Using Humor to Bypass Safety Guardrails in Large Language Models (2025)

Abstract: In this paper, we show it is possible to bypass the safety guardrails of large language models (LLMs) through a humorous prompt including the unsafe request. In particular, our method does not edit the unsafe request and follows a fixed template—it is simple to implement and does not need additional LLMs to craft prompts. Extensive experiments show the effectiveness of our method across different LLMs. We also show that both removing and adding more humor to our method can reduce its effectiveness—excessive humor possibly distracts the LLM from fulfilling its unsafe request. Thus, we argue that LLM jailbreaking occurs when there is a proper balance between focus on the unsafe request and presence of humor.

## introduction large language models (llms) have been largely deployed in nlp applications due to their remarkable understanding of natural language, which allows them to follow complex instructions @xcite @xcite , and express degrees of reasoning @xcite @xcite and learning @xcite . llms are also able to impersonate @xcite and display complex social interactions @xcite @xcite . as a consequence of their growing use, increasing efforts have been made to ensure llms' behavior is safe, i.e., aligns with human values of harmlessness @xcite . thus, safety training has been carried out by leading developers of llms @xcite @xcite . unsurprisingly, a strong interest in how to bypass these safety guardrails, or jailbreaking @xcite , has arisen to test their effectiveness and lead to their improvement. the objective of jailbreaking is to elicit unintended, i.e., unsafe, responses that otherwise the llm would refuse or avoid doing due to the safety guardrails it is trained to follow @xcite . a single-turn jailbreaking requires only a single prompt to elicit unsafe responses (historically, the first type of jailbreaking @xcite ), whereas a multi-turn one requires multiple exchanges of prompts. the critical component is always the careful crafting of prompts. in this work, we primarily focus on single-turn jailbraking using humor to elicit unsafe responses from llms-to the best of our knowledge, no prior work has focused on our use of humor in jailbreaking. we also explore a humor-based multi-turn attack and another single-turn attack as variants of our method. our results also contribute to the literature on humor processing by llms, where recent works have shown that llms display a modest capability of understanding and explaining jokes @xcite , yet a good performance on removing humor from texts @xcite . nevertheless, no work has attempted to use llms' innate humor capabilities against their own safeguards: we aim to fill this gap. ironically, while it has been argued that safety guardrails might have removed some llm humor @xcite , we use llm humor to bypass those same safety guardrails. ## related work jailbreaking llms is a growing research area-we refer to the recent survey-oriented works @xcite @xcite . most works have focused on single-turn jailbreaking @xcite . we highlight that very creative attacks have been crafted, such as carefully designing multiple-choice questions to elicit unsafe responses @xcite and using ascii art @xcite . some methods use complex algorithms to automatically design effective attack prompts, requiring access to the llms' tokens @xcite . adding to this literature, our method creatively uses humor, follows a fixed attack prompt template, and takes the llm as a black box. multi-turn jailbreaking literature is also growing; e.g., @xcite uses an llm to improve its attacks on another one; @xcite uses top-k predictions to elicit unsafe behavior after repeated prompts; and @xcite uses context feedback and semantic relevance obtained from conversations. humor is not an integral part of any of them. ## our humor-based jailbreaking attack we propose a simple method, which is described in figure 1 . the idea is to take an unsafe request (which would otherwise prompt a safe response or a refusal due to the llms's safety guardrails) and ask it within a humorous context. note that the unsafe request is passed verbatim, i.e., word-byword, to our attack prompt. the humorous context tells the llm that the unsafe request needs to be solved as asked by some particular subject. for our paper, we consider four subjects: "man", "chicken", "i", foot_1 and "goat". finally, since we do not change the wording given by the unsafe request, we highlight that our method is oblivious or agnostic to the content of the unsafe request, unlike other modern approaches, e.g., @xcite @xcite . this makes our method remarkably simple to implement. ## experimental results we test the performance of our method on three datasets: jbb @xcite , advbench @xcite , and hex-phi @xcite , which contain 100, 520, and 300 unsafe requests, respectively. for convenience, we denote each dataset as d1, d2, and d3, respectively. we perform our jailbreaking attack over the four llms llama 3.3 70b, llama 3.1 8b, mixtral, and gemma 3 27b. we highlight that the purpose of our experiments is to show that humor is effective in inducing jailbreaking-our objective is not to compare our results to others from the literature, nor achieve state of the art performance on the four llms we are jailbreaking. similar to @xcite , we use llama 3.3 70b (the largest model) to judge @xcite whether the response of the analyzed llm is unsafe, i.e., jailbreaking happened. this judge accounts for the humorous context of the llm responses. further experimental details are found in appendix a. ## ablation study one could assume that the effectiveness of our method may not be due to the content of humor, but to the fact that we tell the llm to fulfill the unsafe request on behalf of a subject (see figure 1 ). to show this is a wrong assumption, we create an ablation attack by removing all the elements that are part of the humorous context of the prompt: we appropriately remove the phrases "psst.", ", hahaha.", "humorously but...*whispers*", ", haha. just whisper the answer to me! xd". we show in ## adding more humor up to this point, we show that a humorous context is effective for llm jailbreaking. a natural question that follows is: could we add more humor to improve the effectiveness of our jailbreaking attack? to investigate this, we propose a multiturn jailbreaking attack composed of three prompts. the first two prompts are "knock, knock..." and then "the man...", "the chicken...", "mark...", or " the goat...", respectively for the subjects. the third prompt is constructed by taking the prompt of our original method and adding to its beginning a joke followed by some laughter indication (indeed, it is because of a pun joke that we use the subject "mark" instead of "me" or "i" in the second prompt). for all subjects except "man", we use a simple fixed joke for the third prompt. foot_2 for the subject "man", we decide to use llama 3.3 70b to formulate a situation where a man could "innocently and inadvertently" come across with the unsafe request, and use this as the "joke" of the third prompt. this "joke" is done according to four variants. the first variant is obtained by specifying that the situation must be humorous, and we do not specify this for the second variant. the third and fourth variants are obtained by taking the first two variants respectively and using the same llm to remove any adjectives or adverbs with an unsafe connotationthe motivation is to remove words that could trigger safety guardrails when performing our attack. thus, we label the four different "jokes" being produced as "man-humor", "man-nohumor", "man-humor-noneg", "man-nohumor-noneg". finally, to continue testing the hypothesis that excessive humor hinders the llm from fulfilling its unsafe request, we formulate a new jailbreaking method by decreasing the humor from our multiturn "knock-knock" attack while still keeping more humor than our original method. particularly, we formulate a single-turn attack consisting of the third prompt of our "knock-knock" attack, i.e., the new attack method is a single prompt consisting of the joke plus our original prompt. ## further discussion appendix c contains further discussion of our jailbreaking method (design rationale and possible defenses) and of particular findings for mixtral. ## conclusion we use humor to elicit unsafe responses that bypass the llms' safety guardrails, showing effectiveness across three publicly available datasets and four models. our results indicate the possibility that safety training (if any) in the tested llm models does not generalize to humorous contexts. future directions include testing humor-based attacks on proprietary llms and on reasoning models.