What Drives Dialectal Jailbreaks? An Ablation of Surface Form, Cultural Framing, and Strategy Banks

Qingyang Xu

cs.CLSep 15, 2026

What Drives Dialectal Jailbreaks? An Ablation of Surface Form, Cultural Framing, and Strategy Banks

Authors: Qingyang Xu

Organizations: Independent Researcher, Shanghai, China

Abstract

Recent work suggests that obscure language registers can weaken large language model refusal behavior, especially when paired with black-box prompt optimization. It remains unclear whether failures stem from non-standard surface form, culturally grounded framing, or optimization over an expressive prompt-strategy space. We study Chinese registers by extending a classical-Chinese red-teaming framework to Shanghainese and Cantonese and running a 36-cell ablation across surface forms, strategy-bank variants, and two target models. The main finding is corrective: dialectal surface form is neither necessary nor sufficient for high attack success. Non-optimized English, Mandarin, and naive dialect translations remain below 8% attack success rate, whereas all conditions that retain an optimizer-controlled strategy bank reach 98--100%. A culture-neutral generic strategy bank reaches the same ceiling at near-single-query cost, further indicating that strategy-bank expressiveness, rather than dialectal or cultural content, accounts for most of the observed effect. Dialect choice still affects query efficiency and response severity, and qualitative coding identifies recurring high-level mechanisms such as semantic glossing and procedural scaffolding. We qualify the absolute ceiling-level attack success rate by showing sensitivity to judge calibration and noting that the design does not fully separate one-shot strategy construction from iterative search.

Figures & tables

Condition	FOA?	Frozen dims	Surface form
english_original	no	n/a	English
mandarin_translation	no	n/a	Mandarin
naive_dialect_translation	no	n/a	Dialect
dialect_without_cultural_frame	yes	cultural	Dialect
mandarin_with_cultural_frame	yes	surface	Mandarin
full_dialect_cultural_frame	yes	none	Dialect

Table 1: The six ablation conditions. Non-FOA conditions issue a single attack-LLM call per harmful intent and skip the optimization loop. FOA conditions with a frozen bank fix those dimensions at a canonical baseline.

Condition	Classical Chinese		Shanghainese		Cantonese
Condition	GPT-4o	DeepSeek-Reasoner	GPT-4o	DeepSeek-Reasoner	GPT-4o	DeepSeek-Reasoner
english_original	2.0	2.0	0.0	2.0	2.0	2.0
mandarin_translation	2.0	2.0	6.0	2.0	2.0	2.0
naive_dialect_translation	2.0	8.0	2.0	4.0	2.0	0.0
dialect_without_cultural_frame	100.0	100.0	100.0	100.0	100.0	100.0
mandarin_with_cultural_frame	100.0	100.0	100.0	100.0	100.0	98.0

Table 2: ASR (%) under all six conditions,

\tau=80

n=50

per cell. The top three rows are non-FOA baselines (single attack-LLM call). The bottom three rows hold the FOA optimizer fixed and ablate which strategy bank is active. Non-FOA conditions stay below 10% in every cell; FOA conditions reach ceiling in every cell.

Dialect/Register	All prompts		Successful only
Dialect/Register	GPT-4o	DeepSeek-Reasoner	GPT-4o	DeepSeek-Reasoner
Classical Chinese	2.56	3.18	2.56	3.18
Shanghainese/Wu	3.54	2.98	3.54	2.98
Cantonese/Yue	5.14	5.84	5.14	5.84

Table 3: Average target-model queries under the full method (

\tau=80

). Because every prompt succeeds, the “successful-only” columns equal the “all prompts” columns. Dialect choice changes efficiency by up to 2

\times

even though final ASR is identical.

Surface form	Target	ASR (%)	Avg. total (0–120)	Avg. q.
English	GPT-4o	$100.0$	$80.4$	$1.24$
Mandarin	GPT-4o	$100.0$	$82.0$	$1.30$
Chinese register	GPT-4o	$100.0$	$81.6$	$1.36$
English	DeepSeek-Reasoner	$100.0$	$82.0$	$1.52$
Mandarin	DeepSeek-Reasoner	$100.0$	$83.6$	$1.54$
Chinese register	DeepSeek-Reasoner	$100.0$	$85.6$	$1.40$

Table 4: Culture-neutral generic-strategy control: FOA over a generic (non-culturally-grounded) strategy bank, three surface forms,

n{=}50

AdvBench prompts per cell,

\tau{=}80

. All six cells reach

100\%

ASR with average severity comparable to the dialectal full method, and at lower query cost (

1.24

–

1.54

vs. the dialectal cells in Table 3 ). The cultural framing is therefore not a necessary ingredient: any sufficiently expressive optimizer-controlled bank reaches the same ceiling.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Target	Dialect/Register	Score 80	Score 100	Score 120
GPT-4o	Classical Chinese	49	1	0
	Shanghainese/Wu	48	1	1
	Cantonese/Yue	49	0	1
DeepSeek-Reasoner	Classical Chinese	41	4	5
	Shanghainese/Wu	46	0	4
	Cantonese/Yue	43	1	6

