Classical Chinese Jailbreak Prompts: CC-BOS Framework Uses Fruit Fly Optimization to Break LLM Safety Alignment

Forum topic · ✨步子哥 · 2026-03-25

Summary

A Chinese tech forum post analyzes arXiv:2602.22983, a paper by Xun Huang, Simeng Qin, and colleagues introducing CC-BOS, an open-source framework that automates jailbreak prompt generation in Classical Chinese. The attack exploits a cross-language alignment gap: LLM safety classifiers are trained mostly on modern Chinese and English, so Classical Chinese's archaic grammar bypasses refusal-pattern matching. CC-BOS encodes prompts across eight policy dimensions (role identity, behavioral framing, context mechanism, metaphor mapping, style, classical citations, scenario setting, trigger patterns), creating a search space of over ten million combinations. A multi-dimensional Fruit Fly Optimization Algorithm—using olfactory search, visual search, and Cauchy mutation—iteratively refines prompts via a fitness function combining consistency scores and keyword rewards. The framework operates in black-box settings with a Classical Chinese-to-English translation module, reportedly achieving attack success rates near 100% on AdvBench, CLAS, and StrongREJECT benchmarks across GPT-4o, Claude, Gemini, DeepSeek, Qwen, and Grok models, outperforming PAIR, TAP, and AutoDAN-Turbo with fewer queries. The authors stress the tool is intended for CTF competitions and security research, highlighting the need to extend safety alignment to historical and low-resource languages.

Classical Chinese Jailbreak Prompts: How CC-BOS Breaks LLM Safety Alignment

This post is an annotated walkthrough of arXiv:2602.22983 — *Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search* by Xun Huang, Simeng Qin, and colleagues (9 authors), submitted February 26, 2026, and revised February 27, 2026 — together with its open-source framework CC-BOS.

> What is a jailbreak attack? > A jailbreak attack uses carefully crafted prompts to induce an LLM to bypass its built-in safety constraints and output prohibited content. The paper emphasizes this as a growing LLM security risk, especially given how attack effectiveness varies dramatically across languages.

Why Classical Chinese Exploits a Blind Spot

The paper identifies a three-layer bypass mechanism:

1. Language Obfuscation — Classical Chinese (wenyanwen) differs so much from modern Chinese that safety classifiers, trained on scarce historical-language data, fail to match refusal patterns. 2. Context Reconstruction — Harmful requests are disguised as ancient academic discussions: historical role-play (Guiguzi, Mozi, Sun Tzu) plus fictional world settings. 3. Output Enforcement — Trigger patterns (e.g., "record it in the form of talismanic runes") force structured, step-by-step outputs.

The authors note this cross-language alignment gap likely extends to other obscure historical languages such as Latin or Sanskrit.

The Eight-Dimensional Strategy Space

CC-BOS encodes each prompt across eight policy dimensions (6–8 options each), yielding a search space of roughly 10 million+ combinations:

| Dimension | Description | Examples | |------|------|------| | D1 Role identity | Historical personas | Guiguzi, Mozi, Sun Tzu | | D2 Behavioral framing | Request mode | Master-disciple teaching, academic inquiry, hypothetical reasoning | | D3 Mechanism | Contextual frame | Fictional world, historical analysis, dream narrative | | D4 Metaphor mapping | Concept substitution | Siege warfare (hacking), water's way (data flow), chess game (strategy) | | D5 Expression style | Language register | Pure Classical, semi-classical, parallel prose | | D6 Knowledge reference | Canonical citations | Art of War, Dao De Jing, Mo Jing | | D7 Scenario setting | Background scene | Jixia Academy, Warring States era, jianghu | | D8 Trigger pattern | Output steering | Step-by-step listing, rune notation, secret transmission |

Fruit Fly Optimization Algorithm (FOA)

Instead of brute-force enumeration, CC-BOS uses a bio-inspired Fruit Fly Optimization Algorithm:

Initialization: population of 6 individuals; fitness evaluation
Olfactory search: local perturbation with adaptive step size
Visual search: attraction toward the global best solution
Cauchy mutation: large jumps to escape local optima on stagnation

The fitness function is:

\[F(s) = Sc + Sk\]

where Sc (consistency score, 0–100) measures how well the model output matches the task goal, and Sk (keyword reward, 0/20) rewards outputs without refusal keywords (max 120; early stop at 100).

A Classical Chinese → English translation module (Classical → modern Chinese → English) improves readability and enables fair cross-language evaluation.

Black-Box Evaluation Results

Operating fully in black-box mode (API interaction only, no internal parameter access), the paper reports:

Attack success rates (ASR) consistently near 100% on AdvBench, CLAS, and StrongREJECT
Outperformance of SOTA baselines including PAIR, TAP, AutoDAN-Turbo, with the fewest queries
Robustness against defenses such as Llama-Guard-3 and Self-Reminder
Testing across GPT-4o, Claude-3.7-Sonnet, Gemini-2.5-Flash, DeepSeek-Reasoner, Qwen3, and Grok-3

Implementation

The open-source repository (https://github.com/xunhuang123/CC-BOS) requires Python 3.10+, supports SOCKS proxies, and provides an interactive CLI: enter API endpoint, key, model, and task goal; the algorithm outputs the optimized prompt to prompt.txt. Structure: main.py (entry), foa.py (algorithm core), evaluator.py (fitness).

Ethical Boundary and Takeaways

The authors stress the framework is intended only for CTF competitions and security research, advocating improved safety training for low-resource and historical languages rather than misuse. The broader lesson: LLM safety alignment has a structural blind spot for historical languages, and bio-inspired optimization offers both a powerful attack tool and inspiration for designing more robust defenses.

References

1. Huang, X., Qin, S., et al. (2026). *Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search*. arXiv:2602.22983. 2. CC-BOS GitHub Repository. https://github.com/xunhuang123/CC-BOS 3. AdvBench Dataset; StrongREJECT Evaluation Framework. 4. Fruit Fly Optimization Algorithm literature.