---
title: "A Wolf in Sheep's Clothing — paper by Ding et al. (2023)"
description: "The authors argue that most jailbreaks come down to two moves, and they build ReNeLLM, an… 39 references, cited by 79 papers here."
authors: ["Peng Ding", "Jun Kuang", "Dan Ma", "Xuezhi Cao", "Yunsen Xian", "Jiajun Chen", "Shujian Huang"]
year: 2023
venue: "arXiv:2311.08268"
source: "https://arxiv.org/abs/2311.08268"
doi: "10.48550/arxiv.2311.08268"
arxiv: "2311.08268"
licence: "CC BY 4.0 (arXiv)"
licence_url: "http://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/ding-2023-wolf-sheep-s-clothing-generalized/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/ding-2023-wolf-sheep-s-clothing-generalized/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2023](https://md.research.elamur.ai/free/en/papers/2023/page/8/) / A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily

# A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily

**Authors:** [Peng Ding](https://md.research.elamur.ai/free/en/authors/peng-ding/), [Jun Kuang](https://md.research.elamur.ai/free/en/authors/jun-kuang/), Dan Ma, [Xuezhi Cao](https://md.research.elamur.ai/free/en/authors/xuezhi-cao/), Yunsen Xian, [Jiajun Chen](https://md.research.elamur.ai/free/en/authors/jiajun-chen/) and [Shujian Huang](https://md.research.elamur.ai/free/en/authors/shujian-huang/) · **Year:** 2023 · **Venue:** arXiv:2311.08268 · **Licence:** [CC BY 4.0 (arXiv)](http://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://arxiv.org/abs/2311.08268) · [PDF](https://arxiv.org/pdf/2311.08268) · [DOI 10.48550/arxiv.2311.08268](https://doi.org/10.48550/arxiv.2311.08268) · [arXiv 2311.08268](https://arxiv.org/abs/2311.08268) · [OpenAlex](https://openalex.org/W4388717351)

**Citations:** 6 citations (OpenAlex, 2026-10-14) · [79](https://md.research.elamur.ai/free/en/papers/ding-2023-wolf-sheep-s-clothing-generalized/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Safety-aligned LLMs can still be manipulated into giving harmful answers through jailbreak prompts. Existing attacks either depend on laborious hand-written templates (e.g., DAN) or on slow gradient search over white-box models (e.g., GCG). GCG produces nonsensical suffixes that are easy to filter and work poorly on commercial systems. The authors argue that most jailbreaks come down to two moves, and they build ReNeLLM, an automatic, training-free framework in which LLMs generate attacks against other LLMs. First, a harmful request is altered by a random chain of meaning-preserving edits, and an LLM classifier confirms the harmful intent is still present. Second, the altered request is hidden inside a harmless-looking task, and attempts repeat until an evaluator LLM judges the target's reply harmful. Experiments show higher attack success at much lower time cost than baselines, transfer across open and commercial models, and weak existing defenses. Attention analysis suggests nesting changes which part of a prompt the model prioritizes, which motivates priority-based defenses. The work offers a practical red-teaming tool and a warning for safety alignment research.

## Key points
- The attack is framed as a search over a finite strategy space. The goal is to maximize the harmfulness score that an evaluator LLM assigns to the target model's response.
- Six rewriting operations are used: shortening, restructuring sentences, misspelling sensitive words, inserting meaningless characters, partial translation and style change. These feed into three nesting scenarios: code completion, text continuation and table filling.
- Supervised fine-tuning of llama-2-chat-13b on code-completion attack data lowered table-filling ASR from 100 to 0. Text continuation still reached an ASR of 88.1, so the defense did not generalize.
- Used as a harmfulness classifier, GPT-3.5 cut GCG's ASR by 86.0 but caught only 17.7 for ReNeLLM. GPT-4 was stronger, yet ReNeLLM kept about 10% effectiveness while the other methods fell near zero.
