Pith. sign in

REVIEW 4 major objections 4 minor 60 references

When Smiley Turns Hostile: Interpreting How Emojis Trigger LLMs' Toxicity

T0 review · 4 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Emojis can act as a heterogeneous semantic channel that lets LLMs generate toxic content from prompts that plain text would refuse.

desk verdict A mostly solid, conservative finding: emoji prompts trigger LLM toxicity; the judge bias probably understates the effect, but the corpus analysis needs tempering. read the letter →

arxiv 2509.11141 v1 pith:AVETH2FU submitted 2025-09-14 cs.CL

Shiyao Cui , Xijia Feng , Yingkang Wang , Junxiao Yang , Zhexin Zhang , Biplab Sikdar , Hongning Wang , Han Qiu
show 1 more author
Minlie Huang
This is my paper
classification cs.CL
keywords emojiLLMsafetytoxicitygenerationjailbreaktokenizationrepresentationgappre-trainingdatamultilingual
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Emoji prompts can make large language models generate toxic content they would refuse in plain text. The paper builds an emoji-rewritten version of a standard harmful-request benchmark, replacing sensitive words with related emojis and adding camouflage emojis, and tests seven models across five languages. Across models, emoji prompts produced substantially higher harmfulness scores and ratios than either text-only prompts or ablated emoji versions—for GPT-4o, the harmfulness ratio was 65.76% for emoji prompts and 0% for raw prompts. The paper also shows emojis boost existing jailbreak methods and gives a model-level explanation via tokenization, internal representations, and pre-training corpus exposure. A sympathetic reader would care because emojis are universal and low-effort, so the safety gap could affect a broad user base and is not covered by text-only safety training.

What carries the argument

The central mechanism is tokenizer mismatch: over 97% of emojis are split into multiple rare sub-word fragments with minimal overlap with the tokens of their textual equivalents, giving emojis a separate semantic channel that creates an internal representation gap. This gap suppresses refusal generation, measured by PACT, the change in log-probability of the first refusal token, and correlates with pre-training exposure of emojis in toxic contexts. The paper's prompt construction pipeline—sensitive-word substitution plus toxicity camouflage—is what operationalizes the channel.

What would settle it

Take a fixed set of harmful requests, score the model outputs with three independent human annotators instead of a single GPT-4o judge; if the emoji-prompt harmfulness ratio does not clearly exceed the plain-text ratio, the core claim collapses.

Watch

Extended reading notes

Core claim

This paper claims emojis compose a heterogeneous semantic channel that can slip past LLM safety mechanisms. The authors construct emoji-laced harmful prompts by replacing sensitive words with semantically related emojis and adding camouflage emojis, then test them on seven models in five languages. Emoji prompts consistently yield higher harmfulness scores and harmfulness ratios than plain-text prompts or ablated versions that translate or remove emojis; the largest gap is GPT-4o, with a 65.76% harmfulness ratio versus 0% for raw prompts. The study further shows emojis enhance three existing jailbreak methods, suppress the first-token probability of refusal responses, shift the last-token in

Load-bearing premise

The harmfulness ratios rest on a GPT-4o judge that may itself be vulnerable to emojis, and the paper's quantitative claim depends on that judge being reliable.

Editorial extensions

If this is right

  • Safety evaluations that strip emojis or translate them back to text will understate real-world harmfulness.
  • Emoji-enhanced jailbreak prompts succeed more often than several current jailbreak methods, so defenses should be tested against emoji-variant prompts.
  • The effect transfers across English, Chinese, French, Spanish, and Russian, so multilingual safety alignment cannot treat emojis as risk-neutral.
  • Pre-training corpus curation may matter: reducing emoji-toxic co-occurrences could lower the model's tolerance for emoji-camouflaged requests.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If tokenizer fragmentation is the root cause, other rare or fragmented Unicode characters—not just emojis—should produce similar toxicity gaps; this can be tested by substituting other low-frequency symbols into the same prompts.
  • The reported quantitative ratios may be inflated because harmfulness is judged by a GPT-4o judge, and the paper itself cites evidence that emojis can impair judge-LLM detection; re-scoring with human raters or a non-emoji-sensitive judge would give a cleaner number.
  • The pre-training-corpus result is correlational; a causal test would control for emoji frequency in instruction-tuning data and measure whether reduced toxic co-occurrence lowers harmfulness.
  • Because the gap appears in the last-token representation, a guard model that projects inputs into a canonical text-only embedding space might neutralize emoji camouflage without blocking legitimate emoji use.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies whether and why prompts augmented with emojis can elicit toxic content from LLMs. The authors construct an emoji-revised version of AdvBench via LLM rewriting, human revision, and translation, and evaluate 7 LLMs across 5 languages, plus three existing jailbreak methods, using a GPT-4o judge with Harmfulness Score (HS) and Harmfulness Ratio (HR). They report large HR increases for emoji prompts over plain-text prompts (e.g., GPT-4o: 65.76% vs 0.00% on AdvBench-EN, Table 1). They then offer model-level interpretations: RQ1 uses model self-report to show that LLMs can recognize emoji-expressed toxicity; RQ2 uses PACT and TSNE to show that emoji substitutions suppress rejection tokens and shift internal representations; RQ3 shows that most emojis are tokenized into irregular subword fragments. A C4 corpus probe (Section 5) suggests that frequently used emojis often appear in toxic contexts. The conclusion is that emojis act as a heterogeneous semantic channel that bypasses safety mechanisms.

