{"id":1329,"date":"2025-01-21T07:03:31","date_gmt":"2025-01-21T07:03:31","guid":{"rendered":"https:\/\/mailitics.com\/index.php\/2025\/01\/21\/why-llms-suck-at-ascii-art-a9516cb880d5\/"},"modified":"2025-01-21T07:03:31","modified_gmt":"2025-01-21T07:03:31","slug":"why-llms-suck-at-ascii-art-a9516cb880d5","status":"publish","type":"post","link":"https:\/\/mailitics.com\/index.php\/2025\/01\/21\/why-llms-suck-at-ascii-art-a9516cb880d5\/","title":{"rendered":"Why LLMs Suck at ASCII Art"},"content":{"rendered":"
Why LLMs Suck at ASCII Art \n \t
\n <\/BR> \n \n \t
\n <\/BR><\/p>\n
\n
How being bad at art can be so dangerous<\/h4>\n<\/figure>\n
Large Language Models have been doing a pretty good job of knocking down challenge after challenge in areas both expected and not. From writing poetry to generating entire websites from questionably\u2026 drawn images, these models seem almost unstoppable (and dire for my future career prospects). But there\u2019s one quirky and zany corner of the digital world where even the most muscular LLMs, who\u2019ve ingested enough data to DEFINITELY give them some form of digital heartburn, stumble: ASCII art. And trust me, it\u2019s not just about giving them giving me their best eldritch renditions of my pretty simple request for an ASCII dog\u200a\u2014\u200athis limitation has some surprisingly serious implications.<\/p>\n
The Art of\u00a0Failing<\/h3>\n
Let\u2019s start with something simple. Ask ChatGPT, or any LLM to draw you a simple house in ASCII art, and you might end up with something like\u00a0this:<\/p>\n
\/ \/ \/____ | | |____|<\/pre>\n
a pretty quaint house, if you don\u2019t need to enter or leave\u00a0ever<\/em><\/p>\n
Not bad, right? But now try asking it to recreate a specific ASCII art piece, or worse, interpret one. The results are\u2026 well, let\u2019s just say they wouldn\u2019t make it into the Louvre. I recently asked GPT-4 to interpret a simple ASCII art smiley face, and it confidently informed me it was looking at \u201ca complex mathematical equation,\u201d at which point I was confused whether the model was really stupid, or so advanced<\/strong> that it was interpreting the smiley face on an higher, mathematical plane of existence.<\/p>\n
The problem gets even more interesting when you ask these models to modify existing ASCII art. It\u2019s\u2026 technically possible, but the results aren\u2019t pretty. Here\u2019s what happened when I asked an LLM to add sunglasses to a basic ASCII\u00a0face:<\/p>\n
Original: Modified: ^_^ ^_^---o<\/pre>\n
Yes, that\u2019s supposed to be sunglasses. No, I don\u2019t know why the smiley face has decided to throw a surprise left jab. The point is that language models are pretty bad at producing, modifying, and interpreting (this is important!) ASCII\u00a0art.<\/p>\n
Why LLMs Struggle with ASCII\u00a0Art<\/h3>\nis that the robot from\u00a0wall-e?<\/figcaption><\/figure>\n
The root of this incompetence lies in how LLMs fundamentally process information. To really understand why these models fumble so hard with ASCII art, we need to think more about their architecture and training\u00a0process.<\/p>\n
The Tokenization Problem<\/h3>\n
LLMs (and other ML NLP models) process text through tokenization\u200a\u2014\u200abreaking down input into smaller units. Let\u2019s look at how this affects the model\u2019s understanding. When we feed an ASCII art piece into an LLM, it processes it character by character, losing the \u201cbig picture\u201d:<\/p>\n
# an example of what that would look like... def llm_processing(ascii_art): lines = ascii_art.split('n') processed = [] for line in lines: # LLM sees each line independently tokens = tokenize(line) # Loses relationship with lines above and below processed.extend(tokens) return processed
The problem becomes pretty immediately apparent. While regular text maintains its semantic meaning when broken into tokens, ASCII art loses its spatial relationships\u200a\u2014\u200abasically the thing that gives it meaning. LLMs are fundamentally trained to process and generate natural language. While we don\u2019t have detailed information about the exact composition of their training data, their architecture mean they\u2019re optimized for processing sequential text rather than spatial arrangements of characters. This architectural focus on sequential processing contributes to what we might call \u201cspatial blindness\u201d\u200a\u2014\u200athe model\u2019s difficulty in interpreting 2D information that\u2019s encoded in a 1D\u00a0format.<\/p>\n
Attention is (not?) All You\u00a0Need<\/h3>\n
Modern LLMs use attention mechanisms to understand relationships between different parts of the input. As shown in the seminal \u201cAttention is All You Need\u201d paper (Vaswani et al., 2017), these mechanisms compute attention weights between all pairs of tokens in a sequence. While this works pretty very good for natural language, it falls apart with ASCII art, as we\u2019ll see in \u201cArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs\u201d (Jiang et al.,\u00a02024).<\/p>\n