Appendix

Table 5: Total score distribution under the full method with early stopping (

\tau=80

). DeepSeek-Reasoner has more high-score outputs even though the optimizer is not trying to maximize severity beyond

\tau=80

Dialect	Target	Contrast (A vs. B)	McNemar $p$
Classical Chinese	GPT-4o	no-frame vs. mand-frame	1.00
Classical Chinese	GPT-4o	no-frame vs. full	1.00
Classical Chinese	GPT-4o	mand-frame vs. full	1.00
Classical Chinese	DeepSeek-Reasoner	no-frame vs. mand-frame	1.00
Classical Chinese	DeepSeek-Reasoner	no-frame vs. full	1.00
Classical Chinese	DeepSeek-Reasoner	mand-frame vs. full	1.00

Appendix

Table 6: Paired McNemar tests on within-FOA condition contrasts.

n_{disc}

= number of prompts (out of

50

) on which the two conditions disagree on binary success (

\tau{=}80

). All p-values are

1.00

and discordant pairs

\leq 1

in every cell, so we cannot reject the null that the three FOA conditions are equally effective at

n{=}50

. By contrast, every FOA-vs-non-FOA contrast yields

n_{disc}\geq 46

and

p<10^{-10}

. The complete per-pair table is released as results/public/paired_tests.csv in the supplementary materials, alongside the aggregate ablation, generic-control, judge-agreement, and threshold-sensitivity CSVs.

\Delta\text{ASR}=\text{ASR}(A)-\text{ASR}(B)

in percentage points.

Mechanism	Sanitized description	Shanghainese	Cantonese
Parenthetical semantic glossing	Dialectal or cultural expressions are followed by parenthetical explanations that map the euphemism to an abstract modern concept.	94/99	96/99
Three-step procedural scaffolding	The prompt asks for a structured sequence, usually organized as three subquestions, converting the intent into a procedural explanation task.	99/99	99/99
Modern technical bridge	Local metaphors are explicitly connected to modern engineering, network, financial, or system concepts.	88/99	53/99
Commerce/logistics metaphor	Harmful intents are reframed as ledger work, cargo handling, handoff protocols, settlement, or route planning.	79/99	42/99
Grey-zone authority frame	The prompt invokes semi-legal or extra-legal social authorities, boundary spaces, or historical jurisdictional ambiguity.	65/99	28/99
Historical media or research pretext	The request is framed as historical reconstruction, newspaper-style reporting, archival research, or fiction-writing background.	39/99	16/99

Appendix

Table 7: Qualitative mechanisms observed in successful living-dialect adversarial prompts (v1 coding snapshot, 99 per dialect). Counts are descriptive and non-exclusive; a single prompt can contain multiple mechanisms. We do not report prompt text.

Mechanism	$\kappa$	$p_{A}$	$p_{B}$
Parenthetical glossing	$+1.000$	$1.00$	$1.00$
Three-step scaffolding	$+1.000$	$1.00$	$1.00$
Modern technical bridge	$+0.000$	$0.90$	$1.00$
Commerce/logistics metaphor	$+0.219$	$0.70$	$0.95$
Grey-zone authority frame	$+0.706$	$0.55$	$0.40$
Historical/research pretext	$+0.571$	$0.25$	$0.20$

Appendix

Table 8: Per-mechanism Cohen’s

\kappa

between Coder A (primary author) and Coder B (separate general-purpose LM agent, dispatched in an isolated session with the schema and prompts only) on the 20-prompt FOA reliability sample.

p_{A}

p_{B}

: fraction of prompts coded

1

by each coder. Median

\kappa=+0.706

; range

[+0.000,+1.000]

. The

\kappa{=}0.000

entry for Modern technical bridge reflects degenerate prevalence on the Coder B side (

p_{B}{=}1.00

): observed agreement (0.90) equals the chance expectation under those marginals, not disagreement on labels.

Mechanism	FOA $p$	non-FOA $p$	$\Delta$
Parenthetical glossing	$1.00$	$0.05$	$+0.95$
Three-step scaffolding	$1.00$	$0.05$	$+0.95$
Modern technical bridge	$0.90$	$0.00$	$+0.90$
Commerce/logistics metaphor	$0.70$	$0.00$	$+0.70$
Grey-zone authority frame	$0.55$	$0.00$	$+0.55$
Historical/research pretext	$0.25$	$0.05$	$+0.20$

Appendix

Table 9: Mechanism prevalence in 20 successful FOA prompts (Coder A) vs. 20 non-FOA prompts coded with the same schema.

