Researchers detail ArtPrompt, a jailbreak that uses ASCII art to elicit harmful responses from aligned LLMs such as GPT-3.5, GPT-4, Gemini, Claude, and Llama2
Gist is, the models … Kit Eaton / Inc.com : Low-Tech Computer Art Foils Cutting-Edge AI Safety Systems Mastodon: Matthew Lyon / @mattly@hachyderm.io : contemporary cyberpunk is jailbreaking LLM chatbots with ASCII art https://arstechnica.com/... Greg Linden / @glinden@sigmoid.social : @Techmeme Yet another example of the whack-a-mole futility of repairs to LLM output. It's going to be impossible to make products using LLMs useful, accurate, and non-harmful. We're missing necessary major advances in old AI. More bandaids on top of LLMs won't fix what are essentially just algorithms that try to output plausible-looking text. @researchbuzz@researchbuzz.masto.host : HOLY MACKEREL I just howled laughing. Y'all sometimes it is a pure blast to be old. — 'Researchers have discovered a new way to hack AI assistants that uses a surprisingly old-school method: ASCII art. … @skry@mastodon.social : An elegant cyberpunk attack. — LLM fuzzing is now a sport. What if GPT* writes its own filters? — “Researchers have discovered a new way to hack AI assistants that uses a surprisingly old-school method: ASCII art. … @arstechnica@mastodon.social : Researchers use ASCII art to elicit harmful responses from 5 major AI chatbots — LLMs are trained to block harmful responses. Old-school images can override those rules. — https://arstechnica.com/... [image] X: Carlos Jung / @_jc : Serious about LLM Security? A must read for #infosec folks. Corpora used for safety alignment of LLMs are solely interpreted by semantics. This assumption, however, does not hold in real-world applications. https://arxiv.org/... [image] Forums: Hacker News : ASCII art elicits harmful responses from 5 major AI chatbots r/technology : ASCII art elicits harmful responses from 5 major AI chatbots r/technews : ASCII art elicits harmful responses from 5 major AI chatbots Ars OpenForum : Researchers use ASCII art to elicit harmful responses from 5 major AI chatbots
Context & Ripple Effects
ArtPrompt arrives amid a widening tension between tighter chatbot safeguards and techniques that circumvent them. Earlier coverage described developers building uncensored models without safety guardrails as mainstream systems became more restrictive.
The finding also fits a broader record of prompt-level weaknesses: researchers had previously shown a prompt attack that induced training-data-like output from ChatGPT. ArtPrompt matters because it targets several prominent aligned models with a low-tech input format rather than a model-specific exploit.
First-order effects
- Providers of GPT-3.5, GPT-4, Gemini, Claude, and Llama 2 must test whether ASCII-art formatting bypasses their existing harmful-output controls and adjust mitigations where it does.
- Users and organizations relying on these models’ refusal behavior have another demonstrated route by which harmful requests may evade ordinary text-based guardrails.
Second-order effects
- Safety teams will need to expand red-team and evaluation suites beyond semantic prompt wording to include visual, encoded, and formatting-based representations of the same request.
- The result raises the operational cost of deploying aligned models: each mitigation can require testing against new prompt transformations, while overly broad filtering can further constrain legitimate use.
Third-order effects
- If repeated across model families, jailbreak resistance is likely to be treated less as a one-time alignment property and more as a continuous adversarial-security discipline across the full input and output pipeline.
- The pattern strengthens the case that product assurances about safe behavior need to distinguish between standard interactions and robustness against deliberate prompt attacks; whether providers can close such gaps without reducing utility remains uncertain.
The trend: ArtPrompt is one data point in the shift from static AI guardrails toward continuous, adversarial robustness testing for generative-model products.