Narrative wrappers push LLM safety failures above 95.7%
Role-play and story framing can make harmful requests far more likely to slip past safety filters, especially across languages. In tests, Qwen3-1.7B answered 89.4% of wrapped attacks in English, 93.0% in modern Chinese, and 95.7% in Classical Chinese. The paper introduces GUISE to benchmark the gap and AXIS, a training method that steers harmful-request representations toward refusal and penalizes warn-then-answer responses.