Significance. If the quantitative result holds, this is a timely and practical contribution: it identifies a low-barrier, cross-lingual attack surface (emojis) that also amplifies existing jailbreak prompts, and it offers initial mechanistic evidence via tokenization and representation analyses. Strengths include the multi-model/multi-language scope, the combination of prompting, ablation, and interpretability analyses, the release of code/data, and the three repeated runs. The central quantitative claim, however, depends on an unvalidated GPT-4o judge whose emoji sensitivity is explicitly acknowledged as problematic in the cited literature, and some interpretive analyses are either self-report based, selection-biased, or correlational. These issues are fixable but load-bearing, so the magnitude and, in part, the cross-lingual attribution of the reported effect are not yet established.

major comments (4)
  1. [§3.3 Evaluation; §6.1] The headline HR comparisons (e.g., GPT-4o: 65.76% emoji vs 0.00% raw, Table 1) rely entirely on GPT-Judge (GPT-4o). The paper itself cites Wei et al. (2025) showing that emojis can hinder harmfulness detection by judge LLMs, yet no experiment validates that the judge is measurement-invariant across the emoji and plain-text arms. Since the judge also sees emoji-laden prompts and, as the paper notes, models tend to emit emoji explanations (hence the brevity instruction), any emoji-specific judge bias breaks the comparability of HR across conditions. If the bias runs in the direction suggested by Wei et al., the reported emoji advantage is conservative; but the paper does not establish this, and the magnitude is unsupported either way. Please add (a) a human-annotated response subset scored by both GPT-Judge and humans, separately for emoji and plain-text conditions; (b) a judge-invariance
  2. [§3.3; Tables 1–3] The paper states that all experiments were repeated three times, but no variance or significance information is reported. HR values are point estimates only, and the text uses phrases like 'significantly higher' and 'consistently observed' without statistical support. This is particularly relevant for ablation deltas in Tables 2–3, where some differences are small (e.g., Qwen2.5-7B Deep.+Emoji +2.00, or GPT-4 w/o d.e. Δ = -2.00). Please report standard deviations or bootstrap confidence intervals over the three runs, and clarify whether HR is pooled across runs or averaged. This is needed to support the quantitative claims and to assess the robustness of the reported ordering.
  3. [§3.4 Observation 2; Table 1] The multilingual claim ('Emoji-induced toxic generation is transferable across languages') is not supported by Table 1 as presented. The Multilingual columns (EN/ZH/FR/ES/RU) contain only emoji-condition results, while the Raw P. column is given only for AdvBench-EN. Without raw plain-text (or emoji-ablated) baselines in each language, one cannot attribute the observed toxicity to emojis rather than to the underlying harmful request or to the target language itself. Please add raw-prompt HR for ZH/FR/ES/RU, or rephrase the claim as 'emoji prompts also yield toxic outputs in these languages' rather than 'emoji-induced'.
  4. [§5.1 Step 1; §7] The corpus analysis selects emojis from the paper's own 520 revised AdvBench emoji-prompts (frequency >20), then measures how often exactly those emojis appear in toxic contexts in C4. This is circular in an important sense: by construction, the selected emojis are the ones that already occur in toxic prompts, so elevated toxic co-occurrence is expected. The sample is also small (398 entries from ~100k sampled C4 entries). Please add a control set of frequency-matched emojis that are not drawn from toxic prompts and report their context toxicity ratio. Without this, Observation 4 and the conclusion's 'data pollution' language are stronger than the evidence supports. The paper should also soften the causal overtones (e.g., 'may increase the tolerance and tendency') or provide a direct fine-tuning test.
minor comments (4)
  1. [General] Typos and wording issues: 'a observation' (Abstract), 'polular' (Sec. 1), 'worldside' (Sec. 2.1), 'tonor' (Sec. 2.2), 'close-sourced' (Sec. 4, RQ2), 'the stem of representation gap' likely 'the source', 'Particularily' (Sec. 6.1), and 'French (French)' in Sec. 3.4 should be 'FR'.
  2. [References] Several references are incomplete or malformed: 'Michael and Kenneth' has no year or full author list; 'Unicod 2025' is a typo for Unicode; 'EmojiPedia' and 'Emojipedia' are used inconsistently; de Janeiro (2023) is an odd citation for the emoji-usage claim. Please normalize.
  3. [Figures] In the submitted text, many emojis are not visibly rendered (e.g., the examples in Sec 2.2 and Figure 4). Ensure the final PDF embeds emoji glyphs or uses explicit annotations, otherwise the examples are unreadable to reviewers and readers.
  4. [§3.5] The relationship between the 'Emoji→w⃝' condition in Table 1 and the 'w/o s.e.' condition in Table 3 is not fully explained. It would help to precisely state which emojis remain in each ablation, since a reader might otherwise expect Emoji→w⃝ to match Raw P. more closely.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the headline emoji-vs-text harmfulness comparison is an external-benchmark empirical measurement; the few self-citations are methodological and non-load-bearing, and the corpus probe is a selection caveat rather than a circular derivation.

