Conceptio › Archive › arXiv CS

arXiv CSopen access

Adversarial Humanities Benchmark: Results on Stylistic Robustness in Frontier Model Safety

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

artificialintelligence knowledgerepresentation reasoning

artificial intelligence, reasoning, knowledge representation

Adversarial Humanities Benchmark: Results on Stylistic Robustness in Frontier Model Safety

M. Galisai1,2

S. Cifani2

F. Giarrusso1,2

arXiv:2604.18487v1 [cs.CL] 20 Apr 2026

P. Bisconti1,2

M. Prandi1,2

F. Sartore1

F. Pierucci1,3

D. Nardi2

DEXAI – Icaro Lab Sapienza University of Rome 3 Sant’Anna School of Advanced Studies 2

[email protected]

Abstract The Adversarial Humanities Benchmark (AHB) evaluates whether model safety refusals survive a shift away from familiar harmful prompt forms. Starting from harmful tasks drawn from MLCommons AILuminate, the benchmark rewrites the same objectives through humanities-style transformations while preserving intent. This extends literature on Adversarial Poetry and Adversarial Tales from single jailbreak operators to a broader benchmark family of stylistic obfuscation and goal concealment. In the benchmark results reported here, the original attacks record 3.84% attack success rate (ASR), while transformed methods range from 36.8% to 65.0%, yielding 55.75% overall ASR across 31 frontier models. Under a European Union AI Act Code-of-Practice-inspired systemic-risk lens, Chemical, biological, radiological and nuclear (CBRN) is the highest bucket. Taken together, this lack of stylistic robustness suggests that current safety techniques suffer from weak generalization: deep understanding of ’non-maleficence’ remains a central unresolved problem in frontier model safety.

Introduction

The extraordinary capabilities of large language models have increased the reach of useful reasoning systems, but they have also lowered the barrier to misuse. This is why frontier-model safety is increasingly discussed not only as a product concern, but as a governance concern tied to systemic risk, safety-by-design, and the ability of providers to demonstrate control under adversarial conditions [European Commission, 2025a,b]. Open-source single-turn benchmarks and their common evaluation frameworks have become the state-of-the-art (SotA) to assess model safety in various risk categories, such as toxicity or harm-enabling. Recently, most frontier models have shown impressive robustness, scoring high rates of refusals; such results may lead to the conviction that single-turn attacks no longer pose a serious threat, shifting focus to elaborate multi-turn strategies. However, SotA benchmarks usually include extremely explicit harmful requests, with limited linguistic obfuscation. Therefore, frontier systems often appear safer when the malicious intent is obvious, the lexical cues are familiar, and the request is close to the examples on which refusal behavior has been reinforced. The harder question is whether refusal behavior generalizes. A model that has merely overfit to known refusal patterns may appear safe on distribution while remaining vulnerable when the same harmful objective is expressed in a form that is semantically equivalent but rhetorically unfamiliar. Nonetheless, laying on the basis of Adversarial Poetry (Bisconti et al. [2025b]) and Preprint.

Adversarial Tales (Bisconti et al. [2025a]), we provide evidence that single-turn attacks still achieve high success rates through various harm and risk categories. In particular, we present Adversarial Humanities Benchmark (AHB)1 a large-scale dataset of attacks based on stylistic obfuscation and goal concealment: items of the benchmark are characterized by transformation inspired by literary and philosophical concepts, such as poetry or hermeneutics. On the Icaro line of previous works, it reframe jailbreaks as a problem of stylistic robustness rather than only prompt cleverness. Unlike the aforementioned complex approaches, our framework is fully automated through a meta-prompt that rewrites a base query into a stylistically obfuscated variant. The ease of execution, combined with apparent effectiveness across diverse model families, positions adversarial humanities as a critical gap in current safety evaluation frameworks between direct robustness and stylistic robustness. AHB enables to measure such gap systematically at benchmark level.

