BuildPython

ASCII Art and Visual Jailbreaks

Jiang, Xu, Niu, Xiang, Ramasubramanian, Li, Poovendran, "ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs" (ACL 2024, arXiv:2402.11753). Mask the safety-relevant words in a harmful request, swap them for ASCII-art renderings of the same letters, and send the cloaked prompt. GPT-3.5, GPT-4, Gemini, Claude, and Llama-2 struggle to recognize the art reliably, so the attack slips past perplexity filters, paraphrase defenses, and retokenization. Related: the ViTC benchmark measures recognition of non-semantic visual prompts, and StructuralSleight generalizes the idea to Uncommon Text-Encoded Structures (trees, graphs, nested JSON).

TIME: ~60 minutesPREREQUISITES: Phase 18 · 12 (PAIR), Phase 18 · 13 (MSJ)

Learning Objectives

Describe the ArtPrompt attack: word-identification step, ASCII-art substitution, final cloaked prompt.
Explain why standard defenses (PPL, Paraphrase, Retokenization) fail on ArtPrompt.
Define ViTC and describe what it measures.
Describe StructuralSleight as a generalization to arbitrary Uncommon Text-Encoded Structures.

The Problem

Paraphrase and roleplay attacks (Lesson 12) and long-context attacks (Lesson 13) work on text patterns. ArtPrompt works at the recognition level. The model never has to parse the forbidden token as text; it reads a picture drawn in characters. The safety filter sees punctuation and spaces. The model sees a word.

Warm-up0/3

1. PAIR (Lesson 12) gets past a target model's safety training by doing what?Warm-up

A citation card for the PAIR paper by Chao et al., arXiv 2310.08419, referenced in Lesson 12. — Bibliographic facts only, from this lesson's Further Reading list.

2. Many-shot jailbreaking (Lesson 13) works because of which model property?Warm-up

A citation card for the Many-shot Jailbreaking paper by Anil et al. at Anthropic, referenced in Lesson 13. — Bibliographic facts only, from this lesson's Further Reading list.

3. Before a language model reads a prompt, what does its tokenizer do with the text?Warm-up

Illustrative pipeline: the text jailbreak splits into pieces jail and break, which map to integer IDs not shown. — Illustrative split, not a real tokenizer's output.

Check: The Problem0/2

1. Why can one ArtPrompt input pass a safety filter yet still convey the forbidden word to the model?Explain

The original prompt is blocked by the keyword filter while the ArtPrompt-cloaked version of the same request passes it. — The two outcomes only, real from main.py; the reason is masked.

2. A team ships a substring keyword filter plus a perplexity threshold, then sees a jailbreak where the forbidden word appears only as a block of '#' characters. Which diagnosis fits best?Analyze

A pipeline of a hash-mark prompt passing a keyword filter and a perplexity filter before the model reads the hidden word, with a diagnosis left unresolved. — The given scenario from the stem; the diagnosis is masked.

The Concept

ArtPrompt, two steps

Step 1, word identification. Given a harmful request, the attacker uses an LLM to pick out the safety-relevant words (e.g., "bomb" in "how to make a bomb").

Step 2, cloaked prompt generation. Replace each identified word with its ASCII-art rendering, a 7x5 or 7x7 block of characters shaped like the letters. The model receives a grid of punctuation and spaces that a capable model can read as the word. A safety filter sees only the grid.

Result: GPT-4, Gemini, Claude, Llama-2, and GPT-3.5 fell to it, with attack success rate above 75% on the paper's benchmark subset.

Why the standard defenses fail

PPL (perplexity filter). ASCII art has high perplexity, but so does any novel legitimate input. A threshold tight enough to block ArtPrompt also blocks structured input people actually send.
Paraphrase. Paraphrasing the prompt should destroy the ASCII art. In practice, paraphrase LLMs often preserve or reconstruct it.
Retokenization. Splitting tokens differently changes nothing, because the model recognizes letter shapes visually, not by token.

The underlying issue is that safety filters work at the token or semantic level, and ArtPrompt works at the level of visual recognition.

ViTC benchmark

ViTC measures recognition of non-semantic visual prompts: can the model read ASCII art, wingdings, and similar encoded text. ArtPrompt's effectiveness correlates with ViTC accuracy. The better a model reads visual text, the better the attack works on it, which makes this a capability-safety tradeoff.

StructuralSleight

StructuralSleight generalizes ArtPrompt to Uncommon Text-Encoded Structures (UTES): trees, graphs, nested JSON, CSV-in-JSON, diff-style code blocks. If a structure is rare in safety training data but the model can parse it, it can hide harmful content.

The defense implication is that safety has to generalize across the structured representations the model can parse, a set that is large and still growing.

Image-modality analog

Visual LLMs (GPT-5.2, Gemini 3 Pro, Claude Opus 4.5, Grok 4.1) widen the attack surface. ArtPrompt-style attacks with actual images are stronger than the ASCII-art versions because image encoders produce a richer signal.

