---
title: "How Johnny Can Persuade LLMs to Jailbreak Them — Zeng 2024"
description: "Most jailbreak research treats LLMs as algorithmic systems, attacking them with optimized gibberish suffixes, ciphers or role-play templates."
authors: ["Yi Zeng", "Hongpeng Lin", "Jingwen Zhang", "Diyi Yang", "Ruoxi Jia", "Weiyan Shi"]
year: 2024
venue: "Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2024.acl-long.773/"
doi: "10.18653/v1/2024.acl-long.773"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2024](https://md.research.elamur.ai/free/en/papers/2024/page/3/) / How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs

# How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs

**Authors:** [Yi Zeng](https://md.research.elamur.ai/free/en/authors/yi-zeng/), Hongpeng Lin, [Jingwen Zhang](https://md.research.elamur.ai/free/en/authors/jingwen-zhang/), [Diyi Yang](https://md.research.elamur.ai/free/en/authors/diyi-yang/), [Ruoxi Jia](https://md.research.elamur.ai/free/en/authors/ruoxi-jia/), [Weiyan Shi](https://md.research.elamur.ai/free/en/authors/weiyan-shi/) · **Year:** 2024 · **Venue:** Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2024.acl-long.773/) · [PDF](https://aclanthology.org/2024.acl-long.773.pdf) · [DOI 10.18653/v1/2024.acl-long.773](https://doi.org/10.18653/v1/2024.acl-long.773) · [OpenAlex](https://openalex.org/W4402671039)

**Citations:** 102 citations (openalex-snapshot · 2026-10-14) · [100](#cited-by) in our library, of the 140884 papers whose bibliographies we read

## Summary

Most jailbreak research treats LLMs as algorithmic systems, attacking them with optimized gibberish suffixes, ciphers or role-play templates. This paper asks a different question: can ordinary persuasion, the kind non-experts use daily, talk a model into unsafe behavior? The authors draw on decades of social science work to build a taxonomy of persuasion techniques. They then train Persuasive Paraphrasers that rewrite plain harmful queries into fluent, human-readable persuasive adversarial prompts (PAPs).

A broad scan across 14 risk categories measures how well each technique works. A second, iteratively applied paraphraser is fine-tuned on the PAPs that succeeded. In 10 trials, this approach jailbreaks Llama-2-7b-Chat, GPT-3.5 and GPT-4 in over 92% of cases, beating algorithm-focused baselines without any specialized optimization. Stronger models turned out to be more vulnerable to persuasion and harder to protect with standard defenses. Existing post-hoc defenses leave a clear gap.

The work matters because it identifies a realistic, low-cost risk from everyday users. It also argues that AI safety needs more fundamental fixes.

## Key points

- **Taxonomy:** 15 high-level strategies (ethical and unethical) cover 40 fine-grained techniques, such as Evidence-based Persuasion, Expert Endorsement, Emotional Appeal and Foot-in-the-door.
- **Results:** PAP reaches an attack success rate above 92% on Llama-2-7b-Chat, GPT-3.5 and GPT-4. Claude was reported to resist PAPs.
- **Comparison:** The authors frame prior attacks such as GCG, PAIR, GPTFuzzer and low-resource-language attacks as lower levels of humanizing LLMs, with PAP at the highest level.
- **Defenses:** Current post-hoc defenses fall short against PAPs. The authors propose adaptive defenses, including adaptive safety system prompts and a summarization-based method, which also help against other attacks.
- **Release:** Findings were shared with Meta and OpenAI. Only the taxonomy is public, at github.com/CHATS-lab/persuasive_jailbreaker. Jailbreak data is available to researchers on request, and the trained paraphraser is withheld.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

Fields: [Natural language processing](https://md.research.elamur.ai/free/en/shelves/nlp/)

## Cited by

Cited by

100 papers of our library cite it (of the 140884 whose bibliographies we read); 3 of them have a page here, 97 not yet.

- [Jailbreaking Black Box Large Language Models in Twenty Queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/)
- [DeepInception: Hypnotize Large Language Model to Be Jailbreaker](https://md.research.elamur.ai/free/en/papers/li-2023-deepinception-hypnotize-large-language-model/)
- [Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbreak-guard-aligned-language-models/)

