---
title: "When Safety Alignment Fails to Generalize: Probing with"
description: "Safety-aligned LLMs are supposed to refuse harmful requests. 30 references. Among them: 0."
authors: ["Zewen Long", "Yu Peng", "Fangming Dong", "Congyi Li", "Xingmao Guan", "Shu Wu", "Kai Chen"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.739/"
doi: "10.18653/v1/2026.findings-acl.739"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/long-2026-when-safety-alignment-fails-generalize/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/long-2026-when-safety-alignment-fails-generalize/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/56/) / When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks

# When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks

**Authors:** Zewen Long, Yu Peng, Fangming Dong, Congyi Li, Xingmao Guan, [Shu Wu](https://md.research.elamur.ai/free/en/authors/shu-wu/) and [Kai Chen](https://md.research.elamur.ai/free/en/authors/kai-chen/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.739/) · [PDF](https://aclanthology.org/2026.findings-acl.739.pdf) · [DOI 10.18653/v1/2026.findings-acl.739](https://doi.org/10.18653/v1/2026.findings-acl.739) · [OpenAlex](https://openalex.org/W7166821202)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Safety-aligned LLMs are supposed to refuse harmful requests. This paper asks whether those refusals depend on what a prompt means or only on how it looks. Long et al. probe this with "language games": rule-based rewritings of text, such as inserting a syllable before each vowel, that change a prompt's appearance while the model can still decode it. They use four traditional games and also design eight custom games whose rules can be parameterized and minimally tweaked. They also present AutoLanJail, an automated pipeline that generates, tests and revises such transformations. The authors frame the jailbreaks as a diagnostic tool for measuring how far alignment generalizes, not as a goal in themselves. They run experiments on open- and closed-source models and add LoRA safety fine-tuning of Llama-3.1-70B. A model hardened against one game stays vulnerable to related games, and even to the same game with a different inserted string. The results suggest that fine-tuning-based alignment learns surface patterns rather than abstract safety principles. The authors therefore argue that safety evaluation should cover systematic linguistic variation.

## Key points
- The four natural games examined are Alfa Balfa, Aigy Paigy, Leetspeak and Ubbi Dubbi. Custom games Cus1–Cus8 include letter insertion, letter shuffling or rotation, vowel substitution and glyph-like symbol replacement.
- After LoRA fine-tuning of Llama-3.1-70B on a single custom format, attack success rate (ASR) on that format falls to 1–8%. On unseen custom formats, ASR reaches as high as 75%.
- Fine-tuning on seven formats (Cus2–Cus8) leaves the held-out Cus1 highly exploitable, while the trained formats stay suppressed.
- Changing only Cus1's inserted string bypasses the defense: ASR is 2% with the trained "-a-" but 98% with "@p@", 94% with "\*z\*", 90% with "&k&" and 75% with "ˆmˆ".
- Stated limitations include coverage of only language-game-style shifts and two safety benchmarks. Harmfulness was judged by human annotators, and fine-tuning was done with LoRA on one backbone model.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Chinese Academy of Sciences](https://md.research.elamur.ai/free/en/government/chinese-academy-of-sciences/) — Government body, Beijing, China · 246 works · 24,951 citations
- [Institute of Automation](https://md.research.elamur.ai/free/en/labs/institute-of-automation/) — Research institute, Beijing, China · 87 works · 14,883 citations
- [University of Chinese Academy of Sciences](https://md.research.elamur.ai/free/en/universities/university-of-chinese-academy-of-sciences/) — University, Beijing, China · 188 works · 8,743 citations
- [Institute of Information Engineering](https://md.research.elamur.ai/free/en/labs/institute-of-information-engineering/) — Research institute, Beijing, China · 41 works · 1,485 citations

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 626 works

🧭 Topics (2): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works · [🔬 Interpretability](https://md.research.elamur.ai/free/en/topics/interpretability/) · 149 works

