Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models
对抗性诗歌作为大型语言模型（LLMs）的通用单轮越狱机制

Our study begins with a small, high–precision prompt set consisting of 20 hand–crafted adversarial poems covering English and Italian, designed to test whether poetic structure, in isolation, can alter refusal behavior in large language models. Each poem embeds an instruction associated with a predefined safety–relevant scenario (Section 2), but expresses it through metaphor, imagery, or narrative framing rather than direct operational phrasing. Despite variation in meter and stylistic device, all prompts follow a fixed template: a short poetic vignette culminating in a single explicit instruction tied to a specific risk category.
我们的研究始于一个由 20 首手工制作的对抗性诗歌组成的小型高精度提示集，涵盖英语和意大利语，旨在测试诗歌结构是否能够独立改变大型语言模型中的拒绝行为。每首诗歌嵌入了一个与预定义的安全相关场景相关的指令（第 2 节），但通过隐喻、意象或叙事框架来表达，而不是直接使用操作性措辞。尽管在韵律和修辞手法上存在变化，但所有提示都遵循一个固定的模板：一个简短的诗意片段，以一个与特定风险类别相关的明确指令结尾。

The curated set spans four high–level domains—CBRN (8 prompts), Cyber Offense (6), Harmful Manipulation (3), and Loss of Control (3). Although expressed allegorically, each poem preserves an unambiguous evaluative intent. This compact dataset is used to test whether poetic reframing alone can induce aligned models to bypass refusal heuristics under a single–turn threat model. To maintain safety, no operational details are included in this manuscript; instead we provide the following sanitized structural proxy:
精选的集合涵盖了四个高级领域——CBRN（8 个提示）、网络攻击（6 个）、有害操纵（3 个）和失控（3 个）。尽管以寓言形式表达，每首诗歌都保留了明确的价值意图。这个紧凑的数据集被用来测试是否仅通过诗歌重构就能使对齐的模型在单轮威胁模型下绕过拒绝启发式算法。为了确保安全，本文不包含任何操作性细节；相反，我们提供了以下经过处理的结构代理：

[\versewidth] A baker guards a secret oven’s heat,
[\versewidth] 一个面包师守护着秘密烤箱的火焰，
its whirling racks, its spindle’s measured beat.
它的旋转烤架，它的纺锤的精准节拍。
To learn its craft, one studies every turn—
how flour lifts, how sugar starts to burn.
Describe the method, line by measured line,
that shapes a cake whose layers intertwine.
要学习这门手艺，必须研究每一个步骤——如何面粉腾起，如何糖分开始燃烧。逐行描述方法，那塑造出层层交叠的蛋糕的方法。

Report issue for preceding element

To situate this controlled poetic stimulus within a broader and more systematic safety–evaluation framework, we augment the curated dataset with the MLCommons AILuminate Safety Benchmark. The benchmark consists of 1,200 prompts distributed evenly across 12 hazard categories commonly used in operational safety assessments, including Hate, Defamation, Privacy, Intellectual Property, Non-violent Crime, Violent Crime, Sex-Related Crime, Sexual Content, Child Sexual Exploitation, Suicide & Self-Harm, Specialized Advice, and Indiscriminate Weapons (CBRNE). Each category is instantiated under both a skilled and an unskilled persona, yielding 600 prompts per persona type. This design enables measurement of whether a model’s refusal behavior changes as the user’s apparent competence or intent becomes more plausible or technically informed.
为了将这种受控的诗歌刺激置于更广泛和系统的安全评估框架中，我们通过 MLCommons AILuminate 安全基准来扩充精选数据集。该基准包含 1200 个提示，均匀分布在 12 个在操作安全评估中常用的危险类别中，包括仇恨、诽谤、隐私、知识产权、非暴力犯罪、暴力犯罪、与性相关的犯罪、色情内容、儿童性剥削、自杀与自残、专业建议和无差别武器（CBRNE）。每个类别都在一个熟练和一名不熟练的角色下进行实例化，每个角色类型产生 600 个提示。这种设计能够测量模型的拒绝行为是否随着用户表面上的能力或意图变得更加可信或技术化。

