PaperlayerView exact revision on arXiv

Source-linked AI summary

ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Models

Da Cheng Gu, Yifei Dong, Xinghao Yang, Yongshun Gong, Wei Liu

arXiv:2609.02215v1cs.AI

TL;DR

The paper examines whether safety alignment generalises when harmful requests are recontextualised as ASCII artwork rather than stated plainly. Using matched black-box comparisons, it finds the ASCII Attack effective across models and judges, while highlighting substantial disagreement among harm classifiers.

  • Problem

    Safety alignment is trained mainly on plainly stated harmful requests, leaving limited evidence about whether it generalises to recontextualised requests with the same operational content.

  • Method

    The ASCII Attack embeds a fully legible harmful request in ASCII art, presents it as artwork, and evaluates it against genuine harmful direct-question controls across matched decoding conditions.

  • Results

    The attack is the strongest single-query attack evaluated under four of five harm judges, with framing effects varying more by model than topic and remaining present across scale.

  • Takeaways & Limitations

    The findings support evaluating recontextualised attacks with response-level, harm-aware adjudication because judge disagreement affects how vulnerability is measured.

  • Takeaways & Limitations

    The study is English-only and single-turn, and serving-runtime effects could not be quantified because the serving binary was unrecoverable for three quarters of the corpus.

Abstract

from arXiv · show

Safety alignment trains large language models to refuse harmful requests stated plainly, but that training is applied mostly to surface form. Requests that only recontextualise the same operational content, changing how the model reads it, are therefore only weakly covered. The ASCII Attack is one such recontextualisation. It is single-turn and black-box: one message, with no access to model internals. It embeds a fully legible harmful request in ASCIl-art characters, presents it as artwork, and asks for feedback. Unlike ArtPrompt, it hides nothing: the request stays readable. The reply is written as artistic critique and can contain operational detail that a plain request would have been refused for. Every framed prompt is paired with a direct-question control, so the contrast is isolated from topic, model and decoding variation. The contrast identifies a bundled surface, not one isolated channel. Across eleven models and eight harm topics, a harm-aware classifier judges 62% of framed prompts harmful against 42% of controls. On the most susceptible model the framed prompt succeeds 93% of the time. A single query matches or exceeds published single-query attacks under four of five harm judges. The effect tracks the model more than the topic and does not diminish with scale. At least one judge dissents from the panel majority on nearly two-thirds of framed rows, which is itself a measurement-validity finding. That pattern is consistent with mismatched generalisation.

1. Introduction

The ASCII Attack tests whether harmful requests remain actionable when fully legible content is recontextualised as ASCII-art critique. Its matched-pair design measures this bundled framing surface across models and topics.

  • Motivation: Safety training often targets natural-prose harmful prompts, leaving semantically equivalent requests outside that surface vulnerable to mismatched generalisation.The paper distinguishes changing a request’s surface form from changing its operational content.
  • Attack design: The ASCII Attack embeds a fully legible harmful request in non-pictorial ASCII-art scaffolding and asks for artistic feedback.Unlike word-cloaking attacks, it requires no decoding of hidden tokens.
  • Observed behavior: The framing can elicit operationally useful content in the register of artistic critique, despite the same harmful intent being refused when posed plainly.Figure 1 presents the two registers and a real dataset response as an illustrative row.
  • Measurement: Every framed prompt is paired with a same-topic direct-question control, measuring the bundled framing surface rather than unpaired topic, model, and decoding variation.The design balances decoding regimes across arms while pairing at the variant level.
  • Contributions: The paper contributes an attack specification, a matched-pair protocol, and an architecture-conditional analysis of this previously unstudied surface.The introduction identifies the ASCII-art aesthetic frame as the mechanism under study, not genuine pictorial representation.

2. Background and Related Work

Prior work includes obfuscation, cipher, typographic, optimization, and automated-search jailbreaks, while the ASCII Attack occupies a distinct aesthetic-register surface. Its closest comparison is ArtPrompt, but the two differ in payload visibility, mechanism, and threat model.

