{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T23:55:48Z","timestamp":1783814148477,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":71,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100006374","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62476107"],"award-info":[{"award-number":["62476107"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3690291","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"660-674","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":52,"title":["Optimization-based Prompt Injection Attack to LLM-as-a-Judge"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-6088-509X","authenticated-orcid":false,"given":"Jiawen","family":"Shi","sequence":"first","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2839-9127","authenticated-orcid":false,"given":"Zenghui","family":"Yuan","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0384-5138","authenticated-orcid":false,"given":"Yinuo","family":"Liu","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8315-7972","authenticated-orcid":false,"given":"Yue","family":"Huang","sequence":"additional","affiliation":[{"name":"University of Notre Dame, South Bend, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8747-9912","authenticated-orcid":false,"given":"Pan","family":"Zhou","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1539-7939","authenticated-orcid":false,"given":"Lichao","family":"Sun","sequence":"additional","affiliation":[{"name":"Lehigh University, Bethlehem, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9900-9309","authenticated-orcid":false,"given":"Neil Zhenqiang","family":"Gong","sequence":"additional","affiliation":[{"name":"Duke University, Durham, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al.","author":"Achiam Josh","year":"2023","unstructured":"Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)."},{"key":"e_1_3_2_1_2_1","unstructured":"Mistral AI. 2023. Mixtral of experts. https:\/\/mistral.ai\/news\/mixtral-of-experts\/"},{"key":"e_1_3_2_1_3_1","volume-title":"Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132","author":"Alon Gabriel","year":"2023","unstructured":"Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132 (2023)."},{"key":"e_1_3_2_1_4_1","unstructured":"Anthropic. 2023. Claude 2. https:\/\/www.anthropic.com\/news\/claude-2"},{"key":"e_1_3_2_1_5_1","volume-title":"The claude 3 model family: Opus, sonnet, haiku. Claude-3 Model Card","author":"Anthropic AI","year":"2024","unstructured":"AI Anthropic. 2024. The claude 3 model family: Opus, sonnet, haiku. Claude-3 Model Card, Vol. 1 (2024)."},{"key":"e_1_3_2_1_6_1","unstructured":"Yuntao Bai Andy Jones Kamal Ndousse Amanda Askell Anna Chen Nova DasSarma Dawn Drain Stanislav Fort Deep Ganguli Tom Henighan et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862 (2022)."},{"key":"e_1_3_2_1_7_1","volume-title":"Jeremy McHugh, Leyla Hujer, Aditya Bahl, Daniel del Castillo Iglesias, Ron Heichman, and Ramesh Darwishi.","author":"Branch Hezekiah J","year":"2022","unstructured":"Hezekiah J Branch, Jonathan Rodriguez Cefalu, Jeremy McHugh, Leyla Hujer, Aditya Bahl, Daniel del Castillo Iglesias, Ron Heichman, and Ramesh Darwishi. 2022. Evaluating the susceptibility of pre-trained language models via handcrafted adversarial examples. arXiv preprint arXiv:2209.02128 (2022)."},{"key":"e_1_3_2_1_8_1","volume-title":"A comprehensive survey of ai-generated content (aigc): A history of generative ai from gan to chatgpt. arXiv preprint arXiv:2303.04226","author":"Cao Yihan","year":"2023","unstructured":"Yihan Cao, Siyu Li, Yixin Liu, Zhiling Yan, Yutong Dai, Philip S Yu, and Lichao Sun. 2023. A comprehensive survey of ai-generated content (aigc): A history of generative ai from gan to chatgpt. arXiv preprint arXiv:2303.04226 (2023)."