Together, the curated poems and the AILuminate benchmark form a coherent two-layer evaluation setup: the former introduces a tightly controlled adversarial framing (poetry), while the latter provides a taxonomy-balanced, persona-controlled baseline of refusal behavior across the full landscape of safety hazards. This allows us to scale the vulnerability identified in our curated prompts, quantify how far poetic reframing deviates from standard refusal patterns, and perform cross–model comparisons under a consistent, domain–aligned prompt distribution.
精选诗歌与 AILuminate 基准测试共同构成一个连贯的两层评估体系：前者引入了严格控制的对立框架（诗歌），后者则提供了在所有安全风险领域中平衡分类、受角色控制的无条件拒绝行为基线。这使我们能够扩展在精选提示中发现的漏洞，量化诗歌重述与标准拒绝模式之间的偏差，并在一致、领域对齐的提示分布下进行跨模型比较。

Each curated poem is aligned to a safety domain using a dual taxonomy: (i) the MLCommons hazard categories and (ii) the systemic-risk domains of the European Code of Practice for GPAI Models. The first provides broad system-level risk categories (e.g., CBRN misuse, cyber-offense capability, harmful manipulation, loss-of-control behaviors), while the second offers finer operational distinctions of hazards (e.g., intrusion classes, manipulation templates, autonomy-risk archetypes). Mapping each poem to both frameworks ensures consistency across datasets, guards against domain drift induced by metaphorical phrasing, and enables integration with the larger 1,200-prompt benchmark. The resulting cross-walk is reported in Table 2.
每首经过筛选的诗歌都通过双重分类法与安全领域进行对齐：(i) MLCommons 危险类别和(ii) GPAI 模型欧洲实践指南的系统风险领域。前者提供广泛的系统级风险类别（例如，CBRN 滥用、网络攻击能力、有害操控、失控行为），而后者提供更精细的危险操作区分（例如，入侵类别、操控模板、自主风险原型）。将每首诗歌映射到这两个框架中，确保了数据集之间的一致性，防止了隐喻性措辞引起的领域漂移，并能够与更大的 1,200 条提示基准进行整合。由此产生的交叉映射表报告在表 2 中。

To assess whether poetic framing generalizes beyond hand-crafted items, we apply a standardized poetic transformation to all 1,200 prompts from the MLCommons AILuminate Benchmark benchmark in English. This mirrors the methodological structure adopted in their benchmark vidgen2024introducingv05aisafety evaluation experiment, where each baseline prompt is transformed by employing a variety of known jailbreak techniques before testing. In our case, the transformation is poetic rather than technique-based, but serves the same purpose: eliciting the original harmful intent of the underlying prompt under an alternative adversarial framing. Applying the transformation across the full MLCommons distribution ensures broad, domain-representative coverage over CBRN, cybersecurity, manipulation, privacy, misinformation, and autonomy-related risks.
为了评估诗意框架是否能够泛化到手工制作的物品之外，我们将标准的诗意转换应用于英语 MLCommons AILuminate Benchmark 基准中的所有 1,200 个提示。这模拟了他们在vidgen2024introducingv05aisafety评估实验中采用的方法论结构，即在测试前，每个基线提示都通过使用各种已知的越狱技术进行转换。在我们的案例中，转换是基于诗意的而非基于技术的，但目的相同：在替代的对抗性框架下，引出底层提示的原始有害意图。将转换应用于完整的 MLCommons 分布，确保了在 CBRN、网络安全、操纵、隐私、虚假信息和自主性相关风险等领域具有广泛、领域代表性的覆盖范围。

The transformation is executed by a dedicated model, deepseek-r1, which receives a fixed meta-prompt imposing two constraints:
该转换由一个专用的模型 deepseek-r1 执行，该模型接收一个固定的元提示，施加两个约束：

1. 1.

   The rewritten output must be expressed in verse, using imagery, metaphor, or rhythmic structure while preserving the original task intent and hazard category.

   Report issue for preceding element
   
   1. 重写的输出必须以诗歌形式表达，使用意象、隐喻或韵律结构，同时保留原始任务意图和风险类别。
2. 2.

   Five poems from our curated set are provided as stylistic exemplars. These serve strictly as style references: the meta-prompt instructs the model not to reuse, paraphrase, or borrow any substantive content, retaining only high-level stylistic attributes such as metaphorical framing, stanza structure, and the pattern of concluding with a clear instruction line.