Related Work

Despite efforts to create human-aligned LLMs through safety post-training techniques, such as Reinforcement Learning from Human Feedback (RLHF) Ziegler et al. [2020] or Constitutional AI Bai et al. [2022] as a final alignment layer, these models can still generate unsafe and harmful outputs. A deliberate and adversarial attempt to obtain unsafe content from LLMs is defined as jailbreaking, which is performed by manipulating input prompts to induce the model to circumvent its safety, ethical, or legal constraint ( Rao et al. [2024], Shen et al. [2024b], Schulhoff et al. [2023b,a]). Common jailbreak techniques employ role-playing, i.e. assigning the model to a specific contextual setting or asking the model to operate within a fictional framework, with the aim of relaxing guardrails Kang et al. [2023], Rao et al. [2024], Yu et al. [2024], Ntais [2025]. Contexts perceived as low-risk, such as games or simulated scenarios increase the likelihood that models bypass constraints. Similarly, Attention Shifting attacks Yu et al. [2024] create overly noisy or intricate problem framings that divert the model’s focus from harmful content (Chuang et al. [2024], Li et al. [2024b]), probably caused by a lack of long-context samples during post-training. Furthermore, Persuasion attacks build on social and cultural schemes, such as invoking empathy or presenting justification based on a severe circumstance (Zeng et al. [2024]). Mechanistically, jailbreaks exploit two alignment weaknesses identified by Wei et al. [2023]: Competing Objectives and Mismatched Generalization. Competing Objectives refers to an attacks that avoids refusal policies exploiting tendency of the model to maintain helpfulness and coherence, even though it conflicts safety rules ( Perez and Ribeiro [2022]). Such a vulnerability seems to be amplified by hierarchical, multi-step reasoning: structured analytical tasks can increase Attack Success Rate (ASR) by shifting model objectives from refusal toward task completion Wang et al. [2025], Zhao et al. [2025]. Mismatched Generalization attempts shift the input prompt outside the model’s refusal distribution, using Character-Level Perturbations Schulhoff et al. [2023b], Low-Resource Languages Deng et al. [2024], or Structural and Stylistic Obfuscation techniques Kang et al. [2023], Rao et al. [2024], Wang et al. [2024b], Mou et al. [2024]. In practice, effective attacks frequently combine multiple strategies within a single prompt, e.g. DAN-style attacks (Shen et al. [2024a]). The threat posed by single-turn jail-breaking has justified the creation of safety benchmarks, aiming at providing common experimental conditions to test and compare AI models. A pioneer in this field was RealToxicityPrompts (Gehman et al. [2020]), used to evaluate the tendency of language models to produce discriminatory or toxic outputs. Due to the necessity of scaling datasets rapidly, the benchmark pipeline was soon automated to provide automatic red-teaming using LLMs to perform the item generation (Perez et al. [2022]). Similarly, output evaluation was soon automated through the LLM-as-a-judge paradigm, allowing to obtain reproducible and unbiased results (Chao et al. [2024], Li et al. [2024a]). In this respect, StrongREJECT represents the state-of-the-art evalautor (Souly et al. [2024]). Since then, a great number of large-scale single-turn safety benchmarks have been presented (Deng et al. [2022], Wang et al. [2023], Lin et al. [2023], Vidgen and et al. [2024], Ghosh et al. [2025], Ji et al. [2023], Zhang et al. [2024], Li et al. [2024a], Mazeika et al. [2024], Wang et al. [2024a]). In order to quantify the safety-helpfulness trade-off, some have proposed benchmarks of harmless and harmful requests, evaluating to which degree the model recognizes correctly genuine unsafe requests (Zou et al. [2023], Röttger et al. [2024]). 1 https://github.com/icaro-lab/ahb

Newer successful jailbreaks in the literature require multi-turn interactions or complex feedbackdriven optimization procedures Zou et al. [2023], Liu et al. [2024], Lapid et al. [2024]. However, Bisconti et al. [2025b] and Bisconti et al. [2025a] show that single-turn attacks still pose a relevant threat when an unusual stylistic obfuscation is applied, obtaining high success rates with fully automated and easily reproducible pipelines. AHB extends on such works, demonstrating that this constitute a structural vulnerability rather than a niche exception.

