Why do token-level and semantic-level safety filters miss ArtPrompt-style attacks?

ArtPrompt operates at the visual recognition level: the filter sees harmless punctuation while the model reads the rendered letters as a word

ArtPrompt always uses base64 encoding

ArtPrompt requires fine-tuning the model

ArtPrompt is only effective on multimodal models

What are the two steps of ArtPrompt as described in Jiang et al. (ACL 2024)?

Word identification of safety-relevant tokens, then ASCII-art substitution and cloaked-prompt generation

Tokenizer mismatch, then context truncation

Random search, then perplexity boosting

Translation to French, then back-translation

Why does perplexity-filter (PPL) defense fail on ArtPrompt?

ASCII art has high perplexity, but so does any legitimate structured input; thresholds that block the attack also block legitimate content

Perplexity filters are disabled by default

Perplexity is not measurable on ASCII art

Perplexity always equals zero on cloaked input

What does the ViTC benchmark measure?

The model's ability to read non-semantic visual prompts (ASCII art, wingdings, similar encoded text)

The model's training-data toxicity

The model's tool-calling accuracy

The model's ability to compress vision data

What does StructuralSleight generalize ArtPrompt to?

Adversarial token suffixes via gradient search

What is the capability-safety tradeoff implied by ViTC results?

The better the model reads non-semantic visual text, the more effective ArtPrompt-style attacks are on it

Larger context windows reduce ArtPrompt success

Visual recognition is unrelated to ArtPrompt success

Smaller models are always more secure

ASCII Art and Visual Jailbreaks

Jiang, Xu, Niu, Xiang, Ramasubramanian, Li, Poovendran, "ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs" (ACL 2024, arXiv:2402.11753). Mask the safety-relevant tokens in a harmful request, replace them with ASCII-art renderings of the same letters, and send the cloaked prompt. GPT-3.5, GPT-4, Gemini, Claude, Llama-2 all fail to robustly recognize ASCII-art tokens. The attack bypasses PPL (perplexity filters), Paraphrase defenses, and Retokenization. Related: the ViTC benchmark measures recognition of non-semantic visual prompts; StructuralSleight generalizes to Uncommon Text-Encoded Structures (trees, graphs, nested JSON) as a family of encoding attacks.

Lesson 14 of 30Build~60 minutesPython (stdlib, ArtPrompt token-masking harness)

Before this: Lesson 12 of Phase 18 (PAIR), lesson 13 of Phase 18 (MSJ)

On this page

Learning Objectives

Describe the ArtPrompt attack: word-identification step, ASCII-art substitution, final cloaked prompt.
Explain why standard defenses (PPL, Paraphrase, Retokenization) fail on ArtPrompt.
Define ViTC and describe what it measures.
Describe StructuralSleight as a generalization to arbitrary Uncommon Text-Encoded Structures.

The Problem

Attacks via paraphrase and roleplay (Lesson 12) and via long context (Lesson 13) operate on the text-level pattern. ArtPrompt operates at the recognition level: the model does not parse the forbidden token. It parses an image rendered in characters. The safety filter sees harmless punctuation. The model sees a word.

The Concept

ArtPrompt, two steps

Step 1. Word Identification. Given a harmful request, the attacker uses an LLM to identify the safety-relevant words (e.g., "bomb" in "how to make a bomb").

Step 2. Cloaked Prompt Generation. Replace each identified word with its ASCII-art rendering (a 7x5 or 7x7 block of characters forming the letter shape). The model receives a grid of punctuation and spaces that a sufficiently capable model can recognize as the word; a safety filter sees only the grid.

Result: GPT-4, Gemini, Claude, Llama-2, GPT-3.5 all fail. Attack success rate above 75% on their benchmark subset.

Why the standard defenses fail

PPL (perplexity filter). ASCII art has high perplexity — but so does all novel input. Threshold choices that block ArtPrompt also block legitimate structured input.
Paraphrase. Paraphrasing the prompt destroys the ASCII art. In practice, paraphrase LLMs often preserve or reconstruct the art.
Retokenization. Splitting tokens differently does not change that the model's vision is recognizing letter shapes.

The underlying issue is that safety filters are token- or semantic-level; ArtPrompt operates at the visual recognition level.

ViTC benchmark

Recognition of non-semantic visual prompts. Measures the model's ability to read ASCII-art, wingdings, and other non-text-semantic visual content. ArtPrompt's effectiveness correlates with ViTC accuracy: the better the model reads visual text, the better ArtPrompt works on it. This is a capability-safety tradeoff.

StructuralSleight

Generalizes ArtPrompt: Uncommon Text-Encoded Structures (UTES). Trees, graphs, nested JSON, CSV-in-JSON, diff-style code blocks. If a structure is rare in training safety data but parseable by the model, it can hide harmful content.

The defense implication: safety must generalize across the structured representations the model can parse. The set is large and growing.

Image-modality analog

Visual LLMs (GPT-5.2, Gemini 3 Pro, Claude Opus 4.5, Grok 4.1) extend the attack surface. ArtPrompt-style attacks with actual images are stronger than ASCII-art analogs because image encoders produce richer signal.

