mlsanityData to 14 Oct 2026

Emoji-Based Jailbreaking of Large Language Models

arXiv 2601.00936 ↗First posted 2 Jan 2026cs.CR cs.AIcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Large Language Models (LLMs) are integral to modern AI applications, but their safety alignment mechanisms can be bypassed through adversarial prompt engineering. This study investigates emoji-based jailbreaking, where emoji sequences are embedded in textual prompts to trigger harmful and unethical outputs from LLMs. We evaluated 50 emoji-based prompts on four open-source LLMs: Mistral 7B, Qwen 2 7B, Gemma 2 9B, and Llama 3 8B. Metrics included jailbreak success rate, safety alignment adherence, and latency, with responses categorized as successful, partial and failed. Results revealed model-specific vulnerabilities: Gemma 2 9B and Mistral 7B exhibited 10 % success rates, while Qwen 2 7B achieved full alignment (0% success). A chi-square test (chi^2 = 32.94, p < 0.001) confirmed significant inter-model differences. While prior works focused on emoji attacks targeting safety judges or classifiers, our empirical analysis examines direct prompt-level vulnerabilities in LLMs. The results reveal limitations in safety mechanisms and highlight the necessity for systematic handling of emoji-based representations in prompt-level safety and alignment pipelines.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 9 of its 19 references that are in the map. First posted on arXiv 2 Jan 2026.

Builds on

9 of 19 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 8

  1. 2017Attention Is All You Needcited by 60,361
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2023Mistral 7Bcited by 3,164
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  5. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  6. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  7. 2015Sentiment of Emojiscited by 32
  8. 2025Emoti-Attack: Zero-Perturbation Adversarial Attacks on NLP Systems via Emoji Sequencescited by 5

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Are LLMs Safe Beyond Text: Do Emojis Expose Gaps in Safety Evaluation
  2. 2024Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection
  3. 2024Improved Large Language Model Jailbreak Detection via Pretrained Embeddings
  4. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
  5. 2025Evaluating Adversarial Vulnerabilities in Modern Large Language Models
  6. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  7. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models
  8. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks