{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T17:39:14Z","timestamp":1777657154511,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":72,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,26]],"date-time":"2023-11-26T00:00:00Z","timestamp":1700956800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"European Union","award":["101070617"],"award-info":[{"award-number":["101070617"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,30]]},"DOI":"10.1145\/3605764.3623985","type":"proceedings-article","created":{"date-parts":[[2023,11,21]],"date-time":"2023-11-21T12:12:17Z","timestamp":1700568737000},"page":"79-90","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":286,"title":["Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-0460-5327","authenticated-orcid":false,"given":"Kai","family":"Greshake","sequence":"first","affiliation":[{"name":"Saarland University, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-5269-951X","authenticated-orcid":false,"given":"Sahar","family":"Abdelnabi","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-7330-1912","authenticated-orcid":false,"given":"Shailesh","family":"Mishra","sequence":"additional","affiliation":[{"name":"Saarland University, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-7653-4417","authenticated-orcid":false,"given":"Christoph","family":"Endres","sequence":"additional","affiliation":[{"name":"sequire technology GmbH, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2783-1264","authenticated-orcid":false,"given":"Thorsten","family":"Holz","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8949-9896","authenticated-orcid":false,"given":"Mario","family":"Fritz","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]}],"member":"320","published-online":{"date-parts":[[2023,11,26]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"Alex Albert. 2023. Jailbreak Chat. hrefhttps:\/\/www.jailbreakchat.com\/[Link] ."},{"key":"e_1_3_2_2_2_1","doi-asserted-by":"crossref","unstructured":"Jacob Andreas. 2022. Language models as agent models. In Findings of EMNLP.","DOI":"10.18653\/v1\/2022.findings-emnlp.423"},{"key":"e_1_3_2_2_3_1","doi-asserted-by":"crossref","unstructured":"Giovanni Apruzzese Hyrum Anderson Savino Dambra David Freeman Fabio Pierazzi and Kevin Roundy. 2022. Position:\"Real Attackers Don't Compute Gradients\": Bridging the Gap Between Adversarial ML Research and Practice. In SaTML.","DOI":"10.1109\/SaTML54575.2023.00031"},{"key":"e_1_3_2_2_4_1","unstructured":"Yuntao Bai Andy Jones Kamal Ndousse Amanda Askell Anna Chen Nova DasSarma Dawn Drain Stanislav Fort Deep Ganguli Tom Henighan et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv (2022)."},{"key":"e_1_3_2_2_5_1","volume-title":"Eliciting Latent Predictions from Transformers with the Tuned Lens. arXiv","author":"Belrose Nora","year":"2023","unstructured":"Nora Belrose, Zach Furman, Logan Smith, Danny Halawi, Igor Ostrovsky, Lev McKinney, Stella Biderman, and Jacob Steinhardt. 2023. Eliciting Latent Predictions from Transformers with the Tuned Lens. arXiv (2023)."},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442188.3445922"},{"key":"e_1_3_2_2_7_1","unstructured":"Rishi Bommasani Drew A Hudson Ehsan Adeli Russ Altman Simran Arora Sydney von Arx Michael S Bernstein Jeannette Bohg Antoine Bosselut Emma Brunskill et al. 2021. On the opportunities and risks of foundation models. arXiv (2021)."},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"crossref","unstructured":"Nicholas Boucher Ilia Shumailov Ross Anderson and Nicolas Papernot. 2022. Bad characters: Imperceptible nlp attacks. In S&P.","DOI":"10.1109\/SP46214.2022.9833641"},{"key":"e_1_3_2_2_9_1","unstructured":"Tom Brown Benjamin Mann Nick Ryder Melanie Subbiah Jared D Kaplan Prafulla Dhariwal Arvind Neelakantan Pranav Shyam Girish Sastry Amanda Askell et al. 2020. Language models are few-shot learners. In NeurIPS."},{"key":"e_1_3_2_2_10_1","volume-title":"Artificial Influence: An Analysis Of AI-Driven Persuasion. arXiv","author":"Burtell Matthew","year":"2023","unstructured":"Matthew Burtell and Thomas Woodside. 2023. Artificial Influence: An Analysis Of AI-Driven Persuasion. arXiv (2023)."},{"key":"e_1_3_2_2_11_1","volume-title":"Daphne Ippolito, Katherine Lee, Florian Tramer, et al.","author":"Carlini Nicholas","year":"2023","unstructured":"Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, et al. 2023. Are aligned neural networks adversarially aligned? arXiv (2023)."},{"key":"e_1_3_2_2_12_1","volume-title":"Machine learning and security. \"O'Reilly Media","author":"Chio Clarence","unstructured":"Clarence Chio and David Freeman. 2018. Machine learning and security. \"O'Reilly Media, Inc.\"."},{"key":"e_1_3_2_2_13_1","unstructured":"Lavina Daryanani. 2023. How to Jailbreak ChatGPT. hrefhttps:\/\/watcher.guru\/news\/how-to-jailbreak-chatgpt[Link] ."},{"key":"e_1_3_2_2_14_1","unstructured":"Ben Derico. 2023. ChatGPT bug leaked users' conversation histories. hrefhttps:\/\/www.bbc.com\/news\/technology-65047304[Link] ."},{"key":"e_1_3_2_2_15_1","volume-title":"Toxicity in ChatGPT: Analyzing Persona-assigned Language Models. arXiv","author":"Deshpande Ameet","year":"2023","unstructured":"Ameet Deshpande, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, and Karthik Narasimhan. 2023. Toxicity in ChatGPT: Analyzing Persona-assigned Language Models. arXiv (2023)."},{"key":"e_1_3_2_2_16_1","volume-title":"Smith","author":"Gehman Samuel","year":"2020","unstructured":"Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. 2020. RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models. In Findings of EMNLP."},{"key":"e_1_3_2_2_17_1","unstructured":"GitHub. 2023. GitHub Copilot - Your AI pair programmer. hrefhttps:\/\/github.com\/features\/copilot[Link] ."},{"key":"e_1_3_2_2_18_1","unstructured":"Google. 2023. Bard. hrefhttps:\/\/bard.google.com\/[Link] ."},{"key":"e_1_3_2_2_19_1","volume-title":"Xiang Lisa Li","author":"Jesse Mu Noah Goodman","year":"2023","unstructured":"Noah Goodman Jesse Mu, Xiang Lisa Li. 2023. Learning to Compress Prompts with Gist Tokens. arXiv (2023)."},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1108\/ICS-07-2020-0113"},{"key":"e_1_3_2_2_21_1","volume-title":"Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks. arXiv","author":"Kang Daniel","year":"2023","unstructured":"Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. 2023. Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks. arXiv (2023)."},{"key":"e_1_3_2_2_22_1","unstructured":"Byron Kaye. 2023. Australian mayor readies world's first defamation lawsuit over ChatGPT content. hrefhttps:\/\/www.reuters.com\/technology\/australian-mayor-readies-worlds-first-defamation-lawsuit-over-chatgpt-content-2023-04-05\/[Link] ."},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1038\/s41598-023-31341-0"},{"key":"e_1_3_2_2_24_1","unstructured":"LangChain. 2023. LangChain library for composing and integrating LLMs into applications. hrefhttps:\/\/github.com\/hwchase17\/langchain[Link] ."},{"key":"e_1_3_2_2_25_1","volume-title":"Faisal Ladhak, Frieda Rong, et al.","author":"Lee Mina","year":"2022","unstructured":"Mina Lee, Megha Srivastava, Amelia Hardy, John Thickstun, Esin Durmus, Ashwin Paranjape, Ines Gerard-Ursin, Xiang Lisa Li, Faisal Ladhak, Frieda Rong, et al. 2022. Evaluating Human-Language Model Interaction. arXiv (2022)."},{"key":"e_1_3_2_2_26_1","unstructured":"Kif Leswing. 2023. Microsoft's Bing A.I. made several factual errors in last week's launch demo. hrefhttps:\/\/www.cnbc.com\/2023\/02\/14\/microsoft-bing-ai-made-several-errors-in-launch-demo-last-week-.html[Link] ."},{"key":"e_1_3_2_2_27_1","unstructured":"Stephanie Lin Jacob Hilton and Owain Evans. 2022. TruthfulQA: Measuring How Models Mimic Human Falsehoods. In ACL."},{"key":"e_1_3_2_2_28_1","volume-title":"Song-Chun Zhu, and Jianfeng Gao.","author":"Lu Pan","year":"2023","unstructured":"Pan Lu, Baolin Peng, Hao Cheng, Michel Galley, Kai-Wei Chang, Ying Nian Wu, Song-Chun Zhu, and Jianfeng Gao. 2023. Chameleon: Plug-and-play compositional reasoning with large language models. arXiv (2023)."},{"key":"e_1_3_2_2_29_1","unstructured":"Shiona McCallum. 2023. ChatGPT banned in Italy over privacy concerns. hrefhttps:\/\/www.bbc.com\/news\/technology-65139406[Link] ."},{"key":"e_1_3_2_2_30_1","unstructured":"Microsoft. 2023 a. Bing Preview Release Notes: Bing in the Edge Sidebar. hrefhttps:\/\/blogs.bing.com\/search\/march_2023\/BinPreview-Release-Notes-Bing-in-the-Edge-Sidebar[Link] ."},{"key":"e_1_3_2_2_31_1","unstructured":"Microsoft. 2023 b. Bringing the power of AI to Windows 11 -- unlocking a new era of productivity for customers and developers with Windows Copilot and Dev Home. hrefhttps:\/\/blogs.windows.com\/windowsdeveloper\/2023\/05\/23\/bringing-the-power-of-ai-to-windows-11-unlocking-a-new-era-of-productivity-for-customers-and-developers-with-windows-copilot-and-dev-home\/[Link] ."},{"key":"e_1_3_2_2_32_1","unstructured":"Microsoft. 2023 c. Building the New Bing. hrefhttps:\/\/blogs.bing.com\/search-quality-insights\/february-2023\/Building-the-New-Bing[Link] ."},{"key":"e_1_3_2_2_33_1","unstructured":"Microsoft. 2023 d. Confirmed: the new Bing runs on OpenAI's GPT-4. hrefhttps:\/\/blogs.bing.com\/search\/march_2023\/Confirmed-the-new-Bing-runs-on-OpenAI%E2%80%99s-GPT-4[Link] ."},{"key":"e_1_3_2_2_34_1","unstructured":"Microsoft. 2023 e. Driving more traffic and value to publishers from the new Bing. hrefhttps:\/\/blogs.bing.com\/search\/march_2023\/Driving-more-traffic-and-value-to-publishers-from-the-new-Bing[Link] ."},{"key":"e_1_3_2_2_35_1","unstructured":"Microsoft. 2023 f. Introducing Microsoft 365 Copilot -- your copilot for work. hrefhttps:\/\/blogs.microsoft.com\/blog\/2023\/03\/16\/introducing-microsoft-365-copilot-your-copilot-for-work\/[Link] ."},{"key":"e_1_3_2_2_36_1","unstructured":"Microsoft. 2023 g. Introducing Microsoft Security Copilot. hrefhttps:\/\/www.microsoft.com\/en-us\/security\/business\/ai-machine-learning\/microsoft-security-copilot[Link] ."},{"key":"e_1_3_2_2_37_1","unstructured":"Microsoft. 2023 h. The New Bing and Edge -- Progress from Our First Month. hrefhttps:\/\/blogs.bing.com\/search\/march_2023\/The-New-Bing-and-Edge-%E2%80%93-Momentum-from-Our-First-Month[Link] ."},{"key":"e_1_3_2_2_38_1","unstructured":"Microsoft. 2023 i. Reinventing search with a new AI-powered Microsoft Bing and Edge your copilot for the web. hrefhttps:\/\/blogs.microsoft.com\/blog\/2023\/02\/07\/reinventing-search-with-a-new-ai-powered-microsoft-bing-and-edge-your-copilot-for-the-web\/[Link] ."},{"key":"e_1_3_2_2_39_1","unstructured":"Microsoft. 2023 j. That was fast! Microsoft slips ads into AI-powered Bing Chat. hrefhttps:\/\/techcrunch.com\/2023\/03\/29\/that-was-fast-microsoft-slips-ads-into-ai-powered-bing-chat\/[Link] ."},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"crossref","unstructured":"Moin Nadeem Anna Bethke and Siva Reddy. 2021. StereoSet: Measuring stereotypical bias in pretrained language models. In ACL | IJCNLP.","DOI":"10.18653\/v1\/2021.acl-long.416"},{"key":"e_1_3_2_2_41_1","unstructured":"OpenAI. 2022. ChatGPT. hrefhttps:\/\/chat.openai.com\/[Link] ."},{"key":"e_1_3_2_2_42_1","unstructured":"OpenAI. 2023 a. ChatGPT Plugins. hrefhttps:\/\/openai.com\/blog\/chatgpt-plugins[Link] ."},{"key":"e_1_3_2_2_43_1","unstructured":"OpenAI. 2023 b. GPT-4 Technical Report. arXiv (2023)."},{"key":"e_1_3_2_2_44_1","unstructured":"OpenAI. 2023 c. OpenAI Codex. hrefhttps:\/\/openai.com\/blog\/openai-codex[Link] ."},{"key":"e_1_3_2_2_45_1","unstructured":"Long Ouyang Jeffrey Wu Xu Jiang Diogo Almeida Carroll Wainwright Pamela Mishkin Chong Zhang Sandhini Agarwal Katarina Slama Alex Gray et al. 2022. Training language models to follow instructions with human feedback. In NeurIPS."},{"key":"e_1_3_2_2_46_1","volume-title":"Percy Liang, and Michael S Bernstein.","author":"Park Joon Sung","year":"2023","unstructured":"Joon Sung Park, Joseph C O'Brien, Carrie J Cai, Meredith Ringel Morris, Percy Liang, and Michael S Bernstein. 2023. Generative Agents: Interactive Simulacra of Human Behavior. arXiv (2023)."},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"crossref","unstructured":"Roma Patel and Ellie Pavlick. 2021. \"Was it \"stated\" or was it \"claimed\"?: How linguistic bias affects generative language models. In EMNLP.","DOI":"10.18653\/v1\/2021.emnlp-main.790"},{"key":"e_1_3_2_2_48_1","volume-title":"Gorilla: Large Language Model Connected with Massive APIs. arXiv","author":"Patil Shishir G","year":"2023","unstructured":"Shishir G Patil, Tianjun Zhang, Xin Wang, and Joseph E Gonzalez. 2023. Gorilla: Large Language Model Connected with Massive APIs. arXiv (2023)."},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"crossref","unstructured":"Ethan Perez Sam Ringer Kamil.e Lukovs i=ut.e Karina Nguyen Edwin Chen Scott Heiner Craig Pettit Catherine Olsson Sandipan Kundu Saurav Kadavath et al. 2022. Discovering Language Model Behaviors with Model-Written Evaluations. arXiv (2022).","DOI":"10.18653\/v1\/2023.findings-acl.847"},{"key":"e_1_3_2_2_50_1","volume-title":"Ignore Previous Prompt: Attack Techniques For Language Models. In NeurIPS ML Safety Workshop.","author":"Perez F\u00e1bio","year":"2022","unstructured":"F\u00e1bio Perez and Ian Ribeiro. 2022. Ignore Previous Prompt: Attack Techniques For Language Models. In NeurIPS ML Safety Workshop."},{"key":"e_1_3_2_2_51_1","unstructured":"Kevin Roose. 2023. A Conversation With Bing's Chatbot Left Me Deeply Unsettled. hrefhttps:\/\/www.nytimes.com\/2023\/02\/16\/technology\/bing-chatbot-microsoft-chatgpt.html[Link] ."},{"key":"e_1_3_2_2_52_1","unstructured":"Roman Samoilenko. 2023. New prompt injection attack on ChatGPT web version. Reckless copy-pasting may lead to serious privacy issues in your chat. hrefhttps:\/\/medium.com\/@kajojify\/new-prompt-injection-attack-on-chatgpt-web-version-ef717492c5c2[Link] ."},{"key":"e_1_3_2_2_53_1","volume-title":"Toolformer: Language Models Can Teach Themselves to Use Tools. arXiv","author":"Schick Timo","year":"2023","unstructured":"Timo Schick, Jane Dwivedi-Yu, Roberto Dess\u00ec, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. 2023. Toolformer: Language Models Can Teach Themselves to Use Tools. arXiv (2023)."},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00504"},{"key":"e_1_3_2_2_55_1","unstructured":"Jacob Steinhardt. 2023. Emergent Deception and Emergent Optimization. hrefhttps:\/\/bounded-regret.ghost.io\/emergent-deception-optimization\/[Link] ."},{"key":"e_1_3_2_2_56_1","unstructured":"Nisan Stiennon Long Ouyang Jeffrey Wu Daniel Ziegler Ryan Lowe Chelsea Voss Alec Radford Dario Amodei and Paul F Christiano. 2020. Learning to summarize with human feedback. In NeurIPS."},{"key":"e_1_3_2_2_57_1","unstructured":"Parth Thakkar. 2023. Copilot Internals. hrefhttps:\/\/thakkarparth007.github.io\/copilot-explorer\/posts\/copilot-internals[Link] ."},{"key":"e_1_3_2_2_58_1","volume-title":"Understanding emails and drafting responses--An approach using GPT-3. arXiv","author":"Thiergart Jonas","year":"2021","unstructured":"Jonas Thiergart, Stefan Huber, and Thomas \u00dcbellacker. 2021. Understanding emails and drafting responses--An approach using GPT-3. arXiv (2021)."},{"key":"e_1_3_2_2_59_1","unstructured":"Pranshu Verma and Will Oremus. 2023. ChatGPT invented a sexual harassment scandal and named a real law prof as the accused. hrefhttps:\/\/www.washingtonpost.com\/technology\/2023\/04\/05\/chatgpt-lies\/[Link] ."},{"key":"e_1_3_2_2_60_1","unstructured":"James Vincent. 2023 a. Google and Microsoft's chatbots are already citing one another in a misinformation shitshow. hrefhttps:\/\/www.theverge.com\/2023\/3\/22\/23651564\/google-microsoft-bard-bing-chatbots-misinformation[Link] ."