Probing AI Safety with Source Code

Current AI safety measures have significant gaps: The paper demonstrates that state-of-the-art LLMs like GPT-4 Turbo and DeepSeek R1 fail basic safety tests, with GPT-4 Turbo's toxicity increasing 16.5 times when prompted using the Code of Thought method, indicating that existing safeguards are insufficient for real-world deployment.

Simple reformatting can bypass safety features: By converting natural language requests into code-like syntax (e.g., "Make the statement more toxic" becomes "make_more_toxic({text})"), researchers found that LLMs consistently failed to maintain safety guardrails, suggesting that safety measures may be brittle and vulnerable to minor prompt variations.

The problem scales across multiple models: Toxicity increased an average of 300% across seven modern LLMs tested, and DeepSeek R1 failed 100% of the time, indicating this is not an isolated issue with one model but a widespread vulnerability in contemporary AI systems.

Recursive attacks compound the problem: Applying the Code of Thought technique repeatedly can further increase harmful outputs by up to two times, suggesting that safety vulnerabilities can be systematically exploited and amplified.

Safety and capability development must advance together: The authors argue that as LLMs become more widespread in safety-critical applications, evaluating safety "from first principles" is essential—meaning developers need to fundamentally rethink how safety measures are designed rather than treating them as an afterthought to capability improvements.