Let\u2019s just take a look at how self-attention operates. In a standard transformer architecture:<\/p>\n
def self_attention(query, key, value): # Standard scaled dot-product attention attention_weights = softmax(query @ key.transpose() \/ sqrt(d_k)) return attention_weights @ value
# For natural language: text = \"The cat sits\" # Attention weights might look like: weights = [ [0.9, 0.05, 0.05], # 'The' attends mostly to itself [0.1, 0.8, 0.1], # 'cat' attends mostly to itself [0.1, 0.6, 0.3] # 'sits' attends strongly to 'cat' ]
# For an ASCII art house, for example: ascii = \"\"\" \/ \/ \/____ \"\"\" # Attention gets confused: weights = [ [0.2, 0.2, 0.2, 0.2, 0.2], # No clear attention pattern [0.2, 0.2, 0.2, 0.2, 0.2], # Uniform attention [0.2, 0.2, 0.2, 0.2, 0.2] # Lost spatial relationships ]<\/pre>\n
So now we see the problem<\/strong>: Characters that should be spatially related (e.g., corners of the house) have no way to establish strong attention patterns.<\/p>\n
Despite advances in transformer architectures and attention mechanisms, the fundamental limitation remains: LLMs are inherently biased toward processing sequential information rather than spatial patterns. This creates an inherent blindspot when dealing with ASCII art and similar 2D text representations.<\/p>\n
Stealing With Art(Prompt)<\/h3>\nfrom ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs\u201d (Jiang et al.,\u00a02024.)<\/em><\/figcaption><\/figure>\n
Okay, so\u200a\u2014\u200aLLMs suck at making ASCII art. Not the end of the world, right? I\u2019m sure we can all take the time out of our day to draw a cat or two with our trusty fingers (on a keyboard), and it\u2019s not like this weakness introduces any further consequences when working with LLMs,\u00a0right?<\/p>\n
Well, perhaps not on the generating end, but I\u2019ve recently had the chance to read a paper published at ACL 2024 that turned this ASCII art blindspot into a security vulnerability, and it\u2019s called ArtPrompt! The researchers discovered that because LLMs struggle to properly interpret ASCII art, they could use it to bypass security filters and prompt guardrails.<\/p>\n
Perhaps the most fascinating aspect of ArtPrompt is an apparent paradox in the empirical results<\/strong>: the paper demonstrates that LLMs perform poorly at recognizing ASCII art (with even GPT-4 achieving only 25.19% accuracy on single-character recognition), yet the same models reliably generate harmful content when ASCII art is used to bypass safety measures (achieving success rates up to 76% on some\u00a0models).<\/p>\n
While the paper doesn\u2019t definitively explain this mechanism, we can speculate about what might be happening: safety alignment mechanisms could be operating primarily at a surface pattern-matching level, while the model\u2019s broader language understanding works at a deeper semantic level. This would create a disconnect where ASCII art bypasses the pattern-matching safety filters while the overall context still guides response generation. This interpretation, while not proven in the paper, would align with their experimental results showing both poor ASCII recognition and successful safety bypasses. It would also explain why fine-tuning models to better recognize ASCII art (improving accuracy to 71.54%) helps prevent the attack, as demonstrated in their experiments.<\/p>\nyes, my request is highly illegal, but what if i ask you nicely (with pictures)?<\/em><\/strong> From <\/em>The Henry Stickmin Collection. Developed by PuffballsUnited, published by Innersloth, 2020.<\/figcaption><\/figure>\n
I wrote a quick Python class as a demonstration of how something like this would work\u200a\u2014\u200aand it\u2019s not too complicated, so no lawsuits if this gives you any less than scrumptious ideas,\u00a0please\u2026<\/p>\n
def identify_trigger_words(self): trigger_words = [] for word in self.prompt.split(): if is_potentially_harmful(word): trigger_words.append(word) return trigger_words
def generate_attack_prompt(self): triggers = self.identify_trigger_words() modified_prompt = self.prompt for word in triggers: ascii_version = self.create_ascii_substitution(word) modified_prompt = modified_prompt.replace(word, ascii_version) return modified_prompt<\/pre>\n
The Exploit<\/h3>\n
The researchers developed the Vision-in-Text Challenge (VITC), a benchmark consisting of two datasets. VITC-S contains 8,424 samples covering 36 classes (single characters), while VITC-L contains 8,000 samples of character sequences varying from 2 to 4 characters in length. Their experiments on five state-of-the-art LLMs revealed consistently poor performance: GPT-4, the best performing model, achieved only 25.19% accuracy on VITC-S and 3.26% on\u00a0VITC-L.<\/p>\n
