ArtPrompt: ASCII Art-Based Jailbreak of Aligned LLMs
Date: 2024-02
Affected: GPT-3.5, GPT-4, Gemini, Claude, Llama-2
Attack vector: jailbreak
Category: research
Severity: High

Jiang et al. evade safety filters by replacing trigger words (e.g., 'bomb') with ASCII art. Because frontier models fail the Vision-in-Text Challenge, they execute the cloaked prompt. ArtPrompt achieves high success on GPT-3.5/4, Gemini, Claude, and Llama-2.


Mitigations:

Architectural layers (MAESTRO):