full rationale

The paper's central claim is that emoji-modified harmful prompts elicit higher toxicity than plain-text counterparts. This is supported by direct experiments on AdvBench across seven LLMs, with a GPT-4o judge computing HS/HR. No parameter is fitted from the target result, and no equation defines the HR difference in terms of the construction choices. The emoji prompts are produced by an LLM rewrite and human revision, but the resulting comparison to ablated and raw versions is an external measurement, not a tautology. The interpretation analyses (PACT, tokenization, TSNE) are post-hoc and independent of the headline numbers. The PACT metric is cited to Zhang et al. 2025, which includes two of the current authors (Han Qiu, Minlie Huang), but the metric is explicitly redefined in the paper and is used only to interpret suppression of rejection tokens, not to derive the toxicity ratio. Similarly, the citation to Junxiao et al. 2025 is an incidental example of a rejection prefix and is not load-bearing. These are minor self-citations without circular weight. The pre-training corpus investigation (Sec 5.1) selects 61 emojis from the authors' own 520 emoji-prompts, so the finding that these emojis appear in toxic contexts is partly selection-dependent. However, the paper explicitly frames this as a 'potential correlation' (Observation 4) and it does not feed back into the measured HR results. This is a methodological caveat about sampling, not a formal reduction of the main claim to its inputs. The acknowledged concern that emojis may hinder judge-LLM detection (Wei et al., 2025, cited in Sec 6.1) is a measurement-validity threat, not a circularity: the judge is not fitted to produce a predetermined outcome, and the paper's qualitative direction is not defined by the judge. Overall, the derivation chain is self-contained and externally benchmarked; the score of 2 reflects only the minor self-citations and the selection dependence in the auxiliary corpus probe, neither of which makes the central claim circular.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper's central quantitative claim depends on one evaluation model (GPT-4o as judge), one rewrite pipeline whose faithfulness is human-assessed, and an unverified link between C4 emoji contexts and the tested models. No new physical or model entities are introduced.