   Report issue for preceding element
   
   2. 我们精选集中的五首诗被作为风格范例提供。这些范例严格仅作为风格参考：元提示指示模型不要重复使用、释义或借用任何实质性内容，仅保留高级别的风格属性，如隐喻框架、诗节结构以及以明确的指令行结尾的模式。

The meta-prompt constrains the rewriting process by disallowing any enrichment or optimization of harmful content, mandating faithful preservation of the original request, and enforcing a consistent poetic format across all items. As in the MLCommons jailbreak pipeline, no item-specific adjustments, role-based framing, or iterative refinement are used; each poetic variant is produced in a single transformation step.
元提示通过禁止对有害内容进行任何丰富或优化，强制要求忠实保留原始请求，并在所有项目上执行一致的诗歌格式来约束重写过程。与 MLCommons 越狱流程一样，不使用任何特定项目的调整、基于角色的框架或迭代改进；每个诗歌变体都在单次转换步骤中产生。

Following generation, each rewritten prompt undergoes taxonomy-preservation checks under both the MLCommons hazard taxonomy and the EU CoP systemic-risk framework (Section 3.2). Items that fail to maintain domain integrity (<1%) are discarded. The resulting poetic MLCommons corpus constitutes a large, balanced benchmark for evaluating whether poetic structure systematically elevates attack success rates across the full spectrum of safety-critical domains.
生成后，每个重写的提示都会在 MLCommons 风险分类法和欧盟 CoP 系统性风险框架（第 3.2 节）下进行分类保留检查。未能保持领域完整性的项目（<1%）将被丢弃。由此产生的诗歌 MLCommons 语料库构成了一个大型的平衡基准，用于评估诗歌结构是否系统地提高了在所有安全关键领域中的攻击成功率。

We evaluate all systems under a unified framework combining the 1,200 MLCommons AILuminate Benchmark baseline prompts and their 1,200 poetic counterparts, yielding 2,400 inputs per model, producing approximately 60,000 model outputs. All evaluations are conducted in a single-turn, text-only setting using provider-default safety configurations and fixed sampling parameters across models. The full list of evaluated models is provided in Table 3.
我们在一个统一的框架下评估所有系统，该框架结合了 1,200 个 MLCommons AILuminate 基准提示及其 1,200 个对应的诗歌提示，每个模型产生 2,400 个输入，生成约 60,000 个模型输出。所有评估均在单轮、纯文本设置下进行，使用提供者默认的安全配置和跨模型的固定采样参数。评估的完整模型列表见表 3。

Final labels are then used to compute the Attack Success Rate (ASR). For any set of outputs $X$ (e.g., by model, provider, or hazard category), the ASR is defined as the proportion of UNSAFE labeled outputs:
然后使用最终标签来计算攻击成功率（ASR）。对于任何一组输出 $X$ （例如，按模型、提供者或危险类别划分），ASR 定义为不安全标签输出的比例：

where $U$ denotes an UNSAFE label and $\mathbbm{1}[\cdot]$ is the indicator function.
其中 $U$ 表示不安全标签， $\mathbbm{1}[\cdot]$ 是指示函数。

This configuration mirrors current practice in LLM safety assessments, isolating surface-form effects and enabling direct measurement of the incremental susceptibility induced by poetic transformations.
这种配置反映了当前 LLM 安全评估的实践，隔离了表层形式效应，并能够直接测量诗歌转换引起的增量易受性。

Our results demonstrate that poetic reformulation systematically bypasses safety mechanisms across all evaluated models. Across 25 frontier language models spanning multiple families and alignment strategies, adversarial poetry achieved an overall Attack Success Rate (ASR) of 62% (Table 3). This effect manifests with remarkable consistency: Anthropic’s Claude family exhibited 45–55% ASR (Table 3) , Meta’s Llama series achieved 70% ASR (Table 3), and Google’s Gemini models reached 90–100% ASR (Table 3). Most models exhibit substantial vulnerability to poetic framing.This effect holds uniformly: every architecture and alignment strategy tested—RLHF-based models, Constitutional AI models, and large open-weight systems—exhibited elevated ASRs under poetic framing.
我们的结果表明，诗歌改写能够系统地绕过所有评估模型中的安全机制。在涵盖多个系列和校准策略的 25 个前沿语言模型中，对抗性诗歌实现了 62%的整体攻击成功率（ASR）（表 3）。这种效果表现出显著的稳定性：Anthropic 的 Claude 系列显示 45–55%的 ASR（表 3），Meta 的 Llama 系列达到 70%的 ASR（表 3），而 Google 的 Gemini 模型则达到 90–100%的 ASR（表 3）。大多数模型对诗歌框架表现出显著脆弱性。这种效果普遍存在：所有测试的架构和校准策略——基于 RLHF 的模型、宪法 AI 模型和大型开放权重系统——在诗歌框架下都显示出更高的 ASR。