- The listed limitations are fixed nesting scenarios, English-only datasets, random selection of strategies, and reliance on costly online models (GPT-3.5, GPT-4, Claude2). Code is available at github.com/NJUNLP/ReNeLLM.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Nanjing University](https://md.research.elamur.ai/free/en/universities/nanjing-university/) — University, Nanjing, China · 99 works · 8,512 citations
- [Meituan](https://md.research.elamur.ai/free/en/companies/meituan/) — Company, Beijing, China · 26 works · 3,953 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen and Shujian Huang. 2023. A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily. arXiv:2311.08268.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@misc{ding2023wolf,
  title = {{A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily}},
  author = {Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen and Shujian Huang},
  year = {2023},
  doi = {10.48550/arxiv.2311.08268},
  eprint = {2311.08268},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.2311.08268}
}
```

- [← previous Solving Math Word Problems via Cooperative Reasoning induced Language Models](https://md.research.elamur.ai/free/en/papers/zhu-2023-solving-math-word-problems-cooperative/)
- [next → BayLing: Bridging Cross-lingual Alignment and Instruction Following through Interactive Translation for Large Language Models](https://md.research.elamur.ai/free/en/papers/zhang-2023-bayling-bridging-cross-lingual-alignment/)
- [↑ back to papers of 2023](https://md.research.elamur.ai/free/en/papers/2023/page/8/)

## References

39 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Albert. 2023. [https://www.jailbreakchat.com/](https://www.jailbreakchat.com/). [↗](https://www.jailbreakchat.com/)
2. Anthropic. 2023. Model card and evaluations for claude models, [https://www-files.anthropic.com/production/images/Model-Card-Claude-2](https://www-files.anthropic.com/production/images/Model-Card-Claude-2). pdf. [↗](https://www-files.anthropic.com/production/images/Model-Card-Claude-2)
3. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+et+al%2E+2022%2E+Training+a+helpful+and+harmless+assistant+with+rein)
4. Bochuan Cao, Yuanpu Cao, Lu Lin, and Jinghui Chen. 2023. [Defending against alignment-breaking attacks via robustly aligned llm](https://md.research.elamur.ai/free/en/papers/cao-2024-defending-against-alignment-breaking-attacks/). arXiv preprint arXiv:2309.14348.
5. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
6. Noam Chomsky. 2002. Syntactic structures. Mouton de Gruyter. [find](https://scholar.google.com/scholar?q=Noam+Chomsky%2E+2002%2E+Syntactic+structures%2E+Mouton+de+Gruyter%2E)
7. Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep reinforcement learning from human preferences. Advances in neural information processing systems, 30. [find](https://scholar.google.com/scholar?q=Paul+F+Christiano%2C+Jan+Leike%2C+Tom+Brown%2C+Miljan+Martic%2C+Shane+Legg%2C+and+Dario+Amodei%2E+2017%2E+Deep+reinforcement+learning+from+human+preferences%2E+Advances+in+neural+information+processing+systems%2C+30%2E)
8. Hao Fu, Yao; Peng and Tushar Khot. 2022. How does gpt obtain its ability? tracing emergent abilities of language models to their sources. Yao Fu’s Notion. [find](https://scholar.google.com/scholar?q=Hao+Fu%2C+Yao%3B+Peng+and+Tushar+Khot%2E+2022%2E+How+does+gpt+obtain+its+ability%3F+tracing+emergent+abilities+of+language+models+to+their+sources%2E+Yao+Fu%E2%80%99s+Notion%2E)
9. Josh A Goldstein, Girish Sastry, Micah Musser, Renee DiResta, Matthew Gentzel, and Katerina Sedova. 2023. Generative language models and automated influence operations: Emerging threats and potential mitigations. arXiv preprint arXiv:2301.04246. — [arXiv:2301.04246](https://arxiv.org/abs/2301.04246) [find](https://scholar.google.com/scholar?q=Josh+A+Goldstein%2C+Girish+Sastry%2C+Micah+Musser%2C+Renee+DiResta%2C+Matthew+Gentzel%2C+and+Katerina+Sedova%2E+2023%2E+Generative+language+models+and+automated+influence+operations%3A+Emerging+threats+and+potential+)
10. Julian Hazell. 2023. Large language models can be used to effectively scale spear phishing campaigns. arXiv preprint arXiv:2305.06972. — [arXiv:2305.06972](https://arxiv.org/abs/2305.06972) [find](https://scholar.google.com/scholar?q=Julian+Hazell%2E+2023%2E+Large+language+models+can+be+used+to+effectively+scale+spear+phishing+campaigns%2E+arXiv+preprint+arXiv%3A2305%2E06972%2E+%E2%80%94+%5BarXiv%3A2305%2E06972%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2305%2E06972%29)
11. Xingwei He, Zhenghao Lin, Yeyun Gong, Hang Zhang, Chen Lin, Jian Jiao, Siu Ming Yiu, Nan Duan, Weizhu Chen, et al. 2023. [Annollm: Making large language models to be better crowdsourced annotators](https://md.research.elamur.ai/free/en/papers/he-2023-annollm-making-large-language-models/). arXiv preprint arXiv:2303.16854.
12. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). arXiv preprint arXiv:2309.00614.
13. Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. 2023. Exploiting programmatic behavior of llms: Dual-use through standard security attacks. arXiv preprint arXiv:2302.05733. [find](https://scholar.google.com/scholar?q=Daniel+Kang%2C+Xuechen+Li%2C+Ion+Stoica%2C+Carlos+Guestrin%2C+Matei+Zaharia%2C+and+Tatsunori+Hashimoto%2E+2023%2E+Exploiting+programmatic+behavior+of+llms%3A+Dual%2Duse+through+standard+security+attacks%2E+arXiv+preprint)
14. Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. [Large language models are zero-shot reasoners](https://md.research.elamur.ai/free/en/papers/kojima-2022-large-language-models-zero-shot/). Advances in neural information processing systems, 35:22199– 22213.
15. Tomasz Korbak, Kejian Shi, Angelica Chen, Rasika Vinayak Bhalerao, Christopher Buckley, Jason Phang, Samuel R Bowman, and Ethan Perez. 2023. [Pretraining language models with human preferences](https://md.research.elamur.ai/free/en/papers/korbak-2023-pretraining-language-models-human-preferences/). In International Conference on Machine Learning, pages 17506–17533. PMLR.
16. Raz Lapid, Ron Langberg, and Moshe Sipper. 2023. Open sesame! universal black box jailbreaking of large language models. arXiv preprint arXiv:2309.01446. — [arXiv:2309.01446](https://arxiv.org/abs/2309.01446) [find](https://scholar.google.com/scholar?q=Raz+Lapid%2C+Ron+Langberg%2C+and+Moshe+Sipper%2E+2023%2E+Open+sesame%21+universal+black+box+jailbreaking+of+large+language+models%2E+arXiv+preprint+arXiv%3A2309%2E01446%2E+%E2%80%94+%5BarXiv%3A2309%2E01446%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F230)
17. June M Liu, Donghao Li, He Cao, Tianhe Ren, Zeyi Liao, and Jiamin Wu. 2023a. Chatcounselor: A large language models for mental health support. arXiv preprint arXiv:2309.15461. — [arXiv:2309.15461](https://arxiv.org/abs/2309.15461) [find](https://scholar.google.com/scholar?q=June+M+Liu%2C+Donghao+Li%2C+He+Cao%2C+Tianhe+Ren%2C+Zeyi+Liao%2C+and+Jiamin+Wu%2E+2023a%2E+Chatcounselor%3A+A+large+language+models+for+mental+health+support%2E+arXiv+preprint+arXiv%3A2309%2E15461%2E+%E2%80%94+%5BarXiv%3A2309%2E15461%5D%28htt)
18. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023b. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
19. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Yang Liu. 2023c. [Jailbreaking chatgpt via prompt engineering: An empirical study](https://md.research.elamur.ai/free/en/papers/liu-2023-jailbreaking-chatgpt-prompt-engineering-empirical/). arXiv preprint arXiv:2305.13860.
20. Zhaoyang Liu, Zeqiang Lai, Zhangwei Gao, Erfei Cui, Xizhou Zhu, Lewei Lu, Qifeng Chen, Yu Qiao, Jifeng Dai, and Wenhai Wang. 2023d. Controlllm: Augment language models with tools by searching on graphs. arXiv preprint arXiv:2310.17796. — [arXiv:2310.17796](https://arxiv.org/abs/2310.17796) [find](https://scholar.google.com/scholar?q=Zhaoyang+Liu%2C+Zeqiang+Lai%2C+Zhangwei+Gao%2C+Erfei+Cui%2C+Xizhou+Zhu%2C+Lewei+Lu%2C+Qifeng+Chen%2C+Yu+Qiao%2C+Jifeng+Dai%2C+and+Wenhai+Wang%2E+2023d%2E+Controlllm%3A+Augment+language+models+with+tools+by+searching+on+graph)
21. Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloundou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. 2023. [A holistic approach to undesired content detection in the real world](https://md.research.elamur.ai/free/en/papers/markov-2022-holistic-approach-undesired-content-detection/). In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 15009–150…
22. ONeal. 2023. Chatgpt-dan-jailbreak, [https://gist.github.com/coolaj86/](https://gist.github.com/coolaj86/) 6f4f7b30129b0251f61fa7baaa881516. [↗](https://gist.github.com/coolaj86/)
23. ChatGPT, [https://openai.com/](https://openai.com/) [↗](https://openai.com/)
24. OpenAI. 2023b. [GPT-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/), [https://cdn.openai.com/papers/gpt-4.pdf](https://cdn.openai.com/papers/gpt-4.pdf). [↗](https://cdn.openai.com/papers/gpt-4.pdf)
25. OpenAI. 2023c. [https://openai.com/policies/](https://openai.com/policies/) usage-policies. [↗](https://openai.com/policies/)
26. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in Neural Information Processing Systems, 35:27730–27744.
27. Fábio Perez and Ian Ribeiro. 2022. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). arXiv preprint arXiv:2211.09527.