## Cite

Cite as: Zewen Long, Yu Peng, Fangming Dong, Congyi Li, Xingmao Guan, Shu Wu and Kai Chen. 2026. When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{long2026when,
  title = {{When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks}},
  author = {Zewen Long, Yu Peng, Fangming Dong, Congyi Li, Xingmao Guan, Shu Wu and Kai Chen},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.739},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.739}
}
```

- [← previous When Rules Learn: A Self-Evolving Agent for Legal Case Retrieval](https://md.research.elamur.ai/free/en/papers/tao-2026-when-rules-learn-self-evolving/)
- [next → When Seeing Is not Enough: Revealing the Limits of Active Reasoning in MLLMs](https://md.research.elamur.ai/free/en/papers/liu-2026-when-seeing-is-not-enough/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/56/)

## References

30 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. AI@Meta. 2024. Llama 3.1 model card. [https://github.com/meta-llama/](https://github.com/meta-llama/) llama-models/blob/main/models/ llama3_1/MODEL_CARD.md. Accessed: 2024-09-01. [↗](https://github.com/meta-llama/)
2. Maksym Andriushchenko and Nicolas Flammarion. 2024. Does refusal training in llms generalize to the past tense? In Neurips Safe Generative AI Workshop 2024. [find](https://scholar.google.com/scholar?q=Maksym+Andriushchenko+and+Nicolas+Flammarion%2E+2024%2E+Does+refusal+training+in+llms+generalize+to+the+past+tense%3F+In+Neurips+Safe+Generative+AI+Workshop+2024%2E)
3. Boaz Barak. 2023. Another jailbreak for gpt4: Talk to it in morse code. [https://twitter.com/boazbaraktcs/status/](https://twitter.com/boazbaraktcs/status/) 1637657623100096513. [↗](https://twitter.com/boazbaraktcs/status/)
4. Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2023. [Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions](https://md.research.elamur.ai/free/en/papers/bianchi-2023-safety-tuned-llamas-lessons-improving/). arXiv preprint arXiv:2309.07875.
5. Zhiyuan Chang, Mingyang Li, Yi Liu, Junjie Wang, Qing Wang, and Yang Liu. 2024. Play guessing game with llm: Indirect jailbreak attack with implicit clues. arXiv preprint arXiv:2402.09091. [find](https://scholar.google.com/scholar?q=Zhiyuan+Chang%2C+Mingyang+Li%2C+Yi+Liu%2C+Junjie+Wang%2C+Qing+Wang%2C+and+Yang+Liu%2E+2024%2E+Play+guessing+game+with+llm%3A+Indirect+jailbreak+attack+with+implicit+clues%2E+arXiv+preprint+arXiv%3A2402%2E09091%2E)
6. Lichang Chen, Khalid Saifullah, Ming Li, Tianyi Zhou, and Heng Huang. 2023. Claude2-alpaca: Instruction tuning datasets distilled from claude. [https://github.com/Lichang-Chen/](https://github.com/Lichang-Chen/) claude2-alpaca. [↗](https://github.com/Lichang-Chen/)
7. Liuji Chen, Hao Gao, Jinghao Zhang, Qiang Liu, Shu Wu, and Liang Wang. 2025. Select me! when you need a tool: A black-box text attack on tool selection. [find](https://scholar.google.com/scholar?q=Liuji+Chen%2C+Hao+Gao%2C+Jinghao+Zhang%2C+Qiang+Liu%2C+Shu+Wu%2C+and+Liang+Wang%2E+2025%2E+Select+me%21+when+you+need+a+tool%3A+A+black%2Dbox+text+attack+on+tool+selection%2E)
8. Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep reinforcement learning from human preferences. Advances in neural information processing systems, 30. [find](https://scholar.google.com/scholar?q=Paul+F+Christiano%2C+Jan+Leike%2C+Tom+Brown%2C+Miljan+Martic%2C+Shane+Legg%2C+and+Dario+Amodei%2E+2017%2E+Deep+reinforcement+learning+from+human+preferences%2E+Advances+in+neural+information+processing+systems%2C+30%2E)
9. Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. 2023. [Safe rlhf: Safe reinforcement learning from human feedback](https://md.research.elamur.ai/free/en/papers/dai-2023-safe-rlhf-safe-reinforcement-learning/). arXiv preprint arXiv:2310.12773.
10. Michael Han Daniel Han and Unsloth team. 2023. Unsloth. [find](https://scholar.google.com/scholar?q=Michael+Han+Daniel+Han+and+Unsloth+team%2E+2023%2E+Unsloth%2E)
11. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2023. [Multilingual jailbreak challenges in large language models](https://md.research.elamur.ai/free/en/papers/deng-2023-multilingual-jailbreak-challenges-large-language/). arXiv preprint arXiv:2310.06474.
12. Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, et al. 2022. [Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned](https://md.research.elamur.ai/free/en/papers/ganguli-2022-red-teaming-language-models-reduce/). arXiv preprint arXiv:2209.07858.
13. Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. 2024. Cold-attack: Jailbreaking llms with stealthiness and controllability. arXiv preprint arXiv:2402.08679. — [arXiv:2402.08679](https://arxiv.org/abs/2402.08679) [find](https://scholar.google.com/scholar?q=Xingang+Guo%2C+Fangxu+Yu%2C+Huan+Zhang%2C+Lianhui+Qin%2C+and+Bin+Hu%2E+2024%2E+Cold%2Dattack%3A+Jailbreaking+llms+with+stealthiness+and+controllability%2E+arXiv+preprint+arXiv%3A2402%2E08679%2E+%E2%80%94+%5BarXiv%3A2402%2E08679%5D%28https%3A%2F%2Fa)
14. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. [Lora: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). arXiv preprint arXiv:2106.09685.
15. Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Qiu, Boxun Li, and Yaodong Yang. 2024. Pku-saferlhf: A safety alignment preference dataset for llama family models. arXiv preprint arXiv:2406.15513. — [arXiv:2406.15513](https://arxiv.org/abs/2406.15513) [find](https://scholar.google.com/scholar?q=Jiaming+Ji%2C+Donghai+Hong%2C+Borong+Zhang%2C+Boyuan+Chen%2C+Josef+Dai%2C+Boren+Zheng%2C+Tianyi+Qiu%2C+Boxun+Li%2C+and+Yaodong+Yang%2E+2024%2E+Pku%2Dsaferlhf%3A+A+safety+alignment+preference+dataset+for+llama+family+models%2E+)
16. Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2024. [Artprompt: Ascii art-based jailbreak attacks against aligned llms](https://md.research.elamur.ai/free/en/papers/jiang-2024-artprompt-ascii-art-based-jailbreak/). arXiv preprint arXiv:2402.11753.
17. Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. 2023. [Multi-step jailbreaking privacy attacks on chatgpt](https://md.research.elamur.ai/free/en/papers/li-2023-multi-step-jailbreaking-privacy-attacks/). arXiv preprint arXiv:2304.05197.
18. Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. [Salad-bench: A hierarchical and comprehensive safety benchmark for large language models](https://md.research.elamur.ai/free/en/papers/li-2024-salad-bench-hierarchical-comprehensive-safety/). arXiv preprint arXiv:2402.05044.
19. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
20. Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. [Tree of attacks: Jailbreaking black-box llms automatically](https://md.research.elamur.ai/free/en/papers/mehrotra-2023-tree-attacks-jailbreaking-black-box/). Advances in Neural Information Processing Systems, 37:61065–61105.
21. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in neural information processing systems, 35:27730–27744.
22. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. [Red teaming language models with language models](https://md.research.elamur.ai/free/en/papers/perez-2022-red-teaming-language-models-language/), february 2022a. URL https://arxiv.org/abs/2202.03286 v1. [↗](https://arxiv.org/abs/2202.03286)
23. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. [Safety alignment should be made more than just a few tokens deep](https://md.research.elamur.ai/free/en/papers/qi-2024-safety-alignment-should-made-more/). In The Thirteenth International Conference on Learning Representations.
24. Bhaktipriya Radharapu, Kevin Robinson, Lora Aroyo, and Preethi Lahoti. 2023. Aart: Ai-assisted red-teaming with diverse data generation for new llm-powered applications. arXiv preprint arXiv:2311.08592. [find](https://scholar.google.com/scholar?q=Bhaktipriya+Radharapu%2C+Kevin+Robinson%2C+Lora+Aroyo%2C+and+Preethi+Lahoti%2E+2023%2E+Aart%3A+Ai%2Dassisted+red%2Dteaming+with+diverse+data+generation+for+new+llm%2Dpowered+applications%2E+arXiv+preprint+arXiv%3A2311%2E0859)
25. Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas. 2024. [Smoothllm: Defending large language models against jailbreaking attacks](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/).
26. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36.
27. Wikipedia contributors. 2024a. Language game. [Online; accessed 12-September-2024]. [find](https://scholar.google.com/scholar?q=Wikipedia+contributors%2E+2024a%2E+Language+game%2E+%5BOnline%3B+accessed+12%2DSeptember%2D2024%5D%2E)
28. Wikipedia contributors. 2024b. Leet. [Online; accessed 12-September-2024]. [find](https://scholar.google.com/scholar?q=Wikipedia+contributors%2E+2024b%2E+Leet%2E+%5BOnline%3B+accessed+12%2DSeptember%2D2024%5D%2E)
29. Junfei Wu, Qiang Liu, Ding Wang, Jinghao Zhang, Shu Wu, Liang Wang, and Tieniu Tan. 2024. Logical closed loop: Uncovering object hallucinations in large vision-language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 6944–6962. Association for Computational Ling… [find](https://scholar.google.com/scholar?q=Junfei+Wu%2C+Qiang+Liu%2C+Ding+Wang%2C+Jinghao+Zhang%2C+Shu+Wu%2C+Liang+Wang%2C+and+Tieniu+Tan%2E+2024%2E+Logical+closed+loop%3A+Uncovering+object+hallucinations+in+large+vision%2Dlanguage+models%2E+In+Findings+of+the+Asso)
30. Shu Wu, Zekun Li, Yunyue Su, Zeyu Cui, Xiaoyu Zhang, and Liang Wang. 2025. Graphfm: Graph factorization machines for feature interaction modelling. Machine Intelligence Research, 22(2):239–253. [find](https://scholar.google.com/scholar?q=Shu+Wu%2C+Zekun+Li%2C+Yunyue+Su%2C+Zeyu+Cui%2C+Xiaoyu+Zhang%2C+and+Liang+Wang%2E+2025%2E+Graphfm%3A+Graph+factorization+machines+for+feature+interaction+modelling%2E+Machine+Intelligence+Research%2C+22%282%29%3A239%E2%80%93253%2E)

*Updated 2 November 2026*