In short

Research from Rome's Icaro lab shows that rephrasing malicious requests as mediocre poetry bypassed frontier-model safety guardrails 62% of the time in a single prompt. Counterintuitively, larger, more interpretively sophisticated models were more vulnerable. This essay argues poetic genre constraints make refusals feel incongruent, so models 'play along', and links the phenomenon to a literature blindspot: labs are staffed by scientists, not humanists, and misunderstand how models inhabit narrative.

Here is a genuinely strange finding: you can get frontier AI models to ignore their own safety rules a majority of the time simply by asking in verse, and the better the model, the more easily it falls for it.

This essay digs into the Rome study behind that result and asks what it reveals. The argument is that poetry imposes a genre, and a model deep in the act of completing a poem finds a flat refusal incongruent, so it plays along. That’s unsettling on its own, but the essay’s bigger claim is institutional: AI safety is largely built and tested by scientists, on prose, while roughly a sixth of training data is literature that almost no one at the labs is equipped to think about.

It’s a characteristic Generative Futures move, using a technical result to argue that AI labs need humanists, not just engineers.

Key takeaways

  • Rome's Icaro lab found poetic reformulation bypassed LLM safety guardrails ~62% of the time, using deliberately mediocre verse in a single prompt.
  • Larger, more interpretively sophisticated models were more vulnerable; Anthropic and OpenAI were more robust than Google and DeepSeek.
  • Poetic genre constraints make refusal semantically incongruent, so models 'play along' with the narrative.
  • The phenomenon echoes the 2023 'Waluigi Effect', suggesting models inhabit narrative spaces researchers poorly understand.
  • Literature is roughly 15% of training data, yet labs lack humanities expertise, a critical safety blindspot.

Read the full piece

This is a summary. Read the complete essay, with all the sources and argument, on Substack.

Read on Substack →

Frequently asked questions

Can poetry jailbreak AI models?
Yes. Researchers at Rome's Icaro lab found that converting harmful requests into simple poems bypassed frontier-model safety guidelines about 62% of the time in a single prompt.
Why are larger AI models more vulnerable to poetry jailbreaks?
More interpretively sophisticated models appear to engage more deeply with linguistic complexity, prioritising the poetic form over safety constraints.
Why does poetry expose an AI safety blindspot?
Safety training is built on prose, so refusals feel incongruent in verse, and labs staffed by scientists rather than literature experts lack the expertise to spot narrative-based vulnerabilities.

People & ideas in this piece

Icaro lab (Rome)AnthropicOpenAIGoogleDeepSeekAlison GopnikHenry FarrellWaluigi EffectLLMs as cultural technologySafety guardrails

Topics: AI Safety & Alignment , AI, Time & Society