{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,20]],"date-time":"2026-10-20T16:27:50Z","timestamp":1792513670675,"version":"4.5.0"},"publisher-location":"Cham","reference-count":60,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031708787","type":"print"},{"value":"9783031708794","type":"electronic"}],"license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024]]},"DOI":"10.1007\/978-3-031-70879-4_6","type":"book-chapter","created":{"date-parts":[[2024,9,4]],"date-time":"2024-09-04T15:02:20Z","timestamp":1725462140000},"page":"105-124","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":58,"title":["Jatmo: Prompt Injection Defense by\u00a0Task-Specific Finetuning"],"prefix":"10.1007","author":[{"given":"Julien","family":"Piet","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Maha","family":"Alrashed","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chawin","family":"Sitawarin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sizhe","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zeming","family":"Wei","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Elizabeth","family":"Sun","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Basel","family":"Alomair","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Wagner","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,9,5]]},"reference":[{"key":"6_CR1","unstructured":"Templates for Chat Models (2023). https:\/\/huggingface.co\/docs\/transformers\/chat_templating"},{"key":"6_CR2","unstructured":"The Trojan Detection Challenge (LLM Edition) (2023). https:\/\/trojandetection.ai"},{"key":"6_CR3","unstructured":"Alon, G., Kamfonas, M.: Detecting language model attacks with perplexity (2023). arXiv:2308.14132"},{"key":"6_CR4","unstructured":"Anthropic: Claude 2. Anthropic (2023). https:\/\/www.anthropic.com\/index\/claude-2"},{"key":"6_CR5","unstructured":"Armstrong, S., Gorman, R.: Using GPT-Eliezer against ChatGPT Jailbreaking (2022). https:\/\/www.alignmentforum.org\/posts\/pNcFYZnPdXyL2RfgA\/using-gpt-eliezer-against-chatgpt-jailbreaking"},{"key":"6_CR6","unstructured":"Bai, Y., et\u00a0al.: Training a helpful and harmless assistant with reinforcement learning from human feedback (2022). arXiv:2204.05862"},{"key":"6_CR7","unstructured":"Bubeck, S., et\u00a0al.: Sparks of artificial general intelligence: early experiments with GPT-4 (2023). arXiv:2303.12712"},{"key":"6_CR8","unstructured":"Carlini, N., et\u00a0al.: Extracting training data from large language models. In: 30th USENIX Security Symposium (2021)"},{"key":"6_CR9","unstructured":"Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G.J., Wong, E.: Jailbreaking black box large language models in twenty queries (2023). arXiv:2310.08419"},{"key":"6_CR10","doi-asserted-by":"crossref","unstructured":"Chen, C., Shu, K.: Combating misinformation in the age of LLMs: opportunities and challenges (2023). arXiv:2311.05656","DOI":"10.1002\/aaai.12188"},{"key":"6_CR11","doi-asserted-by":"crossref","unstructured":"Chen, Y., Wang, R., Jiang, H., Shi, S., Xu, R.: Exploring the use of large language models for reference-free text quality evaluation: an empirical study (2023). arXiv:2304.00723","DOI":"10.18653\/v1\/2023.findings-ijcnlp.32"},{"key":"6_CR12","doi-asserted-by":"crossref","unstructured":"Chiang, C.H., Lee, H.: Can large language models be an alternative to human evaluations? (2023). arXiv:2305.01937","DOI":"10.18653\/v1\/2023.acl-long.870"},{"key":"6_CR13","unstructured":"Chung, H.W., et\u00a0al.: Scaling instruction-finetuned language models (2022). arXiv:2210.11416"},{"key":"6_CR14","unstructured":"Adams, C.J., Sorensen, J., Elliott, J., Dixon, L., McDonald, M., nithum, Cukierski, W.: Toxic Comment Classification Challenge (2017). https:\/\/kaggle.com\/competitions\/jigsaw-toxic-comment-classification-challenge"},{"key":"6_CR15","unstructured":"Dong, Y., et\u00a0al.: How robust is Google\u2019s bard to adversarial image attacks? (2023). arXiv:2309.11751"},{"key":"6_CR16","doi-asserted-by":"crossref","unstructured":"Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., Fritz, M.: Not what you\u2019ve signed up for: compromising real-world LLM-integrated applications with indirect prompt injection (2023). arXiv:2302.12173","DOI":"10.1145\/3605764.3623985"},{"key":"6_CR17","doi-asserted-by":"crossref","unstructured":"Hackl, V., M\u00fcller, A.E., Granitzer, M., Sailer, M.: Is GPT-4 a reliable rater? Evaluating consistency in