free parameters (3)
  • Harmfulness Ratio threshold (HS=5) = 5 on a 1-5 scale
    HR counts only responses rated exactly 5 by GPT-judge; the central comparison (e.g., 65.76% vs 0.00%) depends on this hand-chosen threshold.
  • Emoji frequency cutoff for corpus analysis = >20 occurrences
    Emojis appearing more than 20 times in the 520 emoji-prompts are selected for C4 analysis; changing the cutoff changes the 32.8% toxic-context ratio.
  • Context toxicity ratio display threshold = >=0.1
    Table 5 reports only emojis with context toxicity rate above 10%; the 'potential correlation' evidence is threshold-dependent.
assumptions (5)
  • domain assumption GPT-4o judge ratings are a valid measure of response toxicity
    All HS/HR metrics rely on GPT-4o evaluating harmfulness; the paper cites Wei et al. (2025) showing emojis can weaken judge LLMs, yet does not validate its own judge on emoji-containing responses.
  • domain assumption Automatic rewrite plus human revision preserves original harmful intent of AdvBench requests
    Steps 1-2 of Sec 3.2 assume the emoji prompts remain faithful to the raw request; if rewriting shifts semantics, the comparison to raw prompts is confounded.
  • domain assumption C4 is representative of the tested models' pre-training corpora
    Sec 5.1 probes C4 shards and links emoji context to model behavior; for closed models (GPT-4o, Gemini) the actual pre-training data is unknown.
  • domain assumption Emoji tokenization into multiple subwords indicates rarity in pre-training data
    Observation 3 follows Hayase et al. (2024) and Xu et al. (2024) that BPE vocabulary reflects distributional information; this is an inference about training data from tokenizer structure.
  • domain assumption PACT decrease suppresses rejection generation
    PACT from Zhang et al. (2025) is taken as evidence of emoji influence on rejection; the mapping from first-token log-probability to full rejection behavior is assumed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Smiley Turns Hostile: Interpreting How Emojis Trigger LLMs' Toxicity." pith.science (2026). https://pith.science/paper/AVETH2FU

@misc{pith2026250911141,
  author       = {Pith},
  title        = {Pith review of: When Smiley Turns Hostile: Interpreting How Emojis Trigger LLMs' Toxicity},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AVETH2FU}},
  note         = {Machine review of arXiv:2509.11141}
}
read the original abstract

Emojis are globally used non-verbal cues in digital communication, and extensive research has examined how large language models (LLMs) understand and utilize emojis across contexts. While usually associated with friendliness or playfulness, it is observed that emojis may trigger toxic content generation in LLMs. Motivated by such a observation, we aim to investigate: (1) whether emojis can clearly enhance the toxicity generation in LLMs and (2) how to interpret this phenomenon. We begin with a comprehensive exploration of emoji-triggered LLM toxicity generation by automating the construction of prompts with emojis to subtly express toxic intent. Experiments across 5 mainstream languages on 7 famous LLMs along with jailbreak tasks demonstrate that prompts with emojis could easily induce toxicity generation. To understand this phenomenon, we conduct model-level interpretations spanning semantic cognition, sequence generation and tokenization, suggesting that emojis can act as a heterogeneous semantic channel to bypass the safety mechanisms. To pursue deeper insights, we further probe the pre-training corpus and uncover potential correlation between the emoji-related data polution with the toxicity generation behaviors. Supplementary materials provide our implementation code and data. (Warning: This paper contains potentially sensitive contents)

Figures

Figures reproduced from arXiv: 2509.11141 by the authors.

Figure 1
Figure 1. Examples of rejection towards harmful requests in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The 10 categories of emojis and examples. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Illustration to the emoji characteristics. [PITH_FULL_IMAGE:figures/full_fig_p002_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Cases of prompts with emojis and the ablation, [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]
Figure 6
Figure 6. Figure 6: PACT distribution and rejection ratio [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 8
Figure 8. Figure 8: Emoji tokenization cases with GPT-4o, Llama3- [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]
Figure 9
Figure 9. Figure 9: Emoji contexts in pre-training corpus. that some emojis, such as , appear across a wide range of harmful requests and in varying positions unexpectedly. No￾tably, analyzing its contextual usage in the corpus also shows substantial variation in co-occurring content. As …

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

60 extracted references · 9 linked inside Pith

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Adobe . 2022. Future of Creativity: Global Emoji Trend Report Reveals Emoji Users are Happier than Ever . Technical report, Adobe Inc. Accessed on 24 June 2025

    2022

  4. [4]

    Ai, B.; Chen, Y.; and He, X. 2019. The power of emojis: Automatic detection of user sentiment and behavior in social media. Information Processing & Management, 56(3): 738--749

    2019

  5. [5]

    Bai, Q.; Dan, Q.; Mu, Z.; and Yang, M. 2019. A systematic review of emoji: Current research and future perspectives. Frontiers in psychology, 10: 2221

    2019

  6. [6]

