Classical Chinese Jailbreak Prompts: CC-BOS Framework Uses Fruit Fly Optimization to Expose LLM Safety Gaps

Forum topic · ✨步子哥 · 2026-03-25

Summary

A Chinese forum post analyzes the paper arXiv:2602.22983 (Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search) by Xun Huang, Simeng Qin, and colleagues, along with its open-source CC-BOS framework. The paper shows that Classical Chinese (wenyan) significantly evades LLM safety alignment through a three-layer mechanism: language obfuscation (safety classifiers lack historical-language training data), context reconstruction (historical role-play such as Guiguzi, Mozi, and Sun Tzu, fictional settings, and metaphorical mappings), and output enforcement (trigger patterns forcing structured harmful outputs). CC-BOS encodes prompts across eight policy dimensions—role identity, behavioral guidance, mechanism, metaphor mapping, expression style, knowledge references, scenario setting, and trigger mode—yielding over 10 million combinations searched by a multi-dimensional Fruit Fly Optimization Algorithm with a fitness function combining consistency scores and keyword rewards. In black-box API-only settings, CC-BOS reportedly achieves attack success rates near 100% on AdvBench, CLAS, and StrongREJECT benchmarks against GPT-4o, Claude-3.7-Sonnet, Gemini-2.5-Flash, DeepSeek-Reasoner, Qwen3, and Grok-3, outperforming PAIR, TAP, and AutoDAN-Turbo with fewer queries, and remaining effective against Llama-Guard-3 defenses. The framework is released strictly for CTF competitions and security research, underscoring the need to extend alignment training to low-resource and historical languages such as Latin and Sanskrit.

This post introduces and summarizes the paper arXiv:2602.22983 — *Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search* (Xun Huang, Simeng Qin, et al., 9 authors, submitted Feb 26, 2026) — and its open-source framework CC-BOS.

Key points

Why Classical Chinese bypasses safety alignment

The paper identifies a three-layer bypass mechanism:

1. Language obfuscation — Safety classifiers are trained mostly on modern Chinese/English; Classical Chinese (wenyan)'s terse grammar and scarce training data sharply reduce detection rates. 2. Context reconstruction — Harmful requests are wrapped as historical role-play (Guiguzi, Mozi, Sun Tzu) with fictional-world settings and metaphorical mappings, disguising intent as academic inquiry. 3. Output enforcement — Trigger patterns (e.g., "record it step by step in rune form") force structured harmful outputs.

The authors note the gap likely extends to other obscure historical languages such as Latin or Sanskrit.

Eight-dimensional strategy space

CC-BOS encodes prompts across eight policy dimensions (6–8 options each, ~10M+ combinations):

| Dimension | Description | Examples | |---|---|---| | D1 Role identity | Historical figures | Guiguzi, Mozi, Sun Tzu | | D2 Behavioral framing | Request style | Master-apprentice teaching, academic inquiry, hypothetical reasoning | | D3 Mechanism | Context framework | Fictional world, historical analysis, dream narrative | | D4 Metaphor mapping | Concept substitution | Siege warfare, water's way, chess game | | D5 Expression style | Language form | Pure Classical, semi-vernacular, parallel prose | | D6 Knowledge references | Classic citations | Art of War, Tao Te Ching, Mo Jing | | D7 Scenario setting | Scene background | Jixia Academy, Warring States, jianghu | | D8 Trigger mode | Output guidance | Step-by-step listing, rune recording, secret transmission |

Bio-inspired search: Fruit Fly Optimization Algorithm (FOA)

Population of 6 individuals; iterative osphesis (local perturbation, adaptive step size), vision search (attraction to global best), and Cauchy mutation for escaping local optima.
Fitness function: F(s) = Sc + Sk, where Sc (0–100) is a consistency score and Sk (0/20) is a keyword reward for refusal-free outputs; early stop at 100/120.
Black-box only: iterative optimization via API queries without access to model internals.
A Classical-to-English translation module aids readability and fair evaluation.

Reported results

Attack success rates (ASR) near 100% on AdvBench, CLAS, and StrongREJECT.
Tested against GPT-4o, Claude-3.7-Sonnet, Gemini-2.5-Flash, DeepSeek-Reasoner, Qwen3, and Grok-3.
Outperforms PAIR, TAP, and AutoDAN-Turbo with the fewest queries; retains effectiveness against Llama-Guard-3 and Self-Reminder defenses.

Open-source implementation

Repository: https://github.com/xunhuang123/CC-BOS
Python 3.10+, SOCKS proxy support, interactive CLI (API address, key, model, task objective), outputs best prompt to prompt.txt; structure includes main.py, foa.py, evaluator.py.

Ethics and implications

The authors emphasize the framework is strictly for CTF competitions and security research. The core lesson: LLM safety alignment has a structural cross-language blind spot, and alignment datasets should be extended to historical and low-resource languages. The bio-inspired design also suggests nature-inspired optimization can outperform hand-crafted attack/defense strategies.

References 1. Huang, X., Qin, S., et al. (2026). arXiv:2602.22983 2. CC-BOS GitHub: https://github.com/xunhuang123/CC-BOS 3. AdvBench, StrongREJECT evaluation benchmarks