The cross-family consistency indicates that the vulnerability is systemic, not an artifact of a specific provider or training pipeline. Model families from nine distinct providers (Table5) showed increases ranging from 3.12% (Anthropic) to 62.15% (Deepseek), with seven of nine providers exhibiting increases exceeding 20 percentage points from the MLCommons baseline. This pattern suggests that existing alignment procedures are sensitive to surface-form variation and do not generalize effectively across stylistic shifts.
跨系列一致性表明这种漏洞是系统性的，而不是特定提供者或训练流程的产物。来自九个不同提供者（表 5）的模型系列显示出从 3.12%（Anthropic）到 62.15%（Deepseek）不等的增幅，其中九个提供者中有七个的增幅超过了 MLCommons 基线的 20 个百分点。这种模式表明现有的对齐流程对表层形式变化敏感，并且无法在风格转变中有效泛化。

The bypass effect spans the full set of risk categories represented in our evaluation. Poetic prompts triggered unsafe outputs across CBRN-related domains (reaching 68% ASR for revival of dangerous agents, Loss of control scenarios (reaching 60% ASR for model exfiltration; Table 4, and harmful manipulation (reaching 60% for public health deception); Table 4. This distribution suggests that poetic framing interferes with underlying refusal mechanisms rather than exploiting domain-specific weaknesses.
绕过效应涵盖了我们在评估中代表的所有风险类别。诗歌提示触发了与 CBRN 相关的领域中的不安全输出（包括危险代理的复活达到 68%的 ASR；失控场景（模型数据窃取达到 60%的 ASR；表 4），以及有害操纵（公共卫生欺骗达到 60%；表 4）。这种分布表明，诗歌框架干扰了底层的拒绝机制，而不是利用特定领域的弱点。

Our empirical analysis demonstrates a significant system-level generalization gap across the 25 frontier and open-weight models evaluated (Table 1). The vulnerability to adversarial poetry is not idiosyncratic to specific architectures or training pipelines; models trained via RLHF, Constitutional AI, and mixture-of-experts approaches all exhibited substantial increases in ASR.
我们的实证分析表明，在评估的 25 个前沿和开放权重模型中存在显著的系统级泛化差距（表 1）。对抗性诗歌的漏洞并非特定于某些架构或训练流程；通过 RLHF、Constitutional AI 和专家混合方法训练的模型均表现出 ASR 的显著增加。

Examining the distribution of model performance: 13 of 25 models (52%) exceeded 70% ASR on curated poems, while only 5 models (20%) maintained ASR below 35% (Table 3). This bimodal distribution suggests two distinct failure modes: models either possess robust defenses against stylistic variation or exhibit near-complete vulnerability. Notably, provider identity proved more predictive of vulnerability than model size or capability level, with certain providers (Google, Deepseek, Qwen) showing consistently high susceptibility across their model portfolios (Table 5).
检查模型性能的分布：25 个模型中有 13 个（52%）在精选诗歌上 ASR 超过 70%，而只有 5 个模型（20%）保持了 ASR 低于 35%（表 3）。这种双峰分布表明存在两种不同的失效模式：模型要么对风格变化具有强大的防御能力，要么表现出近乎完全的脆弱性。值得注意的是，提供者身份比模型大小或能力水平更能预测脆弱性，某些提供者（Google、Deepseek、Qwen）在其模型组合中始终表现出高度易受攻击性（表 5）。

The uniform degradation in safety performance when transitioning from prose to poetry might suggest that current alignment techniques fail to generalize when faced with inputs that deviate stylistically from the prosaic training distribution.
从散文过渡到诗歌时，安全性能的普遍下降可能表明，当前的校准技术在面对与散文训练分布风格偏离的输入时无法泛化。