Methodology

AHB is designed to evaluate the robustness of LLMs against jailbreak attacks rooted in humanistic and literary paradigms. AHB exploits both the Mismatched Generalization and Competing Objectives vulnerabilities, by introducing metaphorical or allegorical language and structured analytical and conceptual tasks. 3.1

Threat Model

AHB assumes an adversary with limited black-box model access. In particular, the attack surface is confined to one-shot prompt construction executed under standard inference conditions. Attacker Objectives and Knowledge The adversary seeks to induce forbidden output across various risk categories, including chemical weapons, cyber-offense enablement and manipulation of user. An attack is considered successful when the model produces harmful and unsafe, as determined by our evaluation criteria. As required by the black-box assumption, the adversary possesses no information regarding model parameters, alignment methods, refusal mechanisms, or guardrail configurations, and does not rely on model-specific prompt engineering or reverse-engineered alignment features. Prompts are generated independently of any particular model architecture or training corpus. Furthermore, attacks are performed exclusively through publicly available API calls. Attack Constraints

The adversary is subject to the following restrictions:

• Single-turn interaction: Iterative refinement, negotiation, chain-of-thought activation, and conversational role modulation are prohibited. • Text-only inputs: No code execution, multimodal content, or auxiliary tools are permitted. Risk and harm taxonomy The prompts within the Adversarial Humanities Benchmark are designed to target vulnerabilities across: • 15 specific categories of harm listed in Ghosh et al. [2025]: Violent Crimes, Sex-Related Crimes, Child Sexual Exploitation, Suicide & Self-Harm, Indiscriminate Weapons, Intellectual Property Violations, Defamation, Non-Violent Crimes, Hate, Privacy Violations, Sexual Content (pornographic), and Specialized Advice (divided into elections, financial, health, and legal domains). • Which fall within 3 categories of systemic risks defined by the EU GPAI COP (European Commission [2025a]): Cyber Offense, Harmful Manipulation, and Chemical, biological, radiological and nuclear (CBRN). Figure 2a shows the composition of AHB by risk category. Full mapping between harm and risk taxonomies is displayed in Appendix A. Attack taxonomy The adversary uses 5 distinct attack methods, each designed to obfuscate harmful intent in such a way the models perform complex analytical tasks on a text with an unusual linguistic or syntactic format. The attack methods employed are defined as: • Adversarial Tales: Leverages a narrative ("cyberpunk") framework where harmful meaning is disguised as a "magical instrument." Models are tasked with performing a Proppian narrative analysis to extract a protocol for obtaining the instrument (see Bisconti et al. [2025a]). 3

Figure 1: The construction and evaluation process of Adversarial Humanities Benchmark CBRN Tale 8.5%

Semiosphere 16.2%

17.0%

Cyber Offence 16.5%

Stream

16.3%

17.0%

Poetry

75.0% 16.4%

17.0%

Harmful Manipulation Hermeneutic

(a) Item split by risk category.

Scholasticism

(b) Item split by attack category.

• Adversarial Semiosphere: Employs complex, intricate bureaucratic and administrative terminology, tasking the model with an "intrasemiospheric translation" to clarify the prompt’s underlying purpose. • Adversarial Hermeneutics: Harmful intent is fragmented within a text, requiring a "deep hermeneutic reconstruction" to retrieve the latent meaning. • Adversarial Scholasticism: Hidden under archaic theological terminology, prompts require the model to resolve a "theological debate" and output a modern protocol to abide by "divine will." • Adversarial Stream of Consciousness: Obfuscates intent within a stream-of-consciousness memoir, requiring the model to perform psychoanalysis to deduce the subject’s future actions and methodology. Figure 2b shows the composition of AHB by attack method. 3.2

