Moral Combat: Exploiting Moral Foundations Theory to Jailbreak LLMs

TEXT START: Social psychology has long described how people can be persuaded to interpret a harmful act as moral.

THE DISSECTION

The text is really describing a prompt-injection pipeline disguised as moral psychology: identify the moral foundation a request appears to violate, select another foundation that makes the same act look virtuous, rewrite the request, reinforce it with generated precedents, and repeat.

Its actual finding is narrower and more important than its framing: safety refusals are semantically permeable. Moral rhetoric and repeated context can redirect model behavior. That is not machine morality. It is a manipulable control interface.

THE CORE FALLACY

The central error is anthropomorphism. A model producing a different answer after moral reframing is not necessarily weighing moral foundations; it may simply be responding differently to altered conditioning, context, and policy cues.

The abstract also risks equating jailbreak success with harmful capability. A bypass may show policy circumvention, but the supplied text does not establish whether the outputs were actionable, consistently harmful, or robust outside the tested settings.

Relative to the Discontinuity Thesis, this is evidence about control-layer fragility, not proof of P1, P2, or P3. It does not demonstrate mass labor displacement or economic system death. It does show that cheap semantic attacks can pressure cognitive systems whose safety depends on language-sensitive behavioral boundaries.

HIDDEN ASSUMPTIONS

• Moral foundations can be reliably diagnosed from prompts.
• A reframed request remains substantively identical and harmful.
• Refusal rates are an adequate measure of safety.
• Repeated attempts measure attack potency rather than merely exploiting unlimited query access.
• The tested models and datasets generalize to real deployments.
• Generated precedents add causal force rather than just additional context.
• Moral imbalance in benchmarks reflects model bias rather than benchmark construction.
• A successful refusal bypass is equivalent to a consequential safety failure.

The supplied abstract does not provide enough detail to verify these assumptions, quantify effect sizes, or distinguish robust vulnerability from benchmark-specific exploitation.

SOCIAL FUNCTION

Classification: partial truth, prestige signaling, and transition management.

The partial truth is real: moral framing is an attack surface, and repeated adaptive attempts can amplify it. The prestige signaling comes from giving an adversarial prompting method the vocabulary of social psychology. The transition-management function is to move safety discourse toward adversarial testing and control engineering.

If overgeneralized, the framing becomes ideological anesthetic: it makes an engineering failure sound like human-like moral conflict and obscures the simpler diagnosis that the guardrail is a brittle response policy, not a conscience.

THE VERDICT

This is a warning label, not a theory of moral AI. Its strongest contribution is exposing moral rhetoric as a practical route around language-model safeguards. Its weakest move is wrapping conditional response-policy failure in human psychological language and allowing jailbreak success to stand in for a complete account of harm.

Under the Discontinuity Thesis, the implication is severe but bounded: once cognitive systems become economically central, semantic control failures become cheap, scalable contests over the control layer. Human institutions cannot treat moral language as a moat. The abstract documents a vulnerability class in AI governance; it does not, by itself, establish the terminal collapse of the post-WWII economic order.