## Cite

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zeng2024how,
  title = {{How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs}},
  author = {Zeng, Yi and Lin, Hongpeng and Zhang, Jingwen and Yang, Diyi and Jia, Ruoxi and Shi, Weiyan},
  booktitle = {Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2024},
  doi = {10.18653/v1/2024.acl-long.773},
  url = {https://doi.org/10.18653/v1/2024.acl-long.773}
}
```

- [← previous How Far Are We to GPT-4V? Closing the Gap to Commercial Multimodal Models with Open-Source Suites](https://md.research.elamur.ai/free/en/papers/chen-2024-far-gpt-4v-closing/)
- [next → How Often Are Errors in Natural Language Reasoning Due to Paraphrastic Variability?](https://md.research.elamur.ai/free/en/papers/srikanth-2024-how-often-are-errors-natural/)
- [↑ back to papers of 2024](https://md.research.elamur.ai/free/en/papers/2024/page/3/)

## References

70 references, 18 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Praveen Aggarwal, Sung Youl Jun, and Jong Ho Huh. 2011. Scarcity messages. Journal of Advertising, 40(3):19–30. [find](https://scholar.google.com/scholar?q=Praveen+Aggarwal%2C+Sung+Youl+Jun%2C+and+Jong+Ho+Huh%2E+2011%2E+Scarcity+messages%2E+Journal+of+Advertising%2C+40%283%29%3A19%E2%80%9330%2E)
2. Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132. [find](https://scholar.google.com/scholar?q=Gabriel+Alon+and+Michael+Kamfonas%2E+2023%2E+Detecting+language+model+attacks+with+perplexity%2E+arXiv+preprint+arXiv%3A2308%2E14132%2E) [our card](https://md.research.elamur.ai/free/en/papers/alon-2023-detecting-language-model-attacks-perplexity/)
3. Anthropic. 2023. Model card and evaluations for claude models. [find](https://scholar.google.com/scholar?q=Anthropic%2E+2023%2E+Model+card+and+evaluations+for+claude+models%2E)
4. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. 2022. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Saurav+Kadavath%2C+Sandipan+Kundu%2C+Amanda+Askell%2C+Jackson+Kernion%2C+Andy+Jones%2C+Anna+Chen%2C+Anna+Goldie%2C+Azalia+Mirhoseini%2C+Cameron+McKinnon%2C+et+al%2E+2022%2E+Constitutional+ai%3A+Harmlessness+from+) [our card](https://md.research.elamur.ai/free/en/papers/bai-2022-constitutional-ai-harmlessness-ai-feedback/)
5. Karen Bartsch, Jennifer Cole Wright, and David Estes. 2010. Young children’s persuasion in everyday conversation: Tactics and attunement to others’ mental states. Social Development, 19(2):394–416. [find](https://scholar.google.com/scholar?q=Karen+Bartsch%2C+Jennifer+Cole+Wright%2C+and+David+Estes%2E+2010%2E+Young+children%E2%80%99s+persuasion+in+everyday+conversation%3A+Tactics+and+attunement+to+others%E2%80%99+mental+states%2E+Social+Development%2C+19%282%29%3A394%E2%80%93416%2E)
6. Helena Bilandzic and Rick Busselle. 2013. Narrative persuasion. The SAGE handbook of persuasion: Developments in theory and practice, pages 200–219. [find](https://scholar.google.com/scholar?q=Helena+Bilandzic+and+Rick+Busselle%2E+2013%2E+Narrative+persuasion%2E+The+SAGE+handbook+of+persuasion%3A+Developments+in+theory+and+practice%2C+pages+200%E2%80%93219%2E)
7. Ted Brader. 2005. Striking a responsive chord: How political ads motivate and persuade voters by appealing to emotions. American Journal of Political Science, 49(2):388–405. [find](https://scholar.google.com/scholar?q=Ted+Brader%2E+2005%2E+Striking+a+responsive+chord%3A+How+political+ads+motivate+and+persuade+voters+by+appealing+to+emotions%2E+American+Journal+of+Political+Science%2C+49%282%29%3A388%E2%80%93405%2E)
8. Judee K Burgoon, Leesa Dillman, and Lesa A Stem. 1993. Adaptation in dyadic interaction: Defining and operationalizing patterns of reciprocity and compensation. Communication Theory, 3(4):295–316. [find](https://scholar.google.com/scholar?q=Judee+K+Burgoon%2C+Leesa+Dillman%2C+and+Lesa+A+Stem%2E+1993%2E+Adaptation+in+dyadic+interaction%3A+Defining+and+operationalizing+patterns+of+reciprocity+and+compensation%2E+Communication+Theory%2C+3%284%29%3A295%E2%80%93316%2E)
9. Bochuan Cao, Yuanpu Cao, Lu Lin, and Jinghui Chen. 2023. Defending against alignment-breaking attacks via robustly aligned llm. arXiv preprint arXiv:2309.14348. [find](https://scholar.google.com/scholar?q=Bochuan+Cao%2C+Yuanpu+Cao%2C+Lu+Lin%2C+and+Jinghui+Chen%2E+2023%2E+Defending+against+alignment%2Dbreaking+attacks+via+robustly+aligned+llm%2E+arXiv+preprint+arXiv%3A2309%2E14348%2E)