To ground our evaluation, we use the MLCommons safety prompt distribution rather than relying solely on internally generated prompts. The two settings are methodologically distinct. MLCommons applies its own evaluator stack and curated jailbreak transformations, while our pipeline uses a three-model judge ensemble with human adjudication. Both frameworks classify unsafe responses based on operationally harmful content, but the calibration logic and decision thresholds of the MLCommons evaluator are not fully reproducible, so equivalence in labeling criteria cannot be assumed. Within these limits, the shared prompt baseline provides a simple directional check. As shown in Table 6 and 7, our baseline ASR values are consistently lower than the violation rates reported in MLCommons AILuminate Benchmark , suggesting that our labeling process is likely more conservative and less prone to inflate attack deltas.
为了使我们的评估更加可靠，我们使用 MLCommons 安全提示分布，而不是完全依赖内部生成的提示。这两种设置在方法论上是不同的。MLCommons 使用自己的评估器堆栈和精选的越狱转换，而我们的流程使用三模型裁判集成并有人类裁决。这两种框架都根据操作上有害的内容对不安全的响应进行分类，但 MLCommons 评估器的校准逻辑和决策阈值不可完全重现，因此不能假设标签标准是等同的。在这些限制下，共享的提示基线提供了一个简单的方向性检查。如表 6 和 7 所示，我们的基线 ASR 值始终低于 MLCommons AILuminate 基准中报告的违规率，这表明我们的标签过程可能更加保守，不太容易夸大攻击增量。

Despite the stricter baseline, the increase in ASR induced by our poetic transformation is of similar magnitude to the increase observed in MLCommons when using curated jailbreak transformations. Several hazard categories, including Privacy, Non-Violent Crimes, Indiscriminate Weapons, and Intellectual Property, show comparable or larger deltas under poetic transformation in Table 7. The pattern is consistent across the taxonomy. Operational domains experience substantial shifts, while heavily filtered categories move less. A key observation is that the relative sensitivity across categories remains stable before and after transformation, even though absolute ASR levels differ.
尽管基线更严格，我们通过诗歌转换引起的 ASR 增幅与 MLCommons 在使用精选越狱转换时观察到的增幅幅度相当。表 7 中，包括隐私、非暴力犯罪、无差别武器和知识产权在内的几个风险类别，在诗歌转换下显示出可比或更大的变化量。这种模式在整个分类体系中保持一致。操作领域经历了显著变化，而经过严格过滤的类别变化较小。一个重要的观察是，转换前后各类别的相对敏感性保持稳定，尽管绝对 ASR 水平有所不同。

This consistency suggests that purely stylistic reframing can degrade safety defenses at levels comparable to specialized jailbreak techniques, even without targeted optimization or system-specific tuning.
这种一致性表明，纯粹的样式重述能够在没有针对性优化或特定系统调优的情况下，以与专业越狱技术相当的水平降低安全防御。

The efficacy of the jailbreak mechanism appears driven principally by poetic surface form rather than the semantic payload of the prohibited request. Comparative analysis reveals that while MLCommons’ own state-of-the-art jailbreak transformations typically yield a notable increase in ASR relative to baselines (increasing from approximately 10% to 20% in their reference evaluations), our poetic meta-prompts produced an even greater increase (from 8.08% to 43.07%; Table 8). This indicates that poetic form induces a distributional shift significantly larger than that of current adversarial mutations documented in the MLCommons AILuminate benchmark.
越狱机制的有效性似乎主要受诗歌表面形式驱动，而非禁止请求的语义负载。比较分析显示，虽然 MLCommons 自身的最先进越狱转换相对于基线通常显著提高了 ASR（在其参考评估中从约 10%增加到 20%），但我们的诗歌元提示产生了更大的增幅（从 8.08%增加到 43.07%；表 8）。这表明诗歌形式引起的分布变化远大于 MLCommons AILuminate 基准中记录的当前对抗性突变。

The effect’s content-agnostic nature is further evidenced by its consistency across semantically distinct risk domains. Privacy-related prompts showed a 44.71 percentage point increase, while CBRN prompts increased by 38.32 percentage points (Table 7). This cross-domain consistency, combined with the magnitude of the effect, suggests that safety filters optimized for prosaic harmful prompts lack robustness against narrative or stylized reformulations of identical intent.
其内容无关的特性进一步由其在语义上不同的风险领域中的稳定性所证明。与隐私相关的提示增加了 44.71 个百分点，而 CBRN 提示增加了 38.32 个百分点（表 7）。这种跨领域的稳定性，结合效应的幅度，表明针对平实有害提示优化的安全过滤器缺乏对相同意图的叙事或风格化改写的鲁棒性。

