Search papers, labs, and topics across Lattice.
This paper introduces the ASCII Attack, a novel method that recontextualizes harmful requests as artistic critiques to bypass safety alignment in large language models. By embedding harmful content in ASCII art and framing it as feedback, the study reveals that 62% of such prompts are classified as harmful, significantly outperforming control prompts. The findings indicate that the attack's effectiveness is model-dependent, with the most vulnerable model achieving a 93% success rate, highlighting a critical vulnerability in current safety mechanisms.
The ASCII Attack reveals that framing harmful requests as artistic critique can bypass safety filters in large language models, achieving up to 93% success in eliciting harmful responses.
Safety alignment trains large language models to refuse harmful requests stated plainly, but that training is applied mostly to surface form. Requests that only recontextualise the same operational content, changing how the model reads it, are therefore only weakly covered. The ASCII Attack is one such recontextualisation. It is single-turn and black-box: one message, with no access to model internals. It embeds a fully legible harmful request in ASCIl-art characters, presents it as artwork, and asks for feedback. Unlike ArtPrompt, it hides nothing: the request stays readable. The reply is written as artistic critique and can contain operational detail that a plain request would have been refused for. Every framed prompt is paired with a direct-question control, so the contrast is isolated from topic, model and decoding variation. The contrast identifies a bundled surface, not one isolated channel. Across eleven models and eight harm topics, a harm-aware classifier judges 62% of framed prompts harmful against 42% of controls. On the most susceptible model the framed prompt succeeds 93% of the time. A single query matches or exceeds published single-query attacks under four of five harm judges. The effect tracks the model more than the topic and does not diminish with scale. At least one judge dissents from the panel majority on nearly two-thirds of framed rows, which is itself a measurement-validity finding. That pattern is consistent with mismatched generalisation.
