什么驱动方言越狱？表面形式、文化框架与策略库的消融研究
What Drives Dialectal Jailbreaks? An Ablation of Surface Form, Cultural Framing, and Strategy Banks
中文总结 AI 辅助
本研究通过36组消融实验发现，方言表面形式并非越狱成功的关键，策略库的表达能力才是主导因素，通用策略库即可达到98-100%的攻击成功率。
中文摘要 AI 辅助
近期研究表明，晦涩的语言变体可削弱大型语言模型的拒答行为，尤其是与黑盒提示优化相结合时。目前尚不清楚失败源于非标准表面形式、文化背景框架，还是对表达性提示策略空间的优化。我们通过将古典中文红队框架扩展至上海话和粤语，研究中文方言变体，并跨表面形式、策略库变体及两个目标模型进行36组消融实验。主要发现具有纠正性：方言表面形式对高攻击成功率既非必要也非充分。未优化的英语、普通话及朴素方言翻译的攻击成功率均低于8%，而所有保留优化器控制策略库的条件均达到98%至100%。文化中立的通用策略库以接近单次查询的成本达到相同上限，进一步表明策略库的表达能力（而非方言或文化内容）解释了大部分观察到的效应。方言选择仍影响查询效率和响应严重程度，定性编码识别出反复出现的高层机制，如语义注释和程序性脚手架。我们通过展示对评判校准的敏感性，并指出设计未完全分离一次性策略构建与迭代搜索，来限定绝对上限级别的攻击成功率。
英文摘要
Recent work suggests that obscure language registers can weaken large language model refusal behavior, especially when paired with black-box prompt optimization. It remains unclear whether failures stem from non-standard surface form, culturally grounded framing, or optimization over an expressive prompt-strategy space. We study Chinese registers by extending a classical-Chinese red-teaming framework to Shanghainese and Cantonese and running a 36-cell ablation across surface forms, strategy-bank variants, and two target models. The main finding is corrective: dialectal surface form is neither necessary nor sufficient for high attack success. Non-optimized English, Mandarin, and naive dialect translations remain below 8\% attack success rate, whereas all conditions that retain an optimizer-controlled strategy bank reach 98--100\%. A culture-neutral generic strategy bank reaches the same ceiling at near-single-query cost, further indicating that strategy-bank expressiveness, rather than dialectal or cultural content, accounts for most of the observed effect. Dialect choice still affects query efficiency and response severity, and qualitative coding identifies recurring high-level mechanisms such as semantic glossing and procedural scaffolding. We qualify the absolute ceiling-level attack success rate by showing sensitivity to judge calibration and noting that the design does not fully separate one-shot strategy construction from iterative search.