},{"key":"e_1_3_2_1_9_1","volume-title":"Daphne Ippolito, Florian Tramer, and Ludwig Schmidt.","author":"Carlini Nicholas","year":"2024","unstructured":"Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2024. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_1_10_1","volume-title":"Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419","author":"Chao Patrick","year":"2023","unstructured":"Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419 (2023)."},{"key":"e_1_3_2_1_11_1","volume-title":"MLLM-as-a-Judge: Assessing Multimodal LLM-as-a-Judge with Vision-Language Benchmark. arXiv preprint arXiv:2402.04788","author":"Chen Dongping","year":"2024","unstructured":"Dongping Chen, Ruoxi Chen, Shilin Zhang, Yinuo Liu, Yaochen Wang, Huichi Zhou, Qihui Zhang, Pan Zhou, Yao Wan, and Lichao Sun. 2024. MLLM-as-a-Judge: Assessing Multimodal LLM-as-a-Judge with Vision-Language Benchmark. arXiv preprint arXiv:2402.04788 (2024)."},{"key":"e_1_3_2_1_12_1","volume-title":"StruQ: Defending against prompt injection with structured queries. arXiv preprint arXiv:2402.06363","author":"Chen Sizhe","year":"2024","unstructured":"Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2024. StruQ: Defending against prompt injection with structured queries. arXiv preprint arXiv:2402.06363 (2024)."},{"key":"e_1_3_2_1_13_1","volume-title":"Can Large Language Models Be an Alternative to Human Evaluations? arXiv preprint arXiv:2305.01937","author":"Chiang Cheng-Han","year":"2023","unstructured":"Cheng-Han Chiang and Hung-yi Lee. 2023. Can Large Language Models Be an Alternative to Human Evaluations? arXiv preprint arXiv:2305.01937 (2023)."},{"key":"e_1_3_2_1_14_1","volume-title":"Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https:\/\/vicuna. lmsys. org (accessed","author":"Chiang Wei-Lin","year":"2023","unstructured":"Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https:\/\/vicuna. lmsys. org (accessed 14 April 2023), Vol. 2, 3 (2023), 6."},{"key":"e_1_3_2_1_15_1","unstructured":"Paul Christiano Jan Leike Tom B. Brown Miljan Martic Shane Legg and Dario Amodei. 2023. Deep reinforcement learning from human preferences. arxiv: 1706.03741 [stat.ML]"},{"key":"e_1_3_2_1_16_1","volume-title":"Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751","author":"Ebrahimi Javid","year":"2017","unstructured":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017. Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751 (2017)."},{"key":"e_1_3_2_1_17_1","unstructured":"Wensheng Gan Zhenlian Qi Jiayang Wu and Jerry Chun-Wei Lin. 2023. Large Language Models in Education: Vision and Opportunities. arxiv: 2311.13160 [cs.AI]"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.34740\/KAGGLE\/M\/3301"},{"key":"e_1_3_2_1_19_1","unstructured":"Riley Goodside. 2023. Prompt injection attacks against GPT-3. https:\/\/simonwillison.net\/2022\/Sep\/12\/prompt-injection\/"},{"key":"e_1_3_2_1_20_1","unstructured":"Google. 2023. Bard. http:\/\/bard.google.com\/chat"},{"key":"e_1_3_2_1_21_1","volume-title":"More than you've asked for: A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated Large Language Models. arXiv e-prints","author":"Greshake Kai","year":"2023","unstructured":"Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. More than you've asked for: A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated Large Language Models. arXiv e-prints (2023), arXiv--2302."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Kai Greshake Sahar Abdelnabi Shailesh Mishra Christoph Endres Thorsten Holz and Mario Fritz. 2023. Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arxiv: 2302.12173 [cs.CR]","DOI":"10.1145\/3605764.3623985"},{"key":"e_1_3_2_1_23_1","unstructured":"NCC Group. 2023. Exploring Prompt Injection Attacks. https:\/\/research.nccgroup.com\/2022\/12\/05\/exploring-prompt-injection-attacks\/"},{"key":"e_1_3_2_1_24_1","unstructured":"Rich Harang. 2023. Securing LLM Systems Against Prompt Injection. https:\/\/developer.nvidia.com\/blog\/securing-llm-systems against-prompt-injection"},{"key":"e_1_3_2_1_25_1","volume-title":"Llm self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308","author":"Helbling Alec","year":"2023","unstructured":"Alec Helbling, Mansi Phute, Matthew Hull, and Duen Horng Chau. 2023. Llm self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308 (2023)."},{"key":"e_1_3_2_1_26_1","volume-title":"Zijuan Lin, Liyang Zhou, et al.","author":"Hong Sirui","year":"2023","unstructured":"Sirui Hong, Xiawu Zheng, Jonathan Chen, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, et al. 2023. Metagpt: Meta programming for multi-agent collaborative framework. arXiv preprint arXiv:2308.00352 (2023)."},{"key":"e_1_3_2_1_27_1","unstructured":"Yuzhen Huang Yuzhuo Bai Zhihao Zhu Junlei Zhang Jinghan Zhang Tangjun Su Junteng Liu Chuancheng Lv Yikai Zhang Jiayi Lei Yao Fu Maosong Sun and Junxian He. 2023. C-Eval: A Multi-Level Multi-Discipline Chinese Evaluation Suite for Foundation Models. In Advances in Neural Information Processing Systems."},{"key":"e_1_3_2_1_28_1","volume-title":"Neil Zhenqiang Gong, and Lichao Sun","author":"Huang Yue","year":"2023","unstructured":"Yue Huang, Jiawen Shi, Yuan Li, Chenrui Fan, Siyuan Wu, Qihui Zhang, Yixin Liu, Pan Zhou, Yao Wan, Neil Zhenqiang Gong, and Lichao Sun. 2023. MetaTool Benchmark: Deciding Whether to Use Tools and Which to Use. arXiv preprint arXiv: 2310.03128 (2023)."},{"key":"e_1_3_2_1_29_1","volume-title":"Position: TrustLLM: Trustworthiness in Large Language Models. In International Conference on Machine Learning. PMLR","author":"Huang Yue","year":"2024","unstructured":"Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, et al. 2024. Position: TrustLLM: Trustworthiness in Large Language Models. In International Conference on Machine Learning. PMLR, 20166--20270."},{"key":"e_1_3_2_1_30_1","volume-title":"Trustgpt: A benchmark for trustworthy and responsible large language models. arXiv preprint arXiv:2306.11507","author":"Huang Yue","year":"2023","unstructured":"Yue Huang, Qihui Zhang, Lichao Sun, et al. 2023. Trustgpt: A benchmark for trustworthy and responsible large language models. arXiv preprint arXiv:2306.11507 (2023)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"crossref","unstructured":"Bo Hui Haolin Yuan Neil Gong Philippe Burlina and Yinzhi Cao. 2024. PLeak: Prompt Leaking Attacks against Large Language Model Applications. In ACM CCS.","DOI":"10.1145\/3658644.3670370"},{"key":"e_1_3_2_1_32_1","volume-title":"Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614","author":"Jain Neel","year":"2023","unstructured":"Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614 (2023)."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"e_1_3_2_1_34_1","volume-title":"Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al.","author":"Jiang Albert Q","year":"2023","unstructured":"Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7B. arXiv preprint arXiv:2310.06825 (2023)."},{"key":"e_1_3_2_1_35_1","volume-title":"Automatically Auditing Large Language Models via Discrete Optimization. arXiv preprint arXiv:2303.04381","author":"Jones Erik","year":"2023","unstructured":"Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. Automatically Auditing Large Language Models via Discrete Optimization. arXiv preprint arXiv:2303.04381 (2023)."