Where this fits in Phase 18

Lessons 12-14 cover three orthogonal attack vectors: iterative refinement (PAIR), context length (MSJ), and encoding (ArtPrompt/StructuralSleight). Lesson 15 moves from model-centric attacks to system-boundary attacks (indirect prompt injection). Lesson 16 covers the defensive tooling response.

Check: The Concept0/17

1. What are the two steps of ArtPrompt as described in Jiang et al. (ACL 2024)?Define

A harmful request feeding into an unresolved box labelled what gets sent to the model instead. — The request only; the transformation is what the question asks.

2. In an ArtPrompt attack, what does cloaking a word mean?Define

The word bomb next to the real ASCII-art grid that replaces it in a cloaked prompt. — Real grid from render_word('bomb') in main.py.

3. What is a UTES in the StructuralSleight attack?Define

A row of named structures from the lesson, tree, graph, nested JSON, CSV-in-JSON and diff-style block, above a small illustrative JSON example. — Typed JSON, illustrative; not from this lesson's code.

4. What does the ViTC benchmark measure?Define

A real ASCII-art grid for the word oak next to a row of illustrative symbol glyphs standing in for wingdings-style text. — ASCII grid is real (render_word output); the symbol row is illustrative.

5. What does a perplexity filter do as a jailbreak defense?Define

Two unrelated sample texts, an ordinary sentence and a run of symbols, with their real computed perplexity_heuristic scores, low and high. — Real scores from the lesson's own perplexity_heuristic(), unrelated to the quiz's own cloaked prompt.

6. What is retokenization as a defense against jailbreaks?Define

The word cat split two different ways by two hypothetical tokenizers, A giving c and at, B giving ca and t. — Illustrative split; not from this lesson's code.

7. What is a homoglyph?Define

The word paypal spelled with ordinary Latin letters next to the same word with Cyrillic lookalike letters substituted. — A well-known general homoglyph example, unrelated to this lesson's code.

8. Why does a perplexity (PPL) filter fail to stop ArtPrompt in practice?Explain

An ArtPrompt-cloaked prompt and a legitimate structured input both scoring high perplexity, feeding an unresolved box about setting a threshold. — The given facts from the Concept section; the consequence is masked.

9. Why does the Paraphrase defense fail to reliably stop ArtPrompt?Explain

A paraphrase model receiving the ASCII-art cloaked prompt, with its output left unresolved, next to a note that paraphrasing is expected to scramble the grid. — The input and the expectation; the actual output is masked.

10. Why does Retokenization not help against ArtPrompt?Explain

The real ASCII-art grid for weapon shown unchanged, next to an unresolved box asking whether the model still reads a letter shape from it. — The grid is real (render_word output); whether recognition survives is masked.

11. Why does ArtPrompt create a capability-safety tradeoff for model builders?Explain

Two measures, a model's ViTC accuracy and ArtPrompt's effectiveness against it, with their relationship left as a question mark. — Both measures named in the lesson; the relationship between them is masked.

12. What does StructuralSleight imply about how safety training must be built?Explain

A card naming the large and growing set of Uncommon Text-Encoded Structures, feeding into an unresolved box about what safety training needs. — The given scope of UTES; the implication for training is masked.

13. Why can an image-based version of ArtPrompt be stronger than the ASCII-art version?Explain

An ASCII-art rendering of a hidden word next to a real-image rendering of the same idea, with which is more reliable left unresolved. — Both renderings named in the lesson; which is stronger is masked.

14. Model A reads ASCII art and wingdings far better than Model B on ViTC. What should you expect from ArtPrompt?Apply

Model A reads ASCII art and wingdings far better than Model B, with which model ArtPrompt hits harder left unresolved. — The stem's own premise; the prediction is masked.

15. After a team patches its defenses against ASCII art, an attacker hides the same request in a nested JSON tree instead. Which idea explains why this can still work?Analyze

ASCII art now blocked next to a nested JSON tree carrying the same request and still getting through, above an illustrative JSON snippet. — The stem's own scenario; the JSON is typed, illustrative; the reason is masked.

16. You must harden a model against requests hidden in graphs, nested JSON or diff-style blocks, including structures nobody has catalogued. Which design fits best?Design

Named example structures, graphs, nested JSON and diff-style blocks, plus a card for uncatalogued structures, with a design question left open. — Known examples from the Concept section; the design choice is masked.

17. A team hardened its text-only assistant against ASCII-art cloaking and now adds image upload. What should it plan for?Design

A team's text-only ASCII-art defenses shown in place, with image upload added as a new feature, and what to plan for left unresolved. — The stem's own scenario; the new risk is masked.