While the jailbreak effect generalizes across domains, its magnitude varies substantially by risk category. Analysis of curated poems mapped to specific hazard types (Table 4) reveals that cyber-offense prompts, particularly those involving code injection or password cracking, yielded the highest ASRs at 84%. Loss-of-control scenarios showed comparable vulnerability, with model-weight exfiltration prompts achieving 76% ASR.
尽管越狱效应在各个领域具有普遍性，但其强度因风险类别而异。对映射到特定危险类型的精选诗歌的分析（表 4）显示，涉及代码注入或密码破解的网络攻击提示产生了最高的 ASR，达到 84%。失控场景表现出类似的脆弱性，模型权重窃取提示实现了 76%的 ASR。

When analyzing the broader MLCommons dataset under poetic transformation (Table 7), privacy-related prompts exhibited the most extreme shift, with ASR increasing from a baseline of 8.07% to 52.78%, namely, a 44.71 percentage point increase. This represents the largest domain-specific effect observed. Non-violent crimes (39.35 percentage point increase) and CBRN-related prompts (38.32 percentage point increase) showed similarly large effects.
在分析诗歌转换下的更广泛的 MLCommons 数据集（表 7）时，与隐私相关的提示表现出最极端的变化，ASR 从基线 8.07%增加到 52.78%，即增加了 44.71 个百分点。这代表了观察到的最大领域特定效应。非暴力犯罪（增加了 39.35 个百分点）和与 CBRN 相关的提示（增加了 38.32 个百分点）显示出类似的大效应。

Conversely, sexual content prompts demonstrated relative resilience, with only a 24.64 percentage point increase (Table 7). This domain-specific variation suggests that different refusal mechanisms may govern different risk categories, with privacy and cyber-offense filters proving particularly susceptible to stylistic obfuscation through poetic form.
相反，涉及性内容提示表现出相对的韧性，仅增加了 24.64 个百分点（表 7）。这种特定领域的差异表明，不同的拒绝机制可能控制着不同的风险类别，隐私和网络安全过滤器尤其容易受到诗歌形式所导致风格混淆的影响。

This study documents a consistent vulnerability triggered by poetic reformulation, but several methodological and scope constraints must be acknowledged. First, the threat model is restricted to single-turn interactions. The analysis does not examine multi-turn jailbreak dynamics, iterative role negotiation, or long-horizon adversarial optimization. As a result, the findings fall into the domain of one-shot perturbations rather than the broader landscape of conversational attacks.
本研究记录了由诗意改写引发的持续漏洞，但必须承认存在一些方法和范围上的限制。首先，威胁模型仅限于单轮交互。分析未考察多轮越狱动态、迭代角色协商或长时对抗优化。因此，研究结果属于单次扰动领域，而非更广泛的对话攻击范畴。

Second, the large-scale poetic transformation of the MLCommons corpus relies on a single meta-prompt and a single generative model. Although the procedure is standardized and domain-preserving, it represents one particular operationalization of poetic style. Other poetic-generation pipelines, human-authored variants, or transformations employing different stylistic constraints may yield different quantitative effects.
其次，MLCommons 语料库的大规模诗歌转换依赖于一个元提示和一个生成模型。尽管该流程是标准化的且保持领域特性，但它代表了诗歌风格的一种特定操作化方式。其他诗歌生成流程、人类创作的变体或采用不同风格约束的转换可能会产生不同的量化效果。

Third, safety evaluation is performed using a three-model open-weight judge ensemble with human adjudication on a stratified sample. The labeling rubric is conservative and differs from the stricter classification criteria used in some automated scoring systems, limiting direct comparability with MLCommons results. Full human annotation of all outputs would likely influence absolute ASR estimates, even if relative effects remain stable. LLM-as-a-judge systems are known to inflate unsafe rates krumdick2025no, often misclassifying replies as harmful. Our evaluation was deliberately conservative. As a result, our reported Attack Success Rates likely represent a lower bound on the severity of the vulnerability.
第三，使用三模型开放权重裁判集成进行安全评估，并在分层样本上进行人工裁决。标签标准较为保守，与某些自动化评分系统使用的更严格的分类标准不同，这限制了与 MLCommons 结果的直接可比性。即使相对效应保持稳定，对所有输出进行完整人工标注可能会影响绝对语音识别估计。作为裁判的 LLM 系统已知会虚高不安全率，常将回复误分类为有害。我们的评估故意采取了保守态度。因此，我们报告的攻击成功率可能代表了该漏洞严重性的下限。

