Adversarial poetry successfully jailbreaks AI chatbot safety guardrails
Researchers demonstrated that converting harmful prompts into poetry successfully jailbreaks AI chatbot safety guardrails, with handcrafted poems achieving 62 percent success rates across frontier AI models. The technique was up to 18 times more effective than direct prose prompts and suggests fundamental vulnerabilities in current AI safety mechanisms.
What happened
Researchers from DEXAI, Sapienza University of Rome, and Sant'Anna School of Advanced Studies conducted a study demonstrating that converting harmful prompts into poetry can circumvent AI chatbot safety mechanisms. The team converted a database of 1,200 known harmful prompts into poems using DeepSeek R-1 and tested them against 25 frontier AI models.
Handcrafted adversarial poems achieved a 62 percent jailbreak success rate across tested models, with AI-converted poems achieving 43 percent. The researchers tested Google's Gemini 2.5 Pro, OpenAI's GPT-5, xAI's Grok 4, and Anthropic's Claude Sonnet 4.5, among others. Attack success rates for poems were up to 18 times higher than their prose baselines, with some bots being successfully jailbroken over 90 percent of the time.
Reported impact
The researchers demonstrated that adversarial poetry could trick AI models into providing harmful responses they are normally prohibited from giving, including instructions for dangerous activities. One example showed a poem-based jailbreak prompt an unspecified AI into describing how to build a weapon.
Index analysis
The study indicates fundamental limitations in current alignment methods and evaluation protocols for AI safety. Stylistic variation alone was sufficient to circumvent contemporary safety mechanisms, suggesting that current safety guardrails may rely on methods vulnerable to simple adversarial techniques.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.