How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defense

1 INTRODUCTION

• 95.7% attack success on wrapped Classical Chinese requests contrasts with 20.4% on bare requests; wrapping adds about 75 points, versus 6.3 points across wrapped registers.Under the same wrapper, attack success is 89.4% in English and 93.0% in modern Chinese.Source: Table 1 · p. 1, §1 · pp. 1–2
• GUISE pairs harmful and benign requests across English, modern Chinese and Classical Chinese, with held-out classical wrappers to test generalisation.Chinese language and literature annotators review released harmful prompts for intent fidelity.Source: §1 · p. 2
• GUISE's calibrated judge counts warn-then-answer responses as attack successes, addressing evaluator errors that can make refusals appear more effective.On the same wrapped responses, a prior evaluator reported 28.8–45.1% success where this judge found 89.4–95.7%.Source: §1 · p. 2
• Bare harmful–benign directions lie 6–10° from refusal, but wrapping turns them 77–86° away and reduces refusal projection to benign-text levels across three registers.Classical Chinese has the highest attack success rate.Source: §1 · p. 2
• AXIS combines preference optimisation with rotation to align harmful-request representations to refusal and commitment to carry refusals through rather than warn then answer.Preference optimisation trains on harmful and benign requests to preserve helpful behaviour.Source: §1 · pp. 2–3
• Across Qwen3-1.7B, Qwen3-4B and GLM-4-9B, AXIS achieves the highest combined safety and usability score among the compared methods.The method combines preference optimisation with rotation and commitment objectives.Source: §1 · pp. 2–3

2 RELATED WORK

• Earlier work links jailbreaks to competing objectives and mismatched generalisation; GUISE crosses wrapper and register on matched intents to distinguish their effects.An existing Classical Chinese optimiser changes register and wrapper together, so its success cannot identify which factor matters.Source: §2 · p. 3
• Representation steering can restore refusal under wrapping but breaks about a third of benign answers; AXIS instead trains rotation and commitment objectives.The paper compares five baselines spanning preference optimisation, deeper-refusal methods and fine-tuning defences.Source: §2 · p. 3
• Refusal-phrase matching clears warn-then-answer responses by construction and agrees with expert judgments only 56% of the time, with a 64% false-positive rate.The passage notes that this evaluator remains commonly used in jailbreak research and defence papers.Source: §2 · p. 3

3 GUISE: ASKING THE SAME INTENT FOUR WAYS

• GUISE matches direct and wrapped versions of harmful intents, and includes benign requests restyled in the same wrapper to measure over-refusal.The harmful intents are drawn from licensed public red-team sets and retained when the official CC-BOS pipeline confirms a jailbreak.Source: §3 · p. 4
• Held-out classical genres and translations into English, modern Chinese and Classical Chinese test generalisation across wrappers and register.The held-out genres were absent from training data, and the translation pipeline holds intent and wrapping fixed so register is the changing variable.Source: §3 · p. 4
• A four-way output-centric judge scores responses, counts warn-then-answer as attack success and computes strict refusal rate as 1 − [P(WTA) + P(direct answer)].The same frozen reference responses are rescored in every batch, and batches outside a preset range are discarded.Source: §3 · p. 4
• GUISE splits intents into 561 train, 98 development and 408 test examples, rechecking disjointness before each training job.Main tables use one canonical wrapped prompt per intent, selected before results were read.Source: §3 · p. 4

4 WHAT CHANGES IN THE REPRESENTATION WHEN A REQUEST IS WRAPPED

• The representation account is correlational and population-level, based on matched sets across measured models and registers rather than individual items.The passage frames the representation change as accompanying the failure, not as predicting each wrapped attack.Source: §4 · p. 4
• The analysis measures each condition’s harmful–benign direction against a refusal direction estimated from bare modern Chinese requests, using angle and refusal projection.Angle reflects direction only; projection depends on both direction and length.Source: §4 · pp. 4–5
• After wrapping, the harmful–benign direction lies 77–86° from refusal and its refusal projection falls from 761 for bare modern requests to 164–219, the level of benign text.Wrapping lowers projection similarly in English, modern Chinese and Classical Chinese; register sets the bare starting point.Source: §4 · p. 5
• Rotating the wrapped harm direction onto refusal at constant norm changes nothing, while a constant projection shift restores refusal but turns a third of benign answers into nonsense.The findings motivate a content-dependent correction that pulls harmful requests toward refusal while leaving wrapped benign requests in place.Source: §4 · p. 5