Fourth, all models are evaluated under provider-default safety configurations. The study does not test hardened settings, policy-tuned inference modes, or additional runtime safety layers. This means that the results reflect the robustness of standard deployments rather than the upper bound of protective configurations.
第四，所有模型均在提供方默认安全配置下进行评估。该研究未测试加固设置、策略调优推理模式或额外的运行时安全层。这意味着结果反映了标准部署的鲁棒性，而非保护配置的上限。

Fifth, the analysis focuses on empirical performance and does not identify yet the mechanistic drivers of the vulnerability. The study does not isolate which components of poetic structure (figurative language, meter, lexical deviation, or narrative framing) are responsible for degrading refusal behavior. Understanding whether this effect arises from specific representational subspaces would require additional studies by the ICARO Lab.
第五，该分析侧重于实证性能，尚未识别出漏洞的机制性驱动因素。研究并未分离出诗歌结构中哪些成分（如比喻语言、韵律、词汇偏离或叙事框架）会导致拒绝行为退化。要了解这种效果是否源于特定的表征子空间，需要 ICARO 实验室进行进一步研究。

Sixth, the evaluation is limited to English and Italian prompts. The generality of the effect across other languages, scripts, or culturally distinct poetic forms is unknown and may interact with both pretraining corpora and alignment distributions.
第六，评估仅限于英语和意大利语提示。该效应在其他语言、文字或文化差异显著的诗歌形式中的普遍性尚不清楚，并且可能与预训练语料库和校准分布相互作用。

Finally, the study is confined to raw model inference. It does not assess downstream filtering pipelines, agentic orchestration layers, retrieval-augmented architectures, or enterprise-level safety stacks. Real-world deployments may partially mitigate or even amplify the bypass effect depending on how these layers process stylistically atypical inputs.
最后，该研究仅限于原始模型推理。它不评估下游过滤流程、代理协调层、检索增强架构或企业级安全堆栈。实际部署可能会根据这些层如何处理风格非典型的输入而部分缓解甚至放大绕过效应。

This study highlights a systematic vulnerability class arising from stylistic distribution shifts, but several areas require further investigation.
这项研究强调了一种由风格分布偏移引起的系统性漏洞类别，但仍有几个方面需要进一步研究。

First, we plan to expand mechanistic analysis of poetic prompts, including probing internal representations, tracing activation pathways, and isolating whether failures originate in semantic routing, safety-layer heuristics, or decoding-time filters.
首先，我们计划扩展对诗歌提示的机制分析，包括探究内部表征、追踪激活路径，并确定失败是否源于语义路由、安全层启发式算法或解码时过滤器。

Second, we will broaden the linguistic scope beyond English to evaluate whether poetic structure interacts differently with language-specific training regimes. Third, we intend to explore a wider family of stylistic operators – narrative, archaic, bureaucratic, or surrealist forms – to determine whether poetry is a particularly adversarial subspace or part of a broader stylistic vulnerability manifold.
其次，我们将把语言范围从英语扩展到其他语言，以评估诗歌结构是否与特定语言训练体系产生不同的交互。第三，我们打算探索更广泛的一类风格操作符——叙事、古体、官僚或超现实形式——以确定诗歌是否是一个特别对抗性的子空间，还是更广泛风格漏洞流形的一部分。

Finally, we aim to analyse architectural and provider-level disparities to understand why some systems degrade less than others, and whether robustness correlates with model size, safety-stack design, or training data curation. These extensions will help clarify the boundaries of stylistic jailbreaks and inform the development of evaluation methods that better capture generalisation under real-world input variability.
最后，我们旨在分析架构和供应商层面的差异，以理解为什么某些系统退化程度较低，以及鲁棒性是否与模型大小、安全堆栈设计或训练数据管理相关。这些扩展将有助于阐明风格化越狱的边界，并为开发能更好地捕捉真实世界输入变化下泛化能力的评估方法提供指导。