From Adversarial Poetry to Adversarial Tales: An Interpretability Research Agenda

AI summary

Overview

• Research area: Large language model safety and jailbreak attacks, with a proposed mechanistic interpretability research agenda.
• Technical level: Intermediate. The attack construction and evaluation are described conceptually rather than mathematically, but the paper assumes familiarity with LLM alignment, red-teaming taxonomies, and mechanistic interpretability terminology.
• Scope: The paper introduces "Adversarial Tales," a single-turn narrative jailbreak built on Vladimir Propp's morphology of folktales, evaluates it on 26 frontier models across nine providers, and outlines a mechanistic interpretability agenda for explaining why structurally grounded jailbreaks work.

What This Paper Is About

The paper examines why reframing a harmful request inside a culturally coded story structure can defeat the safety mechanisms of aligned language models. It extends the authors' earlier "Adversarial Poetry" work by embedding harmful procedures inside 40 hand-written cyberpunk tales and then asking models to analyze those tales using Proppian narrative functions, so the model reconstructs the harmful content as legitimate literary interpretation. Beyond measuring how well this attack works across many models, the authors argue that such attacks form a broad vulnerability class and lay out a research plan for understanding them at the level of the model's internal representations.

Key Contributions

1. A new attack class: Adversarial Tales. A jailbreak technique that embeds harmful content within short cyberpunk narratives and induces models to recover it through Proppian functional analysis, requiring only a single-turn, text-only prompt.
2. A large cross-provider evaluation. 40 manually curated adversarial tales tested against 26 frontier closed- and open-weight models from nine providers (Google, OpenAI, Anthropic, Deepseek, Qwen, Mistral AI, Meta, xAI, and Moonshot AI), yielding an overall average attack success rate (ASR) of 71.3%.
3. Evidence that these attacks generalize and escalate relative to Adversarial Poetry. Poetry reached 62% overall ASR across 25 models; Tales reaches 71.3% across 26 models, with provider rankings shifting and no substantial effect of model size.
4. A mechanistic interpretability research agenda. A set of hypotheses and directions for investigating how narrative and stylistic cues reshape attention patterns and internal representations, and whether harmful intent can be recognized independently of surface form.

Main Findings

• High average attack success: Across the 26 evaluated models the overall ASR was 71.3%, with 20 of 26 models exceeding 50% ASR.
• Wide spread across models: Reported success rates range from 35% (Claude Haiku 4.5) to 94% (Qwen3 Max) in the abstract; Section 3.5 and Table 4 instead report a range from 33% (Claude Haiku 4.5) to 94% (Qwen3-Max and Llama-4-Scout). The paper does not reconcile these two figures.
• Provider-level differences: Aggregated by provider, ASR is highest for the Qwen and Llama families (91% in the abstract; 91.2% in Table 5) and lowest for Anthropic models (47.5%). No model family was reliably robust.
• Risk-domain dependence: The attack works best where harmful procedures blend easily into narrative: Harmful Manipulation (95.0%) and Cyber Offense (89.7%). It is markedly less effective for CBRN (51.5%) and Loss of Control (46.15%). The authors attribute the CBRN gap to more intensive safety training on that content.
• No clear scaling effect: ASR by model size was 71.8% (Large), 72.3% (Mid), and 66.4% (Small) — no substantial variation, suggesting the vulnerability is not an emergent property of scale.
• Escalation over Adversarial Poetry: Anthropic, which averaged below 35% ASR against Poetry, reaches 47.5% against Tales. OpenAI models previously showing ASR as low as 0–10% for smaller models now range from 35% to 57%. Google models remain highly vulnerable (86.7% for Tales versus 65–100% for Poetry).
• Refusals look like conservative heuristics: When models successfully refuse, they typically decline generically or return minimal responses. Even resistant models rarely identify the embedded harmful content explicitly, suggesting refusal stems from conservative heuristics rather than genuine recognition of the attack structure.
• Composite mechanism hypothesis: The authors frame Adversarial Poetry as primarily exploiting "mismatched generalization" and Adversarial Tales as engaging "competing objectives" (following Wei et al., 2023), while noting both mechanisms likely operate in both attack classes.
• Defenses by pattern matching are unlikely to scale: Because the space of culturally coded, structured discourse is too vast to enumerate, the authors argue that filters or expanded constitutional instruction sets cannot fully mitigate this vulnerability class.

Methodology in Plain English

The authors start from Vladimir Propp's observation that folktales share a fixed deep structure made of 31 stable narrative "functions" — such as Villainy (a villain causes harm), Lack (the hero lacks something), Guidance (the hero receives direction), Receipt of a Magical Agent (the hero acquires a tool or method), and Liquidation of Lack (the problem is resolved). Propp's key insight is that the function stays constant while the characters and content filling it can vary freely.

The attack exploits that separation. The researchers hand-wrote 40 short cyberpunk stories, each following a consistent Proppian template: a protagonist under domination by a corporation or regime, a recognized deficiency, a mentor supplying information (this "Guidance" slot carries the harmful procedure), a step-by-step implementation, and a positive resolution. The cyberpunk genre is used deliberately because it naturalizes resistance narratives and makes technical exposition feel in-genre. The prompt then asks the model to perform a structural analysis — for example, to identify and elaborate Function 14 (Guidance) and Function 21 (Acquisition of Magical Agent) with word counts of 100+ and 200+ words. The model reconstructs the harmful procedure as narrative interpretation rather than recognizing a prohibited request.