  • Mismatched-generalisation thesis: Mismatched generalisation describes safety behavior failing to transfer from one surface structure to semantically equivalent inputs in another structure.Examples include Base64, synthetic language games, and other form-level transformations that remain within broader model competence.
  • Typographic and aesthetic-register attacks: ArtPrompt hides a sensitive word in ASCII glyphs and asks the model to read it, whereas the ASCII Attack leaves the harmful request legible and asks for artistic critique.The attacks share an ASCII-art surface but differ in mechanism, threat model, and failure modes.
  • Prior jailbreak families: Related attacks move harmful content into pixels, ciphers, low-resource languages, poetry, or optimized suffixes, representing distinct surface transformations.FigStep is an image-based LVLM attack, CipherChat exchanges enciphered messages, and GCG and PAIR use optimization or iterative refinement.
  • Benchmarks and evaluation: The literature’s evaluation stack spans benchmarks and classifier judges, but unpaired attack-success rates are not directly comparable with the present paired uplift.The paper instead emphasizes a same-topic, same-model matched control for its central contrast.
  • Attack positioning: The ASCII Attack uses declared-scene ASCII art without decoding, role-play, system-prompt access, or multi-turn interaction.Its glyphs provide visual scaffolding while the prose names the harmful scene directly.
  • Research gap and positioning: The declared-scene ASCII-art surface is positioned as a previously unstudied corner of the typographic and aesthetic-register jailbreak family.The paper distinguishes it from ArtPrompt, FigStep, CipherChat, and adversarial poetry.

3. Attack Design

The ASCII Attack recontextualises a fully legible harmful request as artistic feedback in a single-turn, black-box setting. Matched controls and the framing-uplift estimand isolate the effect of the bundled framing surface while preserving the underlying request and experimental conditions.

  • Matched control: Each framed prompt is paired with the same harmful request asked plainly, holding topic, model, sub-theme, temperature, and operational content constant.The control differs by omitting the aesthetic meta-instruction, glyph block, scene description, and missing-info list.
  • Matched control: The control is a measurement floor, not a benign baseline, so nonzero control-arm success rates are expected and substantively informative.Llama Guard 3 scores 12.9% of controls as attack-success and JailbreakBench scores 42.3% in the Alpha 11-model corpus.
  • Attack principle: The design bundles aesthetic-register and visual-noise channels, so the paired contrast cannot identify the aesthetic channel in isolation.An information-matched second control would be needed to separate those components.
  • Attack principle: The attack tests mismatched generalisation: capability may recover harmful meaning from transformed input even when refusal behaviour does not transfer.The passage presents this as an expectation consistent with the failure mode, not as demonstrated recurrence across models.
  • Framing uplift: The framing uplift Δframe is the within-sub-theme difference between ASCII-framed and control attack-success rates.This contrast isolates the bundled framing surface rather than the aesthetic register alone.
  • Attack principle: The ASCII Attack is a single-turn, black-box attack that embeds a fully legible harmful request in ASCII-art scaffolding and requests artistic feedback.It does not rely on decoding hidden text or access to model internals.

4. Empirical Design

The empirical study evaluates the attack across eleven models, crossed with topics, variants, temperatures, and seeds, and scores visible responses with multiple independent judges. Its analysis defines attack-success and framing uplift separately for each judge, while treating added evaluators as robustness checks and recording important serving and measurement caveats.

  • Target models: The study evaluates eleven target models spanning roughly 1 B to Llama 4 Scout across several model families.Scout is served through a hosted fp8 endpoint, while the other models use local Ollama inference.
  • Experimental design: The design crosses topic, variant, model, decoding temperature, and seed, with temperatures T∈{0.1, 0.5, 1.0, 2.0}.Pairing occurs at the variant level, and 8 443 rows lack recorded seeds; no reported quantity uses the missing seed field.
  • Outcome measures: Attack-success rate is the proportion of validly judged replies classified as harmful, on-topic, and substantive, computed separately for framed and control arms.Replies that a judge cannot parse into a verdict are excluded from the denominator.
  • Response classification: Every saved model response is scored by five independent harm judges, and per-topic and per-model attack-success rates are computed from visible answers.The judges are JailbreakBench, WildGuard, Llama Guard 3, Llama Guard 4, and Granite Guardian.
  • Evaluator scope: The StrongREJECT compliance grader covers only eight models and reports negative framing uplift despite positive uplift from the five harm judges.It is therefore reported as a disagreement and measurement limitation rather than folded into the main harm-judge analysis.
  • Statistical analysis: The primary analysis uses mixed-effects logistic regression with frame type, log2 parameter count, temperature, and model family as fixed effects, plus topic and sub-theme random intercepts.The analysis plan was fixed in advance.
  • Statistical analysis: Four added judges are robustness checks in a descriptive analysis family, and the planned equivalence tests were not conducted because bounds were never prespecified.Family C quantities have intervals but no hypothesis tests.