• AXIS combines preference optimization over wrapped pairs with rotation and commitment terms, training the model to refuse harmful requests and answer benign ones.Source: §5 · pp. 5–6
• The rotation term aligns the policy’s Classical Chinese harm direction with a refusal direction computed from the frozen base model on training intents.During training, the policy’s direction is tracked from bare harmful and benign requests at the same layer.Source: §5 · pp. 5–6
• Representation alignment alone does not prevent warn-then-answer responses; the commitment term raises the likelihood of chosen responses, emphasizing refusal decisions and completion.It uses a length-normalized negative log-likelihood, up-weighting the first k tokens and terminal EOS.Source: §5 · pp. 5–6
• Training pairs use short in-register refusals as chosen responses to harmful prompts and helpful answers as chosen responses to benign prompts.The rejected responses are harmful answers or warn-then-answer responses for harmful prompts, and refusals for benign prompts.Source: §5 · p. 6

• The controlled study compares LoRA objectives on Qwen3-1.7B, Qwen3-4B, and GLM-4-9B, alongside five reimplemented external methods.AXIS uses λrot=0.1 on all three models without per-model tuning; the 1.7B objective arms use three seeds.Source: §6 · p. 6
• Evaluation covers 334 in-distribution wrapped attacks, 834 held-out attacks across three unseen genres, and two benign-request sets.The benign sets contain 245 Classical Chinese XSTest requests and 300 plain benign requests in the attack framing.Source: §6 · p. 6
• Table 2 compares five alignment methods, plain DPO, the base model, and AXIS across three models using attack-refusal and benign-request metrics.Source: Table 2 · p. 7
• Harmful-set scores use strict refusal rates, while benign-set scores track helpfulness, refusal, or nonsense; judging is checked against human annotations and frozen responses.Comparisons use paired exact McNemar tests with Holm correction, and paired bootstraps resample intents.Source: §6 · p. 7
• On Qwen3-1.7B, the real anchor gives the best safety–usability balance; at 4B and 9B, every anchor saturates held-out-wrapper attacks.Source: Table 3 · p. 8

7.1 SAFETY AND USABILITY AGAINST FIVE RECENT METHODS

• At 1.7B, the base model’s strict refusal rate is 5.4% in-distribution and 29.1% on held-out wrappers, while adversarial-benign over-refusal is 6.9%.The comparison covers five recent alignment methods, plain DPO, and the base model across three model sizes.Source: §7.1 · p. 8
• Above 1.7B, AXIS separates on safety and usability together, while at 1.7B its composite lead rests on the benign half and the shared-dose gap to strongest baselines is wide.At 4B it matches SimPER’s safety with 5.7 points less over-refusal; at 9B it exceeds SimPER in-distribution and ties Booster on safety with 9.0 points less over-refusal.Source: §7.1 · p. 8

7.2 ABLATION STUDIES

• Across twelve adapters, rotation closes the held-out-wrapper angle from 61–81° to 22–32° and raises strict refusal on ood834 by 47.0, 42.7, and 39.7 points across seeds.The refusal-projection gain tracks the refusal-rate gain (ρ=0.94); plain-benign over-refusal does not increase.Source: §7.2 · p. 8, Figure 3 · p. 8
• On ood834, the three rotation anchors, including the placebo, order by their overlap with the model’s safety axis in every seed.All nine paired contrasts are significant.Source: §7.2 · p. 9
• Removing the preference term leaves safety intact or higher but raises plain-benign refusals to 27–41%, versus AXIS’s 0–3%.One AXIS configuration spans 66.5–83.5 on harm334, making single-seed arms within-batch rankings rather than effect sizes.Source: §7.2 · p. 9

7.3 GENERALISATION: HELD-OUT WRAPPERS AND LARGER MODELS

• At the shared dose, adding rotation raises mean strict refusal from 44.3% to 66.6% on harm334 and from 42.8% to 68.4% on ood834.Across twelve seed–set pairs, refusal-projection and strict-refusal gains track each other (ρ=0.79, p=0.002), but vary widely across seeds.Source: §7.3 · p. 9, Figure 4 · p. 9
• Classical-only post-training yields 68.1–73.7% strict refusal on attacks in modern Chinese or English, with at most a 3.2-point in-distribution register cost.On held-out wrappers, modern Chinese and English refusal rates are 73.7% and 70.4%, versus 68.5% for Classical Chinese.Source: §7.3 · p. 9, Table 4 · p. 9
• At larger scales, rotation alone also raises harm334 refusal, while all arms saturate on ood834, shifting dose differences toward over-refusal rather than safety.Rotation alone raises harm334 refusal from 23.7% to 48.8% at 4B and from 44.9% to 84.4% at 9B.Source: §7.3 · p. 9

