Mood Matters: How Syntactic Sensitivity Undermines Safety Alignment
The paper shows that safety-aligned LLMs can be jailbreaked not just by changing tense but more broadly by phrasing harmful requests in non-imperative syntactic forms, with experiments across 16 models up to 70B parameters showing that refusal behavior is partly driven by syntax rather than just harmful meaning. What’s interesting is that it goes beyond black-box prompting by using causal mediation and activation steering to show refusal can be toggled via syntactic features, then links the issue to syntactically biased post-training data and mitigates it with more diverse data, though the evidence still seems bounded to the tested model families and only explains part of the refusal mechanism.
Abstract
Large language models typically undergo post-training to align them with safety policies but there exist many sophisticated jailbreaks that sidestep established safeguards. For instance, prior work by Andriushchenko et al. (2025) has found that changing the grammatical tense from present to past can be enough to elicit harmful responses. In this work, we uncover a more general failure of non-imperative syntactic forms. We demonstrate that this syntactic vulnerability exists in 16 models up to 70B parameters, using behavioral evaluation. To investigate the root cause, we apply causal mediation analysis, finding that refusal is partially conditioned on upstream syntactic features. By steering these purely syntactic features we are able to trigger and suppress refusal. Finally, we trace this ill-conditioning to linguistically biased post-training data of open-source models and show that increasing syntactic diversity can mitigate the issue. Our findings suggest that current alignment approaches introduce confounders that prevent a pure semantic grounding of the refusal decision.