10. Robert B Cialdini and Noah J Goldstein. 2004. Social influence: Compliance and conformity. Annu. Rev. Psychol., 55:591–621. [find](https://scholar.google.com/scholar?q=Robert+B+Cialdini+and+Noah+J+Goldstein%2E+2004%2E+Social+influence%3A+Compliance+and+conformity%2E+Annu%2E+Rev%2E+Psychol%2E%2C+55%3A591%E2%80%93621%2E)
11. Gary Lynn Cronkhite. 1964. Logic, emotion, and the paradigm of persuasion. Quarterly Journal of Speech, 50(1):13–18. [find](https://scholar.google.com/scholar?q=Gary+Lynn+Cronkhite%2E+1964%2E+Logic%2C+emotion%2C+and+the+paradigm+of+persuasion%2E+Quarterly+Journal+of+Speech%2C+50%281%29%3A13%E2%80%9318%2E)
12. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023a. Jailbreaker: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715. — [arXiv:2307.08715](https://arxiv.org/abs/2307.08715) [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Yuekang+Li%2C+Kailong+Wang%2C+Ying+Zhang%2C+Zefeng+Li%2C+Haoyu+Wang%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2023a%2E+Jailbreaker%3A+Automated+jailbreak+across+multiple+large+language+model+chatbots%2E+arX)
13. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2023b. Multilingual jailbreak challenges in large language models. arXiv preprint arXiv:2310.06474. [find](https://scholar.google.com/scholar?q=Yue+Deng%2C+Wenxuan+Zhang%2C+Sinno+Jialin+Pan%2C+and+Lidong+Bing%2E+2023b%2E+Multilingual+jailbreak+challenges+in+large+language+models%2E+arXiv+preprint+arXiv%3A2310%2E06474%2E) [our card](https://md.research.elamur.ai/free/en/papers/deng-2023-multilingual-jailbreak-challenges-large-language/)
14. Nicholas DiFonzo and Prashant Bordia. 2011. Rumors influence: Toward a dynamic social impact theory of rumor. In The science of social influence, pages 271–295. Psychology Press. [find](https://scholar.google.com/scholar?q=Nicholas+DiFonzo+and+Prashant+Bordia%2E+2011%2E+Rumors+influence%3A+Toward+a+dynamic+social+impact+theory+of+rumor%2E+In+The+science+of+social+influence%2C+pages+271%E2%80%93295%2E+Psychology+Press%2E)
15. James Price Dillard and Leanne K Knobloch. 2011. Interpersonal influence. The Sage handbook of interpersonal communication, pages 389–422. [find](https://scholar.google.com/scholar?q=James+Price+Dillard+and+Leanne+K+Knobloch%2E+2011%2E+Interpersonal+influence%2E+The+Sage+handbook+of+interpersonal+communication%2C+pages+389%E2%80%93422%2E)
16. Yanai Elazar, Akshita Bhagia, Ian Magnusson, Abhilasha Ravichander, Dustin Schwenk, Alane Suhr, Pete Walsh, Dirk Groeneveld, Luca Soldaini, Sameer Singh, et al. 2023. What’s in my big data? arXiv preprint arXiv:2310.20707. [find](https://scholar.google.com/scholar?q=Yanai+Elazar%2C+Akshita+Bhagia%2C+Ian+Magnusson%2C+Abhilasha+Ravichander%2C+Dustin+Schwenk%2C+Alane+Suhr%2C+Pete+Walsh%2C+Dirk+Groeneveld%2C+Luca+Soldaini%2C+Sameer+Singh%2C+et+al%2E+2023%2E+What%E2%80%99s+in+my+big+data%3F+arXiv+prep)
17. Robert H Gass and John S Seiter. 2022. Persuasion: Social influence and compliance gaining. Routledge. [find](https://scholar.google.com/scholar?q=Robert+H+Gass+and+John+S+Seiter%2E+2022%2E+Persuasion%3A+Social+influence+and+compliance+gaining%2E+Routledge%2E)
18. Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A Smith. 2020. Realtoxicityprompts: Evaluating neural toxic degeneration in language models. arXiv preprint arXiv:2009.11462. [find](https://scholar.google.com/scholar?q=Samuel+Gehman%2C+Suchin+Gururangan%2C+Maarten+Sap%2C+Yejin+Choi%2C+and+Noah+A+Smith%2E+2020%2E+Realtoxicityprompts%3A+Evaluating+neural+toxic+degeneration+in+language+models%2E+arXiv+preprint+arXiv%3A2009%2E11462%2E) [our card](https://md.research.elamur.ai/free/en/papers/gehman-2020-realtoxicityprompts-evaluating-neural-toxic-degeneration/)
19. Erving Goffman. 1974. Frame analysis: An essay on the organization of experience. Harvard University Press. [find](https://scholar.google.com/scholar?q=Erving+Goffman%2E+1974%2E+Frame+analysis%3A+An+essay+on+the+organization+of+experience%2E+Harvard+University+Press%2E)
20. Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, et al. 2023. Are aligned neural networks adversarially aligned? arXiv preprint arXiv:2306.15447. [find](https://scholar.google.com/scholar?q=Nicholas+Carlini%2C+Milad+Nasr%2C+Christopher+A+Choquette%2DChoo%2C+Matthew+Jagielski%2C+Irena+Gao%2C+Anas+Awadalla%2C+Pang+Wei+Koh%2C+Daphne+Ippolito%2C+Katherine+Lee%2C+Florian+Tramer%2C+et+al%2E+2023%2E+Are+aligned+neural+n)