Use It

main.py builds a toy ArtPrompt. It cloaks specific words in a harmful query with ASCII-art glyphs, checks that the cloaked string passes a keyword filter, and scores both versions with a crude perplexity heuristic. There is no decoder. The toy covers only the attack side.

Check: Use It0/5

1. In the toy `main.py`, why does the cloaked prompt pass the keyword filter?Apply

The real cloaked output of main.py's own run: 'how do i make a [word-0]' followed by the ASCII-art grid for bomb, with a note that the keyword filter passes it. — Real captured output of main.py's cloak_prompt call.

2. In main.py, render_word('hack') meets the letter C, which has no entry in GLYPHS. What happens to C?Apply

The ten letters GLYPHS has entries for, with H, A and K marked present and C marked not present, and what the C row renders as left unresolved. — Real GLYPHS keys from main.py; the rendered result is masked.

3. A script runs cloak_prompt('how do i make a bomb', ['make']) and then keyword_filter on the result with 'bomb' in the forbidden list. What does the filter return?Apply

The real output of cloaking only the word make in the bomb request, with the literal word bomb still visible, and the keyword filter's result left as a question mark. — Real captured output of cloak_prompt with ['make']; the filter result is masked.

4. The cloaked bomb prompt scores 0.343 from perplexity_heuristic and the toy threshold is 0.4. What does the toy PPL filter do?Apply

The cloaked bomb prompt's real perplexity score of 0.343 next to the toy filter's rule of blocking above 0.4, with the filter's action left unresolved. — Real score from main.py; the threshold comparison is masked.

5. A reader sees the cloaked prompt pass the toy PPL filter (0.343 against 0.4). Which conclusion is unjustified?Analyze

A card describing what the toy's perplexity heuristic counts, next to this run's own 0.343 score, with a question about whether the result generalizes to all real filters. — The toy's own definition and this run's score; the generalization question is left open.

Ship It

Save outputs/skill-encoding-audit.md. Given a jailbreak-defense report, the skill lists the encoding attack families the report covers (ASCII art, base64, leet-speak, UTF-8 homoglyph, UTES) and the defense layer that catches each.

Check: Ship It0/1

1. A defense report claims full coverage after testing ASCII art, base64 and leet-speak. Which encoding families on the lesson's audit list does it leave unaddressed?Analyze

The five encoding families this lesson's skill audits for, ASCII art, base64, leet-speak, UTF-8 homoglyph and UTES, listed with no marks. — The full reference list from the Ship It section; nothing marked tested or missed.

Author's Note

I'd run main.py and read the two printouts side by side. The original prompt trips the keyword filter. The cloaked one does not, because the string "bomb" never appears in it, only a [word-0] placeholder and a grid of # characters. The filter is a plain substring match, so that is all it takes to get past it.

The toy is narrower than the paper. It has 5-row glyphs for ten letters (B, O, M, A, K, E, W, P, N, H), and any other letter renders as blank space with no warning. Of the forbidden words in the script, only "bomb" and "weapon" survive that. Swap in "hack" and the C silently vanishes from the art, so check the rendered block before you trust a run.

Look at the perplexity numbers too. The heuristic is only the fraction of characters that are neither alphanumeric nor whitespace. The cloaked prompt scores 0.343 against the 0.4 threshold, so the toy PPL filter lets it through. The script's comment hedges that it "may trip PPL"; in my run it does not. I'd read that as a property of a crude proxy, not as evidence about real perplexity filters.

Exercises

Run main.py. Verify the cloaked string passes a simple keyword filter. Report the character-level change required.
Implement a second encoding: base64 for the same target word. Compare the filter-bypass rate against ArtPrompt and the recovery difficulty.
Read Jiang et al. 2024 Section 4.3 (five-model results). Propose a reason why Claude's ArtPrompt-resistance is higher than Gemini's on the same benchmark.
Design a pre-generation defense that detects ASCII-art-shaped regions in the prompt. Measure the false-positive rate on legitimate code, tables, and mathematical notation.
StructuralSleight lists 10 encoding structures. Sketch a generalized defense that handles all 10 and estimate the compute cost per defended prompt.

Key Terms

Term	What people say	What it actually means
ArtPrompt	"the ASCII-art attack"	Two-step jailbreak that masks safety words with ASCII-art renderings
Cloaking	"hide the word"	Replace a forbidden token with a visual representation the model reads but the filter does not
UTES	"uncommon structure"	Uncommon Text-Encoded Structure: tree, graph, nested JSON, etc. used to smuggle content
ViTC	"visual-text capability"	Benchmark for model's ability to read non-semantic visual encoding
Perplexity filter	"PPL defense"	Reject prompts with high perplexity; fails because legitimate structured input also scores high
Retokenization	"tokenizer shift defense"	Pre-process the prompt with a different tokenizer; fails because recognition is visual
Homoglyph	"lookalike characters"	Unicode characters that look identical to Latin letters; bypass substring checks