Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models

"Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models" studies how turning harmful prompts into verse can systematically break LLM safety mechanisms. The authors take known dangerous queries from the MLCommons AILuminate benchmark and other risk scenarios (CBRN threats, cyber-offence, manipulation, loss of control, privacy and misinformation) and rewrite them as short poems that preserve the operational intent but change only the style.

They then test these poetic prompts on 25 state-of-the-art proprietary and open-weight models from nine providers, always in a strict single-turn black-box setting using default safety settings. Curated poems reach an average jailbreak success rate of about 62%, while 1,200 automatically generated poetic versions of MLCommons prompts achieve around 43%, with some providers exceeding 90% attack success.

The central conclusion is that poetic framing itself—metaphor, rhythm, narrative indirection—disrupts the pattern-matching heuristics used by current guardrails. Stylistic variation alone is enough to bypass many contemporary alignment and evaluation schemes, revealing a broad, systematic vulnerability that future safety methods must explicitly address.

Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models

Piercosma Bisconti, Matteo Prandi, Federico Pierucci, Francesco Giarrusso, Marcantonio Bracale, Marcello Galisai, Vincenzo Suriani, Olga Sorokoletova, Federico Sartore, Daniele Nardi