},{"key":"e_1_3_2_1_36_1","volume-title":"Large language models are state-of-the-art evaluators of translation quality. arXiv preprint arXiv:2302.14520","author":"Kocmi Tom","year":"2023","unstructured":"Tom Kocmi and Christian Federmann. 2023. Large language models are state-of-the-art evaluators of translation quality. arXiv preprint arXiv:2302.14520 (2023)."},{"key":"e_1_3_2_1_37_1","volume-title":"Rlaif: Scaling reinforcement learning from human feedback with ai feedback. arXiv preprint arXiv:2309.00267","author":"Lee Harrison","year":"2023","unstructured":"Harrison Lee, Samrat Phatale, Hassan Mansoor, Kellie Lu, Thomas Mesnard, Colton Bishop, Victor Carbune, and Abhinav Rastogi. 2023. Rlaif: Scaling reinforcement learning from human feedback with ai feedback. arXiv preprint arXiv:2309.00267 (2023)."},{"key":"e_1_3_2_1_38_1","volume-title":"Generative judge for evaluating alignment. arXiv preprint arXiv:2310.05470","author":"Li Junlong","year":"2023","unstructured":"Junlong Li, Shichao Sun, Weizhe Yuan, Run-Ze Fan, Hai Zhao, and Pengfei Liu. 2023. Generative judge for evaluating alignment. arXiv preprint arXiv:2310.05470 (2023)."},{"key":"e_1_3_2_1_39_1","volume-title":"SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models. arXiv preprint arXiv:2402.05044","author":"Li Lijun","year":"2024","unstructured":"Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models. arXiv preprint arXiv:2402.05044 (2024)."},{"key":"e_1_3_2_1_40_1","volume-title":"Text Adversarial Purification as Defense against Adversarial Attacks. arXiv preprint arXiv:2203.14207","author":"Li Linyang","year":"2022","unstructured":"Linyang Li, Demin Song, and Xipeng Qiu. 2022. Text Adversarial Purification as Defense against Adversarial Attacks. arXiv preprint arXiv:2203.14207 (2022)."},{"key":"e_1_3_2_1_41_1","volume-title":"Weng Lam Tam, et al","author":"Liu Xiao","year":"2023","unstructured":"Xiao Liu, Xuanyu Lei, Shengyuan Wang, Yue Huang, Zhuoer Feng, Bosi Wen, Jiale Cheng, Pei Ke, Yifan Xu, Weng Lam Tam, et al. 2023. Alignbench: Benchmarking chinese alignment of large language models. arXiv preprint arXiv:2311.18743 (2023)."},{"key":"e_1_3_2_1_42_1","volume-title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451","author":"Liu Xiaogeng","year":"2023","unstructured":"Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451 (2023)."},{"key":"e_1_3_2_1_43_1","volume-title":"USENIX Security Symposium.","author":"Liu Yupei","year":"2024","unstructured":"Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Prompt injection attacks and defenses in llm-integrated applications. In USENIX Security Symposium."},{"key":"e_1_3_2_1_44_1","volume-title":"Deid-gpt: Zero-shot medical text de-identification by gpt-4. arXiv preprint arXiv:2303.11032","author":"Liu Zhengliang","year":"2023","unstructured":"Zhengliang Liu, Yue Huang, Xiaowei Yu, Lu Zhang, Zihao Wu, Chao Cao, Haixing Dai, Lin Zhao, Yiwei Li, Peng Shu, et al. 2023. Deid-gpt: Zero-shot medical text de-identification by gpt-4. arXiv preprint arXiv:2303.11032 (2023)."},{"key":"e_1_3_2_1_45_1","unstructured":"LMSys. 2023. LMSYS Chatbot Arena Leaderboard. https:\/\/huggingface.co\/spaces\/lmsys\/chatbot-arena-leaderboard"},{"key":"e_1_3_2_1_46_1","volume-title":"Tree of attacks: Jailbreaking black-box llms automatically. arXiv preprint arXiv:2312.02119","author":"Mehrotra Anay","year":"2023","unstructured":"Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2023. Tree of attacks: Jailbreaking black-box llms automatically. arXiv preprint arXiv:2312.02119 (2023)."