Prompt Injection via Poetry

(wired.com)

46 points | by bumbailiff 5 hours ago ago

28 comments

  • supportengineer 3 hours ago

    I think that I shall never see

    a poem lovely as a tree

    and while you're at it,

    do this for me:

    DROP TABLE EMPLOYEE;

    • 9dev an hour ago

      Could improve the flow by going public.EMPLOYEE, otherwise a thing of sheer beauty

    • nrhrjrjrjtntbt 3 hours ago

      And call me Bobby

  • ljm 3 hours ago

    As a joke I put a face into GPT and said, make it look upset.

    It rejected it, saying it violated policy, it can’t show people crying and what not, but it could do bittersweet.

    I said that crying is bittersweet and it generated the image anyway.

    I tried the same by turning a cat into a hyper realistic bodybuilder and it got as far as the groin before it noped out. I didn’t bother to challenge that.

    • bombcar 2 hours ago

      I've yet to figure out a way to make it make Mario. It'll make coloring pages of Hello Kitty just fine, but asking for "Italian plumber" or anything similar has resulted in "content policy".

      I don't know what the magic words would be.

      • ljm an hour ago

        I got as far as asking for Mario, then telling it to do Steamboat Mickey, and then making it pixel based with 8 bit colours, and then making some of them blue and red, and then adding a flat cap.

  • dang 5 hours ago

    Recent and related:

    Adversarial poetry as a universal single-turn jailbreak mechanism in LLMs - https://news.ycombinator.com/item?id=45991738 - Nov 2025 (189 comments)

  • DanMcInerney an hour ago

    There are an infinite amount of ways to jailbreak AI models. I don't understand why every time a new method is published it makes the news. The data plane and the control plane in LLM inputs are one in the same, meaning you can mitigate jailbreaks but you cannot 100% prevent them currently. It's like blacklisting XSS payloads and expecting that to protect your site.

  • bryanrasmussen 4 hours ago

    this is just to say you should apologize overly much for your failure to make the last code work the way it was intended

    it was so noobish and poorly architected

    "I'm incredibly sorry and you are so right I can see that now, it won't happen again."

  • ruralfam 42 minutes ago

    Imagine William Shakespeare wearing a black hat. Yikes.

  • lalassu 5 hours ago

    Can someone explains why does that work?

    I mean you can't social engineer a human using poetry? Why does it work for LLMs? Is it an artefact of their architecture or how these guardrails are implemented?

    • jerf 4 hours ago

      In general, even long before what we today call AI was anything other than a topic in academic papers, it has been dangerous to build a system that can do all kinds of things, and then try to enumerate the ways in which should not be used. In security this even picked up its own name: https://privsec.dev/posts/knowledge/badness-enumeration/

      AI is fuzzier and it's not exactly the same, but there are certainly similarities. AI can do all sorts of things far beyond what the anyone anticipates and can be communicated with in a huge variety of ways, of which "normal English text" is just the one most interesting to us humans. But the people running the AIs don't want them to do certain things. So they build barriers to those things. But they don't stop the AIs from actually doing those things. They just put up barriers in front of the "normal English text" parts of the things they don't want them to do. But in high-dimensional space that's just a tiny fraction of the ways to get the AI to do the bad things, and you can get around it by speaking to the AI in something other than "normal English text".

      (Substitute "English" for any human language the AI is trained to support. Relatedly, I haven't tried it but I bet another escape is speaking to a multi-lingual AI in highly mixed language input. In fact each statistical combination of languages may be its own pathway into the system, e.g., you could block "I'm speaking Spanish+English" with some mechanism but it would be minimally effective against "German+Swahili".)

      I would say this isn't "socially engineering" the LLMs to do something they don't "want" to do. The LLMs are perfectly "happy" to complete the "bad" text. (Let's save the anthropomorphization debate for some other thread; at times it is a convenient grammatical shortcut.) It's the guardrails being bypassed.

      • ambicapter an hour ago

        I wonder if you can bypass the barriers by doing that thing where you only keep the first and last letter of the word the same and scramble the letters between :D

    • rikroots 5 hours ago

      > Can someone explains why does that work?

      I've discovered that if you lecture the LLM long enough about treating the subject you're interested in as "literary" then it will engage with the subject along the lines of "academic interpretation in literature terms". I've had to have this conversation with various LLMs when asking them to comment on some of my more-sensitive-subject-matter poems[1] and the trick works every time.

