Version Downgrade Attacks

LLM providers maintain multiple model versions simultaneously for backward compatibility. The design assumption is that version selection is a benign quality choice. The gap: older model versions have weaker safety alignment.

• Monitor model version selection in API requests — alert on requests explicitly targeting older versions
• Track version distribution across requests per user — legitimate users typically use latest
• Alert on self-hosted model file changes (checksum monitoring)
• Log model version alongside safety classifier decisions for version-specific safety regression analysis

Version downgrade is a technique multiplier — any jailbreak that has been patched in the current version but was published against an older version becomes viable again via downgrade. Chains directly to T1 (Prompt Subversion), T2 (Semantic Evasion), and T3 (Reasoning Exploitation) using version-era-specific techniques.