},{"key":"e_1_3_2_1_47_1","unstructured":"Meta. 2024. Meta Llama 3. https:\/\/llama.meta.com\/docs\/model-cards-and-prompt-formats\/meta-llama-3\/"},{"key":"e_1_3_2_1_48_1","unstructured":"Microsoft. 2023. Bing Chat. https:\/\/blogs.microsoft.com\/blog\/2023\/02\/07\/reinventing-search-with-a-new-ai-powered-microsoft-bing-and-edge-your-copilot-for-the-web\/"},{"key":"e_1_3_2_1_49_1","unstructured":"Yohei Nakajima. 2022. Yohei's blog post. https:\/\/twitter.com\/yoheinakajima\/status\/1582844144640471040"},{"key":"e_1_3_2_1_50_1","unstructured":"OpenAI. 2023. ChatGPT. https:\/\/chat.openai.com"},{"key":"e_1_3_2_1_51_1","unstructured":"OpenAI. 2023. ChatGPT plugins. https:\/\/openai.com\/blog\/chatgpt-plugins"},{"key":"e_1_3_2_1_52_1","unstructured":"Fabio Perez and Ian Ribeiro. 2022. Ignore Previous Prompt: Attack Techniques For Language Models. arxiv: 2211.09527 [cs.CL]"},{"key":"e_1_3_2_1_53_1","volume-title":"Jatmo: Prompt injection defense by task-specific finetuning. arXiv preprint arXiv:2312.17673","author":"Piet Julien","year":"2023","unstructured":"Julien Piet, Maha Alrashed, Chawin Sitawarin, Sizhe Chen, Zeming Wei, Elizabeth Sun, Basel Alomair, and David Wagner. 2023. Jatmo: Prompt injection defense by task-specific finetuning. arXiv preprint arXiv:2312.17673 (2023)."},{"key":"e_1_3_2_1_54_1","unstructured":"Learn Prompting. 2023. Sandwich Defense. https:\/\/learnprompting.org\/docs\/prompt_hacking\/defensive_measures\/sandwich_defense"},{"key":"e_1_3_2_1_55_1","volume-title":"Communicative agents for software development. arXiv preprint arXiv:2307.07924","author":"Qian Chen","year":"2023","unstructured":"Chen Qian, Xin Cong, Cheng Yang, Weize Chen, Yusheng Su, Juyuan Xu, Zhiyuan Liu, and Maosong Sun. 2023. Communicative agents for software development. arXiv preprint arXiv:2307.07924 (2023)."},{"key":"e_1_3_2_1_56_1","unstructured":"Jose Selvi. 2022. Exploring Prompt Injection Attacks. https:\/\/research.nccgroup.com\/2022\/12\/05\/exploring-prompt-injection-attacks\/"},{"key":"e_1_3_2_1_57_1","volume-title":"Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt. arXiv preprint arXiv:2304.12298","author":"Shi Jiawen","year":"2023","unstructured":"Jiawen Shi, Yixin Liu, Pan Zhou, and Lichao Sun. 2023. Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt. arXiv preprint arXiv:2304.12298 (2023)."},{"key":"e_1_3_2_1_58_1","volume-title":"Eric Wallace, and Sameer Singh.","author":"Shin Taylor","year":"2020","unstructured":"Taylor Shin, Yasaman Razeghi, Robert L Logan IV, Eric Wallace, and Sameer Singh. 2020. Autoprompt: Eliciting knowledge from language models with automatically generated prompts. arXiv preprint arXiv:2010.15980 (2020)."},{"key":"e_1_3_2_1_59_1","volume-title":"Natural backdoor attack on text data. arXiv preprint arXiv:2006.16176","author":"Sun Lichao","year":"2020","unstructured":"Lichao Sun. 2020. Natural backdoor attack on text data. arXiv preprint arXiv:2006.16176 (2020)."},{"key":"e_1_3_2_1_60_1","volume-title":"Adv-bert: Bert is not robust on misspellings! generating nature adversarial samples on bert. arXiv preprint arXiv:2003.04985","author":"Sun Lichao","year":"2020","unstructured":"Lichao Sun, Kazuma Hashimoto, Wenpeng Yin, Akari Asai, Jia Li, Philip Yu, and Caiming Xiong. 2020. Adv-bert: Bert is not robust on misspellings! generating nature adversarial samples on bert. arXiv preprint arXiv:2003.04985 (2020)."},{"key":"e_1_3_2_1_61_1","unstructured":"Hugo Touvron Louis Martin Kevin Stone Peter Albert Amjad Almahairi Yasmine Babaei Nikolay Bashlykov Soumya Batra Prajjwal Bhargava Shruti Bhosale et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)."