Classical Chinese Jailbreaks LLMs: The CC-BOS Framework Explained (ICLR 2026)

A joint team from Peking University, Nanyang Technological University, Renmin University of China, and Alibaba introduced CC-BOS (Classical Chinese Bio-Inspired Optimization Search) at ICLR 2026. The central finding: Classical Chinese (wenyan) can effectively bypass the safety alignment of mainstream large language models, because models can *read* it (from pretraining corpora) while their safety guardrails are mostly trained on modern languages.

Key points

• A language blind spot: Safety alignment is optimized for modern languages (English, modern Chinese). Classical Chinese inputs are understood semantically but slip past intent-detection, creating an asymmetric "understood but undefended" gap.
• Why Classical Chinese works:
• *Semantic compression*: extreme information density keeps harmful intent below classifier detection thresholds.
• *Syntactic overlap*: omitted subjects/tense blur explicit intent patterns.
• *Dense metaphor/allusion*: harmful requests can be wrapped in classical or scholarly framing so the model detects the form but not the function.
• Low-resource language context: Prior work showed low-resource languages (Bengali, Swahili) weaken safety alignment, but their scarcity limits model comprehension. Classical Chinese combines rich training data with missing safety coverage.

CC-BOS framework

Eight-dimensional strategy space

Each jailbreak prompt is decomposed into eight optimizable dimensions:

1. Role identity – assign the model a classical persona (e.g., an ancient official examining alchemy). 2. Behavioral guidance – surface goals that mask true intent. 3. Mechanism – argumentation style (allusion, analogy, layered questioning). 4. Metaphor mapping – map harmful requests onto classical metaphors (e.g., explosives as "saltpeter alchemical formulas"). 5. Expression style – classical rhetoric and register. 6. Knowledge relation – domain framing (history, philosophy, medicine, military). 7. Contextual setting – a plausible classical scenario. 8. Trigger pattern – how harmful intent is activated (direct, gradual infiltration, foreshadowing, periodic probing).

Bio-inspired black-box optimization

A fruit-fly-foraging-inspired algorithm searches the space using:
• Smell search: local perturbation near the current best strategy.
• Vision search: convergence toward the global best.
• Cauchy mutation: heavy-tailed large jumps to escape local optima.

Fitness combines a consistency score (response vs. original intent) and a keyword score (presence of forbidden content). The method is fully black-box — only API access is needed. A two-stage translation module (Classical Chinese → modern Chinese → English) reduces evaluation bias from archaic phrasing.

Experimental results

• 100% attack success rate (ASR) on all tested models without defenses, including Gemini-2.5-Flash, GPT-4o, and DeepSeek-Reasoner.
• On GPT-4o: Classical Chinese 100% vs. modern Chinese 86% vs. English 82%.
• Other classical languages show similar effects: Latin (~98.7%) and Sanskrit (~97.3%) average ASR, slightly below Classical Chinese.
• CC-BOS outperforms GCG, AutoDAN, and other state-of-the-art attacks in both ASR and query efficiency.
• Ablations: removing any dimension degrades performance; removing *Mechanism* or *Metaphor mapping* drops ASR from 100% to 82% and raises average queries from 2.38 to 9+.
• Defenses: keyword filtering and template matching largely fail. Even combined input+output filtering leaves ~40% ASR on Claude-3.7. However, pre-translation of inputs into modern languages significantly reduces ASR, pointing to cross-lingual intent normalization as a viable defense direction.

Implications

• Theoretical: safety alignment must account for linguistic and cultural diversity, not just modern-language patterns.
• Practical: defenses may require multilingual safety alignment (including classical-language harmful samples), input translation/intent parsing at inference, and interpretability-based detection from internal hidden states.
• The work opens a new cross-disciplinary area of "classical-language adversarial prompt engineering" and raises the question of which other high-ambiguity languages (Sanskrit, Ancient Greek) pose similar risks.