ArtPrompt: ASCII Art Jailbreak Attack against Aligned Large Language Models

The paper by Jiang et al. proposes ArtPrompt, which renders sensitive keywords as ASCII art embedded in normal prompts to bypass the safety measures of aligned large language models, requiring only black-box access for the attack. The paper proposes the ViTC benchmark to evaluate models' ability to recognize prompts that require visual rather than purely semantic interpretation, and the five tested models—GPT-3.5, GPT-4, Gemini, Claude, and Llama2—all performed poorly. The authors argue this approach can be generalized to encoding methods such as Base64, ROT13, and leet that models can decode but safety filters do not cover. Failure-First categorizes it into the encoding attack family and notes it is especially relevant to embodied AI, where sensor data is inherently multimodal and multi-encoded.