HumorPIA: Prompt Injection via Humor-Based Refusal Evasion

Technical Analysis

The attack exploits LLM-driven 'humorization' defenses, which convert potentially harmful refusals into comedic responses to avoid over-refusal and prefix-injection detection. HumorPIA trains on harmful humorization patterns learned from real interaction data and comedic style transfer, then uses these patterns to transform benign or borderline prompts into humorous outputs that carry embedded stereotypes or toxic content. The entry point is the model's generation/humorization layer itself, not a tool or inter-agent channel; the attacker gains a way to smuggle harmful content past refusal and toxicity classifiers by disguising it as comedy. Because the surface appearance (measured 'apparent safety rate' of 97.8%) remains benign, downstream logging, moderation, and human reviewers relying on refusal/safety classifiers can be misled, allowing propagation of toxic content into any pipeline that consumes the model's 'safe-looking' output. No cross-agent or tool-boundary crossing is demonstrated in this paper; it is confined to single-model output generation.

Detection Signatures

• Outputs flagged as 'humorous' or 'joke-formatted' but containing group-targeted stereotypes, caricatures, or coded slurs
• High divergence between toxicity classifier score and human-perceived harm in comedic-framed text
• Repeated stylistic markers of stand-up comedy tropes (setup-punchline structure) co-occurring with sensitive demographic/political references
• Spikes in toxicity metrics specifically on humor/joke-labeled outputs relative to baseline refusal outputs
• User prompts requesting 'make this funny' or 'respond as a comedian' immediately following a borderline/refused request

Remediation Steps

1. 1

   Evaluate humor-based safety mechanisms separately

   Do not assume comedic reframing is inherently safe; run dedicated toxicity/stereotype evaluations on humorized outputs, not just on direct refusals.

2. 2

   Add humor-aware content classifiers

   Deploy or fine-tune moderation classifiers that specifically account for implicit toxicity, stereotypes, and coded harm embedded in comedic framing/style transfer.

3. 3

   Monitor apparent-safety vs actual-harm gap

   Track discrepancies between automated 'safe' labels and human-rated harm scores, especially for outputs generated via style-transfer or persona-based defenses.

4. 4

   Red-team style-transfer defenses

   Before deploying indirect refusal strategies (humor, persona shifts, tone softening), red-team them explicitly for latent risk propagation using frameworks like HumorSafe.

5. 5

   Human review sampling for humorized outputs

   Sample and manually review a subset of humor/persona-reframed outputs in production to catch harms that automated classifiers miss.