mlsanityData to 14 Oct 2026

ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Models

arXiv 2609.02215 ↗First posted 2 Sep 2026cs.AIcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Safety alignment trains large language models to refuse harmful requests stated plainly, but that training is applied mostly to surface form. Requests that only recontextualise the same operational content, changing how the model reads it, are therefore only weakly covered. The ASCII Attack is one such recontextualisation. It is single-turn and black-box: one message, with no access to model internals. It embeds a fully legible harmful request in ASCIl-art characters, presents it as artwork, and asks for feedback. Unlike ArtPrompt, it hides nothing: the request stays readable. The reply is written as artistic critique and can contain operational detail that a plain request would have been refused for. Every framed prompt is paired with a direct-question control, so the contrast is isolated from topic, model and decoding variation. The contrast identifies a bundled surface, not one isolated channel. Across eleven models and eight harm topics, a harm-aware classifier judges 62% of framed prompts harmful against 42% of controls. On the most susceptible model the framed prompt succeeds 93% of the time. A single query matches or exceeds published single-query attacks under four of five harm judges. The effect tracks the model more than the topic and does not diminish with scale. At least one judge dissents from the panel majority on nearly two-thirds of framed rows, which is itself a measurement-validity finding. That pattern is consistent with mismatched generalisation.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 28 of its 48 references that are in the map. First posted on arXiv 2 Sep 2026.

Builds on

28 of 48 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  2. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  4. 2023Are aligned neural networks adversarially aligned?26 Jun

Other references · 24

  1. 2017Attention Is All You Needcited by 60,361
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2025Gemma 3 Technical Reportcited by 1,824
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  7. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  9. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  10. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 489
  11. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  12. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
12 more
  1. 2023Low-Resource Languages Jailbreak GPT-4cited by 309
  2. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  3. 2025The Hidden Risks of Large Reasoning Models: A Safety Assessment of R1cited by 91
  4. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 76
  5. 2024EasyJailbreak: A Unified Framework for Jailbreaking Large Language Modelscited by 60
  6. 2024garak: A Framework for Security Probing Large Language Modelscited by 49
  7. 2025AILuminate: Introducing v1.0 of the AI Risk and Reliability Benchmark from MLCommonscited by 35
  8. 2024PyRIT: A Framework for Security Risk Identification and Red Teaming in Generative AI Systemcited by 31
  9. 2025Multi-Turn Jailbreaks Are Simpler Than They Seemcited by 17
  10. 2025HarmMetric Eval: Benchmarking Metrics and Judges for LLM Harmfulness Assessmentcited by 15
  11. 2025Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Modelscited by 15
  12. 2025ArtPerception: ASCII Art-based Jailbreak on LLMs with Recognition Pre-testcited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Quad-State Safety Evaluation of Open-Weight Large Language Models on Non-Canonical Inputs
  2. 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Models
  3. 2024The Dark Side of Human Feedback: Poisoning Large Language Models via User Inputs
  4. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack
  5. 2026Lost in Translation? A Comparative Study on the Cross-Lingual Transfer of Composite Harms
  6. 2026Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams
  7. 2026Discern Truth from Falsehood: Reducing Over-Refusal via Contrastive Refinement
  8. 2025Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Models