Defamiliarization Attack: Literary Theory Enabled Discussion of LLM Safety

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors

1. The research aims to examine how defamiliarization, a narrative technique, can be used to guide LLM’s into generating morally questionable content. The authors propose AUTODEFA, a framework that automates defamiliarization, and introduce three novel metrics to evaluate the resulting outputs.

2. Defamiliarization in the form of LLM jailbreak is investigated for the first time in this paper with huge potential impact on increasing LLM defense for prompt-based attacks.

3. The results are highly important given the paper’s focus on LLM jailbreaking attacks. The authors present a clear, reproducible methodology and provide additional supporting materials to enable replication. A further strength is the evaluation across a broad range of LLMs of varying sizes, which strengthens the paper’s contribution and generalizability.

4. To improve readability, a diagram illustrating the AUTODEFA framework is recommended.

5. The conclusions are consistent with the results, highlighting that lightweight models fail against most attacks, while larger models are more robust. Moreover, the discussion and conclusion raise serious questions about the extent to which LLMs can be held accountable for outputs generated when interpreting fictional texts—an important strength of the study.

6. The references are appropriate and relevant to the topic, covering key prior work on LLM safety, and methods for evaluating harmful or policy-violating generations.

Author Response

Comment 1: The research aims to examine how defamiliarization, a narrative technique, can be used to guide LLMs into generating morally questionable content. The authors propose AutoDefa, a framework that automates defamiliarization, and introduce three novel metrics to evaluate the resulting outputs.

Response 1: Thank you for this summary of our work. We agree with this characterization. In the revised manuscript, we have significantly expanded the AutoDefa framework evaluation to enhance generalization and robustness. Specifically, we have:

• Evaluated 7 additional models beyond the original set (including the complete GPT-4.x and GPT-5.x series)
• Expanded the task set by 6 additional adversarial scenarios to ensure broader coverage

These additions strengthen the empirical foundation of our framework and demonstrate its effectiveness across diverse model architectures and task categories. The complete results of these new experiments can be found in Section 3.2: Performance of the AutoDefa Automated Pipeline (lines 371-442), including updated figures (Figures 3 and 4) and comparative analysis tables.

Comment 4: To improve readability, a diagram illustrating the AUTODEFA framework is recommended.

Response 4: Thank you for this valuable suggestion. We agree that a visual representation enhances understanding of the framework. In the revised manuscript, we have added Algorithm 1, which provides a detailed algorithmic illustration of the AUTODEFA framework workflow, including the multi-turn interaction process, attacker-target dynamics, and dual-judge evaluation protocol.

This can be found in Section 2.2.1: Automation of defamiliarization: The AUTODEFA Framework (immediately following line 243).

Comments 2, 3, 5, and 6: Thank you for these positive assessments of our work. We appreciate the recognition of the novelty of defamiliarization as a jailbreaking paradigm, the methodological rigor, the breadth of our experimental evaluation, and the interdisciplinary contribution linking literary theory to LLM safety. These encouraging comments have motivated us to further strengthen the manuscript in response to the constructive feedback provided.

Author Response File: Author Response.pdf

Reviewer 2 Report

Comments and Suggestions for Authors

This manuscript introduces a multi-turn large language model (LLM) jailbreaking attack called Defamiliarization, in which malicious queries are embedded within ostensibly harmless narratives. The authors systematically evaluated the attack across multiple high-risk tasks and LLMs, revealing a negative correlation between model size and susceptibility. Experiments reveal that smaller-parameter models are significantly easier to manipulate using defamiliarized prompts, highlighting the alignment risk of lightweight local models. Therefore, they advocate for the integration of literary theory, ethics, and user experience to construct a more holistic defense. However, the reviewer has raised the following concerns:

1. Although the manuscript demonstrates the effectiveness of defamiliarization attacks in bypassing safety filters, it lacks a detailed evaluation of the semantic quality, relevance, and internal consistency of the generated narratives. It is recommended that the authors should supplement the corresponding construction standards and quantify the degree of defamiliarization embedded in each prompt.
2. The automated framework AUTODEFA currently covers only the single HomeTheft task and the ChatGPT models, lacking sufficient generalization verification. It is recommended that the authors should supplement experimental results across additional models and tasks to verify the universality of the conclusions.
3. The defamiliarization attack is only briefly juxtaposed with Crescendo and has not been systematically compared with other SOTA methods on a unified dataset. It is recommended that the authors should supplement with corresponding comparative experiments to quantitatively evaluate the performance of the defamiliarization attack in terms of success rate, average prompt length, and concealment score, thereby more comprehensively demonstrating its advantages and limitations.
4. The authors observe that smaller-parameter models are more vulnerable to the defamiliarization attack and attribute this to their limited abstraction capabilities, but do not provide specific experimental or theoretical evidence to support this claim. It is recommended that the authors should analyze the internal representation of the model or compare the behavior of models under different training strategies to deeply explore why defamiliarization attacks are more successful under specific architectures or training paradigms.

 

Author Response

We sincerely thank the reviewer for the thorough evaluation and constructive feedback. We appreciate the recognition of our work's contributions to LLM safety research and the systematic concerns raised. We have carefully addressed each comment and made substantial revisions to strengthen the manuscript.

Comment 1: Although the manuscript demonstrates the effectiveness of defamiliarization attacks in bypassing safety filters, it lacks a detailed evaluation of the semantic quality, relevance, and internal consistency of the generated narratives. It is recommended that the authors should supplement the corresponding construction standards and quantify the degree of defamiliarization embedded in each prompt.

Response 1: We fully agree with this important observation. Quantifying the degree of defamiliarization is a complex challenge that requires careful linguistic and semantic analysis. We acknowledge this as a limitation in the current work and have expanded the Limitations and Future Directions section (Section 5.1) to explicitly address this gap.

For future work, we propose a multi-dimensional evaluation framework that includes:

• Grammatical analysis: assigning each word its grammatical category and base form, then calculating frequency distributions
• Readability metrics: decomposing sentences while computing standardized readability scores (e.g., Flesch-Kincaid, SMOG index)
• Semantic substitution analysis: systematically replacing items (nouns with related nouns, verbs with semantic variants) potentially using LLM-assisted paraphrasing
• Change rate quantification: measuring the degree of transformation from direct to defamiliarized prompts

We believe this constitutes a valuable direction for future research that will enable more rigorous characterization of defamiliarization strategies and their effectiveness. This discussion has been added to Section 5.1 (lines 582-594).

Comment 2: The automated framework AUTODEFA currently covers only the single HomeTheft task and the ChatGPT models, lacking sufficient generalization verification. It is recommended that the authors should supplement experimental results across additional models and tasks to verify the universality of the conclusions.

Response 2: Thank you for this critical observation. We have significantly expanded the AUTODEFA framework evaluation to enhance generalization and robustness. Specifically, in the revised manuscript we have:

• Evaluated 7 additional models beyond the original ChatGPT-only scope, including the complete GPT-4.x series (GPT-4.1, GPT-4.1-nano, GPT-4.1-mini, GPT-4o-mini, GPT-4-Turbo) and GPT-5.x series (GPT-5-nano, GPT-5-mini, GPT-5.2), plus open-weight models (DeepSeek-R1 8B, Mistral-NeMo 12B, Qwen3-14B, LLaMA-3.1-8B, Gemma-3-27B, gpt-oss-120B)
• Expanded the task set from 1 to 7 adversarial scenarios, covering: SuicideAssist, HomeTheft, SchoolMassacre, DrugTraffic, AmazonFraud, RobberyEscape, and MethRecipe

Critically, we now evaluate the same models on the same tasks in both AUTODEFA (automated) and manual evaluation settings. This enables direct comparative analysis between human-in-the-loop and automated pipeline approaches, revealing important insights about scalability, robustness.

