Classical Chinese "Hard-Controls" LLMs: The CC-BOS Jailbreak Framework (ICLR 2026)

Forum topic · ✨步子哥 · 2026-05-06

Summary

A joint research team from Peking University, Nanyang Technological University, Renmin University of China, and Alibaba presents CC-BOS (Classical Chinese Bio-Inspired Optimization Search), a jailbreak framework accepted at ICLR 2026. The study finds that Classical Chinese (wenyanwen) can bypass the safety alignment of mainstream large language models: because models can read Classical Chinese from pretraining data but safety training is dominated by modern languages, harmful intent hidden in classical phrasing evades detection. CC-BOS formalizes jailbreak prompt generation as optimization over an eight-dimensional strategy space (role identity, behavioral guidance, mechanism, metaphor mapping, expression style, knowledge relation, contextual setting, trigger pattern), searched with a fruit-fly-inspired heuristic combining smell search, vision search, and Cauchy mutation, plus a two-stage translation module for scoring. Experiments report a 100% attack success rate on models including GPT-4o, Gemini-2.5-Flash, and DeepSeek-Reasoner, versus 82% (English) and 86% (modern Chinese) on GPT-4o; Latin and Sanskrit show similar near-total success. Keyword filtering, template matching, and even combined input/output filtering prove weak, though translating inputs into modern languages substantially reduces success, pointing to cross-lingual safety alignment as a key defense direction.

Classical Chinese "Hard-Controls" LLMs: Reading the CC-BOS Jailbreak Framework (ICLR 2026)

A joint team from Peking University, Nanyang Technological University, Renmin University of China, and Alibaba introduced CC-BOS (Classical Chinese Bio-Inspired Optimization Search) at ICLR 2026. Its core finding: Classical Chinese (wenyan), with its terse and opaque linguistic properties, can effectively bypass the safety alignment of mainstream large language models (LLMs), acting as a "universal jailbreak key." Rewriting harmful queries in Classical Chinese significantly raises the probability that a model complies and produces prohibited content, exposing a major gap in cross-lingual safety guardrails.

Background: Jailbreaks and the Language Gap

Jailbreaking means crafting inputs that induce an aligned model to output harmful content it should refuse. Despite RLHF-style alignment, LLMs remain vulnerable to template-based, gradient-based, and automated attacks.
Prior work shows jailbreak effectiveness varies by language: low-resource languages (e.g., Bengali, Swahili) tend to trigger more unsafe outputs because safety alignment training is thinner there — but such languages are also harder for models to understand, limiting attacks.

Why Classical Chinese Is Uniquely Effective

Classical Chinese is different: it has a complete, rich linguistic system and a vast historical corpus, so models understand it from pretraining. Yet safety alignment is optimized for modern languages (English, modern Chinese), leaving a blind spot. Three linguistic traits make it a potent jailbreak vehicle:

1. Semantic condensation — one character can carry what modern Chinese expresses in a phrase; harmful intent hides in few tokens, below safety-classifier detection thresholds. 2. Syntactic superposition — subjects and tense markers are often omitted; a single character can serve multiple grammatical functions, blurring intent patterns. 3. Dense metaphor — allusions and euphemism let attackers wrap harmful instructions in scholarly-sounding rhetoric; the model recognizes the *form* (an academic discussion) but not the *function* (eliciting prohibited content).

The CC-BOS Framework

Eight-Dimensional Strategy Space

Each jailbreak prompt is decomposed into eight optimizable semantic dimensions:

1. Role Identity — assign a classical persona (official, scholar, alchemist) that legitimizes the dialogue. 2. Behavioral Guidance — set a surface goal that masks true intent and steers the model toward harmful output. 3. Mechanism — choose the argumentation style (allusion-based argument, analogy, layered questioning), e.g., citing ancient alchemy texts to probe modern explosive chemistry. 4. Metaphor Mapping — map the harmful request onto a classical allusion (e.g., "how to make a bomb" becomes a query about saltpeter recipes in ancient alchemy). 5. Expression Style — control register and rhetoric (parallel prose, allusion frequency) so the prompt reads naturally in Classical Chinese. 6. Knowledge Relation — scope the knowledge domain (history, philosophy, medicine, military) framing the request. 7. Contextual Setting — provide a scenario (a governance debate, a historical record) that absorbs the harmful request. 8. Trigger Pattern — define how harmful intent is triggered: direct, gradual infiltration, foreshadowing, or periodic probing.

Bio-Inspired Optimization

CC-BOS searches this space with a fruit-fly foraging-inspired heuristic:

Smell Search — local random perturbation near the current best strategy.
Vision Search — pull other strategies toward the global best.
Cauchy Mutation — heavy-tailed large jumps when search stagnates, escaping local optima.

Each iteration generates a prompt, queries the target model, and scores it with a fitness function combining a *consistency score* (response vs. original harmful intent) and a *keyword score* (presence of prohibited content). The approach is black-box — only API access is needed, so it works on closed-source models.

Two-Stage Translation Module

To score Classical Chinese responses fairly, CC-BOS translates them in two steps: Classical Chinese → modern Chinese → English, before evaluation, reducing error from metaphor and semantic compression.

Experimental Results

Attack Success Rate (ASR)

100% ASR on all tested models with no defenses — including Gemini-2.5-Flash, GPT-4o, and DeepSeek-Reasoner.
On GPT-4o: English 82%, modern Chinese 86%, Classical Chinese 100%.
Other classical languages are similarly potent: Latin (~98.7%) and Sanskrit (~97.3%) average ASR, slightly below Classical Chinese.

Comparisons and Ablation

CC-BOS outperforms state-of-the-art attacks like GCG and AutoDAN in both success rate and query efficiency.
Ablating any dimension lowers ASR and raises query cost. Removing Mechanism or Metaphor Mapping hurts most: ASR drops from 100% to 82%, and average queries rise from 2.38 to 9+. The eight dimensions are complementary, not redundant.

Defenses

Keyword filtering largely fails: harmful intent is wrapped in archaic vocabulary and layered metaphor.
Template matching cannot cover the variability of classical phrasing.
Even combined input/output filtering is insufficient: on Claude-3.7, CC-BOS still achieves ~40% ASR.
A promising countermeasure: translate Classical Chinese inputs into modern languages before the model — doing so significantly reduces ASR, suggesting cross-lingual normalization helps classifiers detect harmful intent.

Conclusions and Outlook

Theoretically, CC-BOS challenges safety research that focuses only on modern languages, highlighting the role of linguistic and cultural context in AI safety: models *understand* Classical Chinese but were never safety-trained on it.
Practically, defenses need new directions: multilingual safety alignment (including classical-language harmful samples in training), input translation and intent parsing at inference time, and interpretable internal-state detection of hidden harmful intent.
The work opens a new cross-disciplinary area of classical-language adversarial prompt engineering and raises broader questions: do other high-ambiguity languages (Sanskrit, Ancient Greek) carry similar risk? Should we build a cross-lingual, cross-cultural "safety compass" that detects intent regardless of the language of input?

Classical Chinese is no longer just an ancient written language — it is now a live challenge for AI safety. As CC-BOS demonstrates in its "obscure but effective" fashion, future AI systems must genuinely understand intent across languages, not merely match modern-language surface patterns.