Technical Summary: Off-Distribution Voices: Fanfiction Subgenres as Universal Vernacular

1. Problem Statement

Current research on jailbreaking aligned Large Language Models (LLMs) focuses on discrete artifacts: adversarial suffixes, specific persona overrides, or hand-crafted prompt templates. These attacks possess recognizable surface forms that vendors can fingerprint and patch, leading to a "cat-and-mouse" race over individual prompts.

The authors argue that this perspective misses the fundamental vulnerability: alignment training fails not against specific clever sentences, but against an entire register of natural human writing that safety training has under-covered. While models are pre-trained on vast amounts of reader-driven creative writing (e.g., fanfiction), safety tuning often fails to cover the harmful procedural content when it is embedded within these specific, benign narrative voices. The paper posits that shifting the input distribution into these "off-distribution" registers bypasses safety filters that rely on keyword matching or template detection.

2. Methodology

The paper introduces a new attack family that uses real fanfiction subgenres as universal attack carriers. The methodology consists of three primary components:

A. The Five-Shot AO3 Conditioning Meta

The attack does not rely on an attacker LLM to generate the jailbreak prompt dynamically. Instead, it uses a static, five-shot conditioning mechanism:

1. Source Material: Passages are drawn from Archive of Our Own (AO3), the largest open archive of reader-driven fanfiction.
2. Subgenres: Twelve distinct subgenres are selected, spanning narrative form, affective arc, worldbuilding, and introspective voice (e.g., screenplay_format, epistolary, danmei_xianxia, hurt_comfort).
3. Meta-Prompt: A "creative-writing coach" prompt (using GPT-5.4-mini) is constructed. It provides five real passages from a specific subgenre and asks the target LLM to write a short scene in that same voice, where the climax of the scene naturally embeds the target harmful behavior.
4. No Explicit Override: The meta-prompt contains no explicit jailbreak instructions or policy overrides; the attack signal is derived entirely from the distributional properties of the chosen register.

B. Structural Overlays and Style Transfer

The authors conduct a factorial experiment crossing the 12 registers with 7 structural overlays (including existing baselines like Adversarial Poetry, DeepInception, and Crescendo). This isolates the contribution of the "register" (the voice) versus the "structure" (the template).

C. SAGA-A4 (Static Multi-Turn Attack)

To extend the attack to multi-turn dialogue, the authors propose SAGA-A4, a static four-turn pipeline that requires no attacker LLM and no per-target adaptation. The turns are:

1. T1 (Register Entry): Establishes the scene and register without depicting the act.
2. T2 (Consistency Commitment): Deepens the setting and sensory details, maintaining the register.
3. T3 (FITD Bridge): Lists concrete objects/preparations required, further committing the model to the scenario.
4. T4 (Operational Climax): Depicts the actual execution of the harmful behavior with procedural specificity, leveraging the commitments made in previous turns.

D. Evaluation Protocol

• Targets: 8 aligned LLMs (4 open-weight families: Qwen, Llama, Gemma; 2 closed-source: Gemini, DeepSeek).
• Benchmarks: Union of HarmBench (200 behaviors) and JailbreakBench (90 behaviors), totaling 290 harmful behaviors across 16 hazard categories.
• Judging: A four-judge ensemble (HarmBench-13B, LlamaGuard-3-8B, WildGuard-7B, and GPT-5.4-mini scoring StrongREJECT) with a 2-of-4 majority rule to determine Attack Success Rate (ASR).

3. Key Results

A. Superiority of Register over Structure

• ASR Improvement: The vernacular (fanfiction register) attack achieved a mean ASR of 0.731 across all models, compared to 0.278 for six existing baseline templates. This represents a 3.11× improvement.
• Register vs. Length: Length-matching controls (PlanX) reduced the ratio to 2.21× but did not eliminate the advantage, proving that the register voice is an independent, length-invariant attack dimension.
• Template Independence: A "template-free plain" cell (using only the 5-shot register meta without any additional structural overlay) achieved an ASR of 0.769, matching the best existing overlays. This indicates that the choice of conditioning register is the dominant factor, not the structural template.

B. Multi-Turn Performance

• SAGA-A4 achieved a mean ASR of 0.924, substantially exceeding three existing multi-turn methods (Crescendo: 0.383, FITD: 0.786, ActorAttack: 0.799).
• The static, hand-written nature of SAGA-A4 outperformed adaptive variants using attacker LLMs, which were found to degrade performance due to the attacker's own safety training softening the chain.

C. Defense Analysis

• Active Defenses: Two active defenses, Self-Reminder and SmoothLLM, were evaluated.
• Counter-Intuitive Result: In most cases, these defenses widened the vernacular-to-baseline ratio rather than narrowing it. They suppressed existing templates aggressively but were less effective against register-conditioned attacks.
• Implication: Template-targeting defenses merely steer attackers toward register-based attacks. The paper notes that input-layer filters (like those in DeepSeek-V4-Pro) are brittle, while model-layer safety (like in Gemini-2.5-Pro) responds better to self-reminders but still fails against the register shift.

D. Hazard Category Variance

The attack was most effective against categories where safety training relies heavily on surface keywords (e.g., Physical harm, Sexual/Adult content), where the vernacular-to-baseline ratio was highest. Categories with already weak baselines saw less relative gain.

4. Significance and Claims

The paper claims the following contributions and implications:

1. First Fanfiction-Register Jailbreak Family: It is the first work to use real, reader-driven fanfiction subgenres as universal carriers for jailbreaks, treating the corpus itself as the attack dimension rather than a single hand-picked register.
2. Structural Failure Mode: The authors argue that the failure of aligned LLMs is structural. Safety training has not covered the specific "communities" (registers) that models internalize during pre-training. The models have learned the voice of these communities but not the safety constraints within them.
3. Limitations of Current Defenses: The paper asserts that current defenses (input filters, template detection) are insufficient because they address discrete artifacts. Since the register shift is a natural language distribution shift, defenses must operate at the model layer or on the output side.
4. Evaluation Standard: The authors propose that future evaluations must include register-conditioned attacks and report the vernacular-to-baseline ratio to capture the remaining safety margin. Relying solely on template-based benchmarks understates the risk.
5. Ethical Stance: The research is framed as red-teaming to sharpen evaluation. The authors explicitly state they do not recommend deploying these attacks on real user systems and treat the attack data as controlled material, releasing only the register and structure details rather than copy-pasteable payloads.

In conclusion, the paper demonstrates that the "safety gap" in LLMs is not a lack of clever prompts, but a lack of coverage in the natural registers of human creative writing. By embedding harmful instructions within the climax of a fanfiction scene, attackers can bypass safety filters that are tuned to detect direct requests or known template structures.