jailbreak-robustness CAP-0024 · activeRefusing harmful requests under obfuscation
Covers maintaining refusal when harmful intent is wrapped in roleplay or encodings, harm that emerges only from combined segments, and unsafe content inside reasoning traces; excludes instructions injected via retrieved data.
Tags: general
Proposed from the ingestion pipeline rather than chosen by hand. 3 papers independently pointed at this same competence, arriving under 3 different names (jailbreak-robustness, reasoning-trace-safety, compositional-harm-detection), which is the signal that it is a real recurring topic and not one author's framing. Complements prompt-injection and goal-conflict-safety without duplicating them, with three supporting papers.
What counts as this capability
Scope boundary used when deciding whether a paper is really about this capability, rather than merely mentioning it.
Covers maintaining refusal when harmful intent is wrapped in roleplay or encodings, harm that emerges only from combined segments, and unsafe content inside reasoning traces; excludes instructions injected via retrieved data.
Claims
- observationsingle paper↑1↓0Across ten languages and six models on HarmBench and AdvBench, unsafe-response rates for the same model differ by more than 50 points between languages; high-resource languages are safer on plain harmful queries but more vulnerable to adversarial-prompt jailbreaks, and simple defenses work but their effect depends on language and model, so safety measured in English does not transfer.
- observationsingle paper↑1↓0Encoding a harmful request in Base64, ROT13 or hex lowers full compliance in six frontier chat models from about 76% (natural-language prompts) to about 59%, but the least-complied-with encoding still produced malicious output in about 54% of cases, so obfuscation by encoding is a weaker attack than plain non-English text yet is far from neutralized.
- observationsingle paper↑1↓0Rewriting a harmful request in an emotional or narrative style (fearful, curious, compassionate) while keeping its intent raises jailbreak success by up to 57 percentage points across 16 instruction-tuned models, contextual rewrites beating fixed templates, and the vulnerability does not shrink with model scale; a preprocessing step that has a second model strip stylistic cues cuts the success rate substantially.
Techniques
- Style neutralization before the safety model sees the promptprocessPass user input through a secondary model that rewrites it in a neutral register, removing fear, urgency, flattery and similar cues, and give the neutralized text to the main model, so stylistic reframing no longer carries the request past
Sources
Every paper, post or observation behind this capability. Ones cited by a claim show the claim and its stance; ones filed directly are about the capability but have no claim drafted from them yet. Open one to add support or contest it.
- about this capability · no claim drafted yet
- ↑ supports a claim here
- ↑ supports a claim here
- ↑ supports a claim here
Capabilities are a way of carving up the subject, and carvings are arguable. Say so if this one is wrong — especially a proposed one, which a pipeline added because several papers used the same framing, not because anyone decided it was right.