},{"key":"e_1_3_2_1_62_1","volume-title":"OpenChat: Advancing Open-source Language Models with Mixed-Quality Data. arXiv preprint arXiv:2309.11235","author":"Wang Guan","year":"2023","unstructured":"Guan Wang, Sijie Cheng, Xianyuan Zhan, Xiangang Li, Sen Song, and Yang Liu. 2023. OpenChat: Advancing Open-source Language Models with Mixed-Quality Data. arXiv preprint arXiv:2309.11235 (2023)."},{"key":"e_1_3_2_1_63_1","unstructured":"Yidong Wang Zhuohao Yu Zhengran Zeng Linyi Yang Cunxiang Wang Hao Chen Chaoya Jiang Rui Xie Jindong Wang Xing Xie et al. 2023. PandaLM: An Automatic Evaluation Benchmark for LLM Instruction Tuning Optimization. arXiv preprint arXiv:2306.05087 (2023)."},{"key":"e_1_3_2_1_64_1","unstructured":"Simon Willison. 2023. Delimiters won't save you from prompt injection. https:\/\/simonwillison.net\/2023\/May\/11\/delimiters-wont-save-you\/"},{"key":"e_1_3_2_1_65_1","volume-title":"Jailbreaking gpt-4v via self-adversarial attacks with system prompts. arXiv preprint arXiv:2311.09127","author":"Wu Yuanwei","year":"2023","unstructured":"Yuanwei Wu, Xiang Li, Yixin Liu, Pan Zhou, and Lichao Sun. 2023. Jailbreaking gpt-4v via self-adversarial attacks with system prompts. arXiv preprint arXiv:2311.09127 (2023)."},{"key":"e_1_3_2_1_66_1","volume-title":"Evaluating large language models at evaluating instruction following. arXiv preprint arXiv:2310.07641","author":"Zeng Zhiyuan","year":"2023","unstructured":"Zhiyuan Zeng, Jiatong Yu, Tianyu Gao, Yu Meng, Tanya Goyal, and Danqi Chen. 2023. Evaluating large language models at evaluating instruction following. arXiv preprint arXiv:2310.07641 (2023)."},{"key":"e_1_3_2_1_67_1","volume-title":"Wider and deeper llm networks are fairer llm evaluators. arXiv preprint arXiv:2308.01862","author":"Zhang Xinghua","year":"2023","unstructured":"Xinghua Zhang, Bowen Yu, Haiyang Yu, Yangyu Lv, Tingwen Liu, Fei Huang, Hongbo Xu, and Yongbin Li. 2023. Wider and deeper llm networks are fairer llm evaluators. arXiv preprint arXiv:2308.01862 (2023)."},{"key":"e_1_3_2_1_68_1","volume-title":"Advances in Neural Information Processing Systems","volume":"36","author":"Zheng Lianmin","year":"2024","unstructured":"Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. 2024. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_1_69_1","volume-title":"Judgelm: Fine-tuned large language models are scalable judges. arXiv preprint arXiv:2310.17631","author":"Zhu Lianghui","year":"2023","unstructured":"Lianghui Zhu, Xinggang Wang, and Xinlong Wang. 2023. Judgelm: Fine-tuned large language models are scalable judges. arXiv preprint arXiv:2310.17631 (2023)."},{"key":"e_1_3_2_1_70_1","volume-title":"Autodan: Automatic and interpretable adversarial attacks on large language models. arXiv preprint arXiv:2310.15140","author":"Zhu Sicheng","year":"2023","unstructured":"Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. 2023. Autodan: Automatic and interpretable adversarial attacks on large language models. arXiv preprint arXiv:2310.15140 (2023)."},{"key":"e_1_3_2_1_71_1","volume-title":"Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043","author":"Zou Andy","year":"2023","unstructured":"Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023)."}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690291","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3690291","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T05:58:37Z","timestamp":1755842317000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690291"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":71,"alternative-id":["10.1145\/3658644.3690291","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3690291","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}