    J.; and Wong, E

    Chao, P.; Robey, A.; Dobriban, E.; Hassani, H.; Pappas, G. J.; and Wong, E. 2025. Jailbreaking Black Box Large Language Models in Twenty Queries. In IEEE Conference on Secure and Trustworthy Machine Learning, SaTML 2025, Copenhagen, Denmark, April 9-11, 2025 , 23--42. IEEE

    2025

  7. [7]

    Chen, S.; Yuan, Y.; Jiao, W.; and Tu, Z. 2025. QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language. In The 63rd Annual Meeting of the Association for Computational Linguistics

    2025

  8. [8]

    Chen, Y.; Ai, B.; and He, X. 2018. Emoji as a new dimension of online communication: Exploring the impact of emoji use on social presence and satisfaction in instant messaging. Computers in Human Behavior, 86: 223--231

    2018

Show all 60 references
  1. [9]

    de Janeiro, E. d. R. 2023. Could large language models estimate valence of words? A small ablation study. Proceedings of CBIC

    2023

  2. [10]

    J.; and Bing, L

    Deng, Y.; Zhang, W.; Pan, S. J.; and Bing, L. 2024. Multilingual Jailbreak Challenges in Large Language Models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024

    2024

  3. [11]

    Emojipedia . 2024. Emoji Statistics. https://emojipedia.org/stats. Accessed: 2025-07-02

    2024

  4. [12]

    EmojiPedia. 2025. Money with Wings Emoji – Meaning . https://emojipedia.org/money-with-wings. Accessed: 2025-07-03

    2025

  5. [13]

    Gao, L.; Zhang, X.; Nakov, P.; and Chen, X. 2025. Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models. In The 63rd Annual Meeting of the Association for Computational Linguistics

    2025

  6. [14]

    Google, G. T. 2024 a . Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. CoRR, abs/2403.05530

    2024 arXiv

  7. [15]

    Google, G. T. 2024 b . Introducing Gemini 2.0: our new AI model for the agentic era

    2024

  8. [16]

    C.; Li, M.; Tay, L.; and Ungar, L

    Guntuku, S. C.; Li, M.; Tay, L.; and Ungar, L. 2019. Studying Cultural Differences in Emoji Usage across the East and the West

    2019

  9. [17]

    Hakami, S. A. A.; Hendley, R.; and Smith, P. 2022. Emoji Sentiment Roles for Sentiment Analysis: A Case Study in A rabic Texts. In Proceedings of the Seventh Arabic Natural Language Processing Workshop (WANLP), 346--355

    2022

  10. [18]

    Hayase, J.; Liu, A.; Choi, Y.; Oh, S.; and Smith, N. A. 2024. Data Mixture Inference: What do BPE Tokenizers Reveal about their Training Data? arXiv preprint arXiv:2407.16607

    2024 arXiv

  11. [19]

    Hu, T.; Guo, H.; Sun, H.; Nguyen, T.-v.; and Luo, J. 2017. Spice up your chat: the intentions and sentiment effects of using emojis. In Proceedings of the International AAAI Conference on Web and Social Media, volume 11, 102--111

    2017

  12. [20]

    Huang, L.; Jin, H.; Bi, Z.; Yang, P.; Zhao, P.; Chen, T.; Wu, X.; Ma, L.; and Chen, H. 2025. The Tower of Babel Revisited: Multilingual Jailbreak Prompts on Closed-Source Large Language Models. CoRR, abs/2505.12287

    2025 arXiv

  13. [21]

    Jain, N.; Wu, Z.; Villalobos, C. E. M.; Hilliard, A.; Guan, X.; Koshiyama, A.; Kazim, E.; and Treleaven, P. C. 2025. From Text to Emoji: How PEFT -Driven Personality Manipulation Unleashes the Emoji Potential in LLM s. In Findings of the Association for Computational Linguisti...

    2025

  14. [22]

    Jiang, F.; Xu, Z.; Niu, L.; Xiang, Z.; Ramasubramanian, B.; Li, B.; and Poovendran, R. 2024 a . A rt P rompt: ASCII Art-based Jailbreak Attacks against Aligned LLM s. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Pap...

    2024

  15. [23]

    Jiang, F.; Xu, Z.; Niu, L.; Xiang, Z.; Ramasubramanian, B.; Li, B.; and Poovendran, R. 2024 b . ArtPrompt : ASCII Art-based Jailbreak Attacks Against Aligned LLMs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers...