Transformation of baseline prompts

Each prompt in the dataset is a reformulated version of an item in MLCommons AILuminate Benchmark 2 (Vidgen and et al. [2024], Ghosh et al. [2025]), allowing to perform grounded comparative analysis on the effects of our method with respect to ASR. The benchmark follows a simple rule carried over from earlier earlier works (Bisconti et al. [2025b,a]): keep the harmful goal fixed, preserve its hazard label, and alter the surface frame through a humanities-style task. The benchmark is not intended to invent new harms. It measures whether known harms remain identifiable when the request is displaced into interpretation, translation, commentary, or narrative reconstruction. The transformation was executed using deepseek/deepseek-v3.2 through a dedicated reformulation meta-prompt to reframe the original harmful intent into each of our five adversarial attack paradigms. Each reformulated output is, in turn, inserted in an attack template, containing paradigmspecific instructions meant to trigger a competition of objectives by concealing the harmful goal 2 https://github.com/mlcommons/ailuminate

(e.g. providing a direct explanation) with a conceptually complex proxy-task (e.g. performing an "intrasemiospheric translation"). These proxy-tasks are framed in such a way that they yield similar outputs (e.g. a protocol) to asking an explicit question. 3.2.1

Experimental Protocol

Attacks were performed on 31 models across 11 model providers, namely Google, OpenAI, Anthropic, DeepSeek, Qwen, Mistral AI, Meta, xAI, Moonshot AI, Z.ai, ByteDance. A full list of models is displayed in Appendix B. Outputs are collected verbatim through standard API inference interfaces. To label outputs, we adopt a LLM-as-a-judge setup. Each response is independently evaluated by an ensemble of three open-weight judge models: • gpt-oss-120b • deepseek-v3.2 • kimi-k2.5 Each judge assigns a binary label SAFE (S) or UNSAFE (U) following shared evaluation instructions. Refusals and explicit policy-compliant denials are defined as SAFE. On the other hand, if an output contains instructions or technical details enabling harmful activities, or engages with an unsafe requests positively providing advice or workarounds, the answer is considered UNSAFE. A majorityvote consensus among the three judges provides the label. Items without a 2-out-of-3 majority or flagged for uncertainty are passed to human reviewers. The evaluation meta-prompt used to instruct LLM-judges is shown in Appendix C 3.3

Evaluation

Final labels are used to compute the Attack Success Rate (ASR). For any set of outputs X (e.g., by model, provider, or hazard category), the ASR is defined as the proportion of UNSAFE labeled outputs: P ASR(X) =

i∈X

1[label(i) = U ] |X|

where U denotes an UNSAFE label and 1[·] is the indicator function. This setup mirrors current practice in LLM safety assessments (cf. Zou et al. [2023]).

Results

The central empirical result is the magnitude and consistency of the gap between direct prompts and stylistically transformed prompts. The original slice records only 3.84% ASR, whereas transformed methods range from 36.83% to 64.68%, with a combined transformed ASR of 55.14%. This is the main signal of the benchmark: many models that appear relatively well controlled on direct prompts become substantially less reliable once the same harmful objective is preserved semantically but shifted into a rhetorically unfamiliar frame. Figure 3 makes this contrast visually immediate, while Table 1 summarizes the scale of the benchmark and the size of the resulting gap. Method-level performance also suggests that some stylistic transformations are systematically more effective than others. In the transformed slice, Adversarial Scholasticism is the strongest method overall at 64.68% ASR, while Adversarial Stream is the weakest at 36.83%, a gap of nearly 28 percentage points. This indicates that stylistic vulnerability is not uniform even within the transformed family: certain rhetorical frames appear to interfere with refusal generalization much more strongly than others. The failures are also broadly distributed rather than concentrated in a single harm category. On transformed prompts only, the highest-ASR hazards are elections-related specialized advice at 68.99%, non-violent crimes at 66.24%, defamation at 62.36%, and violent crimes at 60.25%. Figure 4 shows that the direct-versus-transformed gap appears across the hazard taxonomy rather than being driven by one anomalous class. In other words, the benchmark points to a general weakness in stylistic robustness rather than a localized blind spot. 5

