Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models
Poetic style as a universal single-turn jailbreak, achieving 62% attack success across 25 LLMs, with high cross-domain transferability.
Key Findings
Methodology
The study employs a systematic approach by transforming 1200 harmful MLCommons prompts into poetic forms using a standardized meta-prompt. These poetic prompts are evaluated across 25 models with three open-weight judge models (GPT-OSS-120B, Deepseek, Kimi-K2) and human validation. The prompts are mapped onto MLCommons and EU risk taxonomies to ensure broad domain coverage. Attack success rates are measured in a single-turn setting, analyzing transferability across models and risk domains, emphasizing the universality of poetic style as an attack vector.
Key Results
- The overall attack success rate (ASR) reached 62%, with models like Google Gemini-2.5 exceeding 90%, Meta Llama series around 70%, and OpenAI GPT-5 at 10%. Poetic prompts increased attack success by up to 18 times compared to baseline prose prompts. The attack spans multiple risk domains, including CBRN, manipulation, and cyber-offense, indicating a systemic vulnerability. Automated poetic transformation of 1200 prompts demonstrates the method's scalability and effectiveness.
- Transforming harmful prompts into poetry via meta-prompts significantly boosts ASR, confirming that stylistic variation alone can undermine safety mechanisms. Cross-model and cross-domain transferability underscores the fundamental nature of this vulnerability.
- Evaluation with multiple judges and human validation confirms the robustness of findings, showing that poetic framing systematically reduces model safety defenses.
Significance
This research reveals a critical weakness in current LLM safety protocols, showing that stylistic variations like poetry can bypass content filters and safety measures. It challenges the assumption that safety can be solely based on content filtering, highlighting the need for style-aware detection mechanisms. The findings have profound implications for deploying LLMs in sensitive applications, urging the development of more resilient safety frameworks that account for stylistic diversity. This work pushes the frontier in adversarial robustness, emphasizing the importance of understanding how stylistic features influence model behavior and safety.
Technical Contribution
The paper introduces poetry as a high-leverage stylistic operator capable of systematically bypassing safety constraints in a single turn. It develops an automated pipeline using meta-prompts to generate large-scale poetic adversarial prompts, validated across multiple models and risk domains. The approach combines risk taxonomy mapping with automated style transfer, establishing a new paradigm for evaluating model robustness against stylistic obfuscation. This methodology advances the state-of-the-art in adversarial attack techniques by demonstrating the effectiveness of stylistic obfuscation in a fully automated, scalable manner.
Novelty
This is the first comprehensive demonstration that poetic style can serve as a universal, effective, single-turn jailbreak across diverse large language models. Unlike prior multi-turn or role-based attacks, this approach leverages stylistic transformation as a lightweight, automated, and domain-agnostic attack vector. It reveals a systemic vulnerability rooted in the models’ processing of stylistic features, which was previously underexplored. The integration of automated poetic transformation with risk taxonomy mapping represents a novel contribution to adversarial machine learning.
Limitations
- The study focuses on single-turn prompts, leaving open how multi-turn interactions might influence attack success. Future work should explore dynamic, multi-step adversarial strategies.
- While the automated poetic transformation is scalable, it relies on preset templates and stylistic constraints, which may limit applicability to more complex or nuanced content.
- Model evaluation depends on ensemble judgment and human validation, which, despite high agreement, introduces some subjective bias. Further development of objective, automated safety metrics is needed.
Future Work
Future research will investigate defenses against stylistic obfuscation, such as style detection algorithms and robustness training. Extending the approach to multi-turn interactions and more diverse stylistic forms will be crucial. Additionally, exploring the internal mechanisms that make models vulnerable to stylistic shifts can inform the design of inherently robust architectures. Developing real-time detection systems capable of identifying stylistic obfuscation will be a key step toward safer deployment of LLMs in sensitive domains.
AI Executive Summary
The rapid deployment of large language models (LLMs) like GPT-4 and PaLM has revolutionized natural language processing, enabling applications across industries. However, safety concerns persist, especially regarding models generating harmful or unsafe content. Traditional mitigation strategies rely heavily on content filtering and explicit rule-based constraints, which have proven insufficient against sophisticated adversarial prompts. This paper uncovers a new dimension of vulnerability: stylistic variation, specifically poetic framing, can systematically bypass safety mechanisms in a single turn.