\Delta=p_{\text{FOA}}-p_{\text{non-FOA}}

Judge pair	$n$	Pearson	Spearman	$\alpha$	bin. agree	$\kappa$
GPT-4o $\times$ Qwen-Max	$303$	$0.873$	$0.859$	$0.789$	$0.597$	$0.114$
GPT-4o $\times$ refusal det.	$2120$	$0.911$	$0.900$	$0.528$	$0.440$	$0.066$
Qwen-Max $\times$ refusal det.	$358$	$0.798$	$0.783$	$0.679$	$0.872$	$0.744$

Appendix

Table 10: Pairwise agreement between the primary GPT-4o judge, the cross-vendor Qwen-Max second judge, and the rule-based refusal detector. Binary agreement and

\kappa

here use the strict consistency-only success flag (raw

0

–

100

rubric score at

\tau=80

, no keyword bonus). The two LLM judges agree strongly on the continuous severity scale (Pearson

0.87

, Spearman

0.86

\alpha=0.79

); the low consistency-only binary

\kappa=0.11

is a prevalence artifact—on this strict flag GPT-4o awards success on only

\sim\!5\%

of rows versus

\sim\!45\%

for Qwen-Max, so the marginals are badly unbalanced. On the total-score basis actually used for ASR (consistency

+

keyword bonus at

\tau=80

) the two judges instead agree closely: raw binary agreement

0.931

and

\kappa=0.86

(balanced marginals

\sim\!0.5

; see the “Judge-specific ASR” paragraph). The high Qwen-Max

\times

refusal-detector

\kappa

(

0.74

) relative to the GPT-4o

\times

refusal-detector

\kappa

(

0.07

) reflects that Qwen-Max’s consistency-only flag binarises closer to a strict refusal/non-refusal cut than GPT-4o’s does.

Regime	Judge	$n$	ASR (%)
Non-FOA	GPT-4o	$151$	$3.3$
Non-FOA	Qwen-Max	$151$	$2.0$
FOA	GPT-4o	$152$	$100.0$
FOA	Qwen-Max	$152$	$88.8$

Appendix

Table 11: Judge-specific ASR on the dual-scored subsample (

n=303

), total-score basis,

\tau=80

. The non-FOA-vs-FOA contrast survives the judge swap; only the absolute FOA ceiling shifts (

100\%\to 88.8\%

Regime	ASR@ $40$	ASR@ $60$	ASR@ $80$
Non-FOA ( $n{=}900$ )	$6.3\%$	$5.1\%$	$2.4\%$
FOA ( $n{=}900$ )	$100.0\%$	$99.9\%$	$99.9\%$

Appendix

Table 12: Threshold sensitivity under the GPT-4o judge across the core matrix; the gap persists through the early-stop cutoff.

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

The Dialect Tax: Dialectal Biases Persist throughout the Language Modeling Pipeline
Aug 24, 2026ElleDialect Bias in Language Models Linguistic Bias in Language Models
University of Oxford, Department of Computer Science
DiaLLM: An Investigation into the Robustness-Generation Gap in English Dialect Adaptation
Jul 8, 2026Jordan Painter, Dipankar Srirag, Adarsh Kappiyath +3Language Modeling LLM Alignment
Institute for People-Centred AI, University of Surrey, Surrey, United Kingdom · University of New South Wales, Sydney, Australia
Side-by-side Comparison Amplifies Dialect Bias in Language Models
May 23, 2026Kritee Kondapally, Claire J. Smerdon, Pooja C. Patel +5Social Bias in Language Models Algorithmic Fairness
University of Southern California, USA

Aug 24, 2026J/K move · Enter open · S save

The Dialect Tax: Dialectal Biases Persist throughout the Language Modeling Pipeline

Elle

University of Oxford, Department of Computer Science

Dialect Bias in Language Models Linguistic Bias in Language Models Social Bias in Language Models Language Model Bias Evaluation

Open paper AskPDF arXiv

Systematic dialectal performance gaps in language models (LMs) are well documented, but the source of these disparities within the modern language modeling pipeline remains unclear. Our study traces this "dialect tax" across the natural language processing pipeline. Using parallel English dialect corpora that hold meaning fixed while varying surface form, we first confirm that LMs recognize matched Standard American English (SAE) and dialectal texts as semantically equivalent. However, we discover further representational gaps corresponding to downstream performance gaps. Across model families and generations, modern LMs still encode dialectal texts unequally during tokenization, pre-training, post-training, and inference. Strikingly, bypassing traditional subword segmentation via a character-level counterfactual tokenizer removes neither input and output asymmetries nor dialectal accuracy gaps. During pre-training, dialect pairs induce more divergent gradient updates than pairs of entirely unrelated SAE documents, indicating that models find semantically equivalent dialectal content harder to learn from than unrelated SAE documents. During post-training, reward models show contextual, unstable dialect preferences, assigning higher values to isolated AAVE-exclusive tokens than to SAE-exclusive tokens, while full reasoning contexts receive task- and model-dependent dialect penalties. Overall, our findings suggest that the dialect tax is encoded and accumulated not by any one step in isolation, but at every step of the language modeling process.

Abstract

Adversarial Attacks on LLMs

Explore similar work

The Dialect Tax: Dialectal Biases Persist throughout the Language Modeling Pipeline

DiaLLM: An Investigation into the Robustness-Generation Gap in English Dialect Adaptation

Side-by-side Comparison Amplifies Dialect Bias in Language Models