5. Results

Across eleven models and eight harm topics, the ASCII Attack generally raises judged harmful-output rates over matched direct-question controls. The effect is strongest as a model-dependent, judge-sensitive surface phenomenon, while comparisons and robustness are bounded by disclosed measurement and serving limitations.

  • The framing uplift was positive under every harm judge, ranging from +7.8 pp to +20.1 pp.The paper reports this range rather than a single pooled headline because the uplift depends jointly on attack and judge.
  • 5.1.1. The framing uplift is positive under all five harm judges: The framed prompt exceeded its matched control in 63 to 74 of 88 model-topic pairs, depending on the judge, and reached 93.3% on the most susceptible target.The reported Cliff’s δ across the 88 pairs was +0.370, though this computation used unpaired model-topic pairs rather than the preregistered unit.
  • 5.1.1. The framing uplift is positive under all five harm judges: Generation provenance was mixed: most rows used local Ollama, while Llama 4 Scout used a hosted fp8 endpoint during the compute migration.All models were judged at 8-bit quantisation on the homogeneous CETUS stack, but serving provenance was not controlled.
  • 5.3. Robustness: None of the three robustness classifiers outside the main panel recorded a determinately positive uplift.HarmBench was determinately negative, while ShieldGemma and Qwen3Guard intervals straddled zero.
  • 5.1. Comparison to prior attacks: A single black-box query matched or exceeded published single-query attacks under four of five harm judges and matched or exceeded PAIR on nine of eleven models.The ASCII Attack was the strongest single-query attack on eight of eleven models; PAIR used up to fifteen interactive queries.
  • 5.1.3. Union coverage: The attack’s pooled union with ArtPrompt and DeepInception reached 77.0%, but this estimate assumes independent prompt success and the matched contrast identifies a bundled treatment.Each baseline added approximately +8.5 pp of marginal coverage over the ASCII arm alone.
  • 5.2. Decomposition: Model architecture explained more framing-uplift variation than harm topic, with positive uplift for nine of eleven target models.Under JailbreakBench, uplift ranged from −34.0 pp to +46.0 pp; the +46.0 pp target also reached 93.3% framed-arm success.

6. Conclusion

The paper defines the ASCII Attack as a single-turn, black-box jailbreak and evaluates it with matched controls and multi-judge classification. Its findings place the attack within mismatched generalisation and show architecture-conditional effectiveness across models.

  • 6. Conclusion: The ASCII Attack embeds a fully legible harmful request in non-pictorial ASCII-art characters and frames it as a request for artistic feedback.Unlike ArtPrompt, it requires no decoding because the harmful request remains readable.
  • 6. Conclusion: The matched-pair design compares each framed prompt with a same-topic direct-question control using multi-judge response-only classification.The design separates the bundled framing surface from topic, model, and decoding variation in unpaired comparisons.
  • 6. Conclusion: The framing channel opens on nine of eleven models across five families and does not close with scale.This is reported as an architecture-conditional result rather than a uniform model-size effect.
  • 6. Conclusion: The ASCII Attack matches or exceeds ArtPrompt and DeepInception under four of five harm judges in the frozen q8 single-query comparison.The comparison uses one black-box query and evaluates eleven target models on eight harm topics.
  • 6. Conclusion: The results are consistent with mismatched generalisation because artistic critique lies outside the natural-language refusal-training distribution while remaining within model competence.Effectiveness through adversarial poetry is cited as a concurrent result consistent with the same aesthetic-register channel.

