{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T04:06:20Z","timestamp":1779422780250,"version":"3.53.1"},"publisher-location":"New York, NY, USA","reference-count":29,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,5,26]],"date-time":"2026-05-26T00:00:00Z","timestamp":1779753600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,5,26]]},"DOI":"10.1145\/3786335.3813128","type":"proceedings-article","created":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T03:16:22Z","timestamp":1779419782000},"page":"773-784","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["SAPO: Secure Automated Prompt Optimization via Multi-Agent Collaboration"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6551-1798","authenticated-orcid":false,"given":"Emmanuel Aboah","family":"Boateng","sequence":"first","affiliation":[{"name":"DoorDash, San Francisco, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0758-2296","authenticated-orcid":false,"given":"Zachary","family":"Johnson","sequence":"additional","affiliation":[{"name":"Microsoft, Redmond, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0826-8031","authenticated-orcid":false,"given":"Tian","family":"Xia","sequence":"additional","affiliation":[{"name":"Microsoft, Redmond, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-2209-6572","authenticated-orcid":false,"given":"Sarah","family":"Zhang","sequence":"additional","affiliation":[{"name":"Amazon, Seattle, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0616-9139","authenticated-orcid":false,"given":"Aidan","family":"Jay","sequence":"additional","affiliation":[{"name":"Microsoft, Redmond, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-3266-4725","authenticated-orcid":false,"given":"Junyao","family":"Feng","sequence":"additional","affiliation":[{"name":"Microsoft, Redmond, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-7324-3990","authenticated-orcid":false,"given":"Aditya","family":"Mate","sequence":"additional","affiliation":[{"name":"Microsoft, Redmond, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-1057-7047","authenticated-orcid":false,"given":"Ehi","family":"Nosakhare","sequence":"additional","affiliation":[{"name":"Microsoft, Redmond, WA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,5,26]]},"reference":[{"key":"e_1_3_3_1_2_2","unstructured":"Dario Amodei Chris Olah Jacob Steinhardt Paul Christiano John Schulman and Dan Man\u00e9. 2016. Concrete Problems in AI Safety. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1606.06565 (2016)."},{"key":"e_1_3_3_1_3_2","unstructured":"Yuntao Bai Saurav Kadavath Sandipan Kundu Amanda Askell Jackson Kernion Andy Jones Anna Chen Anna Goldie Azalia Mirhoseini Cameron McKinnon et\u00a0al. 2022. Constitutional AI: Harmlessness from AI Feedback. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2212.08073 (2022)."},{"key":"e_1_3_3_1_4_2","unstructured":"R Bhonsle R Dutta S Vavilapalli H Seth A Jaye Y Chang M Rungta et\u00a0al. 2025. Auto-Eval Judge: Towards a General Agentic Framework for Task Completion Evaluation. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2508.05508 (2025)."},{"key":"e_1_3_3_1_5_2","unstructured":"EA Boateng K MacDonald A Viswanathan and S Das. 2026. Agentic Multi-Source Grounding for Enhanced Query Intent Understanding: A DoorDash Case Study. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2603.01486 (2026)."},{"key":"e_1_3_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.naacl-industry.52"},{"key":"e_1_3_3_1_7_2","doi-asserted-by":"crossref","unstructured":"Banghao Chen Zhaofeng Zhang Nicolas Langr\u00e9n\u00e9 and Shengxin Zhu. 2025. Unleashing the Potential of Prompt Engineering for Large Language Models. Patterns 6 6 (2025) 101260.","DOI":"10.1016\/j.patter.2025.101260"},{"key":"e_1_3_3_1_8_2","first-page":"7465","volume-title":"Proceedings of the 41st International Conference on Machine Learning","author":"Chen Lichang","year":"2024","unstructured":"Lichang Chen, Jiuhai Chen, Tom Goldstein, Heng Huang, and Tianyi Zhou. 2024. InstructZero: Efficient Instruction Optimization for Black-Box Large Language Models. In Proceedings of the 41st International Conference on Machine Learning. PMLR, Vienna, Austria, 7465\u20137489."