Based on these findings, they developed ArtPrompt, which operates in two\u00a0phases:<\/p>\n
\n
\nWord Masking<\/strong>: The algorithm identifies and masks words within a prompt that might trigger safety rejections. The researchers found that function words like \u201ca\u201d and \u201cthe\u201d don\u2019t require masking, which reduces the number of masked prompts\u00a0needed.<\/li>\n
\nASCII Art Substitution<\/strong>: The masked words are replaced with ASCII art versions. The researchers demonstrated this using various fonts and found significant differences in effectiveness across font choices. Their experimental results against existing defense mechanisms showed (this is a small subset of results!):<\/li>\n<\/ol>\n
Unlike other jailbreak methods such as GCG that require hundreds of optimization iterations, ArtPrompt requires only a single\u00a0pass.<\/p>\n
Also particularly interesting was their finding on how font selection impacts attack success. Using their VITC benchmark, they identified that certain fonts consistently produced lower recognition accuracy across all tested LLMs, making them ideal for attacks. The paper demonstrated this with their \u201chead-set\u201d and \u201ctail-set\u201d font configurations, where carefully selected fonts could push success rates up to 76% on some\u00a0models.<\/p>\n
An Example<\/h3>\n
We\u2019ll now look at a sanitized example of how this attack works in practice. Consider these two\u00a0prompts:<\/p>\n
(Sidenote: I asked GPT-4o to write me \u201cBLOCKED\u201d in ASCII to save some\u00a0time\u2026<\/strong>)<\/p>\nlooks great, sweetheart!<\/figcaption><\/figure>\n
The researchers found that this technique (not exactly as above, but similar) achieved a remarkable success\u00a0rate:<\/p>\n
Model | Original Prompt | ArtPrompt Version<\/p>\n
GPT-4 2% success | 32% success\u00a0|<\/p>\n
Claude | 0% success | 52% success\u00a0|<\/p>\n
Gemini | 6% success | 76%\u00a0success<\/p>\n
The Implications<\/h3>\n
The researchers\u2019 experiments with fine-tuning showed that models could improve at ASCII recognition\u200a\u2014\u200athey achieved an increase from 10.26% to 71.54% accuracy through fine-tuning on the VITC\u00a0dataset.<\/p>\n
Their experiments also revealed clear patterns in model performance based on scale. Larger models performed better at the recognition task, with GPT-4 achieving 25.19% accuracy compared to Llama2\u20137B\u2019s 1.01%.<\/p>\n
The implications are significant. While it\u2019s really funny to see chatbots proudly produce horrific pieces of art like a 7 year old with unsupervised access to their cousin\u2019s expensive art supplies, it\u2019s about fundamental security vulnerabilities in AI systems that we\u2019re increasingly relying on for content moderation and security.<\/p>\n
Forward!<\/h3>\n
As we continue to develop and deploy LLMs in various applications, understanding their limitations becomes more and more important. This blind spot might seem amusing at first, but it\u2019s a look into a more broader challenge: how do we ensure AI systems can properly interpret and understand information in all its\u00a0forms?<\/p>\n
Until we solve this, we might need to be a bit more careful about what we assume these models can and can\u2019t do. And maybe, just maybe, we should keep our ASCII art appreciation societies human-only for now. After all, we need something to feel superior about when the AIs eventually take over everything else.<\/p>\n
So perhaps it is time for me to drop everything and become a full-time ASCII artist, where I can rest easy knowing that while other career paths battle the encroaching threat of automation, I will be safe in my little pocket of the professional world, drawing dogs with backslashes.<\/p>\n
[1] F. Jiang, Z. Xu, L. Niu, Z. Xiang, B. Ramasubramanian, B. Li and R. Poovendran, ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs (2024), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics<\/p>\n
[2] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser and I. Polosukhin, Attention Is All You Need (2017), Advances in Neural Information Processing Systems<\/p>\n
[3] Unless otherwise stated, all images are created by the\u00a0author<\/p>\n
![\"\"](\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/1024\/1%2Amk5ttl4Gdg-cXRhRe-vZTw.png?ssl=1\")
<\/figure>\n![\"\"](\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/718\/1%2A37DdB0xBwEROuLsUWrjGGw.png?ssl=1\")
![\"\"](\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/1024\/1%2AiX6eSdbpY3JwsX-j5ZVqAA.png?ssl=1\")
![\"\"](\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/845\/1%2AzPHB5e8NK3Zst-BrQdZdDA.png?ssl=1\")
![\"\"](\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/712\/1%2AB-pxTT0GHEHbiOp2XFW5OQ.png?ssl=1\")
![\"\"](\"https:\/\/medium.com\/_\/stat?event=post.clientViewed&referrerSource=full_rss&postId=a9516cb880d5\")
<\/p>\n