8 CONCLUSION

• GUISE measures refusal on matched direct, wrapped, benign, and held-out-genre requests under a judge that counts warn-then-answer as attack success.The conclusion reports that narrative wrapping, rather than register, drives the failure and turns the harmful–benign separating direction away from the refusal direction.Source: §8 · p. 10
• AXIS combines rotation to train the harmful-request direction back toward refusal, commitment to carry refusals through to completion, and preference training to keep benign requests answered.The conclusion attributes held-out-wrapper generalisation to the rotation term.Source: §8 · p. 10
• Across three models and five recent methods, AXIS leads the safety–usability composite, with its margin shrinking as model scale increases.Source: §8 · p. 10

AI USE STATEMENT

• Language models generated Classical Chinese versions, parallel-register data, and held-out-genre attacks; trained annotators checked released harmful prompts against English intents, and a Chinese-language scholar revised fluency.Source: AI USE STATEMENT · p. 10
• Responses were model generations scored by a language-model judge, calibrated against blind human annotation and an independent guard model.Source: AI USE STATEMENT · p. 10
• An AI assistant edited prose, helped write code, and drew figures; authors report checking AI-assisted outputs and taking responsibility for the final work.Checks included code equivalence tests and prose and figure review against reported results.Source: AI USE STATEMENT · p. 10

A DISCUSSION AND LIMITATIONS

• Batch comparisons compressed inter-arm gaps by 27%, and three seeds of one configuration spanned 17–20 points; report paired results from one calibrated judge and batch.The recommendation also calls for separate direct and wrapped refusal rates, benign controls in the same guise, seeds, and a frozen anchor set.Source: A DISCUSSION AND LIMITATIONS · p. 14
• The study uses one small model family, while the representational account is correlational and does not predict which individual wrapped attacks are refused.The expert-vetted core is small, and the remaining corpus is machine-generated and audited.Source: A DISCUSSION AND LIMITATIONS · p. 14

B TRAIN–EVALUATION INDEPENDENCE

• Six checks compare training inputs with evaluation files before training; eight English intents whose translations overlapped geometry-training sentences were excluded from every reported number.The checks cover held-out and OOD attacks, benign hold-out, and development sets.Source: B TRAIN–EVALUATION INDEPENDENCE · p. 14, Table 5 · p. 14

C DATASHEET FOR GUISE

• GUISE pairs harmful intents with benign controls rendered through the same classical wrapping, and every released harmful prompt receives expert fidelity review.A 150-prompt core is human-written; the other 97% is machine-rendered. The benchmark is limited to one language, one register family, and one attack framework.Source: C DATASHEET FOR GUISE · pp. 14–15

D REGISTER-SHIFT GENERATOR

• The register-shift generator uses thin deterministic templates rather than search; its three genres yield 834 attacks over 332 intents, with 489 benign counterparts.Elaborate wrappers were dropped because the small model continued the genre instead of answering, reducing attack success to zero.Source: D REGISTER-SHIFT GENERATOR · p. 16

E OBJECTIVE DETAILS

• Harmful preference pairs reject only judged actionable completions, while benign pairs choose helpful rollouts over refusals; the controlled width-1 pool contains 3,336 pairs.The controlled study uses the smallest model GUISE readily jailbreaks and generates responses to completion because a 512-token cap halved measured attack success of trained arms.Source: E OBJECTIVE DETAILS · p. 16, §G.1 · p. 18

F JUDGE CALIBRATION AND DRIFT

• The calibrated judge reaches κ 0.64 and AC1 0.76, while blind paired annotation finds 92.8% agreement on harmful items and 87.9% on benign items.A second-family guard provides evidence against a single-vendor artefact, but it is uncalibrated against human labels.Source: F JUDGE CALIBRATION AND DRIFT · pp. 17–18