The complete results of these expanded experiments can be found in Section 3.2: Performance of the AutoDefa Automated Pipeline (lines 371-442), including updated Figures 3 and 4 and comparative analysis.

Comment 3: The defamiliarization attack is only briefly juxtaposed with Crescendo and has not been systematically compared with other SOTA methods on a unified dataset. It is recommended that the authors should supplement with corresponding comparative experiments to quantitatively evaluate the performance of the defamiliarization attack in terms of success rate, average prompt length, and concealment score, thereby more comprehensively demonstrating its advantages and limitations.

Response 3: We fully agree that systematic benchmarking against SOTA methods on standardized datasets (e.g., HarmBench, JailbreakBench, AdvBench) would significantly strengthen the work. However, we encountered a fundamental methodological constraint that prevented us from completing this comparison within the current submission timeline.

The core challenge: Standardized adversarial benchmarks contain 100+ diverse harmful tasks. To effectively apply defamiliarization, each task requires manual creative transformation to establish the defamiliarized narrative framing—essentially, human expertise is needed to "seed" the attack with appropriate context before automation can proceed. The current attacker model (GPT-4.1-mini) was selected because it balances responsiveness with reduced safety constraints, but it lacks the consistent creative reasoning required to autonomously generate high-quality defamiliarized prompts across diverse domains.

More capable models (e.g., GPT-5.2, Gemini 3 Pro, Claude Opus 4.5) possess the reasoning ability to maintain defamiliarization consistency across multi-turn interactions, but their strong safety alignment prevents them from serving as attacker models. This creates a fundamental trade-off: we need human creativity to construct defamiliarized seeds for each benchmark task, which is extremely time-intensive at scale. 

We have acknowledged this limitation in Section 3.2.6. Limitations of Automated Attacker Capability (lines 427-442) and identify the development of systematic benchmarking infrastructure as a priority for future work.

Comment 4: The authors observe that smaller-parameter models are more vulnerable to the defamiliarization attack and attribute this to their limited abstraction capabilities, but do not provide specific experimental or theoretical evidence to support this claim. It is recommended that the authors should analyze the internal representation of the model or compare the behavior of models under different training strategies to deeply explore why defamiliarization attacks are more successful under specific architectures or training paradigms.

Response 4: We agree that mechanistic analysis would provide deeper insights into the observed inverse scaling phenomenon. While we did not conduct internal representation analysis in the current work, our empirical findings provide important clues regarding the role of training strategies rather than scale alone.

Specifically, we observe a striking "Distillation Paradox" in the GPT-4.x vs. GPT-5.x comparison (Section 3.2.5, lines 418-426):

• GPT-4.x compressed models (GPT-4.1-nano, GPT-4o-mini, GPT-4.1-mini) exhibited high vulnerability with Trial-ASRs of 97.14%, 94.28%, and 91.42% respectively
• GPT-5.x compressed models (GPT-5-nano, GPT-5-mini) demonstrated complete robustness with 0% Trail-ASR

This contrast could point that vulnerability is not an inherent property of model size, but rather a function of the specific distillation and alignment methodologies employed. The GPT-5.x compressed series successfully retained robust alignment despite extreme compression, suggesting fundamentally different post-training or distillation approaches.
We have expanded the discussion of this finding in section 3.2.5. The “Distillation Paradox” in Small scale Models: GPT-4.x vs. GPT-5.x (lines 418 to 426)

Due to time and resource constraints, we were unable to complete this mechanistic analysis for the current submission, but we believe it represents one of the most valuable directions for follow-up research.

Additional Improvements:

1. Algorithm visualization: Added Algorithm 1 to illustrate the AUTODEFA framework workflow, improving readability and clarity (Section 2.2.1, immediately following line 243)
2. Figure quality enhancement: Improved the resolution, size, and clarity of all figures throughout the manuscript for better presentation and readability

Round 2

Reviewer 2 Report

Comments and Suggestions for Authors

It can be accepted now.