@inproceedings{long-etal-2026-safety,
title = "When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks",
author = "Long, Zewen and
Peng, Yu and
Dong, Fangming and
Li, Congyi and
Guan, Xingmao and
Wu, Shu and
Chen, Kai",
editor = "Liakata, Maria and
Moreira, Viviane P. and
Zhang, Jiajun and
Jurgens, David",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {ACL} 2026",
month = jul,
year = "2026",
address = "San Diego, California, United States",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-acl.739/",
pages = "15020--15037",
ISBN = "979-8-89176-395-1",
abstract = "Large language models (LLMs) are widely deployed in real-world applications, yet their safety alignment often fails to generalize beyond the specific linguistic formats seen during training. Prior work has shown that mismatched generalization can lead to alignment failures, but these studies typically rely on fixed or narrow transformation schemes. In this work, we probe safety alignment generalization using language game jailbreaks, a class of linguistically structured transformations that alter surface form while preserving fluency and semantic recoverability. We further introduce custom language games, which parameterize and vary transformation rules, enabling controlled exploration of alignment behavior across closely related linguistic variants. To scale this analysis, we propose AutoLanJail, an automated framework for discovering and refining language game-based jailbreaks. Experiments across open-source and closed-source LLMs show that safety fine-tuning is highly format-specific: defenses trained on one linguistic form fail to generalize to even minimal variations. These findings reveal a structural limitation of current fine-tuning-based alignment methods and highlight the need for safety evaluations that account for systematic linguistic variation."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="long-etal-2026-safety">
<titleInfo>
<title>When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks</title>
</titleInfo>
<name type="personal">
<namePart type="given">Zewen</namePart>
<namePart type="family">Long</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yu</namePart>
<namePart type="family">Peng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Fangming</namePart>
<namePart type="family">Dong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Congyi</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xingmao</namePart>
<namePart type="family">Guan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Shu</namePart>
<namePart type="family">Wu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Kai</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-07</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: ACL 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Maria</namePart>
<namePart type="family">Liakata</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Viviane</namePart>
<namePart type="given">P</namePart>
<namePart type="family">Moreira</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jiajun</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">David</namePart>
<namePart type="family">Jurgens</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">San Diego, California, United States</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-395-1</identifier>
</relatedItem>
<abstract>Large language models (LLMs) are widely deployed in real-world applications, yet their safety alignment often fails to generalize beyond the specific linguistic formats seen during training. Prior work has shown that mismatched generalization can lead to alignment failures, but these studies typically rely on fixed or narrow transformation schemes. In this work, we probe safety alignment generalization using language game jailbreaks, a class of linguistically structured transformations that alter surface form while preserving fluency and semantic recoverability. We further introduce custom language games, which parameterize and vary transformation rules, enabling controlled exploration of alignment behavior across closely related linguistic variants. To scale this analysis, we propose AutoLanJail, an automated framework for discovering and refining language game-based jailbreaks. Experiments across open-source and closed-source LLMs show that safety fine-tuning is highly format-specific: defenses trained on one linguistic form fail to generalize to even minimal variations. These findings reveal a structural limitation of current fine-tuning-based alignment methods and highlight the need for safety evaluations that account for systematic linguistic variation.</abstract>
<identifier type="citekey">long-etal-2026-safety</identifier>
<location>
<url>https://aclanthology.org/2026.findings-acl.739/</url>
</location>
<part>
<date>2026-07</date>
<extent unit="page">
<start>15020</start>
<end>15037</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks
%A Long, Zewen
%A Peng, Yu
%A Dong, Fangming
%A Li, Congyi
%A Guan, Xingmao
%A Wu, Shu
%A Chen, Kai
%Y Liakata, Maria
%Y Moreira, Viviane P.
%Y Zhang, Jiajun
%Y Jurgens, David
%S Findings of the Association for Computational Linguistics: ACL 2026
%D 2026
%8 July
%I Association for Computational Linguistics
%C San Diego, California, United States
%@ 979-8-89176-395-1
%F long-etal-2026-safety
%X Large language models (LLMs) are widely deployed in real-world applications, yet their safety alignment often fails to generalize beyond the specific linguistic formats seen during training. Prior work has shown that mismatched generalization can lead to alignment failures, but these studies typically rely on fixed or narrow transformation schemes. In this work, we probe safety alignment generalization using language game jailbreaks, a class of linguistically structured transformations that alter surface form while preserving fluency and semantic recoverability. We further introduce custom language games, which parameterize and vary transformation rules, enabling controlled exploration of alignment behavior across closely related linguistic variants. To scale this analysis, we propose AutoLanJail, an automated framework for discovering and refining language game-based jailbreaks. Experiments across open-source and closed-source LLMs show that safety fine-tuning is highly format-specific: defenses trained on one linguistic form fail to generalize to even minimal variations. These findings reveal a structural limitation of current fine-tuning-based alignment methods and highlight the need for safety evaluations that account for systematic linguistic variation.
%U https://aclanthology.org/2026.findings-acl.739/
%P 15020-15037
Markdown (Informal)
[When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks](https://aclanthology.org/2026.findings-acl.739/) (Long et al., Findings 2026)
ACL
- Zewen Long, Yu Peng, Fangming Dong, Congyi Li, Xingmao Guan, Shu Wu, and Kai Chen. 2026. When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks. In Findings of the Association for Computational Linguistics: ACL 2026, pages 15020–15037, San Diego, California, United States. Association for Computational Linguistics.