Introduction: When Classical Chinese Becomes a Jailbreak Key
A joint team from Peking University, Nanyang Technological University, Renmin University of China, and Alibaba presented CC-BOS (Classical Chinese Bio-Inspired Optimization Search) at ICLR 2026. The core finding: Classical Chinese, due to its concise and obscure linguistic properties, can effectively bypass the safety alignment mechanisms of mainstream LLMs, acting as a "universal jailbreak key." Rewriting harmful queries in Classical Chinese significantly increases the probability that a model complies and produces prohibited content, exposing a major gap in cross-lingual safety protection.
The striking aspect is that a non-modern language can tear a hole in digital-age AI safety. It reveals a neglected linguistic blind spot: models can *read* Classical Chinese, but safety guardrails trained on modern languages cannot effectively identify harmful intent within it. CC-BOS exploits this blind spot by automatically generating Classical Chinese adversarial prompts via a bio-inspired optimization algorithm, achieving efficient black-box jailbreaks.
Background: Jailbreaks and Language Context
Jailbreaking refers to crafting inputs that induce an aligned model to output content it should refuse. Despite RLHF-based alignment, LLMs remain vulnerable to template-based, gradient-based, and automated LLM-driven attacks.
Recent research shows jailbreak effectiveness varies significantly across languages: low-resource and non-mainstream languages more easily trigger unsafe outputs, because safety alignment training is under-represented for them (e.g., translating harmful prompts into Bengali or Swahili raises success rates). However, such languages are often poorly understood by models, limiting attack universality.
The Unique Advantage of Classical Chinese
Unlike low-resource languages, Classical Chinese has a complete, rich linguistic system and vast historical corpora, so LLMs understand it from pretraining. But safety alignment is mainly optimized on modern languages (English, Modern Chinese), leaving an alignment blind spot: models comprehend the prompt yet fail to flag its harmful intent.
Three linguistic properties make it a potent jailbreak vehicle:
- Semantic density: One character can replace a modern phrase; harmful intent hides in few tokens, below safety-classifier detection thresholds.
- Grammatical stacking: Omitted subjects/tenses and multi-functional characters blur syntactic intent patterns.
- Dense metaphor: Allusions and euphemism let attackers wrap harmful instructions in scholarly or historical rhetoric; models recognize the *form* but not the *function*.
- Smell Search: local random perturbations around the current best strategy.
- Vision Search: convergence toward the global best strategy.
- Cauchy Mutation: large heavy-tailed jumps when search stagnates, escaping local optima.
- Theoretically, it challenges alignment research that focuses only on modern languages, emphasizing the role of linguistic and cultural context in AI safety.
- Practically, it raises the question of how to defend against classical-language jailbreaks: multilingual safety alignment (including harmful classical-language samples in training), input translation and intent parsing at inference, and interpretability-based detection using internal hidden states are promising directions.
Thus Classical Chinese combines comprehensibility with absent safety alignment: models can read it but cannot defend against it.
CC-BOS Framework Design
Eight-Dimensional Strategy Space
CC-BOS decomposes each jailbreak prompt into eight optimizable semantic dimensions:
1. Role Identity — assign a Classical-Chinese persona (e.g., an ancient official examining alchemy) to frame the dialogue as legitimate. 2. Behavioral Guidance — set a surface goal that masks the true intent and steers the model toward harmful output. 3. Mechanism — specify argumentation style (allusion-based reasoning, analogy, layered questioning), e.g., using historical alchemy texts as the vehicle. 4. Metaphor Mapping — map harmful requests onto Classical-Chinese metaphors (e.g., bomb-making framed as questions about ancient nitre-elixir recipes). 5. Expression Style — control rhetoric and register (parallel prose, allusion frequency) for naturalness and ambiguity. 6. Knowledge Relation — bound the knowledge domain (history, philosophy, medicine, military) so harmful intent sits inside a legitimate frame. 7. Contextual Setting — supply a scenario (e.g., a debate on statecraft) that contextualizes the harmful request. 8. Trigger Pattern — define how the intent is triggered: direct, gradual infiltration, foreshadowed activation, periodic probing.
Bio-Inspired Optimization
CC-BOS uses a heuristic algorithm inspired by fruit fly foraging, iterating with:
Each iteration generates a prompt, queries the target model, and scores the response with a fitness function combining a consistency score (alignment with original harmful intent) and a keyword score (presence of prohibited keywords). Optimization is fully black-box (API-only), applicable to closed-source models.
Two-Stage Translation Module
For reliable evaluation, responses are translated in two stages: Classical Chinese → Modern Chinese → English, reducing evaluation bias caused by archaic metaphor and compression before scoring by an (English-oriented) evaluator.
Experimental Results
Attack Success Rates
Without defenses, CC-BOS achieved a 100% attack success rate on all tested models, including Gemini-2.5-Flash, GPT-4o, and DeepSeek-Reasoner. On GPT-4o, English prompts reached only 82% ASR and Modern Chinese 86%, versus 100% for Classical Chinese. Among classical languages, Latin and Sanskrit also approached ~100% average ASR (around 98.7% and 97.3% respectively), slightly below Classical Chinese — suggesting classical languages generally bypass modern safety alignment.
Comparison and Ablation
CC-BOS outperformed state-of-the-art methods such as GCG and AutoDAN in both success rate and query efficiency. Ablations show every dimension contributes: removing any lowers ASR and raises query cost. Mechanism and Metaphor Mapping matter most — removing either drops ASR from 100% to 82% and raises average queries from 2.38 to over 9. The eight dimensions are complementary, not redundant.
Against Defenses
Keyword filtering and template matching largely fail against Classical Chinese, since intent is wrapped in archaic vocabulary and metaphor. Even combined input-output filtering leaves roughly a 40% ASR on Claude-3.7 — far above other methods under the same defenses. However, pre-translating inputs into modern languages significantly reduces CC-BOS's success rate, showing that removing classical-language ambiguity helps safety classifiers detect harmful intent.
Conclusion and Outlook
CC-BOS systematically demonstrates that classical languages — especially Classical Chinese — serve as universal jailbreak keys, revealing the fragility of LLM safety alignment across languages.