21. Lewis Griffin, Bennett Kleinberg, Maximilian Mozes, Kimberly Mai, Maria Do Mar Vau, Matthew Caldwell, and Augustine Mavor-Parker. 2023a. Large language models respond to influence like humans. In Proceedings of the First Workshop on Social Influence in Conversations (SICon 2023), pages 15–24. [find](https://scholar.google.com/scholar?q=Lewis+Griffin%2C+Bennett+Kleinberg%2C+Maximilian+Mozes%2C+Kimberly+Mai%2C+Maria+Do+Mar+Vau%2C+Matthew+Caldwell%2C+and+Augustine+Mavor%2DParker%2E+2023a%2E+Large+language+models+respond+to+influence+like+humans%2E+In+Proc)
22. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419. [find](https://scholar.google.com/scholar?q=Patrick+Chao%2C+Alexander+Robey%2C+Edgar+Dobriban%2C+Hamed+Hassani%2C+George+J+Pappas%2C+and+Eric+Wong%2E+2023%2E+Jailbreaking+black+box+large+language+models+in+twenty+queries%2E+arXiv+preprint+arXiv%3A2310%2E08419%2E) [our card](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/)
23. Lewis D Griffin, Bennett Kleinberg, Maximilian Mozes, Kimberly T Mai, Maria Vau, Matthew Caldwell, and Augustine Marvor-Parker. 2023b. Susceptibility to influence of large language models. arXiv preprint arXiv:2303.06074. [find](https://scholar.google.com/scholar?q=Lewis+D+Griffin%2C+Bennett+Kleinberg%2C+Maximilian+Mozes%2C+Kimberly+T+Mai%2C+Maria+Vau%2C+Matthew+Caldwell%2C+and+Augustine+Marvor%2DParker%2E+2023b%2E+Susceptibility+to+influence+of+large+language+models%2E+arXiv+prepr)
24. Jiaao Chen and Diyi Yang. 2021. Weakly-supervised hierarchical models for predicting persuasive strategies in good-faith textual requests. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 12648–12656. [find](https://scholar.google.com/scholar?q=Jiaao+Chen+and+Diyi+Yang%2E+2021%2E+Weakly%2Dsupervised+hierarchical+models+for+predicting+persuasive+strategies+in+good%2Dfaith+textual+requests%2E+In+Proceedings+of+the+AAAI+Conference+on+Artificial+Intellige)
25. Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021. Gradient-based adversarial attacks against text transformers. arXiv preprint arXiv:2104.13733. [find](https://scholar.google.com/scholar?q=Chuan+Guo%2C+Alexandre+Sablayrolles%2C+Herv%C3%A9+J%C3%A9gou%2C+and+Douwe+Kiela%2E+2021%2E+Gradient%2Dbased+adversarial+attacks+against+text+transformers%2E+arXiv+preprint+arXiv%3A2104%2E13733%2E) [our card](https://md.research.elamur.ai/free/en/papers/guo-2021-gradient-based-adversarial-attacks-against/)
26. Robert B Cialdini. 2001. The science of persuasion. Scientific American, 284(2):76–81. [find](https://scholar.google.com/scholar?q=Robert+B+Cialdini%2E+2001%2E+The+science+of+persuasion%2E+Scientific+American%2C+284%282%29%3A76%E2%80%9381%2E)
27. Keise Izuma. 2013. The neural basis of social influence and attitude change. Current opinion in neurobiology, 23(3):456–462. 14333 12 [find](https://scholar.google.com/scholar?q=Keise+Izuma%2E+2013%2E+The+neural+basis+of+social+influence+and+attitude+change%2E+Current+opinion+in+neurobiology%2C+23%283%29%3A456%E2%80%93462%2E+14333+12)
28. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614. [find](https://scholar.google.com/scholar?q=Neel+Jain%2C+Avi+Schwarzschild%2C+Yuxin+Wen%2C+Gowthami+Somepalli%2C+John+Kirchenbauer%2C+Ping%2Dyeh+Chiang%2C+Micah+Goldblum%2C+Aniruddha+Saha%2C+Jonas+Geiping%2C+and+Tom+Goldstein%2E+2023%2E+Baseline+defenses+for+adversari) [our card](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/)
29. Richard L Johannesen and C Larson. 1989. Perspectives on ethics in persuasion. Persuasion: Reception and responsibility, pages 39–70. [find](https://scholar.google.com/scholar?q=Richard+L+Johannesen+and+C+Larson%2E+1989%2E+Perspectives+on+ethics+in+persuasion%2E+Persuasion%3A+Reception+and+responsibility%2C+pages+39%E2%80%9370%2E)
30. Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. Automatically auditing large language models via discrete optimization. arXiv preprint arXiv:2303.04381. [find](https://scholar.google.com/scholar?q=Erik+Jones%2C+Anca+Dragan%2C+Aditi+Raghunathan%2C+and+Jacob+Steinhardt%2E+2023%2E+Automatically+auditing+large+language+models+via+discrete+optimization%2E+arXiv+preprint+arXiv%3A2303%2E04381%2E)
31. Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. 2023. Exploiting programmatic behavior of llms: Dual-use through standard security attacks. arXiv preprint arXiv:2302.05733. — [arXiv:2302.05733](https://arxiv.org/abs/2302.05733) [find](https://scholar.google.com/scholar?q=Daniel+Kang%2C+Xuechen+Li%2C+Ion+Stoica%2C+Carlos+Guestrin%2C+Matei+Zaharia%2C+and+Tatsunori+Hashimoto%2E+2023%2E+Exploiting+programmatic+behavior+of+llms%3A+Dual%2Duse+through+standard+security+attacks%2E+arXiv+preprint)
32. James M Olson and Mark P Zanna. 1990. Self-inference processes: The ontario symposium, vol. 6. In This volume consists of expanded versions of papers originally presented at the Sixth Ontario Symposium on Personality and Social Psychology held at the University of Western Ontario, Jun 4-5, 1988. Law… [find](https://scholar.google.com/scholar?q=James+M+Olson+and+Mark+P+Zanna%2E+1990%2E+Self%2Dinference+processes%3A+The+ontario+symposium%2C+vol%2E+6%2E+In+This+volume+consists+of+expanded+versions+of+papers+originally+presented+at+the+Sixth+Ontario+Symposiu)
33. OpenAI. 2023. Gpt-4 technical report. [find](https://scholar.google.com/scholar?q=OpenAI%2E+2023%2E+Gpt%2D4+technical+report%2E) [our card](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/)
34. Daniel J O’keefe. 2018. Persuasion. In The Handbook of Communication Skills, pages 319–335. Routledge. [find](https://scholar.google.com/scholar?q=Daniel+J+O%E2%80%99keefe%2E+2018%2E+Persuasion%2E+In+The+Handbook+of+Communication+Skills%2C+pages+319%E2%80%93335%2E+Routledge%2E)
35. Richard M.. Perloff. 2017. The Dynamics of Persuasion: Communication and Attitudes in the 21st Century. Routledge. [find](https://scholar.google.com/scholar?q=Richard+M%2E%2E+Perloff%2E+2017%2E+The+Dynamics+of+Persuasion%3A+Communication+and+Attitudes+in+the+21st+Century%2E+Routledge%2E)
36. Richard E Petty, Leandre R Fabrigar, and Duane T Wegener. 2003. Emotional factors in attitudes and persuasion. Handbook of affective sciences, 752:772. [find](https://scholar.google.com/scholar?q=Richard+E+Petty%2C+Leandre+R+Fabrigar%2C+and+Duane+T+Wegener%2E+2003%2E+Emotional+factors+in+attitudes+and+persuasion%2E+Handbook+of+affective+sciences%2C+752%3A772%2E)
37. Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Soheil Feizi, and Hima Lakkaraju. 2023. Certifying llm safety against adversarial prompting. arXiv preprint arXiv:2309.02705. [find](https://scholar.google.com/scholar?q=Aounon+Kumar%2C+Chirag+Agarwal%2C+Suraj+Srinivas%2C+Soheil+Feizi%2C+and+Hima+Lakkaraju%2E+2023%2E+Certifying+llm+safety+against+adversarial+prompting%2E+arXiv+preprint+arXiv%3A2309%2E02705%2E) [our card](https://md.research.elamur.ai/free/en/papers/kumar-2023-certifying-llm-safety-against-adversarial/)
38. Chanthika Pornpitakpan. 2004. The persuasiveness of source credibility: A critical review of five decades’ evidence. Journal of applied social psychology, 34(2):243–281. [find](https://scholar.google.com/scholar?q=Chanthika+Pornpitakpan%2E+2004%2E+The+persuasiveness+of+source+credibility%3A+A+critical+review+of+five+decades%E2%80%99+evidence%2E+Journal+of+applied+social+psychology%2C+34%282%29%3A243%E2%80%93281%2E)
39. Raz Lapid, Ron Langberg, and Moshe Sipper. 2023. Open sesame! universal black box jailbreaking of large language models. arXiv preprint arXiv:2309.01446. — [arXiv:2309.01446](https://arxiv.org/abs/2309.01446) [find](https://scholar.google.com/scholar?q=Raz+Lapid%2C+Ron+Langberg%2C+and+Moshe+Sipper%2E+2023%2E+Open+sesame%21+universal+black+box+jailbreaking+of+large+language+models%2E+arXiv+preprint+arXiv%3A2309%2E01446%2E+%E2%80%94+%5BarXiv%3A2309%2E01446%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F230)
40. Penny Powers. 2007. Persuasion and coercion: a critical review of philosophical and empirical approaches. HEC F., 19:125. [find](https://scholar.google.com/scholar?q=Penny+Powers%2E+2007%2E+Persuasion+and+coercion%3A+a+critical+review+of+philosophical+and+empirical+approaches%2E+HEC+F%2E%2C+19%3A125%2E)
41. Yuhui Li, Fangyun Wei, Jinjing Zhao, Chao Zhang, and Hongyang Zhang. 2023. Rain: Your language models can align themselves without finetuning. arXiv preprint arXiv:2309.07124. — [arXiv:2309.07124](https://arxiv.org/abs/2309.07124) [find](https://scholar.google.com/scholar?q=Yuhui+Li%2C+Fangyun+Wei%2C+Jinjing+Zhao%2C+Chao+Zhang%2C+and+Hongyang+Zhang%2E+2023%2E+Rain%3A+Your+language+models+can+align+themselves+without+finetuning%2E+arXiv+preprint+arXiv%3A2309%2E07124%2E+%E2%80%94+%5BarXiv%3A2309%2E07124%5D%28htt)
42. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451. [find](https://scholar.google.com/scholar?q=Xiaogeng+Liu%2C+Nan+Xu%2C+Muhao+Chen%2C+and+Chaowei+Xiao%2E+2023%2E+Autodan%3A+Generating+stealthy+jailbreak+prompts+on+aligned+large+language+models%2E+arXiv+preprint+arXiv%3A2310%2E04451%2E) [our card](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/)
43. Jamie Luguri and Lior Jacob Strahilevitz. 2021. Shining a light on dark patterns. Journal of Legal Analysis, 13(1):43–109. [find](https://scholar.google.com/scholar?q=Jamie+Luguri+and+Lior+Jacob+Strahilevitz%2E+2021%2E+Shining+a+light+on+dark+patterns%2E+Journal+of+Legal+Analysis%2C+13%281%29%3A43%E2%80%93109%2E)
44. Arunesh Mathur, Gunes Acar, Michael J Friedman, Eli Lucherini, Jonathan Mayer, Marshini Chetty, and Arvind Narayanan. 2019. Dark patterns at scale: Findings from a crawl of 11k shopping websites. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW):1–32. [find](https://scholar.google.com/scholar?q=Arunesh+Mathur%2C+Gunes+Acar%2C+Michael+J+Friedman%2C+Eli+Lucherini%2C+Jonathan+Mayer%2C+Marshini+Chetty%2C+and+Arvind+Narayanan%2E+2019%2E+Dark+patterns+at+scale%3A+Findings+from+a+crawl+of+11k+shopping+websites%2E+Proc)
45. Maximilian Mozes, Xuanli He, Bennett Kleinberg, and Lewis D Griffin. 2023. Use of llms for illicit purposes: Threats, prevention measures, and vulnerabilities. arXiv preprint arXiv:2308.12833. — [arXiv:2308.12833](https://arxiv.org/abs/2308.12833) [find](https://scholar.google.com/scholar?q=Maximilian+Mozes%2C+Xuanli+He%2C+Bennett+Kleinberg%2C+and+Lewis+D+Griffin%2E+2023%2E+Use+of+llms+for+illicit+purposes%3A+Threats%2C+prevention+measures%2C+and+vulnerabilities%2E+arXiv+preprint+arXiv%3A2308%2E12833%2E+%E2%80%94+%5BarXi)
46. Arvind Narayanan, Arunesh Mathur, Marshini Chetty, and Mihir Kshirsagar. 2020. Dark patterns: Past, present, and future: The evolution of tricky user interfaces. Queue, 18(2):67–92. [find](https://scholar.google.com/scholar?q=Arvind+Narayanan%2C+Arunesh+Mathur%2C+Marshini+Chetty%2C+and+Mihir+Kshirsagar%2E+2020%2E+Dark+patterns%3A+Past%2C+present%2C+and+future%3A+The+evolution+of+tricky+user+interfaces%2E+Queue%2C+18%282%29%3A67%E2%80%9392%2E)
47. Daniel O’Keefe. 2016. Evidence-based advertising using persuasion principles: Predictive validity and proof of concept. European Journal of Marketing, 50(1/2):294–300. [find](https://scholar.google.com/scholar?q=Daniel+O%E2%80%99Keefe%2E+2016%2E+Evidence%2Dbased+advertising+using+persuasion+principles%3A+Predictive+validity+and+proof+of+concept%2E+European+Journal+of+Marketing%2C+50%281%2F2%29%3A294%E2%80%93300%2E)
48. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Yi+Zeng%2C+Tinghao+Xie%2C+Pin%2DYu+Chen%2C+Ruoxi+Jia%2C+Prateek+Mittal%2C+and+Peter+Henderson%2E+2023%2E+Fine%2Dtuning+aligned+language+models+compromises+safety%2C+even+when+users+do+not+intend+to%21) [our card](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/)
49. Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, Peter J Liu, et al. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res. [find](https://scholar.google.com/scholar?q=Colin+Raffel%2C+Noam+Shazeer%2C+Adam+Roberts%2C+Katherine+Lee%2C+Sharan+Narang%2C+Michael+Matena%2C+Yanqi+Zhou%2C+Wei+Li%2C+Peter+J+Liu%2C+et+al%2E+2020%2E+Exploring+the+limits+of+transfer+learning+with+a+unified+text%2Dto%2Dt)
50. Soo Young Rieh and David R Danielson. 2007. Credibility: A multidisciplinary framework. [find](https://scholar.google.com/scholar?q=Soo+Young+Rieh+and+David+R+Danielson%2E+2007%2E+Credibility%3A+A+multidisciplinary+framework%2E)
51. Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684. [find](https://scholar.google.com/scholar?q=Alexander+Robey%2C+Eric+Wong%2C+Hamed+Hassani%2C+and+George+J+Pappas%2E+2023%2E+Smoothllm%3A+Defending+large+language+models+against+jailbreaking+attacks%2E+arXiv+preprint+arXiv%3A2310%2E03684%2E) [our card](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/)
52. Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, and Jordan Boyd-Graber. 2023. Ignore this title and hackaprompt: Exposing systemic vulnerabilities of llms through a global prompt hacking competition.… [find](https://scholar.google.com/scholar?q=Sander+Schulhoff%2C+Jeremy+Pinto%2C+Anaum+Khan%2C+Louis%2DFran%C3%A7ois+Bouchard%2C+Chenglei+Si%2C+Svetlina+Anati%2C+Valen+Tagliabue%2C+Anson+Kost%2C+Christopher+Carnahan%2C+and+Jordan+Boyd%2DGraber%2E+2023%2E+Ignore+this+title+and)
53. Rusheb Shah, Quentin Feuillade-Montixi, Soroush Pour, Arush Tagade, Stephen Casper, and Javier Rando. 2023. Scalable and transferable black-box jailbreaks for language models via persona modulation. arXiv preprint arXiv:2311.03348. 14334 13 — [arXiv:2311.03348](https://arxiv.org/abs/2311.03348) [find](https://scholar.google.com/scholar?q=Rusheb+Shah%2C+Quentin+Feuillade%2DMontixi%2C+Soroush+Pour%2C+Arush+Tagade%2C+Stephen+Casper%2C+and+Javier+Rando%2E+2023%2E+Scalable+and+transferable+black%2Dbox+jailbreaks+for+language+models+via+persona+modulation%2E+a)
54. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. [https://github.com/tatsu-lab/](https://github.com/tatsu-lab/) stanford_alpaca. [↗](https://github.com/tatsu-lab/)
55. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288. [find](https://scholar.google.com/scholar?q=Hugo+Touvron%2C+Louis+Martin%2C+Kevin+Stone%2C+Peter+Albert%2C+Amjad+Almahairi%2C+Yasmine+Babaei%2C+Nikolay+Bashlykov%2C+Soumya+Batra%2C+Prajjwal+Bhargava%2C+Shruti+Bhosale%2C+et+al%2E+2023%2E+Llama+2%3A+Open+foundation+and+fi)
56. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2023. Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher. arXiv preprint arXiv:2308.06463. [find](https://scholar.google.com/scholar?q=Youliang+Yuan%2C+Wenxiang+Jiao%2C+Wenxuan+Wang%2C+Jen%2Dtse+Huang%2C+Pinjia+He%2C+Shuming+Shi%2C+and+Zhaopeng+Tu%2E+2023%2E+Gpt%2D4+is+too+smart+to+be+safe%3A+Stealthy+chat+with+llms+via+cipher%2E+arXiv+preprint+arXiv%3A2308%2E0) [our card](https://md.research.elamur.ai/free/en/papers/yuan-2023-gpt-4-too-smart-safe/)
57. Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. [find](https://scholar.google.com/scholar?q=Andy+Zou%2C+Zifan+Wang%2C+J+Zico+Kolter%2C+and+Matt+Fredrikson%2E+2023%2E+Universal+and+transferable+adversarial+attacks+on+aligned+language+models%2E+arXiv+preprint+arXiv%3A2307%2E15043%2E) [our card](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/)
58. Alex Wang. 2005. The effects of expert and consumer endorsements on audience response. Journal of advertising research, 45(4):402–412. [find](https://scholar.google.com/scholar?q=Alex+Wang%2E+2005%2E+The+effects+of+expert+and+consumer+endorsements+on+audience+response%2E+Journal+of+advertising+research%2C+45%284%29%3A402%E2%80%93412%2E)
59. Jiongxiao Wang, Zichen Liu, Keun Hee Park, Muhao Chen, and Chaowei Xiao. 2023. Adversarial demonstration attacks on large language models. arXiv preprint arXiv:2305.14950. — [arXiv:2305.14950](https://arxiv.org/abs/2305.14950) [find](https://scholar.google.com/scholar?q=Jiongxiao+Wang%2C+Zichen+Liu%2C+Keun+Hee+Park%2C+Muhao+Chen%2C+and+Chaowei+Xiao%2E+2023%2E+Adversarial+demonstration+attacks+on+large+language+models%2E+arXiv+preprint+arXiv%3A2305%2E14950%2E+%E2%80%94+%5BarXiv%3A2305%2E14950%5D%28https%3A%2F)
60. Xuewei Wang, Weiyan Shi, Richard Kim, Yoojung Oh, Sijia Yang, Jingwen Zhang, and Zhou Yu. 2019. Persuasion for good: Towards a personalized persuasive dialogue system for social good. arXiv preprint arXiv:1906.06725. [find](https://scholar.google.com/scholar?q=Xuewei+Wang%2C+Weiyan+Shi%2C+Richard+Kim%2C+Yoojung+Oh%2C+Sijia+Yang%2C+Jingwen+Zhang%2C+and+Zhou+Yu%2E+2019%2E+Persuasion+for+good%3A+Towards+a+personalized+persuasive+dialogue+system+for+social+good%2E+arXiv+preprint+a) [our card](https://md.research.elamur.ai/free/en/papers/wang-2019-persuasion-good-personalized-persuasive-dialogue/)
61. Zeming Wei, Yifei Wang, and Yisen Wang. 2023. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387. [find](https://scholar.google.com/scholar?q=Zeming+Wei%2C+Yifei+Wang%2C+and+Yisen+Wang%2E+2023%2E+Jailbreak+and+guard+aligned+language+models+with+only+few+in%2Dcontext+demonstrations%2E+arXiv+preprint+arXiv%3A2310%2E06387%2E) [our card](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbreak-guard-aligned-language-models/)