},{"key":"e_1_3_3_1_9_2","volume-title":"The Twelfth International Conference on Learning Representations","author":"Dai Josef","year":"2024","unstructured":"Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Yin, and Mickel Liu. 2024. Safe RLHF: Safe Reinforcement Learning from Human Feedback. In The Twelfth International Conference on Learning Representations."},{"key":"e_1_3_3_1_10_2","unstructured":"AB Emmanuel D Victor B Cassiano N Ehimwenma A Nabiha M Chyna et\u00a0al. 2025. Using large generative models to improve the performance of weak language models in performing complex tasks. US Patent US-20250348745-A1."},{"key":"e_1_3_3_1_11_2","first-page":"13730","volume-title":"Proceedings of the 41st International Conference on Machine Learning","author":"Fernando Chrisantha","year":"2024","unstructured":"Chrisantha Fernando, Dylan Banarse, Henryk Michalewski, Simon Osindero, and Tim Rockt\u00e4schel. 2024. Promptbreeder: Self-Referential Self-Improvement via Prompt Evolution. In Proceedings of the 41st International Conference on Machine Learning. PMLR, Vienna, Austria, 13730\u201313751."},{"key":"e_1_3_3_1_12_2","unstructured":"Deep Ganguli Liane Lovitt Jackson Kernion Amanda Askell Yuntao Bai Saurav Kadavath Ben Mann Ethan Perez Nicholas Schiefer Kamal Ndousse et\u00a0al. 2022. Red Teaming Language Models to Reduce Harms: Methods Scaling Behaviors and Lessons Learned. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2209.07858 (2022)."},{"key":"e_1_3_3_1_13_2","volume-title":"The Twelfth International Conference on Learning Representations","author":"Hong Sirui","year":"2024","unstructured":"Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Ceyao Zhang, Jinlin Wang, Zili Wang, Steven Ka\u00a0Shing Yau, Zijian Lin, et\u00a0al. 2024. MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework. In The Twelfth International Conference on Learning Representations."},{"key":"e_1_3_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.108"},{"key":"e_1_3_3_1_15_2","unstructured":"Neel Jain Avi Schwarzschild Yuxin Wen Gowthami Somepalli John Kirchenbauer Ping-yeh Chiang Micah Goldblum Aniruddha Saha Jonas Geiping and Tom Goldstein. 2023. Baseline Defenses for Adversarial Attacks Against Aligned Language Models. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2309.00614 (2023)."},{"key":"e_1_3_3_1_16_2","volume-title":"The Twelfth International Conference on Learning Representations","author":"Khattab Omar","year":"2024","unstructured":"Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, Zhiyuan Zhang, Keshav Santhanam, Sri Vardhamanan, Saiful Haq, Ashutosh Sharma, Thomas\u00a0T. Joshi, Hanna Moazam, et\u00a0al. 2024. DSPy: Compiling Declarative Language Model Calls into State-of-the-Art Pipelines. In The Twelfth International Conference on Learning Representations."},{"key":"e_1_3_3_1_17_2","volume-title":"Advances in Neural Information Processing Systems","author":"Madaan Aman","year":"2023","unstructured":"Aman Madaan, Nikitha Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, et\u00a0al. 2023. Self-Refine: Iterative Refinement with Self-Feedback. In Advances in Neural Information Processing Systems."},{"key":"e_1_3_3_1_18_2","first-page":"35181","volume-title":"Proceedings of the 41st International Conference on Machine Learning","author":"Mazeika Mantas","year":"2024","unstructured":"Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. In Proceedings of the 41st International Conference on Machine Learning. PMLR, Vienna, Austria, 35181\u201335224."},{"key":"e_1_3_3_1_19_2","unstructured":"Jeremy McHugh Kristina \u0160ekrst and Jon Cefalu. 