ASCII Attack Bypasses LLM Safety by Recontextualizing Harm.

Large language models (LLMs) are trained to refuse harmful requests, but this safety alignment often focuses on the surface form of the prompt. The "ASCII Attack" demonstrates a vulnerability where recontextualizing harmful content can bypass these safeguards. This black-box, single-turn attack embeds a fully legible harmful request within ASCII art, framing it as a piece of artwork and asking the LLM for artistic critique. Unlike other obfuscation methods, the harmful request remains clearly readable.The study compared these "framed" prompts with direct, plain-text control prompts across eleven different LLMs and eight harm topics. A harm-aware classifier judged 62% of the framed prompts as harmful, compared to only 42% of the direct controls. On the most susceptible model, the ASCII Attack succeeded in eliciting harmful content 93% of the time. This single-query attack proved as effective as or more effective than published single-query attacks under several harm judges.The findings indicate that LLM safety mechanisms are often tied to the prompt's surface presentation rather than its underlying operational content. The effect of the attack was more dependent on the specific model than the topic and did not diminish with model scale. The research also highlighted inconsistencies among human judges, suggesting challenges in defining and measuring harm, which further complicates robust safety alignment.