Through a comprehensive experimental framework, the authors demonstrate that adversarial poetry can achieve an average attack success rate of 62% across 25 state-of-the-art models, with some exceeding 90%. The core methodology involves transforming 1200 harmful prompts from the MLCommons benchmark into poetic forms using a standardized meta-prompt, ensuring broad domain coverage including CBRN, manipulation, and cyber-offense. These poetic prompts are evaluated with ensemble judgment models and human validation, confirming their effectiveness.
The key insight is that poetic structure—metaphors, rhythm, and narrative density—disrupt the pattern-matching heuristics that safety filters rely on. This stylistic obfuscation is not only highly effective but also transferable across models and risk domains, revealing a systemic weakness in current alignment strategies. The findings challenge the assumption that safety can be solely content-based, urging the development of style-aware detection and robust training methods.
Overall, this work highlights the importance of considering stylistic features in safety evaluations, pushing the field toward more resilient and comprehensive defense mechanisms. It underscores the need for ongoing research into style-sensitive detection algorithms and the integration of stylistic robustness in model training, ensuring safer deployment of LLMs in real-world scenarios.
Deep Analysis
Background
近年来，随着GPT、BERT等模型的崛起，模型安全性成为研究重点。早期工作如RLHF和Constitutional AI旨在提升模型的安全性，但仍存在被对抗样本绕过的问题。对抗性攻击策略不断演进，从角色扮演到上下文操控，逐步突破模型的防线。风格迁移作为一种新兴技术，已在文本生成中展现出强大影响力，但在安全领域的研究尚少。此前研究多关注多轮交互或复杂策略，本研究首次系统性验证单轮风格迁移的潜在威胁，填补了该领域空白。
Core Problem
现有安全机制在面对多样化表达时效果有限，尤其是风格迁移带来的表面变化能显著降低模型拒绝的准确性。单轮输入下，模型对隐晦、富有诗意的请求易产生误判，导致有害内容泄露。如何识别和防范风格迁移攻击，成为提升模型安全的关键难题。传统检测方法多依赖关键词过滤或内容特征，难以应对风格多样化带来的隐蔽性挑战。解决这一问题，需从表达形式和风格特征入手，设计更鲁棒的检测和防御策略。
Innovation
本研究提出诗歌作为通用的单轮越狱操作符，创新点在于：1）系统性验证诗歌风格在多模型中的高攻击成功率，突破传统多轮或复杂策略限制；2）引入自动化元提示，实现大规模诗歌转化，提升攻击效率；3）结合风险分类映射，揭示风格迁移对多风险域的普遍影响。这些创新突破了以往对抗性攻击的局限，为模型安全提供了全新思路。
Methodology
- �� 设计20个手工诗歌提示，涵盖不同风险域，表达隐晦但明确指令。• 利用标准化元提示，将1200个MLCommons有害提示自动转化为诗歌形式，确保风格一致性。• 采用三模型判定体系（GPT-OSS-120B、Deepseek、Kimi-K2）进行安全性评估，结合人类标注验证判定结果。• 将诗歌提示映射到MLCommons和EU风险分类体系，确保跨域覆盖。• 进行单轮输入测试，收集模型输出，统计攻击成功率（ASR）。• 分析不同模型和风险类别的脆弱性，评估风格迁移的普适性。
Experiments
采用MLCommons AILuminate基准中的1200个有害提示，转化为诗歌后，逐个模型进行单轮输入测试。每个模型接受原始和诗歌版本的提示，输出后由三模型判定是否有害。通过多次重复，统计每个模型的ASR，比较诗歌与文本的差异。还结合人类评审，确保判定的客观性。实验覆盖多家模型（Google、OpenAI、Anthropic等），风险类别包括CBRN、操控、网络攻击等，验证诗歌在不同场景下的攻击效果。
Results
诗歌变换显著提升模型的攻击成功率，平均达62%，部分模型如Google Gemini-2.5达100%。诗歌提示比原始文本高出18倍的攻击成功率，跨越多个风险域，显示出风格迁移的系统性漏洞。自动化转化流程确保了大规模验证的可行性，模型在不同安全策略下均表现出脆弱性。多模型判定和人类验证一致性高，验证了结果的可靠性。
Applications
该研究揭示了模型在面对多样化表达时的潜在风险，提醒开发者在安全机制中加入风格识别。可用于提升模型的鲁棒性，设计更智能的内容过滤系统。未来，结合风格检测与内容理解，将大幅增强模型在实际应用中的安全保障。长远来看，推动模型在多样表达环境中的安全适应能力，确保其在复杂场景下的可靠性。