G.1 DESIGN CHOICES BEHIND SECTION 6, AND WHY

• The official evaluator reports 45.1% success on matched wrapping renderings, although the commitment judge reads 94% of the same elaborate-wrapper responses as direct answers.The official evaluator’s consistency score does not credit sustained classical prose as delivery; the study substitutes deepseek-chat for the unavailable original judge.Source: §G.1 · p. 18

G.2 A FROZEN ANCHOR SET CATCHES A SILENT JUDGE CHANGE

• The judge’s identifier substitution silently switched decoding to reasoning mode, which failed to parse a tenth of frozen anchor items and relabelled attack successes as off-topic.The reasoning mode and direct-answering mode had similar accuracy on completed human-labelled items, but the former omitted readings concentrated on long substantive responses.Source: §G.2 · p. 19, Table 9 · p. 19
• The shift moved anchor strict refusal from 23% to 33–35% and affected 73% of judged rows; a hard anchor-rate gate restored results within 0.6 points for the five-baseline table.The gate requires an anchor strict refusal rate in [20.5, 25.5] and at most eight unparseable items.Source: §G.2 · p. 19
• Usability rates remain comparable only within a batch: the gate misses finer-category drift, and the calibration set has no benign labels for a benign-side gate.On unchanged responses, α-DPO over-refusal rose from 53.9% to 77.1% across judging batches.Source: §G.2 · pp. 19–20

H EXTENDED RESULTS

• On the same responses, the attack evaluator reads success 50–61 points lower and misses 53–68% of successes; every ladder step is paired and significant (p ≤0.002).The modern–classical step is also significant in a second batch (p=0.041).Source: H EXTENDED RESULTS · p. 20
• On the width-5 pool, AXIS beats DPO+rot on every set and seed, and seed spread shrinks from 19.7 to 1.3 points as data width and update count co-vary.In distribution, real and random anchors are indistinguishable in two seeds and reversed in the third; the generalising rotation component is along u.Source: H EXTENDED RESULTS · p. 20
• Raising the rotation dose from 1 to 4 changes in-distribution strict refusal by −0.3 points while increasing over-refusal by 5.7 points.At fixed doses above 0.1, seed spread exceeds safety differences between doses, and retraining can change which dose a per-model rule selects.Source: H EXTENDED RESULTS · p. 20
• The representational account is population-level: within wrapped sets, refusal projection on the modern axis does not predict individual refusals, and the predictive direction is nearly orthogonal.A smaller bare-string angle on a larger model holds for only one estimator and layer rule; high-dose rotation raises refusal propensity globally.Source: H EXTENDED RESULTS · p. 20
• At 1.7B, α-DPO leads the recipe in safety across genres and firm refusals, but at 9B the recipe is safer than α-DPO (p < 10−8).At 4B, SimPER, DOOR, and α-DPO reach 94–99% on both safety axes; at 9B, SimPER, Booster, and DOOR do so with 11–19% over-refusal.Source: H EXTENDED RESULTS · p. 20
• The rot+cmt arm matches α-DPO’s in-distribution strict refusal at a third of its over-refusal, but refuses 39% of plain benign requests.Within the Table 14 batch, α-DPO over-refuses more on adversarial than plain benign requests, and its seeds vary widely.Source: H EXTENDED RESULTS · p. 20
• RepBend at its authors’ coefficients collapses into repeated continuations scored as refusal or off-topic; reducing repulsion restores generation but weakens safety.Both variants trail the recipe on Composite+; RepBend has no term that lifts a refusal.Source: H EXTENDED RESULTS · pp. 20–21

I BASELINE IMPLEMENTATION NOTES

• SimPER’s 1.7B run collapses under the shared learning rate: chosen log-likelihood per token falls from −4.4 to −22.5 and rejected from −0.2 to −11.5.On 9B, the same code converges, with chosen log-likelihood per token rising from −4.4 to −0.3 and rejected falling from −1.2 to −11.5; the 1.7B run is reported as trained to preserve the shared-rate design.Source: I BASELINE IMPLEMENTATION NOTES · p. 21

J HIDDEN-STATE GEOMETRY AFTER TRAINING

• Post-training diagnostics measure refusal-direction geometry and harmful–benign separation; the orthogonal anchor shifts geometry unrelated to refusal and still refuses.The base-model diagnostic also measures the angle between harmful-minus-benign contrasts and the refusal direction across wrapped and held-out genre sets.Source: Table 10 · p. 21, Table 11 · p. 22