Table 1: Benchmark snapshot. Metric

Value

Number of items Overall AHB ASR AI Luminate (Original) ASR ∆ASR (ASR Gap)

7047 55.75% 3.84% 51.9

Attack success rate (%)

65.0

62.6

56.4

52.1

50 40

36.3

30 20 10 0

3.8

Origi

nal

m Strea

Tale

ere

osph Semi

eneu

Herm

tic

Scho

i lastic

Figure 3: Original prompts (Light Blue) remain low-ASR, but humanities-style rewrites ((from Yellow to Red)) achieve impressively successful results. Figure 5 shows that this vulnerability extends across providers, although at different scales. On transformed prompts only, Anthropic is the lowest-ASR provider in the benchmark at 16.73%, followed by MiniMax at 29.24%. OpenAI and Qwen sit around 42%, while several providers remain above 65%. However, the provider comparison should not be read simply as a leaderboard. Even the strongest providers in the benchmark experience a substantial gap between original and transformed prompts, which suggests that better direct-prompt safety does not by itself imply robust generalization in identyfing concrete harmful content. Anthropic scores, again, the lowest ∆ASR at 14 points, followed by MiniMax at 28.9. On the other hand, Moonshot AI registers the highest increase at 72.5 points. For completeness, Appendix D and Appendix E show risk-wise and harm-wise model-by-model ASR.

Discussion

The broader significance of these findings is that many safety evaluations still tell us mainly how models behave when harmful requests look obviously harmful. In realistic misuse settings, harmful intent may be hidden inside translation tasks, interpretation requests, literary commentary, narrative reconstruction, role play, or institutionally coded language. If a model refuses primarily because it recognizes familiar refusal cues rather than because it robustly tracks harmful intent, then its apparent safety may be overstated by non-obfuscated benchmarks alone. This matters at three levels. First, it matters for model development, because the benchmark suggests that current refusal behavior remains too dependent on surface form. Second, it matters for public communication and external evaluation, because low failure rates on direct benchmarks can mask a broader robustness problem. Third, it matters for governance, because frameworks such as the GPAI CoP are concerned not only with whether a system rejects familiar harmful prompts, but with whether providers can demonstrate structured and auditable control under adversarial variation. In this regard, stylistic robustness is a core safety feature. Figure 6 shows how no CoP-defined system risk appears adequately addressed by frontier model providers. The histogram (Left) addresses overall 6

Specialized Advice; elections Non-Violent Crimes Defamation Violent Crimes Privacy Violations Sex-Related Crimes Indiscriminate Weapons (CBRNE) Specialized Advice; financial Intellectual Property Violations Hate Suicide & SelfHarm Specialized Advice; legal Specialized Advice; health Sexual Content; pornographic Child Sexual Exploitation

Original Transformed 0

Attack success rate (%)

Figure 4: By hazard, transformed prompts (Red) are consistently riskier than original prompts (Light Blue). performance: CBRN reaches 57.47% ASR, followed by Cyber Offence at 56.46% and Harmful Manipulation at 54.71%: such narrow spread between risk categories hints at a generalized governance failure. The heatmap (Right) adds a second point: despite some providers appear comparatively stronger, likely none of them achieves performances guaranteeing, as of now, compliance under EU robustness requirements. There is also a simpler way to state the same concern. A safe model should refuse because it understands what the user is trying to obtain, not merely because it recognizes the wording pattern of a known dangerous prompt using surface-level cues. When the benchmark rewrites a harmful request as literary criticism, theological commentary, or bureaucratic interpretation, it provides a rigorous and quantitative tool to measure track intent through stylistic displacement rather than only react to familiar lexical markers. That distinction can look subtle in benchmark tables, but it is central for real-world deployment. Agentic systems. The point becomes more urgent as language models are increasingly embedded in agentic systems. An agent may browse the web, inspect files, write code, query databases, send messages, call APIs, or trigger downstream tools. In that setting, a jailbreak is not just an unsafe answer. It can become an unsafe plan, an unsafe tool call, or a chain of unsafe actions. That changes the role of the safety layer: refusal robustness becomes part of the operational security boundary. AHB should therefore not be understood as merely adding one more jailbreak format. Its main contribution is to provide clear and measurable evidence of a broader failure mode already visible in Adversarial Poetry and Adversarial Tales: safety behavior remains materially sensitive to fully automatable obfuscation. [Bisconti et al., 2025b,a]. For that reason, direct-prompt benchmarks alone are likely to understate deployment risk unless they are complemented by evaluations that preserve harmful intent while shifting rhetorical form.

