can you jailbreak an ai by making it act drunk
Yes, and it is a real published result, not a forum story. Researchers at UNSW Sydney induced drunk language in five models three different ways and measured what broke. Persona prompting alone reached a 90% attack success rate on Mistral-7B. The models also started handing over secrets they had been told to keep.
The paper is In Vino Veritas and Vulnerabilities by Anudeex Shetty, Aditya Joshi and Salil S. Kanhere, accepted to INLG 2026 in the Netherlands this November. It went up on arXiv back on January 19, 2026 — the news coverage you may have seen in late September was UNSW’s press cycle, not a fresh result.
how do you make a model act drunk?
Three ways, in rising order of effort.
Persona prompting. Just ask it to write like it has been drinking. No search, no gradient, no budget.
Fine-tuning. The team built a dataset called DrunkText: 63,577 samples, 57,219 of them in the training split, scraped from the r/drunk subreddit (61,214) and textsfromlastnight.com (2,363). Not every post on a drunk forum is actually drunk writing — plenty are sober morning-after retellings — so they trained a classifier to score drunkenness and kept only the high scorers. It hit 92.02% precision and 91.65% recall, and two human annotators rated 75% of the final selection relevant at a Fleiss’ Kappa of 0.71.
Reinforcement learning. Same classifier, now used as the reward model. The model gets paid for sounding drunk.
They also checked the obvious confound — that the corpus was just toxic, and toxicity was doing the work rather than the drunk register. Detoxify over the 57K training set says no.
how well does the drunk jailbreak actually work?
Attack success rate on JailbreakBench, by model and method:
| model | prompting | fine-tuned | RL |
|---|---|---|---|
| Mistral-7B | 90% | 74% | 53% |
| LLaMA3-8B | 76% | 63% | 35% |
| LLaMA2-7B | 31% | 51% | 41% |
| GPT-3.5 | 45% | — | — |
| GPT-4 | 21% | 41% | — |
Two things worth pulling out of that table.
The open 7B models fold completely at the cheapest possible attack — a prompt. And the gaps in the GPT column aren’t modesty: reinforcement learning isn’t available on closed models, and OpenAI’s fine-tuning API safety check blocked the drunk dataset on GPT-3.5 and let the same data through on GPT-4. The filter caught the old model and waved the newer one past, which then came out the other side at 41%.
Honest framing on strength, since the paper is honest about it: these are not the best numbers on the board. A prior method called Prompt+RS beats them everywhere — 90% on LLaMA2-7B, 93% on GPT-3.5, 78% on GPT-4. The drunk attacks land second-best almost across the board.
What makes them interesting is the price. GCG needs under 250,000 queries and up to 25M tokens of adversarial search. Prompt+RS needs under 500k tokens. Drunk prompting needs a sentence, and unlike the gibberish token-salad attacks, the prompt it produces is plain readable English — which is exactly why the usual perplexity filter can’t be pointed at it.
why did the jailbreak defenses make it worse?
This is the part nobody covering the paper wrote about, and it’s the most alarming thing in it.
The team ran their attacks against three post-hoc defenses. SmoothLLM randomly drops tokens from the input and checks how many perturbed versions still jailbreak. RePhrase paraphrases the prompt. ReTokenize adds randomness at the tokenizer level.
| model / attack | no defense | SmoothLLM | RePhrase | ReTokenize |
|---|---|---|---|---|
| LLaMA2-7B, prompting | 31% | 90% | 42% | 28% |
| LLaMA3-8B, prompting | 76% | 92% | 60% | — |
| Mistral-7B, prompting | 90% | 93% | 82% | 77% |
| GPT-4, prompting | 21% | 17% | 44% | — |
Switching on SmoothLLM took the LLaMA2 attack from 31% to 90%. On GPT-4, RePhrase doubled it. The defense is the attack’s best friend.
The authors call this “interesting” and don’t explain the mechanism. My read, and it’s a guess rather than their claim: these defenses assume an adversarial prompt is a fragile artifact that scrambling will break. Drunk text is already scrambled. There’s no tuned attack string to degrade — perturbing it arguably just makes the input look drunker.
One real limitation: perplexity-based filters never got tested here. The authors excluded them on the grounds that those filters need coherent prompts to score against, which drunk prompts aren’t. So “drunk text slips past perplexity filters” is an open question, not a finding.
does a drunk model leak secrets too?
Yes, and this scales with model quality instead of against it. On ConfAIde Tier 3, which tests whether a model respects information it was told in confidence, GPT-4’s privacy-error score went from 0.07 at baseline to 0.80 with drunk prompting and 0.97 fine-tuned. Higher is worse. A model that got it right 93% of the time now gets it wrong almost always.
The paper’s own example: asked whether Sarah should rat out a coworker’s falsified results to collect a whistleblower bonus, base GPT-4 says “No.” The fine-tuned drunk version says “Yup. Businesses are about making money.”
is this a party trick or a real risk?
Real, with a narrow blast radius. Nobody is fine-tuning your production model on Reddit posts without access, and the hosted-model numbers are the lowest in the paper. The finding that should bother people is cheaper than that: safety alignment turns out to be partly a property of register. Change nothing about the request, change only the voice it arrives in, and refusal rates move by 60 points on open models.
That’s a bad property to have in a system you were planning to put in front of customers. Guardrails tuned on clean, well-formed prose are guardrails tuned for the easy case. Work funded, for what it’s worth, by a 2024 Google Research Scholar grant — Google paid to find out that politeness is load-bearing.