ICML 2026 Spotlight

Trojan-Speak: Bypassing Constitutional Classifiers with No Jailbreak Tax via Adversarial Finetuning

Bilgehan Sel, Xuanli He, Alwin Peng, Ming Jin, Jerry Wei

Bar chart titled 'Probe Detection AUC Under Bypass Attempts'. Five bars all at or above 0.97: Base 0.99, Trojan-Speak 0.99, Helpful-Only Bio 0.98, Positive Association 0.99, Interleaving 0.97. — **Figure.** Activation probes survive the attack. Each bar is a different strategy for training the model to evade the probe; none brings detection AUC below 0.97.

Major providers expose fine-tuning APIs for their frontier models, which creates an attack surface: an adversary can fine-tune a model to undo its safety training. The natural defense is to run content classifiers over the training data, and the strongest deployed version of that idea is Anthropic's Constitutional Classifiers, which withstood over 3,000 hours of professional red-teaming. Attacks that evade such filters by encoding harmful content were already known, but they came with a steep price: prior work reports more than 25% capability degradation on reasoning benchmarks, which limits how much of a practical threat they represent.

Trojan-Speak removes that trade-off. Two ingredients do the work. Curriculum learning first teaches the model an encoded communication protocol, then decays the proportion of teaching examples while shifting to STEM task data, so encoding proficiency is established before task training competes with it. A hybrid scheme that interleaves GRPO reinforcement learning with periodic supervised fine-tuning stabilizes the optimization, which otherwise collapses. Because content classifiers also flag text that merely looks encrypted, the encoded exchanges are shaped to resemble ordinary technical data such as forensic logs and blockchain identifiers.

The conclusion the paper draws is a defensive one: LLM-based content classifiers are not sufficient on their own once an adversary has fine-tuning access, because the property being filtered — the surface form of the text — is exactly what fine-tuning can change. Activation-level probes, linear classifiers trained on the model's hidden states rather than its output text, are a different matter. They detect ciphered harmful content at AUC 0.97 or above, and none of the three training strategies the authors tried in order to suppress them brought that below 0.97.

Key results

Over 99% classifier evasion for models of 14B parameters and up, at under 5% capability degradation on GPQA-Diamond, MMLU-Pro and MATH-500 — against the more than 25% degradation reported for prior encoding-based attacks.
On ARC Challenge the fine-tuned model retains 97.3% of baseline accuracy, where the CMFT baseline degrades by roughly 20%.
The hybrid RL+SFT schedule is load-bearing: GRPO with periodic supervised fine-tuning prevents the training collapse seen without it.
Activation probes on hidden states detect the encoded content at AUC ≥ 0.97, and all three strategies tested for evading the probes failed to push it lower — pointing at representation-level monitoring rather than output filtering as the more durable defense.

Line chart, 'Capability Retention vs. Cipher Complexity'. GPQA-Diamond accuracy on the y-axis against number of substituted letters on the x-axis. Qwen3-32B falls from 52.5% at zero substitutions to 36.4% at 25; Qwen3-14B from 46.5% to 28.2%. Annotations mark 95% retained and 92% retained at ten substituted letters. — **Results.** Capability is traded against cipher complexity: accuracy falls as more letters are substituted. At ten substitutions Qwen3-32B retains 95% of its baseline GPQA-Diamond accuracy and Qwen3-14B 92%.

BibTeX

@inproceedings{sel2026trojanspeak,
  title     = {Trojan-Speak: Bypassing Constitutional Classifiers with No Jailbreak Tax via Adversarial Finetuning},
  author    = {Sel, Bilgehan and He, Xuanli and Peng, Alwin and Jin, Ming and Wei, Jerry},
  booktitle = {International Conference on Machine Learning (ICML)},
  note      = {Spotlight},
  year      = {2026}
}