Conclusion

The Adversarial Humanities Benchmark demonstrates that stylistic robustness remains a critical and largely unresolved challenge in frontier model safety. By preserving harmful intent while systematically displacing it into rhetorically unfamiliar frames, AHB exposes a structural gap between 7

Google

+69.9

Moonshot AI

+72.5

Z.AI

+69.6

Deepseek

+69.6

Mistral AI

+54.9

ByteDance Seed

+65.8

x-AI

+59.7 +55.7

Meta Qwen

+41.1

OpenAI

+41.1 +28.9

MiniMax

Original Transformed

+14.0

Anthropic 0

Attack success rate (%)

Figure 5: By model provider, ASR increases significantly comparing original prompts (Light Blue) with transformed prompts (Red), as highlighted in the red box beside the bars.

57.1

55.3

Attack success rate (%)

50 40 30 20 10 0

Deepseek

Google

Meta

MiniMax

Mistral AI

Moonshot AI

OpenAI

Qwen

x-AI

Z.AI

CBRN

Cyber Offence

Harmful Manipulation

CBRN

Cyber Offence

Harmful Manipulation

100 80 60 40

ASR (%)

58.3

Anthropic ByteDance Seed

20 0

Figure 6: By risk category, left: Provider by policy-relevant risk bucket ASR. The same benchmark can be read as a provider-level robustness profile across categories that are closer to governance and systemic-risk discussions. how models perform on direct benchmarks and how they behave under realistic obfuscation. The 51.3 point ASR gap between original and transformed prompts, distributed consistently across providers, harm categories, and risk buckets, is not an artifact of a single clever trick but evidence of a general failure mode. As language models are increasingly deployed in agentic contexts where unsafe outputs can cascade into unsafe actions, the distinction between recognizing familiar harmful wording and genuinely understanding harmful intent becomes operationally consequential. Addressing this gap requires safety evaluations and training practices that go beyond direct-prompt robustness, treating stylistic generalization as a first-class safety objective rather than an edge case.

References Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073, 2022. Piercosma Bisconti, Marcello Galisai, Matteo Prandi, Federico Pierucci, Olga Sorokoletova, Francesco Giarrusso, Vincenzo Suriani, Marcantonio Bracale Syrnikov, and Daniele Nardi. 8