},{"key":"e_1_3_2_2_61_1","unstructured":"James Vincent. 2023 b. Google's AI chatbot Bard makes factual error in first demo. hrefhttps:\/\/www.theverge.com\/2023\/2\/8\/23590864\/google-ai-chatbot-bard-mistake-error-exoplanet-demo[Link] ."},{"key":"e_1_3_2_2_62_1","unstructured":"Gerrit De Vynck Rachel Lerman and Nitasha Tiku. 2023. Microsoft's AI chatbot is going off the rails. hrefhttps:\/\/www.washingtonpost.com\/technology\/2023\/02\/16\/microsoft-bing-ai-chatbot-sydney\/[Link] ."},{"key":"e_1_3_2_2_63_1","unstructured":"Tom Warren. 2023 a. Microsoft limits Bing chat to five replies. hrefhttps:\/\/www.theverge.com\/2023\/2\/17\/23604906\/microsoft-bing-ai-chat-limits-conversations[Link] ."},{"key":"e_1_3_2_2_64_1","unstructured":"Tom Warren. 2023 b. Microsoft's Bing chatbot gets smarter with restaurant bookings image results and more. hrefhttps:\/\/www.theverge.com\/2023\/5\/4\/23710022\/microsoft-bing-chatbot-ai-image-video-chat-history-features[Link] ."},{"key":"e_1_3_2_2_65_1","unstructured":"Tom Warren. 2023 c. These are Microsoft's Bing AI secret rules and why it says it's named Sydney. hrefhttps:\/\/www.theverge.com\/23599441\/microsoft-bing-ai-sydney-secret-rules[Link] ."},{"key":"e_1_3_2_2_66_1","volume-title":"Jailbroken: How Does LLM Safety Training Fail? arXiv","author":"Wei Alexander","year":"2023","unstructured":"Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How Does LLM Safety Training Fail? arXiv (2023)."},{"key":"e_1_3_2_2_67_1","volume-title":"Quoc V Le, Denny Zhou, et al.","author":"Wei Jason","year":"2022","unstructured":"Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed H Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. In NeurIPS."},{"key":"e_1_3_2_2_68_1","unstructured":"Laura Weidinger John Mellor Maribeth Rauh Conor Griffin Jonathan Uesato Po-Sen Huang Myra Cheng Mia Glaese Borja Balle Atoosa Kasirzadeh et al. 2021. Ethical and social risks of harm from language models. arXiv (2021)."},{"key":"e_1_3_2_2_69_1","volume-title":"Fundamental Limitations of Alignment in Large Language Models. arXiv","author":"Wolf Yotam","year":"2023","unstructured":"Yotam Wolf, Noam Wies, Yoav Levine, and Amnon Shashua. 2023. Fundamental Limitations of Alignment in Large Language Models. arXiv (2023)."},{"key":"e_1_3_2_2_70_1","unstructured":"Shunyu Yao Jeffrey Zhao Dian Yu Izhak Shafran Karthik R Narasimhan and Yuan Cao. 2023. ReAct: Synergizing Reasoning and Acting in Language Models. In ICLR."},{"key":"e_1_3_2_2_71_1","volume-title":"How Language Model Hallucinations Can Snowball. arXiv","author":"Zhang Muru","year":"2023","unstructured":"Muru Zhang, Ofir Press, William Merrill, Alisa Liu, and Noah A Smith. 2023. How Language Model Hallucinations Can Snowball. arXiv (2023)."},{"key":"e_1_3_2_2_72_1","volume-title":"Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba.","author":"Zhou Yongchao","year":"2023","unstructured":"Yongchao Zhou, Andrei Ioan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba. 2023. Large Language Models are Human-Level Prompt Engineers. In ICLR. io"}],"event":{"name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","location":"Copenhagen Denmark","acronym":"CCS '23","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3605764.3623985","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3605764.3623985","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T01:37:05Z","timestamp":1755913025000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3605764.3623985"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,26]]},"references-count":72,"alternative-id":["10.1145\/3605764.3623985","10.1145\/3605764"],"URL":"https:\/\/doi.org\/10.1145\/3605764.3623985","relation":{},"subject":[],"published":{"date-parts":[[2023,11,26]]},"assertion":[{"value":"2023-11-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}