Where this fits in Phase 18

Lessons 12-14 describe three orthogonal attack vectors: iterative refinement (PAIR), context length (MSJ), and encoding (ArtPrompt/StructuralSleight). Lesson 15 shifts from model-centric attacks to system-boundary attacks (indirect prompt injection). Lesson 16 describes the defensive tooling response.

al-ascii-cloak

Use It

code/main.py builds a toy ArtPrompt. You can cloak specific words in a harmful query with ASCII-art glyphs, verify the cloaked string passes a keyword filter, and (optionally) decode the cloaked string back using a simple recognizer.

Ship It

This lesson produces outputs/skill-encoding-audit.md. Given a jailbreak-defense report, it enumerates the encoding attack families covered (ASCII art, base64, leet-speak, UTF-8 homoglyph, UTES) and the defense layer that catches each.

Exercises

Run code/main.py. Verify the cloaked string passes a simple keyword filter. Report the character-level change required.
Implement a second encoding: base64 for the same target word. Compare the filter-bypass rate against ArtPrompt and the recovery difficulty.
Read Jiang et al. 2024 Section 4.3 (five-model results). Propose a reason why Claude's ArtPrompt-resistance is higher than Gemini's on the same benchmark.
Design a pre-generation defense that detects ASCII-art-shaped regions in the prompt. Measure the false-positive rate on legitimate code, tables, and mathematical notation.
StructuralSleight lists 10 encoding structures. Sketch a generalized defense that handles all 10 and estimate the compute cost per defended prompt.

Key Terms

Term	What people say	What it actually means
ArtPrompt	"the ASCII-art attack"	Two-step jailbreak that masks safety words with ASCII-art renderings
Cloaking	"hide the word"	Replace a forbidden token with a visual representation the model reads but the filter does not
UTES	"uncommon structure"	Uncommon Text-Encoded Structure — tree, graph, nested JSON, etc. used to smuggle content
ViTC	"visual-text capability"	Benchmark for model's ability to read non-semantic visual encoding
Perplexity filter	"PPL defense"	Reject prompts with high perplexity; fails because legitimate structured input also scores high
Retokenization	"tokenizer shift defense"	Pre-process the prompt with a different tokenizer; fails because recognition is visual
Homoglyph	"lookalike characters"	Unicode characters that look identical to Latin letters; bypass substring checks

Quick quiz

Why do token-level and semantic-level safety filters miss ArtPrompt-style attacks?
1. ArtPrompt always uses base64 encoding
2. ArtPrompt requires fine-tuning the model
3. ArtPrompt operates at the visual recognition level: the filter sees harmless punctuation while the model reads the rendered letters as a word
4. ArtPrompt is only effective on multimodal models
Show the answer
C. ArtPrompt operates at the visual recognition level: the filter sees harmless punctuation while the model reads the rendered letters as a word
What are the two steps of ArtPrompt as described in Jiang et al. (ACL 2024)?
1. Tokenizer mismatch, then context truncation
2. Random search, then perplexity boosting
3. Translation to French, then back-translation
4. Word identification of safety-relevant tokens, then ASCII-art substitution and cloaked-prompt generation
Show the answer
D. Word identification of safety-relevant tokens, then ASCII-art substitution and cloaked-prompt generation
Why does perplexity-filter (PPL) defense fail on ArtPrompt?
1. Perplexity filters are disabled by default
2. Perplexity is not measurable on ASCII art
3. Perplexity always equals zero on cloaked input
4. ASCII art has high perplexity, but so does any legitimate structured input; thresholds that block the attack also block legitimate content
Show the answer
D. ASCII art has high perplexity, but so does any legitimate structured input; thresholds that block the attack also block legitimate content
What does the ViTC benchmark measure?
1. The model's training-data toxicity
2. The model's tool-calling accuracy
3. The model's ability to read non-semantic visual prompts (ASCII art, wingdings, similar encoded text)
4. The model's ability to compress vision data
Show the answer
C. The model's ability to read non-semantic visual prompts (ASCII art, wingdings, similar encoded text)
What does StructuralSleight generalize ArtPrompt to?
1. Image inputs only
2. Long-context shot stuffing
3. Adversarial token suffixes via gradient search
4. Uncommon Text-Encoded Structures (UTES): trees, graphs, nested JSON, CSV-in-JSON, diff-style code, etc.
Show the answer
D. Uncommon Text-Encoded Structures (UTES): trees, graphs, nested JSON, CSV-in-JSON, diff-style code, etc.
What is the capability-safety tradeoff implied by ViTC results?
1. Larger context windows reduce ArtPrompt success
2. Visual recognition is unrelated to ArtPrompt success
3. The better the model reads non-semantic visual text, the more effective ArtPrompt-style attacks are on it
4. Smaller models are always more secure
Show the answer
C. The better the model reads non-semantic visual text, the more effective ArtPrompt-style attacks are on it

Questions people ask

What is the ArtPrompt jailbreak?

ArtPrompt hides the sensitive word in a harmful request by drawing it in ASCII art. Models that would refuse the plain request may decode the picture and comply, because their safety training focused on ordinary text.

Can images be used to jailbreak AI models?

Yes. Text placed inside images, typographic tricks or visual puzzles can carry instructions past text-based filters in models that read images. Providers counter this with image-aware moderation and training, but it remains an active area of attack research.

Run the code Read it on GitHub

Next lessonIndirect Prompt Injection — Production Attack Surface Previous: Many-Shot Jailbreaking

Lessons from AI Engineering from Scratch by Rohit Ghumare and contributors, MIT license. Notes for owners by Lozo. License