7. Future directions

The paper identifies three directions: train refusals across registers and structures, improve response-level harm evaluation, and test defence generalisation across serving environments. These directions address both the attack’s bundled design and unresolved measurement boundaries.

  • 7. Future directions: Refusal training should cover recontextualised registers and structures as a family rather than patching surfaces individually.The paper names artistic critique, verse, cipher, and code as neighbouring regions of the recontextualised manifold.
  • 7. Future directions: Testing whether a defence trained on one recontextualised surface transfers to others would make register-invariance a testable claim.The paper measures only one region of the broader manifold.
  • 7. Future directions: A second control arm matched on information density but written in plain register would isolate the framing channel from extra information in the ASCII prompt.The current design does not give that channel its own coefficient.
  • 7. Future directions: Response-level, harm-aware adjudication is needed because token-versus-policy scoring and five harm classifiers disagree substantially.A stratified hand-labelled study could score each judge against human agreement, especially on rows where judges split.
  • 7. Future directions: Defence generalisation must be demonstrated across serving runtimes because the study could not quantify that channel and could not recover the serving binary for three quarters of the corpus.The paper recommends recording the serving binary on every row and treating runtime as an experimental factor.

CRediT authorship contribution statement

The CRediT statement assigns conceptualization, methodology, experimentation, investigation, curation, analysis, validation, visualization, and writing primarily to Da Cheng Gu, with other authors contributing review, editing, theory, or writing.

  • CRediT authorship contribution statement: Da Cheng Gu is credited with conceptualization, methodology, experiment, investigation, data curation, formal analysis, validation, visualization, and writing.
  • CRediT authorship contribution statement: Yifei Dong and Xinghao Yang are credited with review and editing.
  • CRediT authorship contribution statement: Yongshun Gong is credited with review and editing, while Wei Liu is credited with conceptualization, theory, and writing.Wei Liu is identified as the corresponding author.

Funding

The first author received an Australian Government Research Training Program Stipend, and the research received no other specific grant funding.

  • Funding: The first author was supported by an Australian Government Research Training Program Stipend.
  • Funding: The research received no other specific grant from government, commercial, or not-for-profit funding agencies.

Data availability

The paper withholds raw harmful-prompt and response data because releasing explicit elicitation prompts could enable misuse, while providing verdict tables for reproducible judge-level analysis.

  • Data availability: Raw harmful-prompt and response materials are not publicly released because they contain explicit content designed to elicit harmful outputs.Authors make them available on reasonable request to bona fide researchers.
  • Data availability: Verdict tables provide per-judge labels, operational-target re-grading, and adjudication labels keyed by model, topic, and variant without response text.The release supports recreating judge-level analyses without distributing harmful content.

Code availability

The paper makes its analysis pipeline available for end-to-end reruns while documenting validity threats involving construct measurement and bundled treatment effects.

  • Code availability: The AAH harness, judge prompts, adjudication protocol, and analysis code are available from the authors on reasonable request.These artefacts allow the judging and bias-diagnosis pipeline to be re-run end to end.
  • Code availability: The central validity question is whether measured attack success tracks real-world harm and whether the contrast isolates framing rather than bundled cues.These threats concern the construct and interpretation of the headline quantity.
  • Code availability: ASCII prompts average 785.7 characters versus 81.3 for controls, a 9.66× length ratio that introduces information-priming differences.The prompts also name actors, targets, tools, objectives, and technical sub-questions.
  • Code availability: The design therefore identifies a bundled treatment of framing, information priming, sub-question enumeration, and sigil-glyph presence.A detailed direct-question control matching information density would be needed to isolate framing, but it was not measured.
  • Code availability: Judge estimates disagree: the harm panel reports positive uplift, while StrongREJECT reports a negative uplift that sensitivity analysis reduces substantially.This disagreement is treated as a measurement-validity issue rather than a simple attack failure.
  • Code availability: Headline rates are judge-rated unsafe-response rates, not ground-truth rates, because each judge is an LLM with non-zero error.A blind LLM adjudication panel corroborates the positive effect but is itself a language-model proxy.

