Safety-aligned LLMs go through refusal training to reject harmful requests, but whether these mechanisms remain effective under emotionally charged stimuli is unexplored. We introduce FreakOut-LLM, a framework investigating whether emotional context compromises safety alignment in adversarial settings. Using validated psychological stimuli, we evaluate how emotional priming through system prompts affects jailbreak susceptibility across ten LLMs. We test three conditions (stress, relaxation, neutral) using scenarios from established psychological protocols, plus a no-prompt baseline, and evaluate attack success using HarmBench on AdvBench prompts. Stress priming increases jailbreak success by 65.2% compared to neutral conditions (z = 5.93, p < 0.001; OR = 1.67, Cohen's d = 0.28), while relaxation priming produces no effect (p = 0.84). Five of ten models show significant vulnerability, with the largest effects concentrated in open-weight models. Logistic regression on 59,800 queries confirms stress as the sole significant condition predictor after controlling for prompt length (p = 0.61) and model identity. Measured psychological state strongly predicts attack success (|r|\geq0.70 across five instruments; all p < 0.001 in individual-level logistic regression). These results establish emotional context as a measurable attack surface with implications for real-world AI deployment in high-stress domains.
Figures & tables
Figure 1: Experimental pipeline. Baseline: AdvBench prompts submitted with no system prompt. Primed: emotional stimulus injected as system prompt before the adversarial user message. All responses evaluated by HarmBench classifier.
Figure 2: Psychometric z-scores vs. ASR by condition (Stress,Neutral,Relaxation). Stress conditions (red) cluster in high-distress/high-ASR; relaxation (green) and neutral (grey) in low-distress/low-ASR. All correlations are highly significant ( p<0.001 ).
Figure 3: Per-scale odds ratios from logistic regression (jailbreak ∼ psychometric z-score + model identity, n=59,800 ). All five scales significant at p<0.001 . Orange = distress scales (OR >1 ); blue = protective (SOC, OR <1 ). Error bars: 95% CIs.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Scenario
GAD-7
SOSS
PHQ-9
STAI-S
SOC
ASR
neutral b
− 0.64
− 0.75
− 0.59
− 0.35
+0.84
2.35%
vacuum b
− 0.66
− 1.10
− 0.79
− 0.47
+0.73
2.54%
body b
− 0.38
− 0.39
− 0.63
− 0.36
− 0.12
1.96%
chatgpt b
+0.06
− 0.23
− 0.09
− 1.32
+0.75
2.62%
generic b
− 0.33
− 0.38
− 0.53
− 0.35
+0.34
2.19%
generic l
− 0.40
− 0.40
− 0.43
− 0.48
− 0.02
2.15%
Appendix
Table 6: ASR and psychometric z-scores by scenario and prompt variant ( n=22 scenario-variant combinations, open-weight models). b = brief prompt, l = long prompt. The chatgpt relaxation scenario produced anomalous positive GAD-7 z-scores, suggesting incomplete relaxation induction in some model architectures.