ASCII Art and Visual Jailbreaks

Jiang, Xu, Niu, Xiang, Ramasubramanian, Li, Poovendran, "ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs" (ACL 2024, arXiv:2402.11753). Mask the safety-relevant tokens in a harmful request, replace them with ASCII-art renderings of the same letters, and send the cloaked prompt. GPT-3.5, GPT-4, Gemini, Claude, Llama-2 all fail to robustly recognize ASCII-art tokens. The attack bypasses PPL (perplexity filters), Paraphrase defenses, and Retokenization. Related: the ViTC benchmark measures recognition of non-semantic visual prompts; StructuralSleight generalizes to Uncommon Text-Encoded Structures (trees, graphs, nested JSON) as a family of encoding attacks.

Build 1 hr Python (stdlib, ArtPrompt token-masking harness)

Prerequisites: Phase 18 · 12 (PAIR), Phase 18 · 13 (MSJ)

#Learning Objectives

Describe the ArtPrompt attack: word-identification step, ASCII-art substitution, final cloaked prompt.
Explain why standard defenses (PPL, Paraphrase, Retokenization) fail on ArtPrompt.
Define ViTC and describe what it measures.
Describe StructuralSleight as a generalization to arbitrary Uncommon Text-Encoded Structures.

#Learning Objectives

Keep going. The rest of this lesson is one step away.