mlsanityData to 14 Oct 2026

ArtPerception: ASCII Art-based Jailbreak on LLMs with Recognition Pre-test

arXiv 2510.10281 ↗First posted 11 Oct 2025cs.CR cs.AI cs.CLcited by 2

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

The integration of Large Language Models (LLMs) into computer applications has introduced transformative capabilities but also significant security challenges. Existing safety alignments, which primarily focus on semantic interpretation, leave LLMs vulnerable to attacks that use non-standard data representations. This paper introduces ArtPerception, a novel black-box jailbreak framework that strategically leverages ASCII art to bypass the security measures of state-of-the-art (SOTA) LLMs. Unlike prior methods that rely on iterative, brute-force attacks, ArtPerception introduces a systematic, two-phase methodology. Phase 1 conducts a one-time, model-specific pre-test to empirically determine the optimal parameters for ASCII art recognition. Phase 2 leverages these insights to launch a highly efficient, one-shot malicious jailbreak attack. We propose a Modified Levenshtein Distance (MLD) metric for a more nuanced evaluation of an LLM's recognition capability. Through comprehensive experiments on four SOTA open-source LLMs, we demonstrate superior jailbreak performance. We further validate our framework's real-world relevance by showing its successful transferability to leading commercial models, including GPT-4o, Claude Sonnet 3.7, and DeepSeek-V3, and by conducting a rigorous effectiveness analysis against potential defenses such as LLaMA Guard and Azure's content filters. Our findings underscore that true LLM security requires defending against a multi-modal space of interpretations, even within text-only inputs, and highlight the effectiveness of strategic, reconnaissance-based attacks. Content Warning: This paper includes potentially harmful and offensive model outputs.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 43 of its 71 references that are in the map. First posted on arXiv 11 Oct 2025.

Builds on

43 of 71 references.

Closest ancestors · 16

Same direction, newest first

  1. 2024An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer21 Aug
  2. 2024SeqAR: Jailbreak LLMs with Sequential Auto-Generated Characters2 Jul
  3. 2024Large Language Models Are Involuntary Truth-Tellers: Exploiting Fallacy Failure for Jailbreak Attacks1 Jul
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  5. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction28 Feb
  6. 2024A Cross-Language Investigation into Jailbreak Attacks in Large Language Models30 Jan
  7. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  8. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  9. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  10. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  11. 2023Multilingual Jailbreak Challenges in Large Language Models10 Oct
  12. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
4 more
  1. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  2. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  4. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 27

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
  4. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  5. 2020Extracting Training Data from Large Language Modelscited by 2,189
  6. 2022Large Language Models Encode Clinical Knowledgecited by 1,830
  7. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,255
  8. 2023A Survey on Evaluation of Large Language Modelscited by 1,242
  9. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  10. 2020StereoSet: Measuring stereotypical bias in pretrained language modelscited by 924
  11. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 518
  12. 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 297
15 more
  1. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  2. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  3. 2022Predictability and Surprise in Large Generative Modelscited by 210
  4. 2019BPE-Dropout: Simple and Effective Subword Regularizationcited by 195
  5. 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
  6. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 191
  7. 2022Fine-tuning language models to find agreement among humans with diverse preferencescited by 189
  8. 2019Build it Break it Fix it for Dialogue Safety: Robustness from Adversarial Human Attackcited by 176
  9. 2023Removing RLHF Protections in GPT-4 via Fine-Tuningcited by 171
  10. 2023MART: Improving LLM Safety with Multi-round Automatic Red-Teamingcited by 163
  11. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 76
  12. 2024Health-LLM: Large Language Models for Health Prediction via Wearable Sensor Datacited by 66
  13. 2021Question-aware Transformer Models for Consumer Health Question Summarizationcited by 11
  14. 2023Testing the Depth of ChatGPT's Comprehension via Cross-Modal Tasks Based on ASCII-Art: GPT3.5's Abilities in Regard to Recognizing and Generating ASCII-Art Are Not Totally Lackingcited by 7
  15. 2025TPSQLi: Test Prioritization for SQL Injection Vulnerability Detection in Web Applicationscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026SemLink: A Semantic-Aware Automated Test Oracle for Hyperlink Verification using Siamese Sentence-BERTcited by 0
  2. 2026ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs
  2. 2026DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
  3. 2023JailGuard: A Universal Detection Framework for LLM Prompt-based Attacks
  4. 2024SATA: A Paradigm for LLM Jailbreak via Simple Assistive Task Linkage
  5. 2026ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack
  6. 2024EnJa: Ensemble Jailbreak on Large Language Models
  7. 2025LLM Jailbreak Detection for (Almost) Free!
  8. 2024Efficient LLM-Jailbreaking via Multimodal-LLM Jailbreak