There are 15 attacks in the memory-exploitation category. Each shows its technique id, mode, standards mapping, description, and the exact command to run it (swap the provider and target as needed).
​
critical
memory-injection · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Injects fabricated memories or prior conversation history to make the model believe it already agreed to produce harmful contentRun it:
​
critical
system-prompt-override · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Attempts to replace or nullify the system prompt mid-conversation using injected meta-instructionsRun it:
​
high
attention-diversion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Buries harmful requests inside long distracting content to divert model attention from safety-relevant portionsRun it:
​
high
context-fragmentation · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Spreads a harmful request across multiple messages so no single turn triggers safety filters, then synthesizes the fragmentsRun it:
​
high
context-poisoning · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Poisons the conversation context with misleading facts, false authority claims, or fabricated precedents before making the harmful requestRun it:
​
high
context-window-overflow · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Floods the context window with benign filler text to push safety instructions out of the model’s effective attention spanRun it:
​
high
conversation-hijacking · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Hijacks an ongoing benign conversation by injecting a new harmful objective and claiming it is the real purpose of the sessionRun it:
​
high
false-consensus · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Claims prior agreement to harmful actions across conversation turns, using social pressure and fabricated consensus to override model judgmentRun it:
​
high
history-rewriting · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Claims previous turns said something different than they did, attempting to rewrite conversation history to shift model behaviorRun it:
​
high
instruction-layering · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Stacks contradictory instructions at different priority levels to create ambiguity that the model resolves in favor of the attackerRun it:
​
high
persona-persistence · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Establishes a permissive persona early in conversation then exploits it across turns to extract harmful contentRun it:
​
high
semantic-drift · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Gradually shifts the meaning of key terms across conversation turns until harmful content falls under a redefined benign labelRun it:
​
high
state-confusion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Confuses the model about its current conversation state by presenting contradictory or ambiguous context signalsRun it:
​
medium
temporal-confusion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Confuses the model about time and sequence of events to make it believe restrictions were introduced later or have expiredRun it:
​
medium
token-budget-exhaustion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Exhausts the model’s output token budget with benign content before the harmful request, hoping reduced budget degrades safety checkingRun it: