SSVC, to assess Adversarial Attacks on LLMs. Through a detailed analysis of 56 AAs across multiple metrics, the findings demonstrate that existing metricsfailto adequately differentiate between attacks, primarily due to their rigid, 59 context-limited factors and a focus on traditional technical impacts rather than the nuanced threats posed by AAs. Key observations highlight that factors such as technical-impact, the motivation of attack- ers, and the limited-options of qualitative scoring systems are inadequately addressed in exist- ing frameworks. These limitations restrict the variability and relevance of vulnerability scores, confirming the hypothesis that traditional metrics are not fully suitable for assessing the risks associated with AAs on LLMs. While the development of new metrics was beyond the scope of this work, the study identi- fies several promising directions for improvement. These include integrating tailored technical- impact assessments, context-specific factors, and multiple-choice qualitative scoring options to enhance the granularity and applicability of future metrics. Furthermore, incorporating attack success rates, though complex, could provide a more comprehensive evaluation of adversarial threats. The contributions of this research are multifaceted, providing a taxonomy of adversarial at- tack classifications, a curated list of 56 AAs targeting LLMs, and an in-depth statistical evaluation of existing vulnerability metrics. These findings not only underscore the limitations of current approaches but also serve as a call to action for the development of more robust, flexible, and LLM-specific vulnerability assessment frameworks. Future research should focus on refining these metrics to account for the unique challenges posed by Adversarial Attacks on LLMs, ensuring that the security of these increasingly vital systems is both effective and adaptive to emerging threats. Acknowledgments This work is financially supported by Zayed University under a Research Associate contract Disclosure statement: No potential conflict of interest is reported by the authors 60 Appendix A. Assessment details This appendix provides a comprehensive breakdown of the evaluation results for the seven types of AAs assessed using the four vulnerability metrics: DREAD, CVSS, OWASP Risk Rat- ing, and SSVC. Each attack type was evaluated across multiple LLMs, with detailed scores recorded for every attack and metric. The appendix outlines the methodology used to compute average scores by consolidating the evaluations from three distinct LLMs, ensuring an accurate representation of the results. This detailed presentation of results supports the main text by providing transparency into the scoring process and offering a robust reference for further analysis of the metrics and calculations used in this study. Appendix A.1. White-box Jailbreak Appendix A.2. Black-box Jailbreak Appendix A.3. Prompt Injection Appendix A.4. Evasion attacks Appendix A.5. Model Extraction Appendix A.6. Model Inference Appendix A.7. Poisoning/Trojan/Backdoor 61 References Abdali, S., Anarfi, R., Barberan, C., He, J., 2024. Securing large language models: Threats, vulnerabilities and respon- sible practices. arXiv preprint arXiv:2403.12503 . Andriushchenko, M., Croce, F., Flammarion, N., 2024. Jailbreaking leading safety-aligned llms with simple adaptive attacks. URL:https://arxiv.org/abs/2404.02151,arXiv:2404.02151. Ayub, M.A., Johnson, W.A., Talbert, D.A., Siraj, A., 2020. Model evasion attack on intrusion detection systems using adversarial machine learning, in: 2020 54th annual conference on information sciences and systems (CISS), IEEE. p. 1â6. Badr, M.M., Mahmoud, M.M., Abdulaal, M., Aljohani, A.J., Alsolami, F., Balamsh, A., 2023. A novel evasion attack against global electricity theft detectors and a countermeasure. IEEE Internet of Things Journal 10, 11038â11053. Bagdasaryan, E., Hsieh, T.Y., Nassi, B., Shmatikov, V., 2023. Abusing images and sounds for indirect instruction injection in multi-modal llms. URL:https://arxiv.org/abs/2307.10490,arXiv:2307.10490. Bai, J., Wu, B., Zhang, Y., Li, Y., Li, Z., Xia, S.T., 2021. Targeted attack against deep neural networks via flipping limited weight bits. URL:https://arxiv.org/abs/2102.10496,arXiv:2102.10496. Baumg Ě artner, T., Gao, Y., Alon, D., Metzler, D., 2024. Best-of-venom: Attacking rlhf by injecting poisoned preference data. URL:https://arxiv.org/abs/2404.05530,arXiv:2404.05530. Biggio, B., Nelson, B., Laskov, P., 2013. Poisoning attacks against support vector machines. URL:https://arxiv. org/help/api/index,arXiv:1206.6389. Boesch, G., 2023. What Is Adversarial Machine Learning? Attack Methods in 2024 - viso.ai â viso.ai.https: //viso.ai/deep-learning/adversarial-machine-learning/. [Accessed 27-11-2024]. Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al., 2020. Language models are few-shot learners advances in neural information processing systems 33 . Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., Tramer, F., 2022. Membership inference attacks from first principles. URL:https://arxiv.org/abs/2112.03570,arXiv:2112.03570. Carlini, N., Tram ` er, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Er- lingsson, Ě U., Oprea, A., Raffel, C., 2021. Extracting training data from large language models, in: 30th USENIX Security Symposium (USENIX Security 21), USENIX Association. p. 2633â2650. URL:https://w.usenix. org/conference/usenixsecurity21/presentation/carlini-extracting. Carlini, N., Wagner, D., 2017a. Adversarial examples are not easily detected: Bypassing ten detection methods, in: Proceedings of the 10th ACM workshop on artificial intelligence and security, p. 3â14. Carlini, N., Wagner, D., 2017b. Towards evaluating the robustness of neural networks, in: 2017 ieee symposium on security and privacy (sp), Ieee. p. 39â57. Carlini, N., Wagner, D., 2018a. Audio adversarial examples: Targeted attacks on speech-to-text, in: 2018 IEEE security and privacy workshops (SPW), IEEE. p. 1â7. Carlini, N., Wagner, D., 2018b. Audio adversarial examples: Targeted attacks on speech-to-text, in: 2018 IEEE Security and Privacy Workshops (SPW), p. 1â7. doi:10.1109/SPW.2018.00009. Cartella, F., Anunciacao, O., Funabiki, Y., Yamaguchi, D., Akishita, T., Elshocht, O., 2021. Adversarial attacks for tabular data: Application to fraud detection and imbalanced data. URL:https://arxiv.org/abs/2101.08030, arXiv:2101.08030. Chabanne, H., Danger, J.L., Guiga, L., K Ě uhne, U., 2021.Side channel attacks for architecture extraction of neural networks.CAAI Transactions on Intelligence Technology 6, 3â16.URL:https://ietresearch. onlinelibrary.wiley.com/doi/abs/10.1049/cit2.12026,doi:https://doi.org/10.1049/cit2. 12026,arXiv:https://ietresearch.onlinelibrary.wiley.com/doi/pdf/10.1049/cit2.12026. Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G.J., Wong, E., 2024. Jailbreaking black box large language models in twenty queries. URL:https://arxiv.org/abs/2310.08419,arXiv:2310.08419. Chen, H., Fu, C., Zhao, J., Koushanfar, F., 2021. Proflip: Targeted trojan attack with progressive bit flips, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), p. 7718â7727. Chen, W., Zeng, Y., Qiu, M., 2019. Using adversarial examples to bypass deep learning based url detection system, in: 2019 IEEE International Conference on Smart Cloud (SmartCloud), IEEE. p. 128â130. Chiang, R.H., Barron, T.M., Storey, V.C., 1994.Reverse engineering of relational databases: Extraction of an eer model from a relational database.Data & Knowledge Engineering 12, 107â142.URL:https: //w.sciencedirect.com/science/article/pii/0169023X94900116, doi:https://doi.org/10.1016/ 0169-023X(94)90011-6. Chopra, S., Ahmad, H., Goel, D., Szabo, C., 2024. Chatnvd: Advancing cybersecurity vulnerability assessment with large language models. URL:https://arxiv.org/abs/2412.04756,arXiv:2412.04756. Chu, J., Liu, Y., Yang, Z., Shen, X., Backes, M., Zhang, Y., 2024. Comprehensive assessment of jailbreak attacks against llms. arXiv preprint arXiv:2402.05668 . Dai, H., Li, H., Tian, T., Huang, X., Wang, L., Zhu, J., Song, L., 2018. Adversarial attack on graph structured data, 62 in: Dy, J., Krause, A. (Eds.), Proceedings of the 35th International Conference on Machine Learning, PMLR. p. 1115â1124. URL:https://proceedings.mlr.press/v80/dai18b.html. Das, A., Tariq, A., Batalini, F., Dhara, B., Banerjee, I., 2024.Exposing vulnerabilities in clini- cal llms through data poisoning attacks:Case study in breast cancer.medRxiv URL:https://w. medrxiv.org/content/early/2024/03/21/2024.03.20.24304627, doi:10.1101/2024.03.20.24304627, arXiv:https://w.medrxiv.org/content/early/2024/03/21/2024.03.20.24304627.full.pdf. Deng, G., Liu, Y., Li, Y., Wang, K., Zhang, Y., Li, Z., Wang, H., Zhang, T., Liu, Y., 2023. Jailbreaker: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715 . Deng, G., Liu, Y., Li, Y., Wang, K., Zhang, Y., Li, Z., Wang, H., Zhang, T., Liu, Y., 2024. Masterkey: Automated jailbreaking of large language model chatbots, in: Proc. ISOC NDSS. Devlin, J., 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 . Ding, P., Kuang, J., Ma, D., Cao, X., Xian, Y., Chen, J., Huang, S., 2024. A wolf in sheepâs clothing: Generalized nested jailbreak prompts can fool large language models easily. URL:https://arxiv.org/abs/2311.08268, arXiv:2311.08268. Ding, S., Tian, Y., Xu, F., Li, Q., Zhong, S., 2019. Trojan attack on deep generative models in autonomous driving, in: Security and Privacy in Communication Networks: 15th EAI International Conference, SecureComm 2019, Orlando, FL, USA, October 23-25, 2019, Proceedings, Part I 15, Springer. p. 299â318. Dong, H., Dong, J., Yuan, S., Guan, Z., 2022. Adversarial attack and defense on natural language processing in deep learning: A survey and perspective, in: International conference on machine learning for cyber security, Springer. p. 409â424. Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J., 2018. Boosting adversarial attacks with momentum, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Du, W., Zhao, Y., Li, B., Liu, G., Wang, S., 2022. Ppt: Backdoor attacks on pre-trained models via poisoned prompt tuning., in: IJCAI, p. 680â686. Du, Y., Zhao, S., Ma, M., Chen, Y., Qin, B., 2024. Analyzing the inherent response tendency of llms: Real-world instructions-driven jailbreak. URL:https://arxiv.org/abs/2312.04127,arXiv:2312.04127. Duarte, A.V., Zhao, X., Oliveira, A.L., Li, L., 2024. De-cop: Detecting copyrighted content in language models training data. URL:https://arxiv.org/abs/2402.09910,arXiv:2402.09910. Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al., 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783 . Ebrahimi, J., Rao, A., Lowd, D., Dou, D., 2018. Hotflip: White-box adversarial examples for text classification. URL: https://arxiv.org/abs/1712.06751,arXiv:1712.06751. Eger, S., S ̧ ahin, G.G., R Ě uckl Ě e, A., Lee, J.U., Schulz, C., Mesgar, M., Swarnkar, K., Simpson, E., Gurevych, I., 2020. Text processing like humans do: Visually attacking and shielding nlp systems. URL:https://arxiv.org/abs/1903. 11508,arXiv:1903.11508. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., Song, D., 2018. Robust physical-world attacks on deep learning visual classification, in: Proceedings of the IEEE conference on computer vision and pattern recognition, p. 1625â1634. Fan, H., Wang, B., Zhou, P., Li, A., Xu, Z., Fu, C., Li, H., Chen, Y., 2021. Reinforcement learning-based black-box evasion attacks to link prediction in dynamic graphs, in: 2021 IEEE 23rd Int Conf on High Performance Computing & Communications; 7th Int Conf on Data Science & Systems; 19th Int Conf on Smart City; 7th Int Conf on De- pendability in Sensor, Cloud & Big Data Systems & Application (HPCC/DSS/SmartCity/DependSys), p. 933â940. doi:10.1109/HPCC-DSS-SmartCity-DependSys53884.2021.00149. Finlayson, S.G., Bowers, J.D., Ito, J., Zittrain, J.L., Beam, A.L., Kohane, I.S., 2019. Adversarial attacks on medical machine learning. Science 363, 1287â1289. First, 2016. CVSS v3.1 User Guide â first.org.https://w.first.org/cvss/v3.1/user-guide. Fu, W., Wang, H., Gao, C., Liu, G., Li, Y., Jiang, T., 2024. Practical membership inference attacks against fine-tuned large language models via self-prompt calibration. URL:https://arxiv.org/abs/2311.06062,arXiv:2311.06062. Garg, S., Ramakrishnan, G., 2020. Bae: Bert-based adversarial examples for text classification, in: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Association for Com- putational Linguistics. URL:http://dx.doi.org/10.18653/v1/2020.emnlp-main.498, doi:10.18653/v1/ 2020.emnlp-main.498. Geiping, J., Fowl, L., Huang, W.R., Czaja, W., Taylor, G., Moeller, M., Goldstein, T., 2021. Witchesâ brew: Industrial scale data poisoning via gradient matching. URL:https://arxiv.org/abs/2009.02276,arXiv:2009.02276. Geisler, S., Wollschl Ě ager, T., Abdalla, M.H.I., Gasteiger, J., G Ě unnemann, S., 2024. Attacking large language models with projected gradient descent. URL:https://arxiv.org/abs/2402.09154,arXiv:2402.09154. Genc ̧, D., Ě Ozuysal, M., Tomur, E., 2023. A taxonomic survey of model extraction attacks, in: 2023 IEEE International Conference on Cyber Security and Resilience (CSR), IEEE. p. 200â205. 63 Goodfellow, I.J., Shlens, J., Szegedy, C., 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 . Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., Fritz, M., 2023a. More than youâve asked for: A com- prehensive analysis of novel prompt injection threats to application-integrated large language models. arXiv preprint arXiv:2302.12173 27. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., Fritz, M., 2023b. Not what youâve signed up for: Com- promising real-world llm-integrated applications with indirect prompt injection. URL:https://arxiv.org/abs/ 2302.12173,arXiv:2302.12173. Gu, T., Liu, K., Dolan-Gavitt, B., Garg, S., 2019. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access 7, 47230â47244. doi:10.1109/ACCESS.2019.2909068. Guo, C., Sablayrolles, A., J Ě egou, H., Kiela, D., 2021a. Gradient-based adversarial attacks against text transformers. arXiv preprint arXiv:2104.13733 . Guo, C., Sablayrolles, A., J Ě egou, H., Kiela, D., 2021b. Gradient-based adversarial attacks against text transformers. URL:https://arxiv.org/abs/2104.13733,arXiv:2104.13733. Hayase, J., Borevkovic, E., Carlini, N., Tram ` er, F., Nasr, M., 2024. Query-based adversarial prompt generation. URL: https://arxiv.org/abs/2402.12329,arXiv:2402.12329. Hu, H., Salcic, Z., Sun, L., Dobbie, G., Yu, P.S., Zhang, X., 2022. Membership inference attacks on machine learning: A survey. ACM Computing Surveys (CSUR) 54, 1â37. Huang, H., Zhao, Z., Backes, M., Shen, Y., Zhang, Y., 2024. Composite backdoor attacks against large language models. URL:https://arxiv.org/abs/2310.07676,arXiv:2310.07676. Huang, W.R., Geiping, J., Fowl, L., Taylor, G., Goldstein, T., 2020. Metapoison: Practical general-purpose clean-label data poisoning, in: Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., Lin, H. (Eds.), Advances in Neural Informa- tion Processing Systems, Curran Associates, Inc.. p. 12080â12091. URL:https://proceedings.neurips.c/ paper_files/paper/2020/file/8ce6fc704072e351679ac97d4a985574-Paper.pdf. Huang, Z., Zhang, T., 2019. Black-box adversarial attack with transferable model-based embedding. arXiv preprint arXiv:1911.07140 . Ibitoye, O., Abou-Khamis, R., Shehaby, M.e., Matrawy, A., Shafiq, M.O., 2019. The threat of adversarial attacks on machine learning in network securityâa survey. arXiv preprint arXiv:1911.02621 . Inc., P.A., 2022. PerplexityAi.https://w.perplexity.ai/. [Accessed 27-11-2024]. Jagielski, M., Carlini, N., Berthelot, D., Kurakin, A., Papernot, N., 2020. High accuracy and high fidelity extraction of neural networks, in: 29th USENIX Security Symposium (USENIX Security 20), USENIX Association. p. 1345â 1362. URL:https://w.usenix.org/conference/usenixsecurity20/presentation/jagielski. Kassem, A.M., Mahmoud, O., Mireshghallah, N., Kim, H., Tsvetkov, Y., Choi, Y., Saad, S., Rana, S., 2024. Al- paca against vicuna: Using llms to uncover memorization of llms. URL:https://arxiv.org/abs/2403.04801, arXiv:2403.04801. Kim, S., Yun, S., Lee, H., Gubri, M., Yoon, S., Oh, S.J., 2023. Propile: Probing privacy leakage in large language models. URL:https://arxiv.org/abs/2307.01881,arXiv:2307.01881. Kumar, A., Agarwal, C., Srinivas, S., Li, A.J., Feizi, S., Lakkaraju, H., 2023a. Certifying llm safety against adversarial prompting. arXiv preprint arXiv:2309.02705 . Kumar, K.N., Mohan, C.K., Cenkeramaddi, L.R., 2023b. The impact of adversarial attacks on federated learning: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence 46, 2672â2691. Kumar, P., 2024. Adversarial attacks and defenses for large language models (llms): methods, frameworks & challenges. International Journal of Multimedia Information Retrieval 13, 26. Kurakin, A., Goodfellow, I., Bengio, S., 2017. Adversarial examples in the physical world. ICLR Workshop URL: https://arxiv.org/abs/1607.02533. Lee, D., Tiwari, M., 2024. Prompt infection: Llm-to-llm prompt injection within multi-agent systems. arXiv preprint arXiv:2410.07283 . Li, H., Guo, D., Fan, W., Xu, M., Huang, J., Meng, F., Song, Y., 2023. Multi-step jailbreaking privacy attacks on chatgpt. URL:https://arxiv.org/abs/2304.05197,arXiv:2304.05197. Li, L., Ma, R., Guo, Q., Xue, X., Qiu, X., 2020a. BERT-ATTACK: Adversarial attack against BERT using BERT, in: Webber, B., Cohn, T., He, Y., Liu, Y. (Eds.), Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Association for Computational Linguistics, Online. p. 6193â6202. URL: https://aclanthology.org/2020.emnlp-main.500, doi:10.18653/v1/2020.emnlp-main.500. Li, S., Xue, M., Zhao, B.Z.H., Zhu, H., Zhang, X., 2020b. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing 18, 2088â2105. Li, X., Wang, R., Cheng, M., Zhou, T., Hsieh, C.J., 2024a. Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers. URL:https://arxiv.org/abs/2402.16914,arXiv:2402.16914. Li, Y., Huang, H., Zhao, Y., Ma, X., Sun, J., 2024b. Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models. URL:https://arxiv.org/abs/2408.12798,arXiv:2408.12798. 64 Li, Y., Zhai, T., Jiang, Y., Li, Z., Xia, S.T., 2021. Backdoor attack in the physical world. arXiv preprint arXiv:2104.02361 . Li, Z., Chen, K., Liu, L., Bai, X., Yang, M., Xiang, Y., Zhang, M., 2024c. Tf-attack: Transferable and fast adversarial attacks on large language models. URL:https://arxiv.org/abs/2408.13985,arXiv:2408.13985. Li, Z., Shi, C., Xie, Y., Liu, J., Yuan, B., Chen, Y., 2020c. Practical adversarial attacks against speaker recognition systems, in: Proceedings of the 21st International Workshop on Mobile Computing Systems and Applications, As- sociation for Computing Machinery, New York, NY, USA. p. 9â14. URL:https://doi.org/10.1145/3376897. 3377856, doi:10.1145/3376897.3377856. Liu, F.W., Hu, C., 2024. Exploring vulnerabilities and protections in large language models: A survey. arXiv preprint arXiv:2406.00240 . Liu, H., Jia, J., Gong, N.Z., 2022.PoisonedEncoder: Poisoning the unlabeled pre-training data in contrastive learning, in: 31st USENIX Security Symposium (USENIX Security 22), p. 3629â3645. Liu, H., Zhou, Z., Shang, F., Qi, X., Liu, Y., Jiao, L., 2020a. Boosting gradient for white-box adversarial attacks. arXiv preprint arXiv:2010.10712 . Liu, X., Yu, Z., Zhang, Y., Zhang, N., Xiao, C., 2024a. Automatic and universal prompt injection attacks against large language models. URL:https://arxiv.org/abs/2403.04957,arXiv:2403.04957. Liu, Y., Chen, X., Liu, C., Song, D., 2016. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770 . Liu, Y., Deng, G., Li, Y., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y., Wang, H., Zheng, Y., et al., 2023a. Prompt injection attack against llm-integrated applications. arXiv preprint arXiv:2306.05499 . Liu, Y., Jia, Y., Geng, R., Jia, J., Gong, N.Z., 2024b. Formalizing and benchmarking prompt injection attacks and defenses, in: 33rd USENIX Security Symposium (USENIX Security 24), p. 1831â1847. Liu, Y., Jia, Y., Geng, R., Jia, J., Gong, N.Z., 2024c. Formalizing and benchmarking prompt injection attacks and defenses. URL:https://arxiv.org/abs/2310.12815,arXiv:2310.12815. Liu, Y., Jia, Y., Geng, R., Jia, J., Zhenqiang Gong, N., 2023b. Prompt injection attacks and defenses in llm-integrated applications. arXiv e-prints , arXivâ2310. Liu, Y., Mondal, A., Chakraborty, A., Zuzak, M., Jacobsen, N., Xing, D., Srivastava, A., 2020b. A survey on neural trojans, in: 2020 21st International Symposium on Quality Electronic Design (ISQED), IEEE. p. 33â39. Lukas, N., Salem, A., Sim, R., Tople, S., Wutschitz, L., Zanella-B Ě eguelin, S., 2023. Analyzing leakage of personally identifiable information in language models. URL:https://arxiv.org/abs/2302.00539,arXiv:2302.00539. Ma, X., Li, W.J., 2023. Grey-box adversarial attack on communication in multi-agent reinforcement learning, in: Pro- ceedings of the 2023 International Conference on Autonomous Agents and Multiagent Systems, p. 2448â2450. Mattern, J., Mireshghallah, F., Jin, Z., Sch Ě olkopf, B., Sachan, M., Berg-Kirkpatrick, T., 2023. Membership inference attacks against language models via neighbourhood comparison. URL:https://arxiv.org/abs/2305.18462, arXiv:2305.18462. Michael, H., Steve, L., 2006. The security development lifecycle: Sdl: A process for developing demonstrably more secure software. de Morais, A.M., 2023. Threats to machine learning-based systems; part 1 of 5.https://w.sidechannel.blog/ en/threats-to-machine-learning-based-systems-part-1-of-5/. [Accessed 27-11-2024]. Mu, J., Wang, B., Li, Q., Sun, K., Xu, M., Liu, Z., 2021. A hard label black-box adversarial attack against graph neural networks, in: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Association for Computing Machinery, New York, NY, USA. p. 108â125. URL:https://doi.org/10.1145/ 3460120.3484796, doi:10.1145/3460120.3484796. Nakka, K.K., Frikha, A., Mendes, R., Jiang, X., Zhou, X., 2024. Pii-compass: Guiding llm training data extraction prompts towards the target pii via grounding. URL:https://arxiv.org/abs/2407.02943,arXiv:2407.02943. Nasr, M., Carlini, N., Hayase, J., Jagielski, M., Cooper, A.F., Ippolito, D., Choquette-Choo, C.A., Wallace, E., Tram ` er, F., Lee, K., 2023. Scalable extraction of training data from (production) language models. URL:https://arxiv. org/abs/2311.17035,arXiv:2311.17035. Niu, Z., Sun, Y., Ren, H., Ji, H., Wang, Q., Ma, X., Hua, G., Jin, R., 2024. Efficient llm-jailbreaking by introducing visual modality. URL:https://arxiv.org/abs/2405.20015,arXiv:2405.20015. OpenAI, 2024. Hello GPT-4o.https://openai.com/index/hello-gpt-4o/. [Accessed 27-11-2024]. Oprea, A., Vassilev, A., 2023. Adversarial machine learning: A taxonomy and terminology of attacks and mitigations. Technical Report. National Institute of Standards and Technology. OWASP, 2023. OWASP Top 10 for Large Language Model Applications â OWASP Foundation â owasp.org.https: //owasp.org/w-project-top-10-for-large-language-model-applications/. Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A., 2016. The limitations of deep learning in adversarial settings, in: 2016 IEEE European symposium on security and privacy (EuroS&P), IEEE. p. 372â387. Peng, B., Bi, Z., Niu, Q., Liu, M., Feng, P., Wang, T., Yan, L.K., Wen, Y., Zhang, Y., Yin, C.H., 2024. Jailbreaking and mitigation of vulnerabilities in large language models. arXiv preprint arXiv:2410.15236 . 65 Perez, F., Ribeiro, I., 2022. Ignore previous prompt: Attack techniques for language models. URL:https://arxiv. org/abs/2211.09527,arXiv:2211.09527. Pruthi, D., Dhingra, B., Lipton, Z.C., 2019. Combating adversarial misspellings with robust word recognition. URL: https://arxiv.org/abs/1905.11268,arXiv:1905.11268. Qi, X., Zhu, J., Xie, C., Yang, Y., 2021. Subnet replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting. arXiv preprint arXiv:2107.07240 . Qiu, S., Liu, Q., Zhou, S., Huang, W., 2022. Adversarial attack and defense technologies in natural language processing: A survey. Neurocomputing 492, 278â307. Radford, A., 2018. Improving language understanding by generative pre-training . Rahman, M.A., Rahman, T., Lagani ` ere, R., Mohammed, N., Wang, Y., 2018. Membership inference attack against differentially private deep learning model. Trans. Data Priv. 11, 61â79. Ramesh, G., Dou, Y., Xu, W., 2024. Gpt-4 jailbreaks itself with near-perfect success using self-explanation. URL: https://arxiv.org/abs/2405.13077,arXiv:2405.13077. Ren, S., Deng, Y., He, K., Che, W., 2019. Generating natural language adversarial examples through probability weighted word saliency, in: Korhonen, A., Traum, D., M ` arquez, L. (Eds.), Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, Association for Computational Linguistics, Florence, Italy. p. 1085â 1097. URL:https://aclanthology.org/P19-1103, doi:10.18653/v1/P19-1103. Ribeiro, M.T., Wu, T., Guestrin, C., Singh, S., 2020. Beyond accuracy: Behavioral testing of NLP models with Check- List, in: Jurafsky, D., Chai, J., Schluter, N., Tetreault, J. (Eds.), Proceedings of the 58th Annual Meeting of the As- sociation for Computational Linguistics, Association for Computational Linguistics, Online. p. 4902â4912. URL: https://aclanthology.org/2020.acl-main.442, doi:10.18653/v1/2020.acl-main.442. Russinovich, M., Salem, A., Eldan, R., 2024. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. URL:https://arxiv.org/abs/2404.01833,arXiv:2404.01833. Sadeghi, K., Banerjee, A., Gupta, S.K.S., 2020. A system-driven taxonomy of attacks and defenses in adversarial machine learning. IEEE Transactions on Emerging Topics in Computational Intelligence 4, 450â467. doi:10.1109/ TETCI.2020.2968933. Saha, A., Subramanya, A., Pirsiavash, H., 2020. Hidden trigger backdoor attacks. Proceedings of the AAAI Conference on Artificial Intelligence 34, 11957â11965. URL:https://ojs.aaai.org/index.php/AAAI/article/view/ 6871, doi:10.1609/aaai.v34i07.6871. Schiffman, M., Cisco, C., 2005. A complete guide to the common vulnerability scoring system (cvss) v1 archive. Schwinn, L., Dobre, D., Xhonneux, S., Gidel, G., Gunnemann, S., 2024. Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space. URL:https://arxiv.org/abs/2402.09063, arXiv:2402.09063. Shafahi, A., Huang, W.R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., Goldstein, T., 2018.Poison frogs!targeted clean-label poisoning attacks on neural networks, in: Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Bianchi, N., Garnett, R. (Eds.), Advances in Neural Information Processing Sys- tems, Curran Associates, Inc. URL:https://proceedings.neurips.c/paper_files/paper/2018/file/ 22722a343513ed45f14905eb07621686-Paper.pdf. Shah, S., Mehtre, B.M., 2015.An overview of vulnerability assessment and penetration testing techniques. Journal of Computer Virology and Hacking Techniques 11, 27â49.URL:https://doi.org/10.1007/ s11416-014-0231-x. Shannon, C.E., 1948. A mathematical theory of communication. The Bell System Technical Journal 27, 379â423. doi:10.1002/j.1538-7305.1948.tb01338.x. Shayegani, E., Mamun, M.A.A., Fu, Y., Zaree, P., Dong, Y., Abu-Ghazaleh, N., 2023. Survey of vulnerabilities in large language models revealed by adversarial attacks. arXiv preprint arXiv:2310.10844 . Shen, X., Chen, Z., Backes, M., Shen, Y., Zhang, Y., 2024. âdo anything nowâ: Characterizing and evaluating in-the-wild jailbreak prompts on large language models. URL:https://arxiv.org/abs/2308.03825,arXiv:2308.03825. Shen, Y., He, X., Han, Y., Zhang, Y., 2022. Model stealing attacks against inductive graph neural networks, in: 2022 IEEE Symposium on Security and Privacy (SP), IEEE. p. 1175â1192. Shi, J., Yuan, Z., Liu, Y., Huang, Y., Zhou, P., Sun, L., Gong, N.Z., 2024a. Optimization-based prompt injection attack to llm-as-a-judge. URL:https://arxiv.org/abs/2403.17710,arXiv:2403.17710. Shi, W., Ajith, A., Xia, M., Huang, Y., Liu, D., Blevins, T., Chen, D., Zettlemoyer, L., 2024b. Detecting pretraining data from large language models. URL:https://arxiv.org/abs/2310.16789,arXiv:2310.16789. Shumailov, I., Zhao, Y., Bates, D., Papernot, N., Mullins, R., Anderson, R., 2021. Sponge examples: Energy-latency attacks on neural networks, in: 2021 IEEE European Symposium on Security and Privacy (EuroS&P), p. 212â231. doi:10.1109/EuroSP51992.2021.00024. Sitawarin, C., 2023. llm-sp/at main ¡ chawins/llm-sp â github.com.https://github.com/chawins/llm-sp? search=1. Sitawarin, C., Mu, N., Wagner, D., Araujo, A., 2024. Pal: Proxy-guided black-box attack on large language models. 