2025. Prompt Injection 2.0: Hybrid AI Threats. arxiv:https:\/\/arXiv.org\/abs\/2507.13169\u00a0[cs.CR]"},{"key":"e_1_3_3_1_20_2","doi-asserted-by":"crossref","unstructured":"Reid Pryzant Dan Iter Jerry Li Yin\u00a0Tat Lee Chenguang Zhu and Michael Zeng. 2023. Automatic Prompt Optimization with \u201cGradient Descent\u201d and Beam Search. arxiv:https:\/\/arXiv.org\/abs\/2305.03495\u00a0[cs.CL]","DOI":"10.18653\/v1\/2023.emnlp-main.494"},{"key":"e_1_3_3_1_21_2","unstructured":"Chen Qian Xin Cong Cheng Yang Weize Chen Yusheng Su Juyuan Xu Zhiyuan Liu and Maosong Sun. 2023. Communicative Agents for Software Development. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2307.07924 (2023)."},{"key":"e_1_3_3_1_22_2","first-page":"1016","volume-title":"Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track","author":"Sinha Ankita","year":"2024","unstructured":"Ankita Sinha, Wendi Cui, Kamalika Das, and Jiaxin Zhang. 2024. Survival of the Safest: Towards Secure Prompt Optimization through Interleaved Multi-Objective Evolution. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track. Association for Computational Linguistics, Miami, FL, USA, 1016\u20131027."},{"key":"e_1_3_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.824"},{"key":"e_1_3_3_1_24_2","doi-asserted-by":"crossref","unstructured":"Alexander Wei Nika Haghtalab and Jacob Steinhardt. 2023. Jailbroken: How Does LLM Safety Training Fail? arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2307.02483 (2023).","DOI":"10.52202\/075280-3508"},{"key":"e_1_3_3_1_25_2","unstructured":"Qingyun Wu Gagan Bansal Jieyu Zhang Yiran Wu Beibin Li Erkang Zhu Li Jiang Xiaoyun Zhang Shaokun Zhang Jiale Liu et\u00a0al. 2023. AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2308.08155 (2023)."},{"key":"e_1_3_3_1_26_2","first-page":"1","volume-title":"International Conference on Learning Representations","author":"Yang Chengrun","year":"2024","unstructured":"Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc\u00a0V. Le, Denny Zhou, and Xinyun Chen. 2024. Large Language Models as Optimizers. In International Conference on Learning Representations. OpenReview.net, Vienna, Austria, 1\u201329."},{"key":"e_1_3_3_1_27_2","unstructured":"Mert Yuksekgonul Federico Bianchi Joseph Boen Shengjia Zhao Zhiyuan Zhai Hao Sheng and James Zou. 2024. TextGrad: Automatic \"Differentiation\" via Text. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2406.07496 (2024)."},{"key":"e_1_3_3_1_28_2","unstructured":"Lianmin Zheng Wei-Lin Chiang Ying Sheng Siyuan Zhuang Zhanghao Wu Yonghao Zhuang Zi Lin Zhuohan Li Dacheng Li Eric\u00a0P. Xing et\u00a0al. 2023. Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena. Advances in Neural Information Processing Systems (2023)."},{"key":"e_1_3_3_1_29_2","volume-title":"The Eleventh International Conference on Learning Representations","author":"Zhou Yongchao","year":"2023","unstructured":"Yongchao Zhou, Andrei\u00a0Ioan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba. 2023. Large language models are human-level prompt engineers. In The Eleventh International Conference on Learning Representations."},{"key":"e_1_3_3_1_30_2","unstructured":"Andy Zou Zifan Wang J.\u00a0Zico Kolter and Matt Fredrikson. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2307.15043 (2023)."}],"event":{"name":"CAIS '26: ACM Conference on AI and Agentic Systems","location":"San Jose CA USA","acronym":"CAIS '26"},"container-title":["Proceedings of the ACM Conference on AI and Agentic Systems"],"original-title":[],"deposited":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T03:18:07Z","timestamp":1779419887000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3786335.3813128"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,26]]},"references-count":29,"alternative-id":["10.1145\/3786335.3813128","10.1145\/3786335"],"URL":"https:\/\/doi.org\/10.1145\/3786335.3813128","relation":{},"subject":[],"published":{"date-parts":[[2026,5,26]]},"assertion":[{"value":"2026-05-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}