mlsanityData to 7 Oct 2026

Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search

arXiv 2602.22983 ↗First posted 26 Feb 2026cs.AI cs.CRcited by 10

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

As Large Language Models (LLMs) are increasingly used, their security risks have drawn increasing attention. Existing research reveals that LLMs are highly susceptible to jailbreak attacks, with effectiveness varying across language contexts. This paper investigates the role of classical Chinese in jailbreak attacks. Owing to its conciseness and obscurity, classical Chinese can partially bypass existing safety constraints, exposing notable vulnerabilities in LLMs. Based on this observation, this paper proposes a framework, CC-BOS, for the automatic generation of classical Chinese adversarial prompts based on multi-dimensional fruit fly optimization, facilitating efficient and automated jailbreak attacks in black-box settings. Prompts are encoded into eight policy dimensions-covering role, behavior, mechanism, metaphor, expression, knowledge, trigger pattern and context; and iteratively refined via smell search, visual search, and cauchy mutation. This design enables efficient exploration of the search space, thereby enhancing the effectiveness of black-box jailbreak attacks. To enhance readability and evaluation accuracy, we further design a classical Chinese to English translation module. Extensive experiments demonstrate that effectiveness of the proposed CC-BOS, consistently outperforming state-of-the-art jailbreak attack methods.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 50 of its 62 references that are in the map. First posted on arXiv 26 Feb 2026.

Builds on

50 of 62 references.

Closest ancestors · 28

Same direction, newest first

  1. 2025OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluation6 Dec
  2. 2025Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space27 May
  3. 2025Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs3 May
  4. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  5. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs13 Jun
  6. 2024When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search13 Jun
  7. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses3 Jun
  8. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models31 May
  9. 2024Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters30 May
  10. 2024Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks30 May
  11. 2024Improved Generation of Adversarial Examples Against Safety-aligned LLMs28 May
  12. 2024Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization15 May
16 more
  1. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs21 Apr
  2. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  3. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction28 Feb
  4. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  5. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  6. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space14 Feb
  7. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  9. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  10. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  11. 2023Multilingual Jailbreak Challenges in Large Language Models10 Oct
  12. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  13. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  14. 2023Certifying LLM Safety against Adversarial Prompting6 Sep
  15. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  16. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 22

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2025Qwen3 Technical Reportcited by 8,195
  3. 2024GPT-4o System Cardcited by 4,467
  4. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,655
  5. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  6. 2019Unified Language Model Pre-training for Natural Language Understanding and Generationcited by 668
  7. 2023Prompting Large Language Model for Machine Translation: A Case Studycited by 247
  8. 2023Using an LLM to Help With Code Understandingcited by 222
  9. 2023TaskBench: Benchmarking Large Language Models for Task Automationcited by 138
  10. 2024Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Modelscited by 122
  11. 2025H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinkingcited by 94
  12. 2024The Language Barrier: Dissecting Safety Challenges of LLMs in Multilingual Contextscited by 92
10 more
  1. 2024LLM-based NLG Evaluation: Current Status and Challengescited by 71
  2. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 70
  3. 2024Uncovering Safety Risks of Large Language Models through Concept Activation Vectorcited by 63
  4. 2024SG-Bench: Evaluating LLM Safety Generalization Across Diverse Tasks and Prompt Typescited by 58
  5. 2023All Languages Matter: On the Multilingual Safety of Large Language Modelscited by 51
  6. 2024Code-Switching Red-Teaming: LLM Evaluation for Safety and Multilingual Understandingcited by 34
  7. 2023Query-Efficient Black-Box Red Teaming via Bayesian Optimizationcited by 31
  8. 2025Inverse Reinforcement Learning with Dynamic Reward Scaling for LLM Alignmentcited by 20
  9. 2018Sentence Segmentation for Classical Chinese Based on LSTM with Radical Embeddingcited by 4
  10. 2025Measuring What Matters: A Framework for Evaluating Safety Risks in Real-World LLM Applicationscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 10.

10 papers.

  1. 2026ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scannerscited by 3
  2. 2026How Many Visual Tokens Do Multimodal Language Models Need? Scaling Visual Token Pruning with F^3Acited by 1
  3. 2026LLM-Agnostic Semantic Representation Attackcited by 0
  4. 2026Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMscited by 0
  5. 2026How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributionscited by 0
  6. 2026Reviving Ancient Paintings via Poem: A Colorization Framework for Aligning Cultural Semanticscited by 0
  7. 2026Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreakscited by 0
  8. 2026Yesterday's Shield, Today's Spear: A Self-Evolving Safety Guardrail in Productioncited by 0
  9. 2026Who Judges the Judges? A Chinese Safety QA Benchmark for Evaluating LLM Responses and Safety Judgescited by 0
  10. 2026How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defensecited by 0