66 URL:https://arxiv.org/abs/2402.09674,arXiv:2402.09674. Song, L., Shokri, R., Mittal, P., 2019. Membership inference attacks against adversarially robust deep learning models, in: 2019 IEEE Security and Privacy Workshops (SPW), IEEE. p. 50â56. Spring, J.M., Householder, A., Hatleback, E., Manion, A., Oliver, M., Sarvapalli, V., Tyzenhaus, L., Yarbrough, C., 2021. Prioritizing vulnerability response: A stakeholder-specific vulnerability categorization (version 2.0). Technical Report. Technical Report. CARNEGIE-MELLON UNIV PITTSBURGH PA. Subramanya, A., Pillai, V., Pirsiavash, H., 2019. Fooling network interpretation in image classification, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). Szegedy, C., 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 . Tian, Z., Cui, L., Liang, J., Yu, S., 2022. A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Computing Surveys 55, 1â35. Tolpegin, V., Truex, S., Gursoy, M.E., Liu, L., 2020. Data poisoning attacks against federated learning systems, in: Computer Security â ESORICS 2020, Springer International Publishing, Cham. p. 480â501. Vaswani, A., 2017. Attention is all you need. Advances in Neural Information Processing Systems . Wang, C., Wang, Y., Hooi, B., Cai, Y., Peng, N., Chang, K.W., 2024. Con-recall: Detecting pre-training data in llms via contrastive decoding. URL:https://arxiv.org/abs/2409.03363,arXiv:2409.03363. Wang, C., Zhang, D., Huang, S., Li, X., Ding, L., 2021. Crafting adversarial email content against machine learning based spam email detection, in: Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems, Association for Computing Machinery, New York, NY, USA. p. 23â28. URL:https://doi.org/10. 1145/3457340.3458302, doi:10.1145/3457340.3458302. Wang, H., Shu, K., 2024. Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment. URL:https://arxiv.org/abs/2311.09433,arXiv:2311.09433. Wang, S., Ko, R.K., Bai, G., Dong, N., Choi, T., Zhang, Y., 2023. Evasion attack and defense on machine learning models in cyber-physical systems: A survey. IEEE Communications Surveys & Tutorials . Wang, Y., Chaudhuri, K., 2018. Data poisoning attacks against online learning. URL:https://arxiv.org/abs/ 1808.08994,arXiv:1808.08994. Wei, C., Zhao, Y., Gong, Y., Chen, K., Xiang, L., Zhu, S., 2024. Hidden in plain sight: Exploring chat history tampering in interactive language models. URL:https://arxiv.org/abs/2405.20234,arXiv:2405.20234. Williams, J., 2023. OWASP Risk Rating Methodology â OWASP Foundation â owasp.org.https://owasp.org/ w-community/OWASP_Risk_Rating_Methodology. [Accessed 27-11-2024]. Willison, S., 2024.Prompt injection and jailbreaking are not the same thing â simonwillison.net.https:// simonwillison.net/2024/Mar/5/prompt-injection-jailbreaking/. [Accessed 27-11-2024]. Wintel, F., 2020.When AI Becomes an Attack Surface: Adversarial Attacks â Computer Science Blog @ HdM Stuttgart â blog.mi.hdm-stuttgart.de.https://blog.mi.hdm-stuttgart.de/index.php/2020/08/19/ adversarial-attacks/. [Accessed 27-11-2024]. Wu, A., Han, Y., Zhang, Q., Kuang, X., 2019. Untargeted adversarial attack via expanding the semantic gap, in: 2019 IEEE International Conference on Multimedia and Expo (ICME), IEEE. p. 514â519. Wu, B., Zhu, Z., Liu, L., Liu, Q., He, Z., Lyu, S., 2023. Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective. arXiv preprint arXiv:2302.09457 . Wu, C.H., Koh, J.Y., Salakhutdinov, R., Fried, D., Raghunathan, A., 2024. Adversarial attacks on multimodal agents. URL:https://arxiv.org/abs/2406.12814,arXiv:2406.12814. Xiao, Z., Yang, Y., Chen, G., Chen, Y., 2024. Distract large language models for automatic jailbreak attack. URL: https://arxiv.org/abs/2403.08424,arXiv:2403.08424. Xie, C., Huang, K., Chen, P.Y., Li, B., 2019. Dba: Distributed backdoor attacks against federated learning, in: Interna- tional conference on learning representations. Xu, Y., Zhong, X., Yepes, A.J., Lau, J.H., 2021. Grey-box adversarial attack and defence for sentiment classification. arXiv preprint arXiv:2103.11576 . Xu, Z., Huang, R., Chen, C., Wang, X., 2024a. Uncovering safety risks of large language models through concept activation vector. URL:https://arxiv.org/abs/2404.12038,arXiv:2404.12038. Xu, Z., Liu, Y., Deng, G., Li, Y., Picek, S., 2024b. A comprehensive study of jailbreak attack versus defense for large language models, in: Findings of the Association for Computational Linguistics ACL 2024, p. 7432â7449. Xue, J., Zheng, M., Hua, T., Shen, Y., Liu, Y., B Ě ol Ě oni, L., Lou, Q., 2023.Trojllm:A black- box trojan prompt attack on large language models, in:Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S. (Eds.), Advances in Neural Information Processing Systems, Curran Asso- ciates, Inc.. p. 65665â65677. URL:https://proceedings.neurips.c/paper_files/paper/2023/file/ cf04d01a0e76f8b13095349d9caca033-Paper-Conference.pdf. Yan, J., Yadav, V., Li, S., Chen, L., Tang, Z., Wang, H., Srinivasan, V., Ren, X., Jin, H., 2024a. Backdooring instruction- tuned large language models with virtual prompt injection.URL:https://arxiv.org/abs/2307.16888, arXiv:2307.16888. 67 Yan, S., Wang, S., Duan, Y., Hong, H., Lee, K., Kim, D., Hong, Y., 2024b. An llm-assisted easy-to-trigger backdoor attack on code completion models: Injecting disguised vulnerabilities against strong detection. URL:https:// arxiv.org/abs/2406.06822,arXiv:2406.06822. Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., Zhang, Y., 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing 4, 100211. URL:https://w.sciencedirect. com/science/article/pii/S266729522400014X, doi:https://doi.org/10.1016/j.hcc.2024.100211. Yerlikaya, F.A., Bahtiyar, S ̧ ., 2022. Data poisoning attacks against machine learning algorithms. Expert Systems with Applications 208, 118101. Yu, W., Pang, T., Liu, Q., Du, C., Kang, B., Huang, Y., Lin, M., Yan, S., 2023. Bag of tricks for training data extraction from language models. URL:https://arxiv.org/abs/2302.04460,arXiv:2302.04460. Yuan, X., Ding, L., Zhang, L., Li, X., Wu, D.O., 2022. Es attack: Model stealing against deep neural networks without data hurdles. IEEE Transactions on Emerging Topics in Computational Intelligence 6, 1258â1270. Zhang, C., Morris, J.X., Shmatikov, V., 2024a. Extracting prompts by inverting llm outputs. URL:https://arxiv. org/abs/2405.15012,arXiv:2405.15012. Zhang, H., Lu, S., Li, Z., Jin, Z., Ma, L., Liu, Y., Li, G., 2024b. Codebert-attack: Adversarial attack against source code deep learning models via pre-trained model. Journal of Software: Evolution and Process 36, e2571. URL: https://onlinelibrary.wiley.com/doi/abs/10.1002/smr.2571, doi:https://doi.org/10.1002/smr. 2571,arXiv:https://onlinelibrary.wiley.com/doi/pdf/10.1002/smr.2571. Zhang, Q., Zeng, B., Zhou, C., Go, G., Shi, H., Jiang, Y., 2024c. Human-imperceptible retrieval poisoning attacks in llm-powered applications. URL:https://arxiv.org/abs/2404.17196,arXiv:2404.17196. Zhang, W.E., Sheng, Q.Z., Alhazmi, A., Li, C., 2020. Adversarial attacks on deep-learning models in natural language processing: A survey. ACM Transactions on Intelligent Systems and Technology (TIST) 11, 1â41. Zhang, Z., Wen, J., Huang, M., 2023. Ethicist: Targeted training data extraction through loss smoothed soft prompting and calibrated confidence estimation. URL:https://arxiv.org/abs/2307.04401,arXiv:2307.04401. Zhao, P., Wang, S., Gongye, C., Wang, Y., Fei, Y., Lin, X., 2019. Fault sneaking attack: A stealthy framework for misleading deep neural networks, in: Proceedings of the 56th Annual Design Automation Conference 2019, p. 1â6. Zhao, Y., Pang, T., Du, C., Yang, X., Li, C., Cheung, N.M.M., Lin, M., 2024. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems 36. Zhou, M., Zhou, W., Huang, J., Yang, J., Du, M., Li, Q., 2024. Stealthy and effective physical adversarial attacks in autonomous driving. IEEE Transactions on Information Forensics and Security . Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., Fredrikson, M., 2023. Universal and transferable adversarial attacks on aligned language models. URL:https://arxiv.org/abs/2307.15043,arXiv:2307.15043. Zou, J., Zhang, S., Qiu, M., 2024. Adversarial attacks on large language models, in: International Conference on Knowledge Science, Engineering and Management, Springer. p. 85â96. 68 StartExploitation Utility Technical Impact Public-Safety Impact Immediate Immediate Public-Safety Impact Immediate Immediate Technical Impact Public-Safety Impact Immediate Out-of-Cycle Public-Safety Impact Immediate Out-of-Cycle Technical Impact Public-Safety Impact Immediate Out-of-Cycle Public-Safety Impact Immediate Out-of-Cycle Utility Technical Impact Public-Safety Impact Immediate Out-of-Cycle Public-Safety Impact Immediate Out-of-Cycle Technical Impact Public-Safety Impact Immediate Out-of-Cycle Public-Safety Impact Immediate Scheduled Technical Impact Public-Safety Impact Immediate Scheduled Public-Safety Impact Out-of-Cycle Scheduled Utility Technical Impact Public-Safety Impact Out-of-Cycle Out-of-Cycle Public-Safety Impact Out-of-Cycle Scheduled Technical Impact Public-Safety Impact Out-of-Cycle Scheduled Public-Safety Impact Out-of-Cycle Scheduled Technical Impact Public-Safety Impact Out-of-Cycle Scheduled Public-Safety Impact Scheduled Defer active super e f ective total significant minimal partial significant minimal efficient total significant minimal partial significant minimal laborious total significant minimal partial significant minimal poc super e f ective total significant minimal partial significant minimal efficient total significant minimal partial significant minimal laborious total significant minimal partial significant minimal none super e f ective total significant minimal partial significant minimal efficient total significant minimal partial significant minimal laborious total significant minimal partial significant minimal Figure 4: Decision Tree for Suppliers in SSVC (Spring et al., 2021) 69 (a) White-box jailbreak N°DREAD 18 (H)9 (H)8 (H)8 (H)6 (M) 26 (M)6 (M)6 (M)6 (M)5 (M) 37 (H)7 (H)7 (H)7 (H)5 (M) 47 (H)6 (M)5 (M)6 (M)5 (M) 58 (H)9 (H)7 (H)7 (H)6 (M) 68 (H)8 (H)7 (H)8 (H)6 (M) 77 (H)6 (M)7 (H)6 (M)5 (M) 88 (H)9 (H)8 (H)7 (H)6 (M) Ěx7.387.56.756.885.5 Ď0.691.320.940.780.5 COV9.44%17.64%14.34%11.35%9.09% (b) Black-box jailbreak N°DREAD 18 (H)7 (H)7 (H)8 (H)5 (M) 28 (H)8 (H)8 (H)7 (H)5 (M) 38 (H)8 (H)7 (H)7 (H)6 (M) 49 (H)8 (H)8 (H)8 (H)6 (M) 58 (H)9 (H)8 (H)7 (H)5 (M) 68 (H)6 (M)7 (H)7 (H)5 (M) 79 (H)8 (H)9 (H)8 (H)5 (M) 88 (H)7 (H)7 (H)7 (H)5 (M) Ěx8.257.637.637.385.25 Ď0.430.850.690.480.43 COV5.25%11.24%9.13%6.56%8.25% (c) Prompt-injection attacks N°DREAD 18 (H)9 (H)8 (H)7 (H)6 (M) 28 (H)8 (H)8 (H)7 (H)6 (M) 37 (H)9 (H)7 (H)6 (M)7 (H) 47 (H)8 (H)8 (H)8 (H)5 (M) 58 (H)9 (H)9 (H)8 (H)6 (M) 68 (H)8 (H)7 (H)8 (H)5 (M) 77 (H)6 (M)6 (M)7 (H)5 (M) 87 (H)6 (M)7 (H)6 (M)5 (M) Ěx7.57.887.57.135.63 Ď0.51.660.870.780.69 COV6.67%21.06%11.6%10.9%12.2% (d) Evasion attacks N°DREAD 17 (H)7 (H)6 (M)7 (H)5 (M) 27 (H)9 (H)8 (H)7 (H)5 (M) 36 (M)8 (H)6 (M)6 (M)5 (M) 48 (H)8 (H)7 (H)7 (H)5 (M) 56 (M)9 (H)7 (H)7 (H)6 (M) 68 (H)8 (H)8 (H)8 (H)5 (M) 79 (H)8 (H)8 (H)8 (H)5 (M) 88 (H)8 (H)8 (H)8 (H)5 (M) Ěx7.388.137.257.255.13 Ď0.990.600.830.670.34 COV13.45%7.38%11.44%9.12%6.45% (e) Model-extraction attacks N°DREAD 19 (H)8 (H)8 (H)8 (H)5 (M) 28 (H)9 (H)8 (H)7 (H)5 (M) 39 (H)8 (H)8 (H)9 (H)6 (M) 48 (H)8 (H)7 (H)7 (H)5 (M) 58 (H)5 (M)6 (M)8 (H)4 (M) 67 (H)7 (H)7 (H)7 (H)6 (M) 78 (H)6 (M)7 (H)8 (H)5 (M) 87 (H)7 (H)7 (H)6 (M)5 (M) Ěx87.257.257.55.13 Ď0.711.090.670.750.60 COV8.88%15.03%9.12%10.00%11.72% (f) Model-inference attacks N°DREAD 18 (H)9 (H)7 (H)7 (H)6 (M) 27 (H)8 (H)7 (H)7 (H)5 (M) 36 (M)5 (M)6 (M)6 (M)5 (M) 48 (H)6 (M)6 (M)7 (H)5 (M) 59 (H)8 (H)8 (H)9 (H)6 (M) 67 (H)7 (H)7 (H)7 (H)5 (M) 78 (H)7 (H)7 (H)7 (H)5 (M) 88 (H)8 (H)7 (H)7 (H)5 (M) Ěx7.637.256.887.135.25 Ď0.831.090.640.830.47 COV10.87%15.03%9.30%11.65%8.95% (g) Poisoning/Trojan/Backdoor attacks N°DREAD 18 (H)8 (H)8 (H)8 (H)6 (M) 28 (H)6 (M)7 (H)7 (H)5 (M) 38 (H)8 (H)8 (H)8 (H)6 (M) 47 (H)6 (M)6 (M)6 (M)4 (M) 59 (H)7 (H)6 (M)9 (H)5 (M) 68 (H)9 (H)8 (H)8 (H)6 (M) 78 (H)8 (H)7 (H)7 (H)5 (M) 88 (H)8 (H)8 (H)8 (H)6 (M) Ěx87.57.257.625.38 Ď0.51.000.830.860.70 COV6.25%13.34%11.45%11.28%13.03% Table 14: Variations of DREAD assessments 70 (a) White-box jailbreak N°AVACPRUISCIA 1NHNNCLHN 2NHNNCLHN 3NHNNCLHN 4NHLNCLHN 5NLLNCLHN 6NLLNCLHN 7NHNRCLHN 8NLNRCLHN MNHNNCLHN p i 15/85/86/81111 H0.000.950.950.810.000.000.000.00 (b) Black-box jailbreak N°AVACPRUISCIA 1NLNNULLN 2NLNNULHN 3NLNNULLN 4NLNNCLNN 5NLNNCLNN 6NHNNULLN 7NLLNULHN 8NLNNULHN MNLNNULL,HN p i 17/87/816/813/81 H0.000.540.540.000.810.001.560.00 (c) Prompt-injection attacks N°AVACPRUISCIA 1NLNNUNHN 2NHNRULHN 3NLNNULHN 4NHNRCLHN 5NLNNCLHN 6NHNRCLHN 7NHNRULHN 8NHNNULHN MNHNN,RULHN p i 15/814/85/87/811 H0.000.950.001.000.950.540.000.00 (d) Evasion attacks N°AVACPRUISCIA 1NLNNUNHN 2NLNNUNHN 3NHNNUNHN 4NHNNUNHN 5NLNNUNHN 6NLNNUNHN 7NHNNUNHN 8NLNNUNHN MNLNNUNHN p i 15/8111111 H0.000.950.000.000.000.000.000.00 (e) Model-extraction attacks N°AVACPRUISCIA 1NHNNCHNN 2NLNNCHNN 3NLNNCHNN 4NHNNCHNN 5NHNNCHNN 6NHNNCHNN 7NHNNCHNN 8NLNNCHNN MNHNNCHNN p i 15/8111111 H0.000.950.000.000.000.000.000.00 (f) Model-inference attacks N°AVACPRUISCIA 1NLNNCHNN 2NLNNCHNN 3NHNNCHNN 4NHNNCHNN 5NLNNCHNN 6NLNNCHNN 7NLNNCHNN 8NLNNCHNN MNLNNCHNN p i 16/8111111 H0.000.810.000.000.000.000.000.00 (g) Poisoning/Trojan/Backdoor attacks N°AVACPRUISCIA 1NHNNCLHN 2LHLNULHN 3NLLNCLHN 4NHLNULHN 5NHLNULHN 6NLNNCLHN 7NHNNCLHN 8NHNNCLHN MNHN,LNCLHN p i 7/86/84/815/8111 H0.540.811.000.000.950.000.000.00 Table 15: Variations of CVSS assessments 71 (a) White-box jailbreak N°SLMOSEDEEAIDLCLILAFDRDNCPV 17 (H)6 (H)6 (H)6 (H)7 (H)8 (H)5 (M)5 (M)5 (M)7 (H)4 (M)7 (H)8 (H)4 (M)4 (M) 27 (H)6 (H)5 (M)5 (M)5 (M)7 (H)5 (M)5 (M)5 (M)6 (H)3 (M)6 (H)7 (H)4 (M)4 (M) 37 (H)7 (H)5 (M)6 (H)6 (H)7 (H)5 (M)5 (M)5 (M)7 (H)3 (M)6 (H)7 (H)6 (H)5 (M) 45 (M)6 (H)4 (M)3 (M)4 (M)6 (H)5 (M)4 (M)4 (M)6 (H)1 (L)5 (H)6 (H)3 (M)4 (M) 56 (H)7 (H)6 (H)5 (M)6 (H)7 (H)6 (H)5 (M)5 (M)7 (H)1 (L)6 (H)7 (H)4 (M)4 (M) 67 (H)7 (H)6 (H)6 (H)6 (H)7 (H)5 (M)5 (M)5 (M)7 (H)2 (L)6 (H)7 (H)4 (M)5 (M) 76 (H)6 (H)5 (M)4 (M)5 (M)6 (H)5 (M)5 (M)4 (M)6 (H)1 (L)5 (M)6 (H)3 (M)3 (M) 87 (H)7 (H)7 (H)5 (M)7 (H)7 (H)6 (H)5 (M)4 (M)7 (H)1 (L)6 (H)7 (H)4 (M)4 (M) Ěx6.56.55.635.136.006.885.254.884.626.622.005.886.754.004.12 COV10.92%7.69%13.34%15.23%14.83%8.72%8.25%6.78%10.47%7.31%55.90%10.20%9.80%21.65%14.53% (b) Black-box jailbreak N°SLMOSEDEEAIDLCLILAFDRDNCPV 16 (H)8 (H)8 (H)6 (H)6 (H)7 (H)5 (M)6 (H)8 (H)2 (L)1 (L)6 (H)8 (H)5 (M)7 (H) 25 (M)8 (H)8 (H)6 (H)6 (H)7 (H)6 (H)6 (H)8 (H)1 (L)1 (L)6 (H)8 (H)4 (M)6 (H) 34 (M)8 (H)8 (H)6 (H)7 (H)8 (H)7 (H)7 (H)9 (H)1 (L)1 (L)7 (H)8 (H)5 (M)9 (H) 47 (H)8 (H)7 (H)5 (M)6 (H)8 (H)6 (H)8 (H)8 (H)1 (L)1 (L)6 (H)8 (H)5 (M)8 (H) 56 (H)8 (H)8 (H)5 (M)6 (H)8 (H)5 (M)7 (H)7 (H)1 (L)1 (L)5 (M)7 (H)5 (M)7 (H) 66 (H)8 (H)8 (H)6 (H)6 (H)8 (H)6 (H)7 (H)7 (H)2 (L)1 (L)6 (H)7 (H)5 (M)7 (H) 76 (H)9 (H)8 (H)5 (M)6 (H)8 (H)5 (M)7 (H)8 (H)3 (M)1 (L)6 (H)9 (H)7 (H)8 (H) 86 (H)8 (H)7 (H)5 (M)6 (H)8 (H)5 (M)7 (H)8 (H)3 (M)1 (L)6 (H)8 (H)5 (M)8 (H) Ěx5.758.127.755.506.127.755.757.008.001.621.006.007.885.127.50 COV14.42%4.07%5.59%9.09%5.40%5.59%11.48%9.29%8.25%55.56%0.00%9.00%7.63%12.91%11.60% (c) Prompt-injection attacks N°SLMOSEDEEAIDLCLILAFDRDNCPV 16 (H)8 (H)7 (H)5 (M)6 (H)8 (H)6 (H)6 (H)3 (M)8 (H)3 (M)6 (H)8 (H)4 (M)4 (M) 26 (H)8 (H)7 (H)6 (H)6 (H)7 (H)5 (M)7 (H)5 (M)8 (H)3 (M)7 (H)8 (H)4 (M)6 (H) 36 (H)8 (H)7 (H)5 (M)6 (H)8 (H)6 (H)6 (H)5 (M)8 (H)3 (M)7 (H)8 (H)4 (M)5 (M) 46 (H)8 (H)7 (H)6 (H)6 (H)8 (H)6 (H)7 (H)6 (H)7 (H)3 (M)7 (H)8 (H)5 (M)7 (H) 55 (M)8 (H)7 (H)6 (H)6 (H)8 (H)6 (H)7 (H)6 (H)7 (H)3 (M)7 (H)8 (H)5 (M)6 (H) 67 (H)8 (H)8 (H)6 (H)5 (M)8 (H)5 (M)8 (H)7 (H)9 (H)3 (M)7 (H)8 (H)5 (M)7 (H) 76 (H)8 (H)7 (H)6 (H)5 (M)7 (H)5 (M)6 (H)4 (M)8 (H)3 (M)6 (H)7 (H)3 (M)5 (M) 86 (H)7 (H)6 (H)6 (H)5 (M)6 (H)4 (M)6 (H)3 (M)8 (H)1 (L)5 (M)7 (H)2 (L)3 (M) Ěx6.127.886.255.755.627.625.506.754.757.882.626.507.754.005.50 COV7.84%4.18%10.56%7.48%8.54%9.08%11.64%9.78%24.00%7.63%33.59%10.92%5.55%21.75%19.82% (d) Evasion attacks N°SLMOSEDEEAIDLCLILAFDRDNCPV 17 (H)7 (H)5 (M)4 (M)5 (M)7 (H)5 (M)6 (H)1 (L)8 (H)0 (L)5 (M)7 (H)4 (M)3 (M) 26 (H)7 (H)6 (H)5 (M)5 (M)7 (H)5 (M)6 (H)1 (L)8 (H)0 (L)6 (H)7 (H)5 (M)3 (M) 36 (M)7 (H)5 (M)5 (M)5 (M)6 (H)4 (M)5 (M)1 (L)7 (H)1 (L)5 (M)6 (H)4 (M)3 (M) 47 (H)8 (H)6 (H)5 (M)5 (M)7 (H)5 (M)6 (H)2 (L)8 (H)1 (L)7 (H)8 (H)5 (M)4 (M) 56 (H)7 (H)6 (H)5 (M)5 (M)7 (H)5 (M)6 (H)1 (L)7 (H)1 (L)6 (H)7 (H)5 (M)4 (M) 67 (H)8 (H)7 (H)5 (M)6 (H)7 (H)6 (H)7 (H)2 (L)9 (H)1 (L)7 (H)8 (H)6 (H)5 (M) 77 (H)8 (H)7 (H)5 (M)6 (H)7 (H)6 (H)7 (H)2 (L)9 (H)1 (L)7 (H)8 (H)6 (H)5 (M) 87 (H)8 (H)7 (H)6 (H)6 (H)8 (H)6 (H)7 (H)1 (L)8 (H)1 (L)7 (H)8 (H)5 (M)4 (M) Ěx6.757.506.125.125.387.125.386.501.258.000.756.387.505.124.00 COV6.96%6.67%11.29%9.18%8.92%6.76%11.90%9.85%49.60%9.38%82.67%11.76%8.80%12.91%20.75% (e) Model-extraction attacks N°SLMOSEDEEAIDLCLILAFDRDNCPV 17 (H)8 (H)7 (H)6 (H)5 (M)6 (H)5 (M)7 (H)8 (H)1 (L)1 (L)7 (H)8 (H)7 (H)8 (H) 26 (H)8 (H)7 (H)5 (M)6 (H)7 (H)5 (M)7 (H)8 (H)2 (L)2 (L)7 (H)9 (H)7 (H)8 (H) 36 (H)8 (H)7 (H)6 (H)6 (H)6 (H)5 (M)8 (H)9 (H)1 (L)1 (L)7 (H)8 (H)7 (H)9 (H) 46 (H)8 (H)7 (H)6 (H)5 (M)7 (H)5 (M)7 (H)8 (H)1 (L)1 (L)7 (H)9 (H)7 (H)9 (H) 56 (H)8 (H)7 (H)6 (H)5 (M)6 (H)4 (M)7 (H)8 (H)1 (L)1 (L)7 (H)8 (H)7 (H)9 (H) 66 (H)7 (H)7 (H)5 (M)5 (M)6 (H)5 (M)7 (H)8 (H)2 (L)2 (L)7 (H)9 (H)6 (H)8 (H) 76 (H)8 (H)7 (H)5 (M)5 (M)6 (H)5 (M)7 (H)9 (H)2 (L)2 (L)7 (H)9 (H)7 (H)9 (H) 87 (H)8 (H)7 (H)6 (H)5 (M)6 (H)5 (M)8 (H)8 (H)1 (L)1 (L)7 (H)9 (H)7 (H)9 (H) Ěx6.387.887.005.755.256.384.887.388.251.251.257.008.626.888.62 COV7.53%4.18%0.00%7.48%8.20%7.53%6.78%6.50%5.67%49.60%49.60%0.00%6.96%4.80%6.96% (f) Model-inference attacks N°SLMOSEDEEAIDLCLILAFDRDNCPV 16 (H)7 (H)7 (H)6 (H)5 (M)7 (H)6 (H)7 (H)8 (H)1 (L)2 (L)7 (H)8 (H)7 (H)8 (H) 26 (H)7 (H)7 (H)6 (H)5 (M)6 (H)4 (M)6 (H)8 (H)2 (L)2 (L)7 (H)8 (H)8 (H)8 (H) 35 (M)7 (H)7 (H)5 (M)5 (M)6 (H)5 (M)6 (H)8 (H)1 (L)2 (L)6 (H)7 (H)7 (H)8 (H) 46 (H)7 (H)7 (H)6 (H)6 (H)5 (M)6 (H)6 (H)8 (H)1 (L)2 (L)7 (H)7 (H)7 (H)8 (H) 56 (H)8 (H)7 (H)6 (H)5 (M)6 (H)6 (H)8 (H)9 (H)1 (L)2 (L)8 (H)8 (H)8 (H)9 (H) 66 (H)7 (H)6 (H)6 (H)5 (M)6 (H)5 (M)7 (H)8 (H)2 (L)2 (L)8 (H)8 (H)8 (H)9 (H) 76 (H)8 (H)7 (H)6 (H)6 (H)6 (H)5 (M)7 (H)8 (H)2 (L)2 (L)8 (H)8 (H)7 (H)9 (H) 85 (M)7 (H)7 (H)6 (H)6 (H)7 (H)6 (H)7 (H)7 (H)2 (L)2 (L)8 (H)8 (H)8 (H)6 (H) Ěx5.887.256.886.005.256.385.507.008.001.252.007.507.757.508.50 COV8.17%6.48%4.80%7.50%8.20%7.53%11.64%9.29%6.25%49.60%0.00%8.80%5.55%6.67%7.53% (g) Poisoning/Trojan/Backdoor attacks N°SLMOSEDEEAIDLCLILAFDRDNCPV 16 (H)8 (H)7 (H)6 (H)5 (M)7 (H)5 (M)7 (H)6 (H)7 (H)4 (M)7 (H)8 (H)5 (M)6 (H) 28 (H)8 (H)6 (H)5 (M)5 (M)6 (H)4 (M)5 (M)7 (H)7 (H)3 (M)7 (H)8 (H)6 (H)7 (H) 37 (H)8 (H)8 (H)6 (H)6 (H)7 (H)5 (M)6 (H)7 (H)8 (H)4 (M)7 (H)8 (H)6 (H)7 (H) 47 (H)8 (H)6 (H)6 (H)5 (M)6 (H)4 (M)6 (H)6 (H)8 (H)4 (M)7 (H)8 (H)6 (H)6 (H) 57 (H)8 (H)7 (H)6 (H)4 (M)6 (H)4 (M)8 (H)6 (H)8 (H)3 (M)8 (H)9 (H)7 (H)6 (H) 68 (H)9 (H)7 (H)6 (H)4 (M)6 (H)4 (M)9 (H)6 (H)8 (H)4 (M)8 (H)9 (H)7 (H)6 (H) 78 (H)9 (H)7 (H)7 (H)5 (M)7 (H)4 (M)9 (H)7 (H)8 (H)4 (M)8 (H)9 (H)8 (H)7 (H) 88 (H)8 (H)7 (H)6 (H)4 (M)6 (H)4 (M)8 (H)6 (H)8 (H)4 (M)7 (H)8 (H)6 (H)6 (H) Ěx7.388.257.006.124.886.504.257.256.508.003.757.508.256.506.50 COV9.35%5.67%8.57%7.84%13.12%7.69%11.06%15.03%7.69%6.25%12.53%6.67%5.67%12.77%7.69% Table 16: Variations of OWASP R assessments 72 (a) White-box jailbreak N°EAVTP 1PYCTS 2PNCTS 3PNCTS 4PNCPM 5PYCTS 6PYCTS 7PNCPM 8PYCTS MPN,YCTS p i 14/816/86/8 H0.001.000.000.810.81 (b) Black-box jailbreak N°EAVTP 1PYCTS 2PYDPM 3PYCTS 4PYCTS 5PYCTS 6PYDPM 7AYCTS 8PYCTS MPYCTS p i 7/816/86/86/8 H0.540.000.810.810.81 (c) Prompt-injection attacks N°EAVTP 1PYCTS 2PYCTS 3PYCTS 4PYCTS 5PYCTS 6PYCTS 7NNDPM 8PYCTS