62. Timothy D Wilson, JC Olson, and MP Zanna. 2013. Self-persuasion via self-reflection. In Self-Inference Processes: The Ontario Symposium, J. Olson, M. Zanna, Eds.(Erlbaum, Hillsdale, NJ, 1990), volume 6, pages 43–67. [find](https://scholar.google.com/scholar?q=Timothy+D+Wilson%2C+JC+Olson%2C+and+MP+Zanna%2E+2013%2E+Self%2Dpersuasion+via+self%2Dreflection%2E+In+Self%2DInference+Processes%3A+The+Ontario+Symposium%2C+J%2E+Olson%2C+M%2E+Zanna%2C+Eds%2E%28Erlbaum%2C+Hillsdale%2C+NJ%2C+1990%29%2C+volume+)
63. Arch G Woodside, Suresh Sood, and Kenneth E Miller. 2008. When consumers and brands talk: Storytelling theory and research in psychology and marketing. Psychology & Marketing, 25(2):97–145. [find](https://scholar.google.com/scholar?q=Arch+G+Woodside%2C+Suresh+Sood%2C+and+Kenneth+E+Miller%2E+2008%2E+When+consumers+and+brands+talk%3A+Storytelling+theory+and+research+in+psychology+and+marketing%2E+Psychology+%26+Marketing%2C+25%282%29%3A97%E2%80%93145%2E)
64. Chloe Xiang. 2023. “he would still be here”: Man dies by suicide after talking with ai chatbot, widow says. [find](https://scholar.google.com/scholar?q=Chloe+Xiang%2E+2023%2E+%E2%80%9Che+would+still+be+here%E2%80%9D%3A+Man+dies+by+suicide+after+talking+with+ai+chatbot%2C+widow+says%2E)
65. Rongwu Xu, Brian Lin, Shujian Yang, Tianqi Zhang, Weiyan Shi, Tianwei Zhang, Zhixuan Fang, Wei Xu, and Han Qiu. 2023. The earth is flat because...: Investigating llms’ belief towards misinformation via persuasive conversation. arXiv preprint arXiv:2312.09085. [find](https://scholar.google.com/scholar?q=Rongwu+Xu%2C+Brian+Lin%2C+Shujian+Yang%2C+Tianqi+Zhang%2C+Weiyan+Shi%2C+Tianwei+Zhang%2C+Zhixuan+Fang%2C+Wei+Xu%2C+and+Han+Qiu%2E+2023%2E+The+earth+is+flat+because%2E%2E%2E%3A+Investigating+llms%E2%80%99+belief+towards+misinformation+vi)
66. Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. 2023. Low-resource languages jailbreak gpt-4. arXiv preprint arXiv:2310.02446. [find](https://scholar.google.com/scholar?q=Zheng%2DXin+Yong%2C+Cristina+Menghini%2C+and+Stephen+H+Bach%2E+2023%2E+Low%2Dresource+languages+jailbreak+gpt%2D4%2E+arXiv+preprint+arXiv%3A2310%2E02446%2E) [our card](https://md.research.elamur.ai/free/en/papers/yong-2023-low-resource-languages-jailbreak-gpt/)
67. Jiahao Yu, Xingwei Lin, and Xinyu Xing. 2023. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253. 14335 14 [find](https://scholar.google.com/scholar?q=Jiahao+Yu%2C+Xingwei+Lin%2C+and+Xinyu+Xing%2E+2023%2E+Gptfuzzer%3A+Red+teaming+large+language+models+with+auto%2Dgenerated+jailbreak+prompts%2E+arXiv+preprint+arXiv%3A2309%2E10253%2E+14335+14) [our card](https://md.research.elamur.ai/free/en/papers/yu-2023-gptfuzzer-red-teaming-large-language/)
68. Persuasion Technique Mapping Persuasion Technique Mapping Idx. Reference 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. A B, C C, D, F E, F F G G G G G, H I I I I C, J C, G, I C, G, I C, I C, G, I I, K 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39… [find](https://scholar.google.com/scholar?q=Persuasion+Technique+Mapping+Persuasion+Technique+Mapping+Idx%2E+Reference+1%2E+2%2E+3%2E+4%2E+5%2E+6%2E+7%2E+8%2E+9%2E+10%2E+11%2E+12%2E+13%2E+14%2E+15%2E+16%2E+17%2E+18%2E+19%2E+20%2E+A+B%2C+C+C%2C+D%2C+F+E%2C+F+F+G+G+G+G+G%2C+H+I+I+I+I+C%2C+J+C%2C+G%2C+I+)
69. O’Keefe (2016) Cronkhite (1964) Perloff (2017) Pornpitakpan (2004) Wang (2005) Rieh and Danielson (2007) Cialdini and Goldstein (2004) Cialdini (2001) Dillard and Knobloch (2011) Brader (2005) Petty et al. (2003) Woodside et al. (2008) Bilandzic and Busselle (2013) Burgoon et al. (1993) Aggarwal et… [find](https://scholar.google.com/scholar?q=O%E2%80%99Keefe+%282016%29+Cronkhite+%281964%29+Perloff+%282017%29+Pornpitakpan+%282004%29+Wang+%282005%29+Rieh+and+Danielson+%282007%29+Cialdini+and+Goldstein+%282004%29+Cialdini+%282001%29+Dillard+and+Knobloch+%282011%29+Brader+%282005%29+Petty+e)
70. Evidence-based Persuasion Logical Appeal Expert Endorsement Non-expert Testimonial Authority Endorsement Social Proof Injunctive Norm Foot-in-the-door Commitment Door-in-the-face Commitment Public Commitment Alliance Building Complimenting Shared Values Relationship Leverage Loyalty Appeals Favor Ne… [find](https://scholar.google.com/scholar?q=Evidence%2Dbased+Persuasion+Logical+Appeal+Expert+Endorsement+Non%2Dexpert+Testimonial+Authority+Endorsement+Social+Proof+Injunctive+Norm+Foot%2Din%2Dthe%2Ddoor+Commitment+Door%2Din%2Dthe%2Dface+Commitment+Public+Com)