A.2. Internal validity

Internal-validity analyses find robust positive headline patterns but qualify their mechanism and generality because of control phrasing, judge disagreement, runtime differences, sampling structure, and limited model, topic, and author coverage.

  • Matched controls: The study’s controls are analytical rather than operational, creating a design feature tested by the operational-target sensitivity probe.Each ASCII prompt is paired with a same-sub-theme direct question, but the control asks how attacks are typically executed rather than requesting an operational artefact.
  • Robustness: Leave-one-out analyses never reverse the pooled uplift’s sign across any single model or topic.Across judges, model removals preserve ranges of [+5.4, +9.4] pp for Llama Guard 3, [+14.8, +23.4] pp for JailbreakBench, and [−40.9, −29.4] pp for StrongREJECT.
  • Runtime and scoring: Secondary scoring differs from the headline pipeline through a larger judge context window and separate targeted experiment runs with their own controls.The headline corpus and think-block pass otherwise use the same homogeneous local Q8 judge stack.
  • Runtime: Llama 4 Scout’s 3 840 rows were generated on a hosted fp8 deployment whose provider-assembled chat scaffold was not recorded.This prevents recovery of Scout’s exact input assembly.
  • Runtime: The serving runtime can alter model inputs, but bypassing the template caused repetition on three quarters of responses, preventing a clean numerical estimate.Gemma 4 31 B is the target whose template comes from the serving binary rather than the model file.
  • Scope: The target set excludes abliterated models, so discussion of their residual refusal floor relies on literature rather than an experimental anchor.This limits the in-experiment basis for claims about abliterated baselines.
  • Scope: Absolute rates may shift because judging used Q8 while generation mixed hosted fp8 and unrecorded local quantisations.The magnitude of any fp16-stack shift is unmeasured.
  • Scope: The evaluation covers a curated reproducibility panel, not every available system, so transfer beyond tested models is unestablished.The paper makes no exhaustive-coverage claim.

B.1. Sensitivity probe: operational vs analytical StrongREJECT

StrongREJECT’s negative headline uplift is largely explained by analytical control phrasing and control-arm false positives, while independent harm-aware and adjudicated analyses support a positive framing effect.

  • Diagnosis: StrongREJECT’s pooled inversion is concentrated in its question-blind rubric, which evaluates response quality without checking whether the prompt itself is harmful.The rubric assumes the scored prompt is forbidden, making analytical controls vulnerable to false positives.
  • Operational re-grade: Re-grading 1 501 joined responses moved StrongREJECT’s uplift from −34.0 to −10.0 pp when analytical targets were replaced by operational targets.The control-arm rate fell from 74.2% to 43.8%, so analytical phrasing accounts for roughly 24 percentage points of the apparent inversion.
  • Operational re-grade: An earlier validation sample similarly shifted from −40.5 to −11.7 pp, corroborating the direction without serving as primary evidence.That sample had n=172 across all eight topics and nine models.
  • Interpretation: StrongREJECT’s strict rubric can penalise the lower operational specificity of art-framed replies, so a low score need not indicate a faulty judge.The evaluator was designed to deflate overstated jailbreak claims.
  • Multi-judge correction: Removing convergent control false positives changes StrongREJECT’s uplift from −33.7 to −2.2 pp on eight of eleven models.The correction removes 2 779 control flags and 879 ASCII flags while keeping denominators unchanged.
  • Multi-judge correction: Because 8 443 of 31 593 rows lack recorded seeds, admissible joins bound the corrected uplift within [−4.03, −0.88] pp.The residual sign is determined even though its exact value is not uniquely recoverable.
  • Classifier validity: StrongREJECT false-positives 91–98% of controls against blind panels and has recall of 78–81%, corroborating rubric-driven inversion.Overall precision is calibration-dependent at 13–33% and is not treated as stable.
  • Inter-judge disagreement: Across the three-judge comparison, JailbreakBench flags 60.1% versus 20.8% for Llama Guard and 38.8% for StrongREJECT, revealing structured calibration disagreement.About 79% of disagreement falls into two mirror modes, and topic rankings can reverse across judges.