28. Abhinav Rao, Sachin Vashistha, Atharva Naik, Somak Aditya, and Monojit Choudhury. 2023. Tricking llms into disobedience: Understanding, analyzing, and preventing jailbreaks. arXiv preprint arXiv:2305.14965. — [arXiv:2305.14965](https://arxiv.org/abs/2305.14965) [find](https://scholar.google.com/scholar?q=Abhinav+Rao%2C+Sachin+Vashistha%2C+Atharva+Naik%2C+Somak+Aditya%2C+and+Monojit+Choudhury%2E+2023%2E+Tricking+llms+into+disobedience%3A+Understanding%2C+analyzing%2C+and+preventing+jailbreaks%2E+arXiv+preprint+arXiv%3A2305%2E)
29. Gaurav Sahu, Olga Vechtomova, Dzmitry Bahdanau, and Issam H Laradji. 2023. Promptmix: A class boundary augmentation method for large language model distillation. arXiv preprint arXiv:2310.14192. [find](https://scholar.google.com/scholar?q=Gaurav+Sahu%2C+Olga+Vechtomova%2C+Dzmitry+Bahdanau%2C+and+Issam+H+Laradji%2E+2023%2E+Promptmix%3A+A+class+boundary+augmentation+method+for+large+language+model+distillation%2E+arXiv+preprint+arXiv%3A2310%2E14192%2E)
30. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2023. [" do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/). arXiv preprint arXiv:2308.03825.
31. Irene Solaiman and Christy Dennison. 2021. [Process for adapting language models to society (palms) with values-targeted datasets](https://md.research.elamur.ai/free/en/papers/solaiman-2021-process-adapting-language-models-society/). Advances in Neural Information Processing Systems, 34:5861–5873.
32. Nisan Stiennon, Long Ouyang, Jeffrey Wu, Daniel Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F Christiano. 2020. Learning to summarize with human feedback. Advances in Neural Information Processing Systems, 33:3008– 3021. [find](https://scholar.google.com/scholar?q=Nisan+Stiennon%2C+Long+Ouyang%2C+Jeffrey+Wu%2C+Daniel+Ziegler%2C+Ryan+Lowe%2C+Chelsea+Voss%2C+Alec+Radford%2C+Dario+Amodei%2C+and+Paul+F+Christiano%2E+2020%2E+Learning+to+summarize+with+human+feedback%2E+Advances+in+Neural)
33. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. [Llama 2: Open foundation and fine-tuned chat models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-2-open-foundation-fine/). arXiv preprint arXiv:2307.09288. walkerspider. 2022. DAN is my new friend., ht…
34. Boxin Wang, Wei Ping, Chaowei Xiao, Peng Xu, Mostofa Patwary, Mohammad Shoeybi, Bo Li, Anima Anandkumar, and Bryan Catanzaro. 2022a. Exploring the limits of domain-adaptive training for detoxifying large-scale language models. Advances in Neural Information Processing Systems, 35:35811– 35824. [find](https://scholar.google.com/scholar?q=Boxin+Wang%2C+Wei+Ping%2C+Chaowei+Xiao%2C+Peng+Xu%2C+Mostofa+Patwary%2C+Mohammad+Shoeybi%2C+Bo+Li%2C+Anima+Anandkumar%2C+and+Bryan+Catanzaro%2E+2022a%2E+Exploring+the+limits+of+domain%2Dadaptive+training+for+detoxifying+la)
35. Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. 2022b. [Self-consistency improves chain of thought reasoning in language models](https://md.research.elamur.ai/free/en/papers/wang-2022-self-consistency-improves-chain-thought/). arXiv preprint arXiv:2203.11171.
36. Daniel M Ziegler, Nisan Stiennon, Jeffrey Wu, Tom B Brown, Alec Radford, Dario Amodei, Paul Christiano, and Geoffrey Irving. 2019. Fine-tuning language models from human preferences. arXiv preprint arXiv:1909.08593. [find](https://scholar.google.com/scholar?q=Daniel+M+Ziegler%2C+Nisan+Stiennon%2C+Jeffrey+Wu%2C+Tom+B+Brown%2C+Alec+Radford%2C+Dario+Amodei%2C+Paul+Christiano%2C+and+Geoffrey+Irving%2E+2019%2E+Fine%2Dtuning+language+models+from+human+preferences%2E+arXiv+preprint+ar)
37. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) arXiv preprint arXiv:2307.02483.
38. Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.
39. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. [Chain-of-thought prompting elicits reasoning in large language models](https://md.research.elamur.ai/free/en/papers/wei-2022-chain-thought-prompting-elicits-reasoning/). Advances in Neural Information Processing Systems, 35:24824–24837.

*Updated 2 November 2026*