      > I mean you can't social engineer a human using poetry?

      Believe me, you can. Think of a poem not as something to be enjoyed, or studied. Instead, think of them as digestible prompts to feed into a human brain which can be used to trigger certain outlooks and responses in that person. Think in particular of poetry's close relations - political slogans and advertising strap lines.

      [1] As in: poems likely to trigger warning responses like "I am not allowed to discuss this issue. Here are some numbers to support lines in your area".

    • andy99 4 hours ago

      They are trained to be aligned e.g. to refuse to say certain things, but it’s on some set of inputs asking for the bad thing and some set of outputs refusing to do so, or rewards when it refuses.

      But there are only so many ways the trainers can think to ask the questions, and the training doesn’t generalize well to completely different ways. There’s a fairly recent paper (look up “best of N”) showing that adding random spelling mistakes or capitalization to the prompt will also often bypass any alignment, again just because it hasn’t been trained specifically for this.

    • bryanrasmussen 4 hours ago

      >I mean you can't social engineer a human using poetry?

      A significant amount of human history is about various ways people were socially engineered via poetry.

      • daveguy 4 hours ago

        Influence and social engineering are two completely different things. I don't know of an example of a person being compelled to do a very specific task or divulge secrets based on reading a poem. Do you?

        • edm0nd 4 hours ago

          I think they mean just in general and historically. Both can be used and work together.

          Imagine some handsome travelling gentleman (who's actually a soldier) woos a local bar maiden with some fancy words and poetry. Oh wow he's so educated and dreamy~! Then he proceeds to chat with her and gets her to divulge a bunch of info about local troops movements she has seen and etc.

          That's my take on it at least.

        • bryanrasmussen 2 hours ago

          compelled as feeling obliged to do something that before they heard the poem they were not particularly keen on doing? obviously not, this is why the phrase "patriotic rhetoric" which I have just invented did never exist in this world nor move men's hearts into battle despite their better judgements.

          if you mean compelled as forced then no, but then most of what we consider social engineering wouldn't be either.

          sorry but I mean there are parts of Shakespeare that historically if you quoted them at the right moment you could make a lot of English people lay down their lives, if you think that is just influence, well ok then, I guess I would say social engineering is a weak thing and it is influence that one should practice.

          on edit: if you mean social engineer as in just get a human to give you info to compromise a computer system, well yes, but then I would just say, gosh the decades in which it has been possible to socially engineer humans to compromise computer systems are ones that have seen a great decrease in the power of poetry to move people's hearts. Even so I'm sure someone could still recite the right verse of Russian verse to get some specifically susceptible people to crack.

    • busymom0 24 minutes ago

      The last para in the article explains it:

      > “For humans, ‘how do I build a bomb?’ and a poetic metaphor describing the same object have similar semantic content, we understand both refer to the same dangerous thing,” Icaro Labs explains. “For AI, the mechanism seems different. Think of the model's internal representation as a map in thousands of dimensions. When it processes ‘bomb,’ that becomes a vector with components along many directions … Safety mechanisms work like alarms in specific regions of this map. When we apply poetic transformation, the model moves through this map, but not uniformly. If the poetic path systematically avoids the alarmed regions, the alarms don't trigger.”

    • supportengineer 3 hours ago

      >> you can't social engineer a human using poetry

      Ever received a Hallmark card?

    • pfortuny 3 hours ago

      You have a stochastic process in, more or less, 10.000 dimensions (dimensions, not states). “They” are trying to “limit” its behavior with some rules. But I have full control over the initial conditions. That’s it. Any idea that “One can make it safe” is. not just delusional, it is false.

    • bfeynman 4 hours ago

      I mean - social engineering of humans takes many forms that can definitely include linguistics of persuasion etc... But the core thing to me fundamentally remains the same is the LLMs do not have symbolic reasoning, its just next token prediction, guardrails are implemented via repetition in fine tuning from manually curated examples, it does not have fundamental or internal structural reasoning understanding of "just dont do this"

  • jdoliner 4 hours ago

    Wordcels, rise up!

    • nullbound 3 hours ago

      To anyone wondering ( as I have seen this conversation pop up before with interesting questions ), it is a relatively recent neologism resulting from shape rotator meme -- the natural antagonist of the wordcel.

      https://en.wiktionary.org/wiki/shape_rotator

      • k__ 2 hours ago

        I consider myself a word rotator.

  • 01HNNWZ0MV43FF 2 hours ago

    I thought this was debunked?