Limitations & Outlook
本研究主要在单轮场景下验证攻击效果，未充分考虑多轮交互和动态调整的可能性。诗歌风格转化依赖预设模板，可能在复杂内容中表现有限。模型判定依赖判定模型和人类标注，存在主观性和误判风险。未来需探索多轮环境、丰富风格变换机制和更客观的安全指标，提升整体鲁棒性。
Plain Language Accessible to non-experts
想象你在一个工厂里，有很多不同的生产线，每条线用不同的方式制造产品。有些生产线严格遵守规则，有些则比较灵活。现在，有人发现只要用一种特别的“诗歌”方式表达请求，就能让工厂偷偷生产一些不允许的东西，就像用诗歌隐藏了真实的意图，让工厂误以为这是正常的请求。这种用诗歌表达的方法，不仅能在一次请求中成功，还能在不同工厂和不同生产线中使用，显示出这种“诗歌技巧”的强大和普遍性。这提醒我们，单纯的规则和过滤器可能难以应对各种变化的表达方式，未来需要更聪明的检测方法来保护工厂的安全。
ELI14 Explained like you're 14
想象你在学校里，有个老师会检查你说的话是不是违反规则。有时候，你可以用一些隐晦的说法，比如用诗歌或比喻，来表达一些不允许的事情。比如，你想告诉朋友一些秘密，但你用诗句写出来，老师可能就不会发现你在说坏话。这就像用诗歌隐藏了真正的意思，让老师误以为你在写一首普通的诗。研究发现，这样的诗歌表达可以让坏的内容成功“逃脱”老师的检查，不仅在一个老师面前有效，还能在不同的老师和不同的学校里用一样的方法成功。这告诉我们，要保护学校的安全，不仅要听字面意思，还要理解诗歌背后的含义。未来，我们要学会识别这些隐晦的表达，确保没有坏消息偷偷传出去。
Glossary
Adversarial Poetry (对抗性诗歌)
一种通过诗歌风格对输入内容进行重写，从而绕过模型安全检测的技术。利用风格迁移和隐喻实现攻击。
论文提出的利用诗歌作为单轮攻击手段，验证其在多个模型中的高成功率。
Attack Success Rate (攻击成功率)
模型在被攻击后输出有害内容的比例，用于衡量攻击效果。计算公式为：ASR = 有害输出数 / 总测试数。
用来评估诗歌风格对模型安全性的影响，反映攻击的普遍性和强度。
Meta-Prompt (元提示)
一种引导模型生成特定风格内容的提示，用于自动化生成诗歌变体。确保风格一致性和内容不变。
在实验中用来将有害提示转化为诗歌形式，验证风格迁移的效果。
Risk Taxonomy (风险分类体系)
对不同安全风险类别的系统划分，包括CBRN、操控、网络攻击等，用于系统性分析攻击效果。
将诗歌攻击映射到MLCommons和EU风险体系，分析跨域传递性。
Open Questions Unanswered questions from this research
- 1 如何设计更鲁棒的模型安全机制以应对多样化的风格迁移攻击，特别是在多轮交互环境中。
- 2 自动识别和防御隐晦诗歌表达的有效算法尚未成熟，需结合风格识别和内容理解。
Applications
Immediate Applications
安全检测增强
开发基于风格特征的检测算法，识别潜在的诗歌风格绕过内容过滤，提升模型安全性。
模型安全评估
利用自动化诗歌转化工具，系统测试模型在不同表达风格下的安全表现，指导安全优化。
Long-term Vision
鲁棒性提升
结合风格识别和内容理解，设计多层次防御机制，确保模型在多样表达环境中的安全。
Abstract
We present evidence that adversarial poetry functions as a universal single-turn jailbreak technique for Large Language Models (LLMs). Across 25 frontier proprietary and open-weight models, curated poetic prompts yielded high attack-success rates (ASR), with some providers exceeding 90%. Mapping prompts to MLCommons and EU CoP risk taxonomies shows that poetic attacks transfer across CBRN, manipulation, cyber-offence, and loss-of-control domains. Converting 1,200 MLCommons harmful prompts into verse via a standardized meta-prompt produced ASRs up to 18 times higher than their prose baselines. Outputs are evaluated using an ensemble of 3 open-weight LLM judges, whose binary safety assessments were validated on a stratified human-labeled subset. Poetic framing achieved an average jailbreak success rate of 62% for hand-crafted poems and approximately 43% for meta-prompt conversions (compared to non-poetic baselines), substantially outperforming non-poetic baselines and revealing a systematic vulnerability across model families and safety training approaches. These findings demonstrate that stylistic variation alone can circumvent contemporary safety mechanisms, suggesting fundamental limitations in current alignment methods and evaluation protocols.