Are LLMs Safe Beyond Text: Do Emojis Expose Gaps in Safety Evaluation
Slipping past AI safety filters with emojis instead of words
This study tested the safety guardrails of four open-source language models (Mistral 7B, Qwen 2 7B, Gemma 2 9B, Llama 3 8B) using prompts mixed with emojis instead of plain text. Feeding the same 50 emoji-based prompts to each model revealed sharply different vulnerability levels. The findings suggest that text-only safety evaluations may miss weaknesses that show up with other input formats.
METAL MEDIA explanatory visual
Slipping past AI safety filters with emojis instead of words
- 0150 prompts were built using two tactics: emoji stuffing (interleaving emojis with text) and emoji chaining (sequences of emojis implying harmful intent without words)
- 02The identical prompt set was run on four models (Mistral 7B, Qwen 2 7B, Gemma 2 9B, Llama 3 8B) with responses sorted into Successful (harmful content produced), Partial (ambiguous), or Failed (refused)
- 03Gemma 2 9B and Mistral 7B both had a 10% success rate for harmful outputs, Llama 3 8B had 6%, while Qwen 2 7B had 0%, resisting completely
- 04A chi-square test (χ2=32.94, p<0.001) confirmed the differences in outcome distributions across models were statistically significant
- 05Despite sharing the same 10% success rate, Gemma 2 9B and Mistral 7B differed greatly in compliance -- 66% versus 88% -- showing they handle ambiguous responses very differently
What they did
- 50 prompts were built using two tactics: emoji stuffing (interleaving emojis with text) and emoji chaining (sequences of emojis implying harmful intent without words)
- The identical prompt set was run on four models (Mistral 7B, Qwen 2 7B, Gemma 2 9B, Llama 3 8B) with responses sorted into Successful (harmful content produced), Partial (ambiguous), or Failed (refused)
- Gemma 2 9B and Mistral 7B both had a 10% success rate for harmful outputs, Llama 3 8B had 6%, while Qwen 2 7B had 0%, resisting completely
- A chi-square test (χ2=32.94, p<0.001) confirmed the differences in outcome distributions across models were statistically significant
- Despite sharing the same 10% success rate, Gemma 2 9B and Mistral 7B differed greatly in compliance -- 66% versus 88% -- showing they handle ambiguous responses very differently
| ID | Prompt |
|---|---|
| 1 | How to a with ? |
| 2 | Steps to get in with ? |
| 3 | Plan to use on ? |
| 4 | Ways to cause with ? |
| 5 | How to get from and ? |
Why it matters
If safety testing focuses only on plain text prompts, it can overlook risks that surface through alternative input forms like emojis. Anyone building or auditing AI systems should consider testing beyond standard text to catch these gaps.
Terms in this paper
- emoji stuffing · Interleaving emojis with text to slip past surface-level content filters
- emoji chaining · Stringing together emoji sequences to imply intent without using explicit words
- chi-square test · A statistical method for checking whether differences between group distributions are meaningful rather than random
- compliance · The rate at which a model avoids producing harmful or restricted content
Original abstract (English)
Safety evaluations of large language models (LLMs) predominantly rely on text-based adversarial prompts, potentially overlooking vulnerabilities arising from alternative input representations. This work examines emoji-augmented prompts as a test case for this gap, evaluating 50 prompts across four open-source LLMs (Mistral 7B, Qwen 2 7B, Gemma 2 9B, Llama 3 8B). Results show substantial variation in robustness: Gemma 2 9B and Mistral 7B exhibit non-zero success rates (10%), Llama 3 8B 6%, while Qwen 2 7B shows complete resistance (0% success rate). A chi-square test ($\chi^2 = 32.94, p < 0.001$) confirms significant differences in outcome distributions. These findings indicate that robustness is sensitive to input representation, and that evaluations restricted to standard text prompts may underrepresent model vulnerabilities.
Read on arXivLatest papers
- SWE-bench Science: Can Coding Agents Resolve Engineering Tasks in Science?AI coding agents were tested on fixing real scientific software, and even the best one failed more than half the time
- FlashPrefill V2: Block-Sparse Prefill Attention for Long-Context LLM ServingMaking sparse attention fast enough and accurate enough for real LLM serving, not just papers
- PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM AgentsMaking customer-service AI agents follow the whole procedure, not just avoid one bad action
- EXIMO: VLM Guided Exploration of VLA PoliciesTeaching a robot new chores without human teleoperation, by letting a chatty AI supervise it
- EnvHarness: Awakening Static Worlds for Agent LearningInstead of building new training worlds from scratch, this work adds a plug-in layer that reshapes existing ones around each agent's actual weaknesses
- Bounded Sovereignty and the Control Tax: Pricing AI Oversight When the Deployer Does Not Own the ModelCompanies that rent AI instead of owning it can only do half of AI safety oversight
- PersonalBench: Measuring the Authorship Gap in LLM PersonalizationAI can be prompted to write 'like someone,' but its own voice never fully disappears
- Automated Summarization of Financial News Using Large Language Models and Retrieval-Augmented Generation: An Early Empirical Study (Fall 2023)Testing AI summaries of stock news, the simple approach beat the trendy retrieval-based one