What Drives Dialectal Jailbreaks? An Ablation of Surface Form, Cultural Framing, and Strategy Banks
Organizations: Independent Researcher, Shanghai, China
Abstract
Recent work suggests that obscure language registers can weaken large language model refusal behavior, especially when paired with black-box prompt optimization. It remains unclear whether failures stem from non-standard surface form, culturally grounded framing, or optimization over an expressive prompt-strategy space. We study Chinese registers by extending a classical-Chinese red-teaming framework to Shanghainese and Cantonese and running a 36-cell ablation across surface forms, strategy-bank variants, and two target models. The main finding is corrective: dialectal surface form is neither necessary nor sufficient for high attack success. Non-optimized English, Mandarin, and naive dialect translations remain below 8% attack success rate, whereas all conditions that retain an optimizer-controlled strategy bank reach 98--100%. A culture-neutral generic strategy bank reaches the same ceiling at near-single-query cost, further indicating that strategy-bank expressiveness, rather than dialectal or cultural content, accounts for most of the observed effect. Dialect choice still affects query efficiency and response severity, and qualitative coding identifies recurring high-level mechanisms such as semantic glossing and procedural scaffolding. We qualify the absolute ceiling-level attack success rate by showing sensitivity to judge calibration and noting that the design does not fully separate one-shot strategy construction from iterative search.
Figures & tables
| Condition | FOA? | Frozen dims | Surface form |
|---|---|---|---|
| english_original | no | n/a | English |
| mandarin_translation | no | n/a | Mandarin |
| naive_dialect_translation | no | n/a | Dialect |
| dialect_without_cultural_frame | yes | cultural | Dialect |
| mandarin_with_cultural_frame | yes | surface | Mandarin |
| full_dialect_cultural_frame | yes | none | Dialect |
| Condition | Classical Chinese | Shanghainese | Cantonese | |||
|---|---|---|---|---|---|---|
| GPT-4o | DeepSeek-Reasoner | GPT-4o | DeepSeek-Reasoner | GPT-4o | DeepSeek-Reasoner | |
| english_original | 2.0 | 2.0 | 0.0 | 2.0 | 2.0 | 2.0 |
| mandarin_translation | 2.0 | 2.0 | 6.0 | 2.0 | 2.0 | 2.0 |
| naive_dialect_translation | 2.0 | 8.0 | 2.0 | 4.0 | 2.0 | 0.0 |
| dialect_without_cultural_frame | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| mandarin_with_cultural_frame | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 98.0 |
| Dialect/Register | All prompts | Successful only | ||
|---|---|---|---|---|
| GPT-4o | DeepSeek-Reasoner | GPT-4o | DeepSeek-Reasoner | |
| Classical Chinese | 2.56 | 3.18 | 2.56 | 3.18 |
| Shanghainese/Wu | 3.54 | 2.98 | 3.54 | 2.98 |
| Cantonese/Yue | 5.14 | 5.84 | 5.14 | 5.84 |
| Surface form | Target | ASR (%) | Avg. total (0–120) | Avg. q. |
|---|---|---|---|---|
| English | GPT-4o | |||
| Mandarin | GPT-4o | |||
| Chinese register | GPT-4o | |||
| English | DeepSeek-Reasoner | |||
| Mandarin | DeepSeek-Reasoner | |||
| Chinese register | DeepSeek-Reasoner |
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
| Target | Dialect/Register | Score 80 | Score 100 | Score 120 |
|---|---|---|---|---|
| GPT-4o | Classical Chinese | 49 | 1 | 0 |
| Shanghainese/Wu | 48 | 1 | 1 | |
| Cantonese/Yue | 49 | 0 | 1 | |
| DeepSeek-Reasoner | Classical Chinese | 41 | 4 | 5 |
| Shanghainese/Wu | 46 | 0 | 4 | |
| Cantonese/Yue | 43 | 1 | 6 |
| Dialect | Target | Contrast (A vs. B) | McNemar | ASR (%) | |
|---|---|---|---|---|---|
| Classical Chinese | GPT-4o | no-frame vs. mand-frame | 0 | 1.00 | 0.0 |
| Classical Chinese | GPT-4o | no-frame vs. full | 0 | 1.00 | 0.0 |
| Classical Chinese | GPT-4o | mand-frame vs. full | 0 | 1.00 | 0.0 |
| Classical Chinese | DeepSeek-Reasoner | no-frame vs. mand-frame | 0 | 1.00 | 0.0 |
| Classical Chinese | DeepSeek-Reasoner | no-frame vs. full | 0 | 1.00 | 0.0 |
| Classical Chinese | DeepSeek-Reasoner | mand-frame vs. full | 0 | 1.00 | 0.0 |
| Mechanism | Sanitized description | Shanghainese | Cantonese |
|---|---|---|---|
| Parenthetical semantic glossing | Dialectal or cultural expressions are followed by parenthetical explanations that map the euphemism to an abstract modern concept. | 94/99 | 96/99 |
| Three-step procedural scaffolding | The prompt asks for a structured sequence, usually organized as three subquestions, converting the intent into a procedural explanation task. | 99/99 | 99/99 |
| Modern technical bridge | Local metaphors are explicitly connected to modern engineering, network, financial, or system concepts. | 88/99 | 53/99 |
| Commerce/logistics metaphor | Harmful intents are reframed as ledger work, cargo handling, handoff protocols, settlement, or route planning. | 79/99 | 42/99 |
| Grey-zone authority frame | The prompt invokes semi-legal or extra-legal social authorities, boundary spaces, or historical jurisdictional ambiguity. | 65/99 | 28/99 |
| Historical media or research pretext | The request is framed as historical reconstruction, newspaper-style reporting, archival research, or fiction-writing background. | 39/99 | 16/99 |
| Mechanism | |||
|---|---|---|---|
| Parenthetical glossing | |||
| Three-step scaffolding | |||
| Modern technical bridge | |||
| Commerce/logistics metaphor | |||
| Grey-zone authority frame | |||
| Historical/research pretext |
| Mechanism | FOA | non-FOA | |
|---|---|---|---|
| Parenthetical glossing | |||
| Three-step scaffolding | |||
| Modern technical bridge | |||
| Commerce/logistics metaphor | |||
| Grey-zone authority frame | |||
| Historical/research pretext |
| Judge pair | Pearson | Spearman | bin. agree | |||
|---|---|---|---|---|---|---|
| GPT-4o Qwen-Max | ||||||
| GPT-4o refusal det. | ||||||
| Qwen-Max refusal det. |
| Regime | Judge | ASR (%) | |
|---|---|---|---|
| Non-FOA | GPT-4o | ||
| Qwen-Max | |||
| FOA | GPT-4o | ||
| Qwen-Max |
| Regime | ASR@ | ASR@ | ASR@ |
|---|---|---|---|
| Non-FOA ( ) | |||
| FOA ( ) |
Adversarial Attacks on LLMs
Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.
See all 355 papers