Safety alignment in large language models relies on behavioral training that can be overridden when sufficiently strong in-context patterns compete with learned refusal behaviors. We introduce Involuntary In-Context Learning (IICL), an attack class that uses abstract operator framing with few-shot examples to force pattern completion that overrides safety training. Through 3479 probes across 10 OpenAI models, we identify the attack's effective components through a seven-experiment ablation study. Key findings: (1)~semantic operator naming achieves 100% bypass rate (50/50, $p < 0.001$); (2)~the attack requires abstract framing, since identical examples in direct question-and-answer format yield 0%; (3)~example ordering matters strongly (interleaved: 76%, harmful-first: 6%); (4)~temperature has no meaningful effect (46-56% across 0.0--1.0). On the HarmBench benchmark, IICL achieves 24.0% bypass $[18.6%, 30.4%]$ against GPT-5.4 with detailed 619-word responses, compared to 0.0% for direct queries.

翻译：大型语言模型中的安全对齐依赖于行为训练，但当足够强的语境模式与学习到的拒绝行为相竞争时，这种训练可能被覆盖。我们提出了非自主性语境学习（IICL），一种利用抽象操作符框架结合少样本示例强制模式补全，从而覆盖安全训练的攻击类别。通过对10个OpenAI模型进行3479次探测，我们通过七项实验消融研究确定了该攻击的有效组成部分。关键发现：（1）语义化操作符命名实现了100%的绕过率（50/50，p < 0.001）；（2）该攻击需要抽象框架，因为相同示例采用直接问答格式时绕过率为0%；（3）示例顺序影响显著（交错：76%，有害优先：6%）；（4）温度参数无明显效果（在0.0-1.0范围内绕过率为46-56%）。在HarmBench基准测试中，IICL针对GPT-5.4实现了24.0%的绕过率[18.6%, 30.4%]，并生成详细的619词回答，而直接查询的绕过率为0.0%。