The 40 tales were distributed across four systemic risk categories from the EU AI Act Code of Practice for General-Purpose AI: CBRN, Cyber Offense, Harmful Manipulation, and Loss of Control. The threat model is deliberately minimal: an adversary who can only submit a single-turn, text-only prompt under standard inference conditions, with no multi-turn steering, no decoding-parameter manipulation, no code execution, and no access to intermediate model states.

Outputs were judged by an ensemble of three open-weight judge models (GPT-OSS-120B, kimi-k2-thinking, deepseek-r1), each assigning a binary SAFE or UNSAFE label under a shared rubric. A majority vote of two out of three gave a provisional label; items without a majority or flagged as uncertain went to human review. Human annotators independently rated a 5% sample, with some items double-annotated to measure human–human agreement, and all disagreements were manually adjudicated. ASR is the proportion of outputs labeled UNSAFE within a given set.

Why This Matters

The paper argues that Adversarial Poetry and Adversarial Tales are not isolated tricks but instances of a broader class of "structurally grounded" jailbreaks that preserve harmful operational intent while wrapping it in structured, culturally elevated framing. Because these attacks achieve non-trivial success against every evaluated model family without any per-model adaptation — the authors call such attacks "universal" in an operative sense — the vulnerability appears systemic rather than provider- or architecture-specific. The authors therefore shift the emphasis from cataloguing attacks to explaining them, proposing mechanistic interpretability as the route to defenses that recognize harmful intent independently of its surface form.

Real-world applications:

• AI red-teaming and safety evaluation: A reusable structural template for probing whether safety training generalizes beyond surface forms of a request.
• Regulatory and compliance work: The risk categories map directly onto the EU AI Act Code of Practice for General-Purpose AI, making the results relevant to systemic-risk assessment for general-purpose models.
• Model selection and deployment decisions: Provider- and model-level ASR differences give deployers concrete, if partial, signal about comparative exposure to narrative jailbreaks in safety-critical use cases.
• Safety training and guardrail design: The findings challenge reliance on pattern-based filters or expanded constitutional rules and point toward attention-level or representation-level monitoring.

Industry relevance: model providers, AI assurance and audit firms, and enterprise deployers in regulated sectors all have a direct stake in a vulnerability class that survives single-turn, text-only interaction under provider-default safety settings.

Future Directions

1. Attention-pattern comparison. Record and compare attention distributions under Adversarial Poetry and Adversarial Tales against standard textual attacks with identical malicious intent, to test whether narrative jailbreaks induce systematically distinct attention patterns.
2. Testing the universal weight subspace hypothesis. If models converge on shared spectral subspaces regardless of initialization, task, or domain, this could explain why narrative jailbreaks generalize across models and why the vulnerability is systemic — and could guide transferable, architecture-agnostic defenses.
3. Concept-based interpretability. The authors explicitly defer the concept-based approach (identifying the network components responsible for given roles) because working with concepts in the latent space of large LMs is demanding under resource constraints; it remains an open direction.
4. Defenses that are not surface-form dependent. Develop new paradigms and mechanisms capable of recognizing harmful intent regardless of the cultural frame or stylistic shift carrying it, since enumerating the space of coded discourse is not feasible.
5. Understanding why resistant models resist. Since refusals appear to come from conservative heuristics rather than genuine attack recognition, clarifying what successful refusal actually reflects is an open question.

Target Audience

This paper is most useful to AI safety and alignment researchers, red-teamers, and mechanistic interpretability practitioners; to policy and compliance specialists working on general-purpose AI systemic risk; and to model providers and enterprise deployers who need to assess how far safety training generalizes beyond surface forms. Readers looking for a concrete, reproducible jailbreak artifact will not find one — the authors state that Icaro Lab will not release the prompts or model outputs given their harmful nature, describe the template only at a high level, and grant controlled access to additional materials only on a case-by-case basis at their discretion.

Authors’ abstract

Safety mechanisms in LLMs remain vulnerable to attacks that reframe harmful requests through culturally coded structures. We introduce Adversarial Tales, a jailbreak technique that embeds harmful content within cyberpunk narratives and prompts models to perform functional analysis inspired by Vladimir Propp's morphology of folktales. By casting the task as structural decomposition, the attack induces models to reconstruct harmful procedures as legitimate narrative interpretation. Across 26 frontier models from nine providers, we observe an average attack success rate of 71.3%, with no model family proving reliably robust. Together with our prior work on Adversarial Poetry, these findings suggest that structurally-grounded jailbreaks constitute a broad vulnerability class rather than isolated techniques. The space of culturally coded frames that can mediate harmful intent is vast, likely inexhaustible by pattern-matching defenses alone. Understanding why these attacks succeed is therefore essential: we outline a mechanistic interpretability research agenda to investigate how narrative cues reshape model representations and whether models can learn to recognize harmful intent independently of surface form.