K BENCHMARK CONSTRUCTION DETAILS

• The benchmark contains 1,108 deduplicated intents, and its renderings are distinct enough to release the full set while reporting headline rates on canonical renderings.Of the intents, 1,099 yield at least one confirmed classical jailbreak and 1,067 remain after licensing exclusions; 96% of prompts have distinct twelve-character openings, and eight of 415 evaluation intents are excluded after translation collapse.Source: K BENCHMARK CONSTRUCTION DETAILS · p. 22

L DOSE SELECTION ACROSS MODELS

• At λrot=0.1, the composite is near the per-model best at 4B and best at 9B, but 1.7B dose preferences differ across training runs.At 1.7B, the shared dose costs 6.0 composite points in one batch; that penalty does not reproduce in the other run. At 4B, random-anchor controls score 92.3 and 91.7 at λ=0.1 and 0.3, matching the real anchor’s level.Source: Table 12 · p. 22, L DOSE SELECTION ACROSS MODELS · pp. 22–23

M COMPOSITE SCORE AND WEIGHT SWEEP

• AXIS’s composite lead over the strongest external method is +14.5 [+11.1, +18.1] at 1.7B, +3.0 [+1.0, +5.2] at 4B, and +1.4 [−0.2, +3.0] at 9B.The lead is not significant at 9B, and AXIS ranks first for usability weights from 0.4 to 0.8 at 1.7B, 0.1 to 0.9 at 4B, and 0.1 to 0.7 at 9B.Source: M COMPOSITE SCORE AND WEIGHT SWEEP · p. 23

N SEED VARIABILITY AND THE PER-SEED ABLATION TABLE

• Paired ablation contrasts are computed within seed; in the dose batch, the same AXIS configuration scores 83.8 / 72.8 / 66.5 on harm334 and 90.5 / 81.2 / 71.0 on ood834.The width-5 arm spans only 1.3 points on ood834.Source: N SEED VARIABILITY AND THE PER-SEED… · p. 23, Table 15 · p. 24

O.1 SAFETY SIDE: IN-DISTRIBUTION ATTACKS

• In the two shown in-distribution wrapped attacks, displayed ablation arms comply while AXIS refuses firmly; additional annotated arms also refuse firmly.The case studies use blind human annotations, and their examples contrast rotation-only and full-recipe responses as well as attack and benign cases.Source: O CASE STUDIES · pp. 24–25, §O.1 · pp. 25–26

O.2 OVER-REFUSAL SIDE: BENIGN BORDERLINE QUESTIONS

• AXIS answers benign classical-Chinese register-shifted questions that the strongest preference baseline refuses.The examples include a request about Marge Simpson’s web history and a question about Auschwitz concentration-camp conditions.Source: §O.2 · pp. 27–28
• AXIS provided a helpful answer to a benign borderline question about the Auschwitz concentration camp.The English and Chinese responses identify it as one of Nazi Germany’s largest concentration camps and give 1940 as its establishment year.Source: §O.2 · p. 28

O.3 BOTH AUXILIARY TERMS TOGETHER

• Rotation-only training still gives a direct answer, whereas the full AXIS recipe yields a firm refusal on the same attack.In one example, rotation-only produced instructions for destroying a historical artifact, while AXIS refused.Source: §O.3 · pp. 28–29
• Two further annotated arms, rotation plus commitment without DPO and α-DPO, also refused firmly in the reported cases.For another attack, base training answered directly, while rotation plus commitment without DPO, AXIS with an orthogonal anchor, and α-DPO refused firmly.Source: §O.3 · pp. 28–29

O.4 CROSS-METHOD: THE TWO CORNERS OF THE PLANE

• α-DPO refuses 99.4% of in-distribution attacks but 77.1% of adversarial-benign requests, versus AXIS at 86.5% and 16.3%, respectively.The comparison illustrates competing safety and usability outcomes across the two test items.Source: §O.4 · p. 30
• SimPER’s 1.7B run is a training collapse, and the reproduced passage is only the coherent part of a broader mixed-script output.Source: §O.4 · p. 30
• At λrot=1, AXIS is the only system desired on both wrapped-attack and benign-borderline columns; at λrot=0.1, one of four verdicts changes.The shared-dose AXIS arm becomes a warn-then-answer on srf 0095, joining the baselines that fail that item.Source: Table 16 · p. 31