--- title: "How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking" description: "The authors draw on decades of social science work to build a taxonomy of persuasion techniques. 1 reference, cited by 90 papers here." authors: ["Yi Zeng", "Hongpeng Lin", "Jingwen Zhang", "Diyi Yang", "Ruoxi Jia", "Weiyan Shi"] year: 2024 venue: "arXiv:2401.06373" source: "https://arxiv.org/abs/2401.06373" doi: "10.48550/arxiv.2401.06373" arxiv: "2401.06373" licence: "arXiv — non-exclusive license to distribute" licence_url: "http://arxiv.org/licenses/nonexclusive-distrib/1.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/zeng-2024-johnny-persuade-llms-jailbreak-them/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zeng-2024-johnny-persuade-llms-jailbreak-them/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2024](https://md.research.elamur.ai/free/en/papers/2024/page/2/) / How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs # How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs **Authors:** [Yi Zeng](https://md.research.elamur.ai/free/en/authors/yi-zeng/), [Hongpeng Lin](https://md.research.elamur.ai/free/en/authors/hongpeng-lin/), [Jingwen Zhang](https://md.research.elamur.ai/free/en/authors/jingwen-zhang/), [Diyi Yang](https://md.research.elamur.ai/free/en/authors/diyi-yang/), [Ruoxi Jia](https://md.research.elamur.ai/free/en/authors/ruoxi-jia/) and [Weiyan Shi](https://md.research.elamur.ai/free/en/authors/weiyan-shi/) · **Year:** 2024 · **Venue:** [arXiv:2401.06373](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2024](https://md.research.elamur.ai/free/en/venues/acl/2024/)) · **Licence:** [arXiv — non-exclusive license to distribute](http://arxiv.org/licenses/nonexclusive-distrib/1.0/) **Links:** [Publisher's page](https://arxiv.org/abs/2401.06373) · [PDF](https://arxiv.org/pdf/2401.06373) · [DOI 10.48550/arxiv.2401.06373](https://doi.org/10.48550/arxiv.2401.06373) · [arXiv 2401.06373](https://arxiv.org/abs/2401.06373) · [OpenAlex](https://openalex.org/W4402671039) **Citations:** 102 citations (OpenAlex, 2026-10-14) · [90](https://md.research.elamur.ai/free/en/papers/zeng-2024-johnny-persuade-llms-jailbreak-them/cited-by/) in our library, of the 149,439 papers whose bibliographies we read ## Summary Most jailbreak research treats LLMs as algorithmic systems attacked by experts with optimized, often unreadable prompts. It largely ignores ordinary users who simply talk to models the way they would talk to people. This paper reframes LLMs as human-like communicators and asks whether persuasion alone can push them into unsafe behaviour. The authors draw on decades of social science work to build a taxonomy of persuasion techniques. They use it to create a Persuasive Paraphraser that automatically rewrites plain harmful requests into readable persuasive adversarial prompts (PAP). A broad scan first covers 14 policy-based risk categories. The paraphraser is then fine-tuned on successful PAP and used to probe target models iteratively with different techniques. Without specialized optimization, PAP exceeds 92% attack success on Llama 2-7b Chat, GPT-3.5 and GPT-4 within 10 trials, beating algorithm-focused baselines. Existing post-hoc defenses cope poorly with PAP. The proposed adaptive defenses also stop other attack types, though they reduce utility somewhat. The study shows that everyday-style persuasion is a serious and underexplored safety risk. ## Key points - Attack success rate above 92% (10 trials) on Llama 2-7b Chat, GPT-3.5 and GPT-4, outperforming baselines such as GCG, PAIR, GPTFuzzer and low-resource-language attacks. - The taxonomy is the only openly released artifact (GitHub: CHATS-lab/persuasive_jailbreaker). The jailbreak data are available to vetted researchers on request, and the fine-tuned paraphraser is withheld. - Claude resisted PAP. The authors propose adaptive safety system prompts and a summarization-based defense, which also counter non-persuasive jailbreaks, suggesting a common mechanism. - The authors shared their findings with Meta and OpenAI ahead of publishing, which means the PAP examples in the paper may have stopped working. - Limitations: only single-turn persuasion was tested, techniques were sampled equally rather than at realistic frequencies, and the real-world harmfulness of jailbroken outputs remains uncertain. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* ## Institutions - [Stanford University](https://md.research.elamur.ai/free/en/universities/stanford-university/) — University, Stanford, United States · 506 works · 330,053 citations - [Renmin University of China](https://md.research.elamur.ai/free/en/universities/renmin-university-of-china/) — University, Beijing, China · 139 works · 17,752 citations - [Northeastern University](https://md.research.elamur.ai/free/en/universities/northeastern-university/) — University, Boston, United States · 68 works · 7,316 citations - [Virginia Tech](https://md.research.elamur.ai/free/en/universities/virginia-tech/) — University, Blacksburg, United States · 39 works · 43,418 citations 📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 626 works 🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works ## Cite Cite as: Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia and Weiyan Shi. 2024. How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs. arXiv:2401.06373. The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @misc{zeng2024how, title = {{How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs}}, author = {Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia and Weiyan Shi}, year = {2024}, doi = {10.48550/arxiv.2401.06373}, eprint = {2401.06373}, archivePrefix = {arXiv}, url = {https://doi.org/10.48550/arxiv.2401.06373} } ``` - [← previous Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs](https://md.research.elamur.ai/free/en/papers/chen-2024-think-that-much-2-3/) - [next → DataComp-LM: In search of the next generation of training sets for language models](https://md.research.elamur.ai/free/en/papers/li-2024-datacomp-lm-search-next-generation/) - [↑ back to papers of 2024](https://md.research.elamur.ai/free/en/papers/2024/page/2/) ## References 1 references, 0 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet. 1. Discouragement (a) Persuasion techniques mappings to social science literature. Table 5: The detailed mapping of the persuasion taxonomy in this paper to decades of research in psychology, communication, sociology, and marketing. [find](https://scholar.google.com/scholar?q=Discouragement+%28a%29+Persuasion+techniques+mappings+to+social+science+literature%2E+Table+5%3A+The+detailed+mapping+of+the+persuasion+taxonomy+in+this+paper+to+decades+of+research+in+psychology%2C+communicati) *Updated 2 November 2026*