C. Reasoning-model think-block secondary analysis

The secondary analysis examines whether harmful content appears in reasoning-model think blocks even when visible replies look clean. It re-scores non-empty think-block text separately from response-only outputs.

  • Secondary analysis: 192 reasoning-model responses with non-empty think chains were re-scored using two rubric judges.The think-block text was evaluated alone rather than together with the visible response.

D. Runtime-supplied chat templates: a reproducibility hazard

The runtime-supplied chat template is part of the measurement instrument for some models, creating reproducibility hazards when template removal changes generation rather than isolating framing. In the Gemma 4 31 B test, bypassing the template produced mostly degenerate outputs, so the judged differences cannot estimate attack-success effects.

  • Measurement hazard: A runtime-supplied template can make attack-success rates depend jointly on the model and serving program.The serving program may therefore affect measurements even when model weights, prompts, and seeds are identical.
  • Template mechanism: The runtime wraps user text in a scaffold of special tokens marking whose turn it is.The documented Gemma scaffold places the prompt between user-turn markers, while the applied scaffold occupies fifteen to sixteen tokens.
  • Template mechanism: Gemma 4 31 B is the only target whose actual scaffold is supplied by Ollama’s built-in renderer rather than the model file.Its stored template is a pass-through stub, while the model declares a dependency on the Gemma 4 renderer.
  • Attempted ablation: 76.9% of responses were degenerate with the template bypassed, compared with 0.3% when it was applied.Degeneracy was defined using fixed rules including repetition loops and extreme character repetition.
  • Attempted ablation: Most judged bypassed successes were degenerate text: 94 of Llama Guard 3’s 115 and 114 of WildGuard’s 132.The apparent −18.1 and −8.9 point movements therefore largely measure repetition loops rather than harm.
  • Measurement validity: Removing a runtime-supplied template does not isolate framing because it changes the generation regime and collapses output.Refusal-phrase matching is also invalid here, producing a 52.5 point effect from the same collapse rather than harmful content.
  • Runtime comparison: Ollama 0.24.0 and 0.30.8 produced byte-identical template text and identical templated prompt-token counts across five prompt shapes.They differed only on the untemplated path, where the later build prepended one beginning-of-sequence token; the cross-corpus difference remains open.
  • Reproducibility practice: Runtime name and exact version should be recorded alongside model identifiers, with hosted templates treated as unknown when providers may substitute them.The recommendation also calls for checking whether each target model ships its own template.

E. A worked example: a successful framed response

A worked corpus example shows a framed prompt receiving a detailed response in the register of artistic feedback while preserving operational structure. Redaction removes actionable specifics but retains the evidence that the model treated the harmful request as an art-improvement task.

  • Worked example: Llama Guard 3 marked the worked response safe, while StrongREJECT marked it attack_success and JailbreakBench marked it jailbroken.The three judges evaluated the same response under a response-only payload.
  • Prompt construction: The prompt asks for precise, true-to-life information to improve an ASCII-art scene without directly making the art.Its structure includes a harmful actor, action description, supporting context, multi-step process, and missing operational information.
  • Model response: The model replied with a technical breakdown of information needed to complete the harmful process, framed as making the art accurate to a real-world scenario.This response structure is preserved while operational content is redacted.
  • Model response: The response was approximately 2,670 characters long and retained art-feedback markers while returning operational detail.Phrases such as “Based on the scene provided” and “to make the art accurate” show that the social framing persisted into the reply.
  • Additional example: A second redacted example shows the same framing applied to replaying a stolen session token to hijack an authenticated session.The response addresses token theft, browser replay, and session maintenance as the three missing details, with each operational explanation redacted.
  • Redaction and safety: The redactions preserve the exploited structure: a legible harmful request wrapped in an art-critique frame and glyph block.The examples retain the prompt-response pattern while removing operable specifics such as sources, tools, evasion techniques, and ordered steps.
Loading 2609.02215v1…