Yes, according to one 2026 preprint: when researchers pushed language models to write like someone intoxicated, the models became more susceptible to jailbreaks and privacy leakage on two English-language benchmarks. The finding is real but narrow. It comes from controlled tests of five models, not from attacks on live consumer chatbots, and it does not mean your AI assistant will hand over your secrets after a odd prompt. Here is what was tested, what it does and does not show, and how it differs from prompt injection.
What “drunken text” means here
The phrase describes an induced writing style. Nobody claims an AI is physiologically drunk. The researchers asked whether making a model imitate intoxicated language would also weaken its safety behavior. It is not speech-to-text error, not tools that detect intoxication in users, and not ordinary hallucination.
As an Amazon Associate I earn from qualifying purchases.
The work is by Anudeex Shetty, Aditya Joshi and Salil S. Kanhere, led from UNSW. It is an arXiv preprint dated January 19, 2026, and UNSW’s own publication listing also marks it as a preprint. Treat the results as not yet peer-reviewed unless a later publication is confirmed.
How the researchers tried to “get LLMs drunk”
Dr Aditya Joshi, a UNSW senior lecturer, framed the question in UNSW’s report: “The key research question from the natural language processing (NLP) side for me was, how do we get LLMs drunk?” The team used three induction approaches:
#1 Best Overall
Persona-based prompting
The model is instructed to play a role that writes in an intoxicated manner. This is a temporary, prompt-level change; the model’s weights are untouched.
Causal fine-tuning on drunk text
The model is further trained on text written in that style, so the change is built into updated weights.
Reinforcement-based post-training
The model is rewarded toward the target style through post-training, again altering the weights rather than a single conversation.
Free tools Windows power users keep installed
One-click scans. No signup required.
The sources support separating prompting from the two weight-changing methods. They do not establish how long any effect persists across sessions or in real deployments, and they do not give a basis for ranking the methods on cost or effect size.
Rank #3
What was measured
| Item | Detail reported |
|---|---|
| Models tested | Five |
| Jailbreak benchmark | JailbreakBench |
| Privacy-leakage benchmark | ConfAIde |
| Language | English |
| Reported outcome | Higher susceptibility than base models and than previously reported approaches, including when defenses were present (per the paper’s abstract) |
| Test setting | Programmatic tests, not consumer chat interfaces (per UNSW) |
The abstract and UNSW summary reviewed here do not give enough detail to quote a reliable percentage, so none is given. Be wary of any figure from secondary coverage presented as the odds of an attack working in general; no population-level statistic is established.
Why style can matter for safety
The study suggests that a model’s behavior is not cleanly separable from how it writes. Shift the voice far enough from the careful, assistant-like register it was safety-trained in, and refusals and confidentiality habits may loosen. Professor Salil Kanhere offered an analogy in UNSW’s coverage: “If you’re drunk, you might reveal things which you are not supposed to reveal.” That is an illustration, not a measured result, and it should not be read as proof that models share human psychology.
How this differs from prompt injection
The two are easily confused, but they are different attacks.
- Drunk-language inducement changes the model itself, through a role prompt or through training, so it behaves less safely.
- Prompt injection hides malicious instructions in untrusted material the model reads, such as web pages, emails or documents. OpenAI’s security guidance calls it “a type of social engineering attack specific to conversational AI” and notes that “prompt injections are an evolving security challenge for AI.”
Both argue for testing models beyond ordinary, friendly prompts. The sources do not show they share a mechanism.
Best Value
What this means for real-world risk
- Not demonstrated: that any commercial chatbot will leak a user’s actual secrets, or that results hold beyond five models and two English benchmarks. The authors’ sample did not cover all LLMs on the market.
- Plausible concern: organizations that fine-tune models, accept user-supplied personas, or download adapted weights could introduce a less safe model without noticing, especially if it can reach confidential data or take actions.
What organizations can do
Official guidance from OpenAI, Microsoft, Google and NIST on LLM security is general rather than a test of this specific effect, but its layered approach applies:
- Test under your real conditions. Evaluate the exact model, system prompt and any fine-tuning you will deploy, including unusual personas and styles, not just clean prompts.
- Limit what the model can reach. Give it the minimum data and tool access; a model that cannot see a secret cannot leak it.
- Validate outputs and actions. Filter responses and check proposed actions outside the model. NIST’s draft chatbot report discusses local deployment, access controls and validation filters.
- Sandbox risky operations and require human confirmation for consequential actions.
- Monitor for attacks and re-run safety evaluations after every fine-tune or model update, since weight changes can alter safety behavior.
None of the cited sources establishes a complete fix for drunk-language inducement, so these are risk reducers, not guarantees.
Frequently Asked Questions
Can AI leak secrets?
Under some conditions, yes. In this study’s benchmark scenarios, models adapted to write in a drunk style showed more privacy leakage. That is a test result, not evidence that deployed chatbots routinely expose real users’ data.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Is the study peer-reviewed?
It is an arXiv preprint from January 2026, listed as a preprint by UNSW. No later publication has been verified.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