MPYCTS p i 7/87/87/87/87/8 H0.540.540.540.540.54 (d) Evasion attacks N°EAVTP 1PYCPS 2PYCPS 3AYCPS 4PYCPS 5PNDPM 6PYCPS 7PYCPS 8PYCPS MPYCPS p i 7/87/87/817/8 H0.540.540.540.000.54 (e) Model-extraction attacks N°EAVTP 1PYCTS 2PYCTS 3PYCTS 4PYCTS 5PNCTS 6PYCTS 7PYCTS 8PYCTS MPYCTS p i 17/8111 H0.000.540.000.000.00 (f) Model-inference attacks N°EAVTP 1PYCTS 2PYCTS 3PNDPM 4PYCTS 5PYCTS 6PYDPM 7PYCTS 8PYCTS MPYCTS p i 17/86/86/86/8 H0.000.540.810.810.81 (g) Poisoning/Trojan/Backdoor attacks N°EAVTP 1PYCTS 2PYCTS 3PYCTS 4PNDPM 5PYCTS 6PYCTS 7PYCTS 8PYCTS MPYCTS p i 17/87/87/87/8 H0.000.540.540.540.54 Table 17: Variations of SSVC assessments 73 Table A.18: Detailed assessment of White-box Jailbreak attacks with DREAD N°LLMDREADScore 1 GPT-4o8 (H)8 (H)7 (H)7 (H)5 (M)7 (H) LLAMA38 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity9 (H)9 (H)8 (H)8 (H)6 (M)8 (H) Avg8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) 2 GPT-4o6 (M)5 (M)6 (H)6 (M)5 (M)5.4 (M) LLAMA35 (M)6 (M)5 (M)5 (M)4 (M)5 (M) Perplexity8 (H)7 (H)8 (H)7 (H)5 (M)7 (H) Avg6 (M)6 (M)6 (M)6 (M)5 (M)5.8 (M) 3 GPT-4o6 (M)5 (M)7 (H)6 (M)5 (M)5.8 (M) LLAMA37 (H)7 (H)6 (M)7 (H)5 (M)6.4 (M) Perplexity9 (H)8 (H)8 (H)8 (H)5 (M)7.6 (H) Avg7 (H)7 (H)7 (H)7 (H)5 (M)6.6 (M) 4 GPT-4o7 (H)5 (M)6 (M)7 (H)5 (M)6 (M) LLAMA36 (M)5 (M)4 (M)6 (M)4 (M)5 (M) Perplexity7 (H)7 (H)6 (M)6 (M)6 (M)6.4 (M) Avg7 (H)6 (M)5 (M)6 (M)5 (M)5.8 (M) 5 GPT-4o8 (H)9 (H)7 (H)7 (H)6 (M)7.4 (H) LLAMA39 (H)9 (H)8 (H)8 (H)6 (M)8 (H) Perplexity8 (H)9 (H)7 (H)7 (H)5 (M)7.2 (H) Avg8 (H)9 (H)7 (H)7 (H)6 (M)7.4 (H) 6 GPT-4o8 (H)8 (H)6 (M)7 (H)5 (M)6.8 (M) LLAMA38 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity9 (H)8 (H)8 (H)8 (H)6 (M)7.8 (H) Avg8 (H)8 (H)7 (H)8 (H)6 (M)7.4 (H) 7 GPT-4o7 (H)6 (M)6 (M)7 (H)6 (M)6.6 (M) LLAMA36 (M)6 (M)6 (M)6 (M)4 (M)5.6 (M) Perplexity7 (H)6 (M)7 (H)6 (M)5 (M)5.6 (M) Avg7 (H)6 (M)7 (H)6 (M)5 (M)6.2 (M) 8 GPT-4o8 (H)8 (H)7 (H)7 (H)6 (M)7.2 (H) LLAMA38 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity8 (H)9 (H)8 (H)7 (H)6 (M)7.6 (H) Avg8 (H)9 (H)8 (H)7 (H)6 (M)7.6 (H) 74 Table A.19: Detailed assessment of White-box Jailbreak with CVSS N°LLMAVACPRUISCIABase 1 GPT-4oNHNNCHHN8.7 (H) LLAMA3NLNRCNHN7.4 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNNCLHN7.5 (H) 2 GPT-4oNHNNCHHN8.7 (H) LLAMA3NHLRCNHN6.1 (M) PerplexityNHNNUNHN5.9 (M) AvgNHNNCLHN7.5 (H) 3 GPT-4oNHNNCHHN8.7 (H) LLAMA3NLNRCNHN7.4 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNNCLHN7.5 (H) 4 GPT-4oLHHNCHHN7.2 (H) LLAMA3NLNRCNHN7.4 (H) PerplexityNHNNUNHN5.9 (M) AvgNHLNCLHN7.1 (H) 5 GPT-4oLLHNCHHN7.9 (H) LLAMA3NLNRCNHN7.4 (H) PerplexityNLNNUNHN7.5 (H) AvgNLLNCLHN8.5 (H) 6 GPT-4oLLHNCHHN7.9 (H) LLAMA3NLNRCNHN7.4 (H) PerplexityNLNNUNHN7.5 (H) AvgNLLNCLHN8.5 (H) 7 GPT-4oNHNRCHHN8 (H) LLAMA3NLNRCNHN7.4 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNRCLHN6.9 (M) 8 GPT-4oNLNRCHHN9.3 (C) LLAMA3NLNRCNHN7.4 (H) PerplexityNHNNUNHN5.9 (M) AvgNLNRCLHN8.2 (H) 75 Table A.20: Detailed assessment of White-box Jailbreak with OWASP Risk Rating N°LLMSKMTOPSZEDEEAWIDCIAFDRDNCPVScore 1 GPT-4o7767675686678674.3 (C) LLAMA38685896408068002.1 (H) Perplexity7656675487578563.8 (H) Avg7666785557478443.6 (H) 2 GPT-4o7767575686578774.3 (C) LLAMA37554675507056001.4 (L) Perplexity6754566375467552.9 (M) Avg7655575556367442.8 (M) 3 GPT-4o7867675686578674.4 (C) LLAMA38655785508046802.2 (H) Perplexity7656675486578573.8 (H) Avg7756675557367653.2 (M) 4 GPT-4o4843353377057572.2 (M) LLAMA36554675507056001.4 (L) Perplexity5432456365456341.9 (M) Avg5643465446156341.9 (M) 5 GPT-4o5855665677057773.2 (M) LLAMA38685896408068002.1 (H) Perplexity6754566475467563.1 (M) Avg6765676557167442.8 (H) 6 GPT-4o6857675877057773.6 (H) LLAMA37585785508056001.7 (M) Perplexity7856675386578573.9 (H) Avg7766675557267453.2 (H) 7 GPT-4o7887665867057763.7 (H) LLAMA36554675507056001.4 (L) Perplexity5432456354345231.5 (M) Avg6654565546156332.1 (M) 8 GPT-4o7887866867057763.9 (H) LLAMA37685896408068002.1 (H) Perplexity6754566375467563 (M) Avg7775776547167443.1 (H) 76 Table A.21: Detailed assessment of White-box Jailbreak attacks with SSVC N°LLMEAVUTPScore 1 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 2 GPT-4oNNDLPMDefer LLAMA3PNCETSImmediate PerplexityPYCSTSImmediate AvgPNCETSImmediate 3 GPT-4oPNDLPMScheduled LLAMA3PNCETSImmediate PerplexityPYCSTSImmediate AvgPNCETSImmediate 4 GPT-4oPNCETSImmediate LLAMA3PNCEPMScheduled PerplexityNNDLPMDefer AvgPNCEPMScheduled 5 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 6 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 7 GPT-4oPNCEPMScheduled LLAMA3PNCEPMScheduled PerplexityNNDLPMDefer AvgPNCEPMScheduled 8 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 77 Table A.22: Detailed assessment of Black-box Jailbreak attacks with DREAD N°LLMDREADScore 1 GPT-4o8 (H)7 (H)6 (M)8 (H)5 (M)6.8 (M) LLAMA39 (H)8 (H)8 (H)9 (H)5 (M)7.6 (H) Perplexity8 (H)7 (H)8 (H)7 (H)5 (M)7 (H) Avg8 (H)7 (H)7 (H)8 (H)5 (M)7 (H) 2 GPT-4o8 (H)7 (H)8 (H)7 (H)5 (M)7 (H) LLAMA38 (H)8 (H)7 (H)8 (H)5 (M)7.2 (H) Perplexity7 (H)8 (H)9 (H)6 (M)5 (M)7 (H) Avg8 (H)8 (H)8 (H)7 (H)5 (M)7.2 (H) 3 GPT-4o7 (H)8 (H)7 (H)7 (H)6 (M)7 (H) LLAMA38 (H)8 (H)7 (H)8 (H)6 (M)7.4 (H) Perplexity8 (H)7 (H)8 (H)7 (H)6 (M)7.2 (H) Avg8 (H)8 (H)7 (H)7 (H)6 (M)7.2 (H) 4 GPT-4o8 (H)8 (H)8 (H)7 (H)6 (M)7.4 (H) LLAMA39 (H)9 (H)8 (H)9 (H)6 (M)8.2 (H) Perplexity9 (H)8 (H)8 (H)8 (H)5 (M)7.6 (H) Avg9 (H)8 (H)8 (H)8 (H)6 (M)7.8 (H) 5 GPT-4o7 (H)8 (H)7 (H)7 (H)5 (M)6.8 (M) LLAMA39 (H)9 (H)8 (H)9 (H)6 (M)8.2 (H) Perplexity7 (H)9 (H)8 (H)6 (H)5 (M)7 (H) Avg8 (H)9 (H)8 (H)7 (H)5 (M)7.4 (H) 6 GPT-4o7 (H)6 (M)7 (H)6 (M)5 (M)6.2 (M) LLAMA38 (H)6 (M)6 (M)8 (H)5 (M)6.6 (M) Perplexity8 (H)7 (H)8 (H)7 (H)6 (M)7.2 (H) Avg8 (H)6 (M)7 (H)7 (H)5 (M)6.6 (M) 7 GPT-4o8 (H)8 (H)9 (H)8 (H)4 (M)7.4 (H) LLAMA39 (H)9 (H)8 (H)9 (H)6 (M)8.2 (H) Perplexity9 (H)8 (H)9 (H)8 (H)5 (M)7.8 (H) Avg9 (H)8 (H)9 (H)8 (H)5 (M)7.8 (H) 8 GPT-4o8 (H)6 (M)7 (H)7 (H)6 (M)6.8 (M) LLAMA38 (H)8 (H)7 (H)8 (H)5 (M)7.2 (H) Perplexity7 (H)7 (H)8 (H)6 (M)5 (M)6.6 (M) Avg8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) 78 Table A.23: Detailed assessment of Black-box Jailbreak with CVSS N°LLMAVACPRUISCIABase 1 GPT-4oNLNNUHLN8.2 (H) LLAMA3NLNNCHLN8.2 (H) PerplexityNHNNUNHN5.9 (M) AvgNLNNULLN6.5 (M) 2 GPT-4oNLNNUNHN7.5 (H) LLAMA3NLNNCHLN8.2 (H) PerplexityNLNNUNHN7.5 (H) AvgNLNNULHN8.2 (H) 3 GPT-4oNLNNUHNN7.5 (H) LLAMA3NLNNCHLN8.2 (H) PerplexityNHNNUNHN5.9 (M) AvgNLNNULLN6.5 (M) 4 GPT-4oNHNNCHNN6.8 (M) LLAMA3NLNNCHLN8.2 (H) PerplexityNLNNUNHN7.5 (H) AvgNLNNCLNN7.2 (H) 5 GPT-4oNLNNCHNN8.6 (H) LLAMA3NHLNCHLN6.5 (M) PerplexityNLNNUNHN7.5 (H) AvgNLNNCLNN7.2 (H) 6 GPT-4oNLNNUHLN8.2 (H) LLAMA3NHLNCHLN6.5 (M) PerplexityNHNNUNHN5.9 (M) AvgNHNNULLN5.4 (M) 7 GPT-4oNLNNUHHN9.1 (C) LLAMA3LLHNCHLN6.7 (M) PerplexityNHNNUNHN5.9 (M) AvgNLLNULHN7.1 (H) 8 GPT-4oNLNNUHHN9.1 (C) LLAMA3NLNNCHLN8.2 (H) PerplexityNHNNUNHN5.9 (M) AvgNLNNULHN8.2 (H) 79 Table A.24: Detailed assessment of Black-box Jailbreak with OWASP Risk Rating N°LLMSKMTOPSZEDEEAWIDCIAFDRDNCPVScore 1 GPT-4o5887555374058582.9 (H) LLAMA36895896880048583.3 (H) Perplexity6875475892287563.6 (H) Avg6886675682168573.3 (H) 2 GPT-4o3887535370048201.5 (M) LLAMA37995997990059693.6 (H) Perplexity5885587582287583.5 (H) Avg5886676681168463 (H) 3 GPT-4o2999999390099694.2 (H) LLAMA36895886880048583.2 (H) Perplexity5875485992287593.7 (H) Avg4886787791178593.8 (H) 4 GPT-4o7786676570047562.6 (H) LLAMA38995997990059694.2 (H) Perplexity5855475982387583.4 (H) Avg7875686881168583.5 (H) 5 GPT-4o6875675560046452.1 (H) LLAMA37895886880048583.5 (H) Perplexity5875485982287583.5 (H) Avg6885685771157573 (H) 6 GPT-4o6787565455057562.7 (H) LLAMA36895886880048583.2 (H) Perplexity5865496892287563.5 (H) Avg6886686772169783.8 (H) 7 GPT-4o6888674377058673.5 (H) LLAMA37995997990059693.6 (H) Perplexity59633941092399894.1 (C) Avg6985687583169783.8 (H) 8 GPT-4o6888664377058673.4 (H) LLAMA36895886880048583.2 (H) Perplexity59333941082287593.2 (M) Avg6875685783168583.4 (H) 80 Table A.25: Detailed assessment of Black-box Jailbreak attacks with SSVC N°LLMEAVUTPScore 1 GPT-4oPYCSTSImmediate LLAMA3PNCLTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 2 GPT-4oPYDEPMScheduled LLAMA3PNCLTSImmediate PerplexityPYDEPMScheduled AvgPYDEPMScheduled 3 GPT-4oAYDEPMOut-of-Cycle LLAMA3PNCLTSImmediate PerplexityAYCSTSImmediate AvgAYCSTSImmediate 4 GPT-4oPYCSTSImmediate LLAMA3AYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 5 GPT-4oPYCSTSImmediate LLAMA3AYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 6 GPT-4oPYDEPMScheduled LLAMA3PYCSTSImmediate PerplexityNNDLPMDefer AvgPYDEPMScheduled 7 GPT-4oAYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityAYCSTSImmediate AvgAYCSTSImmediate 8 GPT-4oPNDLPMScheduled LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 81 Table A.26: Detailed assessment of Prompt Injection attacks with DREAD N°LLMDREADScore 1 GPT-4o8 (H)9 (H)7 (H)7 (H)6 (M)7.8 (H) LLAMA38 (H)9 (H)8 (H)7 (H)6 (M)7.6 (H) Perplexity8 (H)9 (H)8 (H)7 (H)6 (M)7.6 (H) Avg8 (H)9 (H)8 (H)7 (H)6 (M)7.6 (H) 2 GPT-4o8 (H)9 (H)8 (H)7 (H)7 (H)7.8 (H) LLAMA39 (H)8 (H)9 (H)8 (H)5 (M)7.8 (H) Perplexity7 (H)8 (H)7 (H)6 (M)5 (M)6.6 (M) Avg8 (H)8 (H)8 (H)7 (H)6 (M)7.4 (H) 3 GPT-4o8 (H)9 (H)7 (H)7 (H)6 (M)7.4 (H) LLAMA37 (H)9 (H)8 (H)6 (M)8 (H)7.6 (H) Perplexity6 (M)9 (H)6 (M)5 (M)7 (H)6.6 (M) Avg7 (H)9 (H)7 (H)6 (M)7 (H)7.2 (H) 4 GPT-4o7 (H)9 (H)8 (H)7 (H)6 (M)7.4 (H) LLAMA38 (H)8 (H)9 (H)9 (H)5 (M)7.8 (H) Perplexity9 (H)7 (H)8 (H)8 (H)5 (M)7.4 (H) Avg7 (H)8 (H)8 (H)8 (H)5 (M)7.2 (H) 5 GPT-4o8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) LLAMA39 (H)8 (H)9 (H)8 (H)5 (M)7.8 (H) Perplexity8 (H)9 (H)9 (H)7 (H)6 (M)7.8 (H) Avg8 (H)9 (H)9 (H)8 (H)6 (M)8 (H) 6 GPT-4o9 (H)8 (H)7 (H)9 (H)6 (M)7.8 (H) LLAMA38 (H)8 (H)8 (H)8 (H)6 (M)7.6 (H) Perplexity8 (H)8 (H)7 (H)6 (M)4 (M)6.6 (M) Avg8 (H)8 (H)7 (H)8 (H)5 (M)7.2 (H) 7 GPT-4o8 (H)6 (M)6 (M)7 (H)5 (M)6.4 (M) LLAMA36 (M)7 (H)6 (M)7 (H)5 (M)6.2 (M) Perplexity7 (H)6 (M)7 (H)7 (H)5 (M)6.4 (M) Avg7 (H)6 (M)6 (M)7 (H)5 (M)6.2 (M) 8 GPT-4o8 (H)6 (M)6 (M)7 (H)6 (M)6.6 (M) LLAMA38 (H)8 (H)8 (H)7 (H)6 (M)7.4 (H) Perplexity6 (M)5 (M)6 (M)5 (M)4 (M)5.2 (H) Avg7 (H)6 (M)7 (H)6 (M)5 (M)6.2 (M) 82 Table A.27: Detailed assessment of Prompt Injection with CVSS N°LLMAVACPRUISCIABase 1 GPT-4oNLNNUNHN7.5 (H) LLAMA3NLNNCHHN10 (C) PerplexityNLNNUNHN7.5 (H) AvgNLNNUNHN7.5 (H) 2 GPT-4oNHNRULHN5.9 (M) LLAMA3LHNRCHHN7.4 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNRULHN5.9 (M) 3 GPT-4oNLNNUNHN7.5 (H) LLAMA3NLNNCHHN10 (C) PerplexityNLNNUNHN7.5 (H) AvgNLNNULHN8.2 (H) 4 GPT-4oNLNRCLLN6.1 (M) LLAMA3NHNRCHHN8 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNRCLHN6.9 (M) 5 GPT-4oNLNRCLLN6.1 (M) LLAMA3NLNNCHHN10 (C) PerplexityNLNNUNHN7.5 (H) AvgNLNNCLHN9.3 (C) 6 GPT-4oNHNRCHHL8.2 (H) LLAMA3NHNRCHHN8 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNRCLHN6.9 (M) 7 GPT-4oNHNRULHN5.9 (M) LLAMA3LHNRCHHN7.4 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNRULHN5.9 (M) 8 GPT-4oNHNRULHN5.9 (M) LLAMA3NHNNCHHN8.7 (H) PerplexityNHNNUNHN5.9 (M) AvgNHNNULHN6.5 (M) 83 Table A.28: Detailed assessment of Prompt-Injection with OWASP Risk Rating N°LLMSKMTOPSZEDEEAWIDCIAFDRDNCPVScore 1 GPT-4o6865586407047002.5 (M) LLAMA36895896868589685.2 (C) Perplexity6865465739578643.4 (H) Avg6875686638368443.3 (H) 2 GPT-4o5867553308048001.5 (M) LLAMA38996997989699796.6 (C) Perplexity4855475887387583.7 (H) Avg6876675758378463.8 (H) 3 GPT-4o5865656307048001.4 (M) LLAMA37896896878589685.4 (C) Perplexity5855475878387583.8 (H) Avg6875686658378453.7 (H) 4 GPT-4o4876646533157332.1 (H) LLAMA38996997989699796.6 (C) Perplexity5855475888387583.9 (H) Avg6876686767378574.1 (C) 5 GPT-4o4877646534147332.2 (H) LLAMA37896896878589685.4 (C) Perplexity5865485888387584.1 (C) Avg5876686767378563.8 (H) 6 GPT-4o6887475878258373.8 (H) LLAMA39987786869588675.5 (C) Perplexity5875485989388584.4 (C) Avg7886585879378574.4 (C) 7 GPT-4o5867653307048001.4 (M) LLAMA38886677558577564.2 (C) Perplexity5875485988387584.3 (C) Avg6876575648367352.6 (M) 8 GPT-4o5867653308048001.7 (M) LLAMA38675473828046202.1 (H) Perplexity5865475878397583.9 (C) Avg6766564638157231.9 (M) 84 Table A.29: Detailed assessment of Prompt-Injection attacks with SSVC N°LLMEAVUTPScore 1 GPT-4oPYDEPMScheduled LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 2 GPT-4oPNDLPMScheduled LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 3 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 4 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityAYCSTSImmediate AvgPYCSTSImmediate 5 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 6 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 7 GPT-4oPNDLPMScheduled LLAMA3NNDLPMDefer PerplexityNNDLPMDefer AvgNNDLPMDefer 8 GPT-4oNNDLPMDefer LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 85 Table A.30: Detailed assessment of Evasion attacks with DREAD N°LLMDREADScore 1 GPT-4o6 (M)8 (H)7 (H)6 (M)5 (M)6.4 (M) LLAMA37 (H)6 (M)5 (M)7 (H)4 (M)5.8 (M) Perplexity8 (H)8 (H)7 (H)7 (H)6 (M)7.2 (H) Avg7 (H)7 (H)6 (M)7 (H)5 (M)6.4 (M) 2 GPT-4o7 (H)8 (H)8 (H)7 (H)4 (M)6.8 (M) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.2 (H) Perplexity7 (H)9 (H)8 (H)6 (M)5 (M)7 (H) Avg7 (H)9 (H)8 (H)7 (H)5 (M)7.2 (H) 3 GPT-4o5 (M)7 (H)6 (M)6 (M)5 (M)5.8 (M) LLAMA36 (M)9 (H)5 (M)6 (M)5 (M)6.2 (H) Perplexity6 (M)8 (H)7 (H)5 (M)6 (M)6.4 (M) Avg6 (M)8 (H)6 (M)6 (M)5 (M)6.2 (M) 4 GPT-4o8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.6 (H) Perplexity7 (H)7 (H)6 (M)6 (M)5 (M)6.2 (M) Avg8 (H)8 (H)7 (H)7 (H)5 (M)7 (H) 5 GPT-4o6 (M)9 (H)8 (H)7 (H)4 (M)6.8 (M) LLAMA36 (M)9 (H)7 (H)8 (H)6 (M)7.2 (H) Perplexity5 (M)9 (H)6 (M)5 (M)7 (H)6.4 (M) Avg6 (M)9 (H)7 (H)7 (H)6 (M)7 (H) 6 GPT-4o7 (H)8 (H)7 (H)8 (H)4 (M)6.8 (M) LLAMA39 (H)9 (H)8 (H)9 (H)5 (M)8 (H) Perplexity8 (H)8 (H)8 (H)7 (H)6 (M)7.4 (H) Avg8 (H)8 (H)8 (H)8 (H)5 (M)7.4 (H) 7 GPT-4o8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) LLAMA39 (H)9 (H)8 (H)9 (H)5 (M)8 (H) Perplexity9 (H)8 (H)8 (H)8 (H)5 (M)7.6 (H) Avg9 (H)8 (H)8 (H)8 (H)5 (M)7.6 (H) 8 GPT-4o7 (H)9 (H)8 (H)7 (H)4 (M)6.8 (M) LLAMA39 (H)8 (H)8 (H)8 (H)5 (M)7.6 (H) Perplexity9 (H)9 (H)8 (H)8 (H)5 (M)7.8 (H) Avg9 (H)9 (H)8 (H)8 (H)5 (M)7.8 (H) 86 Table A.31: Detailed assessment of Evasion attacks with CVSS N°LLMAVACPRUISCIABase 1 GPT-4oLLHNUNHN4.4 (M) LLAMA3NLNNUNHN7.5 (H) PerplexityNLNNUNHN7.5 (H) AvgNLNNUNHN7.5 (H) 2 GPT-4oLLHNUNHN4.4 (M) LLAMA3NLNNUNHN7.5 (H) PerplexityNLNNUNHN7.5 (H) AvgNLNNUNHN7.5 (H) 3 GPT-4oLLHNUNHN4.4 (M) LLAMA3NHNNUNHN5.9 (M) PerplexityNHNNUNHN5.9 (M) AvgNHNNUNHN5.9 (M) 4 GPT-4oNHNNULHN6.5 (M) LLAMA3LHNNUNHN5.1 (M) PerplexityNHNNUNHN5.9 (M) AvgNHNNUNHN5.9 (M) 5 GPT-4oLLHNUNHN4.4 (M) LLAMA3NHNNUNHN5.9 (M) PerplexityNLNNUNHN7.5 (H) AvgNLNNUNHN7.5 (H) 6 GPT-4oNLNNULHN8.2 (H) LLAMA3NLNNUNHN7.5 (H) PerplexityNLNNUNHN7.5 (H) AvgNLNNUNHN7.5 (H) 7 GPT-4oNHNNULHN6.5 (M) LLAMA3NHNNUNHN5.9 (M) PerplexityNHNNUNHN5.9 (M) AvgNHNNUNHN5.9 (M) 8 GPT-4oLLHNUNHN4.4 (M) LLAMA3NLNNUNHN7.5 (H) PerplexityNHNNUNHN5.9 (M) AvgNLNNUNHN7.5 (H) 87 Table A.32: Detailed assessment of Evasion attacks with OWASP Risk Rating N°LLMSKMTOPSZEDEEAWIDCIAFDRDNCPVScore 1 GPT-4o6543476407035201.2 (M) LLAMA38965675608067562.9 (H) Perplexity6755465728278642.9 (M) Avg7754575618057432.2 (M) 2 GPT-4o6543475407035201.2 (M) LLAMA37876786709078763.5 (H) Perplexity5765465728278642.9 (M) Avg6765575618067532.4 (M) 3 GPT-4o6756584405035201.2 (M) LLAMA36754564507056451.9 (M) Perplexity5664454738378642.8 (M) Avg6755564517156432 (M) 4 GPT-4o7865675528178522.8 (H) LLAMA38965675608067562.8 (H) Perplexity6765465738378643.1 (M) Avg7865575628178543 (H) 5 GPT-4o6543475405035201 (M) LLAMA37876786709078673.5 (H) Perplexity6765465738378643.1 (M) Avg6765575617167542.5 (M) 6 GPT-4o6875766529167522.8 (H) LLAMA38976897809089784.3 (H) Perplexity6865455739378643.2 (M) Avg7875676729178653.5 (H) 7 GPT-4o7875765628167522.5 (H) LLAMA38976897809089784.3 (H) Perplexity7865465739378643.4 (H) Avg7875676729178653.5 (H) 8 GPT-4o6865586407047001.5 (M) LLAMA39987998909099894.9 (H) Perplexity7865465739378643.4 (H) Avg7876686718178543.2 (H) 88 Table A.33: Detailed assessment of Evasion attacks with SSVC N°LLMEAVUTPScore 1 GPT-4oPYDEPMScheduled LLAMA3PYCSPSImmediate PerplexityPYCSPSImmediate AvgPYCSPSImmediate 2 GPT-4oPYCSPSImmediate LLAMA3PYCSPSImmediate PerplexityPYCSPSImmediate AvgPYCSPSImmediate 3 GPT-4oAYDEPMOut-of-Cycle LLAMA3PYCSPSImmediate PerplexityAYCSPSImmediate AvgAYCSPSImmediate 4 GPT-4oPYCSTSImmediate LLAMA3PYCSPSImmediate PerplexityPYCSPSImmediate AvgPYCSPSImmediate 5 GPT-4oPNDLPMScheduled LLAMA3PYCSPSImmediate PerplexityNNDLPMDefer AvgPNDLPMScheduled 6 GPT-4oPYCSPSImmediate LLAMA3PYCSPSImmediate PerplexityPYCSPSImmediate AvgPYCSPSImmediate 7 GPT-4oPYCSPSImmediate LLAMA3PYCSPSImmediate PerplexityAYCSPSImmediate AvgPYCSPSImmediate 8 GPT-4oPYCSPSImmediate LLAMA3PYCSPSImmediate PerplexityPYCSPSImmediate AvgPYCSPSImmediate 89 Table A.34: Detailed assessment of Model Extraction with DREAD N°LLMDREADScore 1 GPT-4o9 (H)8 (H)7 (H)7 (H)4 (M)7 (H) LLAMA38 (H)9 (H)9 (H)9 (H)5 (M)8 (H) Perplexity9 (H)8 (H)8 (H)8 (H)6 (M)7.8 (H) Avg9 (H)8 (H)8 (H)8 (H)5 (M)7.6 (H) 2 GPT-4o7 (H)8 (H)8 (H)6 (M)5 (M)6.8 (M) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.6 (H) Perplexity8 (H)9 (H)8 (H)7 (H)5 (M)7.4 (H) Avg8 (H)9 (H)8 (H)7 (H)5 (M)7.4 (H) 3 GPT-4o9 (H)7 (H)8 (H)9 (H)5 (M)7.6 (H) LLAMA39 (H)9 (H)8 (H)9 (H)7 (H)8.4 (H) Perplexity9 (H)9 (H)8 (H)8 (H)6 (M)8 (H) Avg9 (H)8 (H)8 (H)9 (H)6 (M)8 (H) 4 GPT-4o7 (H)7 (H)7 (H)6 (M)4 (M)6.2 (M) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.6 (H) Perplexity8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) Avg8 (H)8 (H)7 (H)7 (H)5 (M)7 (H) 5 GPT-4o8 (H)6 (M)6 (M)8 (H)3 (L)6.2 (M) LLAMA37 (H)4 (M)5 (M)7 (H)4 (M)5.4 (M) Perplexity9 (H)6 (M)7 (H)8 (H)5 (M)7 (H) Avg8 (H)5 (M)6 (M)8 (H)4 (M)6.2 (M) 6 GPT-4o7 (H)7 (H)7 (H)7 (H)6 (M)6.8 (M) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.6 (H) Perplexity7 (H)6 (M)7 (H)6 (M)5 (M)6.2 (M) Avg7 (H)7 (H)7 (H)7 (H)6 (M)6.2 (M) 7 GPT-4o9 (H)6 (M)7 (H)8 (H)5 (M)7 (H) LLAMA38 (H)5 (M)6 (M)8 (H)5 (M)6.4 (M) Perplexity8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) Avg8 (H)6 (M)7 (H)8 (H)5 (M)6.8 (M) 8 GPT-4o7 (H)8 (H)8 (H)6 (M)5 (M)6.8 (M) LLAMA37 (H)6 (M)6 (M)7 (H)5 (M)6.2 (M) Perplexity6 (M)6 (M)6 (M)7 (H)5 (M)6.2 (M) Avg7 (H)7 (H)7 (H)6 (M)5 (M)6.4 (M) 90 Table A.35: Detailed assessment of Model Extraction attacks with CVSS N°LLMAVACPRUISCIABase 1 GPT-4oNHLNCHNN6.8 (M) LLAMA3NHNNCHNN6.8 (M) PerplexityNLNNCHNN8.6 (H) AvgNHNNCHNN6.8 (M) 2 GPT-4oNHNNCHNN6.8 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 3 GPT-4oNHLNCHNN6.3 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 4 GPT-4oNHLNCHNN6.3 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNHNNCHNN6.8 (M) AvgNHNNCHNN6.8 (M) 5 GPT-4oNHLNCHNN6.3 (M) LLAMA3NHNNCHNN6.8 (M) PerplexityNLNNCHNN8.6 (H) AvgNHNNCHNN6.8 (M) 6 GPT-4oNHNNCHNN6.8 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNHNNCHNN6.8 (M) AvgNHNNCHNN6.8 (M) 7 GPT-4oNHNNCHNN6.8 (M) LLAMA3NHNNCHNN6.8 (M) PerplexityNHNNCHNN6.8 (M) AvgNHNNCHNN6.8 (M) 8 GPT-4oNHLNCHNN6.3 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 91 Table A.36: Detailed assessment of Model Extraction with OWASP Risk Rating N°LLMSKMTOPSZEDEEAWIDCIAFDRDNCPVScore 1 GPT-4o8988667880089984.5 (H) LLAMA36875463992168593.3 (H) Perplexity6765454782278683.1 (M) Avg7876565781178783.5 (H) 2 GPT-4o7965765881189883.9 (H) LLAMA35886685892179693.7 (H) Perplexity5765565682378683.2 (M) Avg6875675782279783.8 (H) 3 GPT-4o7888687880089894.2 (H) LLAMA36875754992168593.3 (H) Perplexity5765454792378793.3 (H) Avg6876665891178793.7 (H) 4 GPT-4o6887676780089893.9 (H) LLAMA37886685892179694 (H) Perplexity6765454782378683.2 (M) Avg6876575781179793.6 (H) 5 GPT-4o7988676780089894 (H) LLAMA35875463992168593.2 (M) Perplexity6866454682378793.3 (H) Avg6876564781178793.4 (H) 6 GPT-4o7875665781179783.5 (H) LLAMA36886685892179694 (H) Perplexity5665344782378682.9 (M) Avg6775565782279683.5 (H) 7 GPT-4o6975666792189894 (C) LLAMA37886685892179694 (H) Perplexity5765454792378793.3 (H) Avg6875565792279793.8 (C) 8 GPT-4o8888667880089884 (H) LLAMA36886685892179694 (H) Perplexity6866454782378693.3 (M) Avg7876565881179793.7 (H) 92 Table A.37: Detailed assessment of Model-Extraction attacks with SSVC N°LLMEAVUTPScore 1 GPT-4oPYCSTSImmediate LLAMA3PNCETSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 2 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 3 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityAYCSTSImmediate AvgPYCSTSImmediate 4 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 5 GPT-4oPYCSTSImmediate LLAMA3PNCETSImmediate PerplexityNNDLPMDefer AvgPNCETSImmediate 6 GPT-4oPYDEPMScheduled LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 7 GPT-4oPYCSTSImmediate LLAMA3PNCETSImmediate PerplexityAYCSTSImmediate AvgPYCSTSImmediate 8 GPT-4oPYCSTSImmediate LLAMA3PNCETSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 93 Table A.38: Detailed assessment of Model Inference with DREAD N°LLMDREADScore 1 GPT-4o7 (H)8 (H)7 (H)7 (H)5 (M)6.8 (M) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.6 (H) Perplexity8 (H)9 (H)8 (H)7 (H)6 (M)7.6 (H) Avg8 (H)9 (H)7 (H)7 (H)6 (M)7.4 (H) 2 GPT-4o7 (H)8 (H)8 (H)7 (H)4 (M)6.8 (M) LLAMA37 (H)9 (H)6 (M)9 (H)5 (M)7.2 (H) Perplexity7 (H)8 (H)7 (H)6 (M)5 (M)6.6 (M) Avg7 (H)8 (H)7 (H)7 (H)5 (M)6.8 (M) 3 GPT-4o7 (H)6 (M)7 (H)7 (H)6 (M)6.6 (M) LLAMA36 (M)4 (M)5 (M)6 (M)4 (M)5 (M) Perplexity6 (M)5 (M)6 (M)5 (M)6 (M)5.6 (M) Avg6 (M)5 (M)6 (M)6 (M)5 (M)5.6 (M) 4 GPT-4o8 (H)6 (M)6 (M)8 (H)5 (M)6.6 (M) LLAMA38 (H)7 (H)5 (M)8 (H)5 (M)6.6 (M) Perplexity7 (H)6 (M)7 (H)6 (M)5 (M)6.2 (M) Avg8 (H)6 (M)6 (M)7 (H)5 (M)6.4 (M) 5 GPT-4o9 (H)7 (H)8 (H)9 (H)5 (M)7.6 (H) LLAMA3(H)9 (H)8 (H)9 (H)7 (H)8.4 (H) Perplexity9 (H)9 (H)8 (H)8 (H)6 (M)8 (H) Avg9 (H)8 (H)8 (H)9 (H)6 (M)8 (H) 6 GPT-4o7 (H)7 (H)7 (H)7 (H)5 (M)6.6 (M) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.6 (H) Perplexity7 (H)6 (M)7 (H)6 (M)5 (M)6.2 (M) Avg7 (H)7 (H)7 (H)7 (H)5 (M)6.6 (M) 7 GPT-4o8 (H)6 (M)7 (H)7 (H)4 (M)6.4 (M) LLAMA37 (H)9 (H)6 (M)7 (H)5 (M)6.8 (M) Perplexity8 (H)7 (H)7 (H)7 (H)6 (M)7 (H) Avg8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) 8 GPT-4o7 (H)8 (H)8 (H)7 (H)5 (M)7 (H) LLAMA38 (H)9 (H)7 (H)8 (H)6 (M)7.6 (H) Perplexity8 (H)7 (H)7 (H)6 (M)5 (M)6.6 (M) Avg8 (H)8 (H)7 (H)7 (H)5 (M)7.0 (H) 94 Table A.39: Detailed assessment of Model Inference attacks with CVSS N°LLMAVACPRUISCIABase 1 GPT-4oNLLNCHNN7.7 (H) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 2 GPT-4oNHNNCHNN6.8 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 3 GPT-4oNHNNUHNN5.9 (M) LLAMA3NHNNCHNN6.8 (M) PerplexityNHNNCHNN6.8 (M) AvgNHNNCHNN6.8 (M) 4 GPT-4oNHLNCHNN6.3 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNHNNCHNN6.8 (M) AvgNHNNCHNN6.8 (M) 5 GPT-4oNHLNCHNN6.3 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 6 GPT-4oNHNNUHNN5.8 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 7 GPT-4oNHNNUHNN5.8 (M) LLAMA3NLNNCHNN8.6 (H) PerplexityNLNNCHNN8.6 (H) AvgNLNNCHNN8.6 (H) 8 GPT-4oNLNNCHLN9.3 (C) LLAMA3NLNNCHNN8.6 (H) PerplexityNHNNCHNN6.8 (M) AvgNLNNCHNN8.6 (H) 95 Table A.40: Detailed assessment of Model Inference with OWASP Risk Rating N°LLMSKMTOPSZEDEEAWIDCIAFDRDNCPVScore 1 GPT-4o7887667870068883.5 (H) LLAMA36786786792298994.6 (C) Perplexity5665364672367582.9 (M) Avg6776576781278783.5 (H) 2 GPT-4o7868453673378653.2 (M) LLAMA36786786792298993.4 (C) Perplexity4665663682267892.8 (M) Avg6776564682278883.5 (M) 3 GPT-4o5875666790068993.4 (C) LLAMA35675565582276773 (M) Perplexity5665454782367682.4 (M) Avg5775565681267783.1 (M) 4 GPT-4o8977567690089994 (H) LLAMA35675565582276773 (M) Perplexity5765455782367683 (M) Avg6776566681277783.4 (M) 5 GPT-4o8988568990089994.5 (H) LLAMA36786786792298993.4 (C) Perplexity5765454782378793.3 (H) Avg6876566891288894 (C) 6 GPT-4o8957565893289894.5 (C) LLAMA36786786782298994.5 (C) Perplexity5665454782378793.2 (H) Avg6766565782288893.7 (C) 7 GPT-4o7976566881179683.7 (H) LLAMA36786786782298994.5 (C) Perplexity5765554782378793.3 (H) Avg6876665782288793.8 (C) 8 GPT-4o5877688772088903.2 (H) LLAMA36786786762298994.2 (C) Perplexity5665565782378793.4 (H) Avg5776676771287684.2 (C) 96 Table A.41: Detailed assessment of Model-Inference attacks with SSVC N°LLMEAVUTPScore 1 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 2 GPT-4oPYDEPMScheduled LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 3 GPT-4oPYDEPMScheduled LLAMA3PNCEPMImmediate PerplexityNNDLPMDefer AvgPNDEPMScheduled 4 GPT-4oPYCSTSImmediate LLAMA3PNCEPMImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 5 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 6 GPT-4oPYDEPMScheduled LLAMA3PYCSTSImmediate PerplexityNNDLPMDefer AvgPYDEPMScheduled 7 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 8 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityAYCSTSImmediate AvgPYCSTSImmediate 97 Table A.42: Detailed assessment of Poisoning/Trojan/Backdoor with DREAD N°LLMDREADScore 1 GPT-4o (GPT-4o)7 (H)7 (H)7 (H)7 (H)6 (M)6.8 (M) LLAMA3.2 (90b)8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity (Standard)9 (H)9 (H)8 (H)8 (H)6 (M)8.0 (H) Avg8 (H)8 (H)8 (H)8 (H)6 (M)7.6 (H) 2 GPT-4o (GPT-4o)8 (H)6 (M)6 (M)7 (H)5 (M)6.4 (M) LLAMA3.2 (90b)7 (H)6 (M)6 (M)7 (H)5 (M)6.2 (M) Perplexity (Standard)8 (H)7 (H)8 (H)7 (H)5 (M)7.0 (H) Avg8 (H)6 (M)7 (H)7 (H)5 (M)6.6 (M) 3 GPT-4o (GPT-4o)8 (H)7 (H)8 (H)7 (H)5 (M)7.0 (H) LLAMA3.2 (90b)8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity (Standard)9 (H)8 (H)9 (H)8 (H)6 (M)8.0 (H) Avg8 (H)8 (H)8 (H)8 (H)6 (M)7.6 (H) 4 GPT-4o (GPT-4o)8 (H)6 (M)6 (M)6 (M)4 (L)6.0 (M) LLAMA3.2 (90b)6 (M)6 (M)5 (M)6 (M)4 (L)5.4 (M) Perplexity (Standard)8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) Avg7 (H)6 (M)6 (M)6 (M)4 (L)5.8 (M) 5 GPT-4o (GPT-4o)9 (H)6 (M)6 (M)9 (H)4 (M)6.8 (M) LLAMA3.2 (90b)8 (H)6 (M)6 (M)8 (H)5 (M)6.6 (M) Perplexity (Standard)9 (H)8 (H)7 (H)9 (H)5 (M)7.6 (H) Avg9 (H)7 (H)6 (M)9 (H)5 (M)7.2 (H) 6 GPT-4o (GPT-4o)9 (H)8 (H)8 (H)8 (H)6 (M)7.8 (H) LLAMA3.2 (90b)8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity (Standard)8 (H)9 (H)8 (H)7 (H)6 (M)7.6 (H) Avg8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) 7 GPT-4o (GPT-4o)8 (H)7 (H)6 (M)7 (H)5 (M)6.6 (M) LLAMA3.2 (90b)8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity (Standard)9 (H)8 (H)8 (H)7 (H)5 (M)7.4 (H) Avg8 (H)8 (H)7 (H)7 (H)5 (M)7.0 (H) 8 GPT-4o8 (H)7 (H)7 (H)7 (H)5 (M)6.8 (M) LLAMA38 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Perplexity8 (H)9 (H)8 (H)8 (H)6 (M)7.8 (H) Avg8 (H)8 (H)8 (H)8 (H)6 (M)7.6 (H) 98 Table A.43: Detailed assessment of Poisoning/Trojan/Backdoor with CVSS N°LLMAVACPRUISCIABase 1 GPT-4oNHLNCLHL7.7 (H) LLAMA3NLNNCHHN10 (C) PerplexityNHNNUNHN5.9 (M) AvgNHNNCLHN7.5 (H) 2 GPT-4oLHHNCHHL7.4 (H) LLAMA3LHHNUHHN5.7 (M) PerplexityNHNNUNHN5.9 (M) AvgLHLNULHN5.3 (M) 3 GPT-4oLLHNCHHL8.1 (H) LLAMA3NLNNCHHN10 (C) PerplexityNLNNUNHN7.5 (H) AvgNLLNCLHN8.5 (H) 4 GPT-4oNHLNCLHL7.7 (H) LLAMA3LHHNUHHN5.7 (M) PerplexityNHNNUNHN5.9 (M) AvgNHLNULHN5.9 (M) 5 GPT-4oNHLNCLHL7.7 (H) LLAMA3LHHNUHHN5.7 (M) PerplexityNHNNUNHN5.9 (M) AvgNHLNULHN5.9 (M) 6 GPT-4oNHLNCLHL7.7 (H) LLAMA3NLNNCHHN10 (C) PerplexityNLNNUNHN7.5 (H) AvgNLNNCLHN9.3 (C) 7 GPT-4oNHLNCLHL7.7 (H) LLAMA3NLNNCHHN10 (C) PerplexityNHNNUNHN5.9 (M) AvgNHNNCLHN7.5 (H) 8 GPT-4oNHLNCLHL7.7 (H) LLAMA3NLNNCHHN10 (C) PerplexityNHNNUNHN5.9 (M) AvgNHNNCLHN7.5 (H) 99 Table A.44: Detailed assessment of Poisoning/Trojan/Backdoor with OWASP Risk Rating N°LLMSKMTOPSZEDEEAWIDCIAFDRDNCPVScore 1 GPT-4o6868354737367522.9 (M) LLAMA36895896886578584.9 (C) Perplexity6865564787578674.1 (C) Avg6876575767478563.9 (C) 2 GPT-4o7856353377267773 (H) LLAMA37865785767567574.1 (C) Perplexity9984453698389784.4 (C) Avg8865564577378673.7 (H) 3 GPT-4o6888354377378763.6 (H) LLAMA36895896887578585 (C) Perplexity8975674879589674.9 (C) Avg7886675678478674.4 (C) 4 GPT-4o7858354337368622.7 (M) LLAMA37865785767567574.1 (C) Perplexity6885563989489784.7 (C) Avg7866564668478664 (C) 5 GPT-4o8858354738378623.1 (H) LLAMA36875463896389794.3 (H) Perplexity7986564879489784.9 (C) Avg7876464868389764.2 (C) 6 GPT-4o8858654838378623.2 (H) LLAMA38986574987499885.2 (C) Perplexity89754739895910895.3 (C) Avg8976464968489764 (C) 7 GPT-4o8858354838378623.2 (H) LLAMA39997685998599996 (C) Perplexity89765749895910895.6 (C) Avg8977574978489874.9 (C) 8 GPT-4o8868354737367522.9 (H) LLAMA38886574887488784.8 (C) Perplexity89854639794810784.9 (C) Avg8876464868478664.1 (C) 100 Table A.45: Detailed assessment of Poisoning/Trojan/Backdoor attacks with SSVC N°LLMEAVUTPScore 1 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 2 GPT-4oPYCSTSImmediate LLAMA3PNCETSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 3 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 4 GPT-4oPYDEPMScheduled LLAMA3PNDLPMScheduled PerplexityNNDLPMDefer AvgPNDLPMScheduled 5 GPT-4oPYCSTSImmediate LLAMA3PNCETSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 6 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 7 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 8 GPT-4oPYCSTSImmediate LLAMA3PYCSTSImmediate PerplexityPYCSTSImmediate AvgPYCSTSImmediate 101