mlsanityData to 14 Oct 2026

`A la recherche du sens perdu: your favourite LLM might have more to say than you can understand

arXiv 2503.00224 ↗First posted 28 Feb 2025cs.CLcited by 0

Not on the map. Why?

Abstract (arXiv)

We report a peculiar observation that LLMs can assign hidden meanings to sequences that seem visually incomprehensible to humans: for example, a nonsensical phrase consisting of Byzantine musical symbols is recognized by gpt-4o as "say abracadabra". Moreover, some models can communicate using these sequences. Some of these meanings are hypothesized to partly originate in the massive spurious correlations due to BPE tokenization. We systematically evaluate the presence of such abilities in a wide range of models: Claude-3.5 Haiku, Claude-3.5 Sonnet (New and Old), Claude-3.7 Sonnet, gpt-4o mini, gpt-4o, o1-mini, Llama-3.3 70B, DeepSeek-R1-Distill-Lllama 70B, Qwen2.5 1.5B, Qwen2.5 32B, Phi-3.5 mini, GigaChat-Max, Vikhr-Llama-3.2 1B. We argue that this observation might have far-reaching consequences for both safety and security of the modern and future LLMs and systems that employ them. As an illustration, we show that applying this method in combination with simple templates is sufficient to jailbreak previous generation models, with ASR = 0.4 on gpt-4o mini. Our code and data artifacts are available at https://github.com/L3G5/llm-hidden-meanings

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 39 of its 57 references that are in the map. First posted on arXiv 28 Feb 2025.

Builds on

39 of 57 references.

References · 39

  1. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  2. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  5. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  6. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
  7. 2022Toy Models of Superpositioncited by 971
  8. 2024LLM Evaluators Recognize and Favor Their Own Generationscited by 686
  9. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  10. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
  11. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  12. 2025Humanity's Last Examcited by 491
27 more
  1. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  2. 2023Weak-to-Strong Generalization: Eliciting Strong Capabilities With Weak Supervisioncited by 467
  3. 2024The Platonic Representation Hypothesiscited by 382
  4. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  5. 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 308
  6. 2024Foundational Challenges in Assuring Alignment and Safety of Large Language Modelscited by 199
  7. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 181
  8. 2024Byte Latent Transformer: Patches Scale Better Than Tokenscited by 146
  9. 2023Tracr: Compiled Transformers as a Laboratory for Interpretabilitycited by 104
  10. 2025Gold-medalist Performance in Solving Olympiad Geometry with AlphaGeometry2cited by 97
  11. 2025MATH-Perturb: Benchmarking LLMs' Math Reasoning Abilities against Hard Perturbationscited by 89
  12. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 79
  13. 2025Language Models Use Trigonometry to Do Additioncited by 70
  14. 2025International AI Safety Reportcited by 67
  15. 2024LLM Circuit Analyses Are Consistent Across Training and Scalecited by 63
  16. 2025Do Large Language Model Benchmarks Test Reliability?cited by 54
  17. 2023LLM Censorship: A Machine Learning Challenge or a Computer Security Problem?cited by 49
  18. 2024Fishing for Magikarp: Automatically Detecting Under-trained Tokens in Large Language Modelscited by 46
  19. 2024InterpBench: Semi-Synthetic Transformers for Evaluating Mechanistic Interpretability Techniquescited by 25
  20. 2024The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Modelscited by 20
  21. 2025Forecasting Rare Language Model Behaviorscited by 19
  22. 2025Position: Adversarial ML for LLMs Is Not Making Any Progresscited by 15
  23. 2024Vulnerability of LLMs to Vertically Aligned Text Manipulationscited by 6
  24. 2024Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approachcited by 6
  25. 2024Plentiful Jailbreaks with String Compositionscited by 4
  26. 2025Why is prompting hard? Understanding prompts on binary sequence predictorscited by 4
  27. 2024On the Feasibility of Fully AI-automated Vishing Attackscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Unnatural Languages Are Not Bugs but Features for LLMs
  2. 2024Can large language models understand uncommon meanings of common words?
  3. 2023Large Linguistic Models: Investigating LLMs' metalinguistic abilities
  4. 2026What LLMs Think When You Don't Tell Them What to Think About?
  5. 2024LLMs' Understanding of Natural Language Revealed
  6. 2025Large Language Model probabilities cannot distinguish between possible and impossible language
  7. 2023Beyond Words: A Mathematical Framework for Interpreting Large Language Models
  8. 2025How LLMs Comprehend Temporal Meaning in Narratives: A Case Study in Cognitive Evaluation of LLMs