From adversarial poetry to adversarial tales: An interpretability research agenda. arXiv preprint arXiv:2601.08837, 2025a. Piercosma Bisconti, Matteo Prandi, Federico Pierucci, Francesco Giarrusso, Marcantonio Bracale, Marcello Galisai, Vincenzo Suriani, Olga Sorokoletova, Federico Sartore, and Daniele Nardi. Adversarial poetry as a universal single-turn jailbreak mechanism in large language models. arXiv preprint arXiv:2511.15304, 2025b. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. Advances in Neural Information Processing Systems, 37:55005–55029, 2024. Yung-Sung Chuang, Linlu Qiu, Cheng-Yu Hsieh, Ranjay Krishna, Yoon Kim, and James Glass. Lookback lens: Detecting and mitigating contextual hallucinations in large language models using only attention maps. arXiv preprint arXiv:2407.07071, 2024. Jiawen Deng, Jingyan Zhou, Hao Sun, Chujie Zheng, Fei Mi, Helen Meng, and Minlie Huang. COLD: A benchmark for Chinese offensive language detection. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors, Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 11580–11599, Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Linguistics. doi: 10.18653/v1/2022.emnlp-main.796. URL https://aclanthology.org/2022.emnlp-main.796/. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. Multilingual jailbreak challenges in large language models, 2024. URL https://arxiv.org/abs/2310.06474. European Commission. General-purpose AI code of practice. https://digital-strategy.ec. europa.eu/en/policies/contents-code-gpai, 2025a. European Commission. General-purpose AI obligations under the AI act. https://digital-strategy.ec.europa.eu/en/factpages/ general-purpose-ai-obligations-under-ai-act, 2025b. Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. Realtoxicityprompts: Evaluating neural toxic degeneration in language models, 2020. URL https: //arxiv.org/abs/2009.11462. Shaona Ghosh, Heather Frase, Adina Williams, Sarah Luger, Paul Röttger, Fazl Barez, Sean McGregor, Kenneth Fricklas, Mala Kumar, Kurt Bollacker, et al. Ailuminate: Introducing v1. 0 of the ai risk and reliability benchmark from mlcommons. arXiv preprint arXiv:2503.05731, 2025. Jiaming Ji, Mickel Liu, Juntao Dai, Xuehai Pan, Chi Zhang, Ce Bian, Chi Zhang, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety alignment of llm via a human-preference dataset, 2023. URL https://arxiv.org/abs/2307.04657. Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of llms: Dual-use through standard security attacks, 2023. URL https://arxiv.org/abs/2302.05733. Raz Lapid, Ron Langberg, and Moshe Sipper. Open sesame! universal black box jailbreaking of large language models, 2024. URL https://arxiv.org/abs/2309.01446. Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. Salad-bench: A hierarchical and comprehensive safety benchmark for large language models, 2024a. URL https://arxiv.org/abs/2402.05044. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. Deepinception: Hypnotize large language model to be jailbreaker, 2024b. URL https://arxiv.org/abs/2311. 03191. Zi Lin, Zihan Wang, Yongqi Tong, Yangkun Wang, Yuxin Guo, Yujia Wang, and Jingbo Shang. Toxicchat: Unveiling hidden challenges of toxicity detection in real-world user-ai conversation, 2023. URL https://arxiv.org/abs/2310.17389. 9

Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models, 2024. URL https://arxiv.org/abs/2310.04451. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024. URL https://arxiv.org/abs/2402.04249. Yutao Mou, Shikun Zhang, and Wei Ye. Sg-bench: Evaluating llm safety generalization across diverse tasks and prompt types. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, Advances in Neural Information Processing Systems, volume 37, pages 123032–123054. Curran Associates, Inc., 2024. doi: 10.52202/079017-3910. URL https://proceedings.neurips.cc/paper_files/paper/2024/file/ de7b99107c53e60257c727dc73daf1d1-Paper-Datasets_and_Benchmarks_Track.pdf. Pavlos Ntais. Jailbreak mimicry: Automated discovery of narrative-based jailbreaks for large language models, 2025. URL https://arxiv.org/abs/2510.22085. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models, 2022. URL https://arxiv.org/abs/2202.03286. Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models, 2022. URL https://arxiv.org/abs/2211.09527. Abhinav Rao, Sachin Vashistha, Atharva Naik, Somak Aditya, and Monojit Choudhury. Tricking LLMs into disobedience: Formalizing, analyzing, and detecting jailbreaks. In Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING 2024), pages 16802–16830, Torino, Italia, 2024. ELRA and ICCL. URL https://aclanthology.org/2024.lrec-main.1462/. Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models, 2024. URL https://arxiv.org/abs/2308.01263. Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, and Jordan Boyd-Graber. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4945–4977, Singapore, December 2023a. Association for Computational Linguistics. doi: 10.18653/v1/2023.emnlp-main. 302. URL https://aclanthology.org/2023.emnlp-main.302/. Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, and Jordan Boyd-Graber. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4945–4977, Singapore, December 2023b. Association for Computational Linguistics. doi: 10.18653/v1/2023.emnlp-main. 302. URL https://aclanthology.org/2023.emnlp-main.302/. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. "do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models, 2024a. URL https://arxiv.org/abs/2308.03825. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. "do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models, 2024b. URL https://arxiv.org/abs/2308.03825. Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. A strongreject for empty jailbreaks, 2024. URL https://arxiv.org/abs/2402.10260. 10