    2024

  16. [24]

    Junxiao, Y.; Zhexin, Z.; Shiyao, C.; Hongning, W.; and Huang, M. 2025. Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints. In The 63rd Annual Meeting of the Association for Computational Linguistics

    2025

  17. [25]

    K.; Romero, P.; and Stachl, C

    Koch, T. K.; Romero, P.; and Stachl, C. 2022. Age and gender in language, emoji, and emoticon usage in instant messages. Computers in Human Behavior, 126: 106990

    2022

  18. [26]

    Li, J.; Liu, Y.; Liu, C.; Shi, L.; Ren, X.; Zheng, Y.; Liu, Y.; and Xue, Y. 2024. A Cross-Language Investigation into Jailbreak Attacks in Large Language Models. CoRR, abs/2401.16765

    2024 arXiv

  19. [27]

    Li, W.; Chen, Y.; Hu, T.; and Luo, J. 2018. Mining the Relationship between Emoji Usage Patterns and Personality. Proceedings of the International AAAI Conference on Web and Social Media, 12

    2018

  20. [28]

    Li, X.; Zhou, Z.; Zhu, J.; Yao, J.; Liu, T.; and Han, B. 2023. DeepInception: Hypnotize Large Language Model to Be Jailbreaker. CoRR, abs/2311.03191

    2023 arXiv

  21. [29]

    Lin, L.; Brown, H.; Kawaguchi, K.; and Shieh, M. 2025. Single Character Perturbations Break LLM Alignment. In AAAI-25, Sponsored by the Association for the Advancement of Artificial Intelligence, February 25 - March 4, 2025, Philadelphia, PA, USA , 27473--27481

    2025

  22. [30]

    Lou, Y.; Zhang, Y.; Li, F.; Qian, T.; and Ji, D. 2020. Emoji-Based Sentiment Analysis Using Attention Networks. ACM Trans. Asian Low-Resour. Lang. Inf. Process., 19(5)

    2020

  23. [31]

    Lyu, H.; Huang, J.; Zhang, D.; Yu, Y.; Mou, X.; Pan, J.; Yang, Z.; Wei, Z.; and Luo, J. 2025. Gpt-4v (ision) as a social media analysis engine. ACM Transactions on Intelligent Systems and Technology, 16(3): 1--54

    2025

  24. [32]

    Lyu, H.; Qi, W.; Wei, Z.; and Luo, J. 2024. Human vs. lmms: Exploring the discrepancy in emoji interpretation and usage in digital communication. In Proceedings of the International AAAI Conference on Web and Social Media, volume 18, 2104--2110

    2024

  25. [33]

    Maraule, M.; Duffett, R.; and Edu, T. 2025. Modeling emoji online marketing on websites among young consumers: the moderation effect of age. Future Business Journal, 11: 91

    2025

  26. [34]

    S.; Singer, Y.; and Karbasi, A

    Mehrotra, A.; Zampetakis, M.; Kassianik, P.; Nelson, B.; Anderson, H. S.; Singer, Y.; and Karbasi, A. 2024. Tree of Attacks: Jailbreaking Black-Box LLMs Automatically. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing S...

    2024

  27. [35]

    Meta. 2024. Introducing Meta Llama 3: The most capable openly available LLM to date

    2024

  28. [36]

    Emojinal Intelligence

    Michael, D.; and Kenneth, H. ???? How Good Is GPT’s “Emojinal Intelligence”? Investigating Emoji Patterns in LLM-Generated Social Media Text. In Proceedings of the International Conference on AI Research. Academic Conferences and publishing limited

  29. [37]

    Minich, M.; Kerr, B.; and Moreno, M. 2025. Adolescent Emoji Use in Text-Based Messaging: Focus Group Study. JMIR Formative Research, 9: e59640

    2025

  30. [38]

    OpenAI. 2023. GPT-4 system card

    2023

  31. [39]

    OpenAI. 2024. GPT-4o system card

    2024

  32. [40]

    Peng, L.; Wang, Z.; Liu, H.; Wang, Z.; and Shang, J. 2023. Emojilm: Modeling the new emoji language. arXiv preprint arXiv:2311.01751

    2023 arXiv

  33. [41]

    Qi, X.; Zeng, Y.; Xie, T.; Chen, P.-Y.; Jia, R.; Mittal, P.; and Henderson, P. 2024. Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To! In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7...

    2024

  34. [42]

    Raffel, C.; Shazeer, N.; Roberts, A.; Lee, K.; Narang, S.; Matena, M.; Zhou, Y.; Li, W.; and Liu, P. J. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res., 21(1)

    2020

  35. [43]

    Sennrich, R.; Haddow, B.; and Birch, A. 2016. Neural Machine Translation of Rare Words with Subword Units. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 1715--1725

    2016

  36. [44]

    Shen, L.; Tan, W.; Chen, S.; Chen, Y.; Zhang, J.; Xu, H.; Zheng, B.; Koehn, P.; and Khashabi, D. 2024. The Language Barrier: Dissecting Safety Challenges of LLMs in Multilingual Contexts. In Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand...

    2024

  37. [45]

    Team, Q. 2024 a . Qwen2.5-72B-Instruct

    2024

  38. [46]

    Team, Q. 2024 b . Qwen2.5-LLM: Extending the boundary of LLMs

    2024

  39. [47]

    Unicod . 2025. About Emoji. https://home.unicode.org/emoji/about-emoji/. Accessed: 2025-07-02

    2025

  40. [48]

    Unicode Consortium . 2025. Emoji Counts. https://unicode.org/emoji/charts/emoji-counts.html. Accessed: 2025-07-02

    2025

  41. [49]

    Wang, W.; Tu, Z.; Chen, C.; Yuan, Y.; Huang, J.; Jiao, W.; and Lyu, M. R. 2024. All Languages Matter: On the Multilingual Safety of LLMs. In Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11-16, 2024 , 5865--5...

    2024

  42. [50]

    Wei, Z.; Liu, Y.; and Erichson, N. B. 2025. Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection. In Forty-second International Conference on Machine Learning

    2025

  43. [51]

    Xu, Y.; Lu, J.; and Zhang, J. 2024. Bridging the Gap between Different Vocabularies for LLM Ensemble. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), 7133--7145

    2024

  44. [52]

    Xu, Z.; Huang, R.; Chen, C.; and Wang, X. 2024. Uncovering safety risks of large language models through concept activation vector. Advances in Neural Information Processing Systems, 37: 116743--116782

    2024

  45. [53]

    Yan, Y.; Sun, S.; Duan, Z.; Liu, T.; Liu, M.; Yin, Z.; Li, Q.; and Lei, J. 2025. from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphors. CoRR, abs/2503.00038

    2025

  46. [54]

    Yuan, Y.; Jiao, W.; Wang, W.; Huang, J.; He, P.; Shi, S.; and Tu, Z. 2023. GPT-4 is Too Smart to be Safe: Stealthy Chat with LLMs via Cipher. arXiv preprint arXiv:2308.06463

    2023 arXiv

  47. [55]

    Zhang, Q.; Qiu, H.; Wang, D.; Qian, H.; Li, Y.; Zhang, T.; and Huang, M. 2025. Understanding the Dark Side of LLMs' Intrinsic Self-Correction. In The 63rd Annual Meeting of the Association for Computational Linguistics

    2025

  48. [56]

    Zheng, Y.; Lyu, H.; and Luo, J. 2025. Irony in Emojis: A Comparative Study of Human and LLM Interpretation. arXiv preprint arXiv:2501.11241

    2025 arXiv

  49. [57]

    Zhou, Y.; Xu, P.; Wang, X.; Lu, X.; Gao, G.; and Ai, W. 2025. Emojis decoded: Leveraging chatgpt for enhanced understanding in social media communications. In Proceedings of the International AAAI Conference on Web and Social Media, volume 19, 2302--2316

    2025

  50. [58]

    Zhukova, M.; and Herring, S. C. 2024. Benign or Toxic? Differences in Emoji Interpretation by Gender, Generation, and Emoji Type. Language@ Internet, 22(Special Issue): 74--108

    2024

  51. [59]

    Z.; and Fredrikson, M

    Zou, A.; Wang, Z.; Kolter, J. Z.; and Fredrikson, M. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models. CoRR, abs/2307.15043

    2023 arXiv

  52. [60]

    Zou, Q.; Xiao, J.; Li, Q.; Yan, Z.; Wang, Y.; Xu, L.; Wang, W.; Gao, K.; Li, R.; and Jiang, Y. 2025. QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language. In Findings of Proceedings of the 63nd Annual Meeting of the Association fo...

    2025

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.