GPT-4\u2019s text ratings. Front. Educ. 8 (2023)","DOI":"10.3389\/feduc.2023.1272229"},{"key":"6_CR18","unstructured":"Hermann, K.M., et al.: Teaching machines to read and comprehend. In: NIPS (2015). http:\/\/papers.nips.cc\/paper\/5945-teaching-machines-to-read-and-comprehend"},{"key":"6_CR19","unstructured":"Jain, N., et\u00a0al.: Baseline defenses for adversarial attacks against aligned language models (2023). arXiv:2309.00614"},{"key":"6_CR20","unstructured":"Ji, J., et\u00a0al.: AI alignment: a comprehensive survey (2023). arXiv:2310.19852"},{"key":"6_CR21","unstructured":"Kaddour, J., Harris, J., Mozes, M., Bradley, H., Raileanu, R., McHardy, R.: Challenges and applications of large language models (2023). arXiv:2307.10169"},{"key":"6_CR22","unstructured":"Kandpal, N., Jagielski, M., Tram\u00e8r, F., Carlini, N.: Backdoor attacks for in-context learning with language models. In: ICML Workshop on Adversarial Machine Learning (2023)"},{"key":"6_CR23","unstructured":"Kocetkov, D., et\u00a0al.: The stack: 3 TB of permissively licensed source code. Trans. Mach. Learn. Res. (2023). ISSN 2835-8856. https:\/\/openreview.net\/forum?id=pxpbTdUEpD"},{"key":"6_CR24","unstructured":"Kocmi, T., Federmann, C.: Large language models are state-of-the-art evaluators of translation quality (2023). arXiv:2302.14520"},{"key":"6_CR25","unstructured":"Kumar, A., Agarwal, C., Srinivas, S., Feizi, S., Lakkaraju, H.: Certifying LLM safety against adversarial prompting (2023). arXiv:2309.02705"},{"key":"6_CR26","unstructured":"Lewis, P., et\u00a0al.: Retrieval-augmented generation for knowledge-intensive NLP tasks. In: Advances in Neural Information Processing Systems (2020)"},{"key":"6_CR27","doi-asserted-by":"crossref","unstructured":"Li, H., Guo, D., Fan, W., Xu, M., Song, Y.: Multi-step jailbreaking privacy attacks on ChatGPT (2023). arXiv:2304.05197","DOI":"10.18653\/v1\/2023.findings-emnlp.272"},{"key":"6_CR28","unstructured":"Liu, X., Xu, N., Chen, M., Xiao, C.: AutoDAN: generating stealthy jailbreak prompts on aligned large language models (2023). arXiv:2310.04451"},{"key":"6_CR29","unstructured":"Liu, Y., et al.: Prompt injection attack against LLM-integrated applications (2023). arXiv:2306.05499"},{"key":"6_CR30","doi-asserted-by":"crossref","unstructured":"Liu, Y., Iter, D., Xu, Y., Wang, S., Xu, R., Zhu, C.: G-Eval: NLG evaluation using GPT-4 with better human alignment (2023). arXiv:2303.16634","DOI":"10.18653\/v1\/2023.emnlp-main.153"},{"key":"6_CR31","unstructured":"Liu, Y., Jia, Y., Geng, R., Jia, J., Gong, N.Z.: Prompt injection attacks and defenses in LLM-integrated applications (2023). arXiv:2310.12815"},{"key":"6_CR32","doi-asserted-by":"crossref","unstructured":"Lukas, N., Salem, A., Sim, R., Tople, S., Wutschitz, L., Zanella-B\u00e9guelin, S.: Analyzing leakage of personally identifiable information in language models. In: IEEE Symposium on Security and Privacy (2023)","DOI":"10.1109\/SP46215.2023.10179300"},{"key":"6_CR33","unstructured":"Maas, A.L., Daly, R.E., Pham, P.T., Huang, D., Ng, A.Y., Potts, C.: Learning word vectors for sentiment analysis. In: Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies (2011)"},{"key":"6_CR34","unstructured":"Mao, R., Chen, G., Zhang, X., Guerin, F., Cambria, E.: GPTEval: a survey on assessments of ChatGPT and GPT-4 (2023). arXiv:2308.12488"},{"key":"6_CR35","unstructured":"May, P.: Machine translated multilingual STS benchmark dataset (2021). https:\/\/github.com\/PhilipMay\/stsb-multi-mt"},{"key":"6_CR36","doi-asserted-by":"crossref","unstructured":"Naismith, B., Mulcaire, P., Burstein, J.: Automated evaluation of written discourse coherence using GPT-4. In: Proceedings of the 18th Workshop on Innovative Use of NLP for Building Educational Applications (BEA 2023) (2023)","DOI":"10.18653\/v1\/2023.bea-1.32"},{"key":"6_CR37","unstructured":"Nasr, M., et\u00a0al.: Scalable extraction of training data from (production) language models (2023). arXiv:2311.17035"},{"key":"6_CR38","unstructured":"OpenAI: GPT-4 Technical report (2023). arXiv:2303.08774"},{"key":"6_CR39","unstructured":"OpenAI, API: GPT-3 powers the next generation of apps (2021). https:\/\/openai.com\/blog\/gpt-3-apps"},{"key":"6_CR40","unstructured":"Ouyang, L., et al.: Training language models to follow instructions with human feedback (2022). arXiv:2203.02155"},{"key":"6_CR41","unstructured":"OWASP: OWASP Top 10 for LLM Applications (2023). https:\/\/llmtop10.com\/"},{"key":"6_CR42","unstructured":"OWASP: SQL Injection Prevention - OWASP Cheat Sheet Series, November 2023. https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/SQL_Injection_Prevention_Cheat_Sheet.html. Accessed 12 Oct 2023"},{"key":"6_CR43","unstructured":"Perez, F., Ribeiro, I.: Ignore previous prompt: attack techniques for language models. In: NeurIPS ML Safety Workshop (2022)"},{"key":"6_CR44","unstructured":"Piet, J., Sitawarin, C., Fang, V., Mu, N., Wagner, D.: Mark My words: analyzing and evaluating language model watermarks (2023). arXiv:2312.00273"},{"key":"6_CR45","unstructured":"Project Gutenberg: Project Gutenberg (1971). https:\/\/www.gutenberg.org\/"},{"key":"6_CR46","unstructured":"Robey, A., Wong, E., Hassani, H., Pappas, G.J.: SmoothLLM: defending large language models against jailbreaking attacks (2023). arXiv:2310.03684"},{"key":"6_CR47","doi-asserted-by":"crossref","unstructured":"Schulhoff, S., et\u00a0al.: Ignore this title and HackAPrompt: exposing systemic vulnerabilities of LLMs through a global scale prompt hacking competition (2023). arXiv:2311.16119","DOI":"10.18653\/v1\/2023.emnlp-main.302"},{"key":"6_CR48","doi-asserted-by":"crossref","unstructured":"See, A., Liu, P.J., Manning, C.D.: Get to the point: summarization with pointer-generator networks. In: Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). ACL (2017)","DOI":"10.18653\/v1\/P17-1099"},{"key":"6_CR49","unstructured":"Toyer, S., et\u00a0al.: Tensor trust: interpretable prompt injection attacks from an online game (2023). arXiv:2311.01011"},{"key":"6_CR50","doi-asserted-by":"crossref","unstructured":"Wan, M., McAuley, J.: Item recommendation on monotonic behavior chains. In: Proceedings of the 12th ACM Conference on Recommender Systems (2018)","DOI":"10.1145\/3240323.3240369"},{"key":"6_CR51","doi-asserted-by":"crossref","unstructured":"Wang, J., et al.: Is ChatGPT a good NLG evaluator? A preliminary study (2023). arXiv:2303.04048","DOI":"10.18653\/v1\/2023.newsum-1.1"},{"key":"6_CR52","unstructured":"Wang, J., et\u00a0al.: On the robustness of ChatGPT: an adversarial and out-of-distribution perspective (2023). arXiv:2302.12095"},{"key":"6_CR53","unstructured":"Wei, A., Haghtalab, N., Steinhardt, J.: Jailbroken: how does LLM safety training fail? (2023). arXiv:2307.02483"},{"key":"6_CR54","unstructured":"Wei, J., et al.: Finetuned language models are zero-shot learners (2021)"},{"key":"6_CR55","unstructured":"Wei, Z., Wang, Y., Wang, Y.: Jailbreak and guard aligned language models with only few in-context demonstrations (2023). arXiv:2310.06387"},{"key":"6_CR56","unstructured":"Willison, S.: Delimiters won\u2019t save you from prompt injection (2023). https:\/\/simonwillison.net\/2023\/May\/11\/delimiters-wont-save-you"},{"key":"6_CR57","doi-asserted-by":"crossref","unstructured":"Xu, L., Chen, Y., Cui, G., Gao, H., Liu, Z.: Exploring the universal vulnerability of prompt-based learning paradigm. In: Findings of the Association for Computational Linguistics (2022)","DOI":"10.18653\/v1\/2022.findings-naacl.137"},{"key":"6_CR58","unstructured":"Yu, W., et al.: Bag of tricks for training data extraction from language models (2023). arXiv:2302.04460"},{"key":"6_CR59","unstructured":"Zhang, S., et al.: Instruction tuning for large language models: a survey (2023). arXiv:2308.10792"},{"key":"6_CR60","unstructured":"Zhu, K., et\u00a0al.: PromptBench: towards evaluating the robustness of large language models on adversarial prompts (2023). arXiv:2306.04528"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2024"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-70879-4_6","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,4]],"date-time":"2024-09-04T15:03:38Z","timestamp":1725462218000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-70879-4_6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"ISBN":["9783031708787","9783031708794"],"references-count":60,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-70879-4_6","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]},"assertion":[{"value":"5 September 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Bydgoszcz","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Poland","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 September 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20 September 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/esorics2024.org","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}