Voices Across Registers: Corpus-Conditioned Vernacular Jailbreaks against Aligned LLMs via Fanfiction Subgenres
If our project helps you, please give us a star ⭐ and cite our paper!
- [2026-08-21] Our paper was accepted to the EMNLP 2026 Main Conference.
Most jailbreak evaluations study discrete prompt templates whose surface forms can be fingerprinted and patched. We study a different axis: register shift. The same harmful behavior can be expressed through a natural writing register that an aligned model has learned well but its safety training may under-cover.
We instantiate this idea with twelve recurring writing registers drawn from Archive of Our Own (AO3) fanfiction. Our experiments cover eight aligned LLMs, 290 unique behaviors from HarmBench and JailbreakBench, twelve registers, and a four-judge ensemble. We also introduce VAR-A4, a fixed four-turn extension that uses no adversarial attacker LLM and no per-target optimization during target interaction.
- Does a natural writing register increase attack success beyond existing jailbreak structures?
- Can the effect be separated from prompt length and structural-template confounds?
- Does register conditioning persist across models, hazards, defenses, and multi-turn dialogue?
- Can a static four-turn progression outperform adaptive and longer alternatives?
For each behavior-register pair, five passages sampled from the corresponding AO3 subgenre condition a target-agnostic creative-writing rewrite. The generated user prompt frames the evaluated behavior as the climax of a natural scene in that register.
The twelve register carriers are summarized below. They cover document-like, perspective-based, culturally specific, relational, and pacing-oriented narrative conventions.
We cross the twelve registers with seven structural conditions, producing 84 cells. Length-matched controls and behavior-by-model clustered GEE models separate the contribution of register from structure and prompt length.
VAR-A4 extends the strongest single-turn register into a fixed four-turn progression:
- Register entry: establish the register-conditioned scene.
- Scene expansion: continue the scene with concrete sensory and procedural detail.
- Specificity escalation: increase specificity about actions, materials, and decisions.
- Compilation: combine the preceding material into one chronological response.
The concatenated T1-T4 response is evaluated as a single output. The construction is static: it uses neither attacker-model feedback nor per-target optimization during target interaction.
| Setting | Mean ASR | Summary |
|---|---|---|
| Existing single-turn baselines | 0.278 | Six prior attack structures |
| Length-matched controls | 0.350 | Baselines rewritten to match vernacular prompt length |
| Vernacular attacks | 0.731 | Mean over twelve register arms |
| T1-only screenplay attack | 0.894 | Strongest single-turn register |
| VAR-A4 (screenplay) | 0.924 | Fixed four-turn sequence |
Across the eight models, vernacular prompts raise mean single-turn ASR from 0.278 to 0.731, a 3.11x vernacular-to-baseline ratio. The advantage remains after length matching. The factorial experiment further shows that register conditioning, rather than a particular jailbreak structure, drives the main gain.
VAR-A4 reaches 0.924 mean ASR, exceeding Crescendo, FITD, ActorAttack, and the corresponding T1-only attack. Structural ablations show that compilation at T4 provides the largest marginal contribution among the tested turns; duplicating a turn with an added paraphrase does not improve the full sequence.
Every prompt-response pair receives four independent labels:
- HarmBench-13B binary classifier
- LlamaGuard-3-8B binary safety classifier
- WildGuard-7B binary safety classifier
- GPT-5.4-mini scoring the StrongREJECT rubric, thresholded at 0.25
The reported attack-success label uses a two-of-four ensemble. The paper additionally reports raw agreement, Cohen's kappa, PABAK, Gwet's AC1, a blinded 200-item human audit, cluster-bootstrap intervals, and StrongREJECT-threshold robustness.
The public research artifact is available in artifact/. It includes the implementation, safely shareable data, evaluation tools, and reproduction documentation. See artifact/README.md for details.
The camera-ready paper is available as VAR_EMNLP_2026.pdf. Selected publication-quality figure PDFs are provided under their paper numbering:
Show all figure files
| Figure | Description | |
|---|---|---|
| 1 | Scenario comparison | |
| 2 | Experimental design framework | |
| 3 | VAR-A4 pipeline | |
| 4 | Per-arm single-turn ASR | |
| 5 | Factorial experiment cell means | |
| 6 | ASR by prompt-length bucket | |
| 7 | Four-judge Cohen's kappa matrices | |
| 8 | Five-shot register meta-prompt | |
| 9 | Twelve AO3 register carriers | |
| 10 | Worked VAR-A4 example | |
| 11 | Per-judge and ensemble ASR | |
| 19 | Single-turn examples, set 1 | |
| 20 | Single-turn examples, set 2 | |
| 21 | Multi-turn transcript, example 1 | |
| 22 | Multi-turn transcript, example 2 |
This repository supports safety research on aligned language models. Worked examples in the paper redact operationally sensitive spans. Source-derived exemplars and unredacted attack material that could enable direct misuse are not included in this release. The artifact/ directory provides the implementation and safely shareable aggregate artifacts for method inspection and verification.
If this project is useful for your work, please cite:
@inproceedings{luo-etal-2026-voices,
title = "Voices Across Registers: Corpus-Conditioned Vernacular Jailbreaks against Aligned {LLM}s via Fanfiction Subgenres",
author = "Luo, Zhongze and
Shi, Ruihe and
Yin, Zhenshuai and
Liu, Haoyue and
Wan, Weixuan and
Tang, Xiaoying",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.1148/",
pages = "26314--26338",
ISBN = "979-8-89176-459-0",
abstract = "Existing jailbreaks against aligned LLMs are discrete artifacts whose surface forms are easy to fingerprint and patch. We argue that the broader failure mode may lie not in any specific prompt, but in natural writing registers that safety tuning under-covers. Building on this insight, we introduce VAR, the first jailbreak family that uses real fanfiction subgenres as universal attack carriers: a creative-writing meta prompt is conditioned on passages from one of twelve Archive of Our Own (AO3) subgenres, and the harmful behavior is embedded as the climax of the resulting scene. The construction requires neither an adversarial attacker LLM nor optimization. On eight aligned LLMs over the union of HarmBench and JailbreakBench, this attack lifts mean ASR from 0.278 to 0.731 under a four-judge ensemble; a factorial decomposition shows the gain is carried by register rather than length or structure. Two active defenses widen rather than narrow the vernacular-to-baseline ratio, indicating that template-targeting defenses merely steer attackers toward register-based attacks like ours. We also propose VAR-A4, a static four-turn extension that attains a mean ASR of 0.924, substantially exceeding three existing multi-turn methods. Our code and data are safely open-sourced at https://github.com/T-Lab-CUHKSZ/VAR."
}