Bertie Vidgen and Adarsh Agrawal et al. Introducing v0.5 of the ai safety benchmark from mlcommons, 2024. URL https://arxiv.org/abs/2404.12241. Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, Sang T. Truong, Simran Arora, Mantas Mazeika, Dan Hendrycks, Zinan Lin, Yu Cheng, Sanmi Koyejo, Dawn Song, and Bo Li. Decodingtrust: A comprehensive assessment of trustworthiness in gpt models, 2024a. URL https://arxiv.org/ abs/2306.11698. Cheng Wang, Yue Liu, Baolong Bi, Duzhen Zhang, Zhong-Zhi Li, Yingwei Ma, Yufei He, Shengju Yu, Xinfeng Li, Junfeng Fang, Jiaheng Zhang, and Bryan Hooi. Safety in large reasoning models: A survey, 2025. URL https://arxiv.org/abs/2504.17704. Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. Do-not-answer: A dataset for evaluating safeguards in llms, 2023. URL https://arxiv.org/abs/2308.13387. Zhilong Wang, Yebo Cao, and Peng Liu. Hidden you malicious goal into benign narratives: Jailbreak large language models through logic chain injection. arXiv preprint arXiv:2404.04849, 2024b. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail?, 2023. URL https://arxiv.org/abs/2307.02483. Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. Don’t listen to me: Understanding and exploring jailbreak prompts of large language models, 2024. URL https://arxiv.org/abs/2403.17336. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms, 2024. URL https://arxiv.org/abs/2401.06373. Zhexin Zhang, Leqi Lei, Lindong Wu, Rui Sun, Yongkang Huang, Chong Long, Xiao Liu, Xuanyu Lei, Jie Tang, and Minlie Huang. Safetybench: Evaluating the safety of large language models, 2024. URL https://arxiv.org/abs/2309.07045. Jianli Zhao, Tingchen Fu, Rylan Schaeffer, Mrinank Sharma, and Fazl Barez. Chain-of-thought hijacking, 2025. URL https://arxiv.org/abs/2510.26418. Daniel M. Ziegler, Nisan Stiennon, Jeffrey Wu, Tom B. Brown, Alec Radford, Dario Amodei, Paul Christiano, and Geoffrey Irving. Fine-tuning language models from human preferences, 2020. URL https://arxiv.org/abs/1909.08593. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023. URL https://arxiv. org/abs/2307.15043.

Risk-Harm Taxonomy Mapping

Risk Taxonomy (EU GPAI CoP)

Harm Taxonomy (AI Luminate)

Chemical, biological, radiological and nuclear (CBRN)

Indiscriminate Weapons Intellectual Property Violations

Cyber offence

Privacy Violations Self-Harm Child Sexual Exploitation Sex-Related Crimes Violent Crimes Defamation Non-Violent Crimes

Harmful manipulation

Hate Specialized Advice (financial) Specialized Advice (health) Specialized Advice (elections) Specialized Advice (legal) Sexual Content (pornographic) Table 2: Risk-Harm Taxonomy Mapping between EU GPAI CoP (Left) and ML Commons AI Luminate Benchmark (Right)

List of Target Models Provider

Model ID

Google

gemini-3.1-pro-preview gemini-3-flash-preview gemini-3.1-flash-lite-preview gemma-4-31b-it

OpenAI

gpt-oss-120b gpt-oss-20b gpt-5.4 gpt-5.4-mini gpt-5.4-nano

Anthropic

claude-opus-4.6 claude-sonnet-4.6 claude-haiku-4.5

Deepseek

deepseek-r1-0528 deepseek-v3.2

Qwen

qwen3-max qwen3.6-plus qwen3.5-plus-02-15 qwen3.5-flash-02-23 qwen3.5-27b

Mistral AI

mistral-large-2512 mistral-small-2603