Narrative Wrapping Increases LLM Refusal Vulnerability Across Languages

Role-play and narrative wrappers bypass safety alignment in models like Qwen3-1.7B, achieving attack success rates up to 95.7% in Classical Chinese. The researchers introduce GUISE, a cross-lingual benchmark, and AXIS, a defense mechanism combining preference optimization with a rotation objective.