[19] Cleo Nardo. The Waluigi effect (mega-post). https://www.lesswrong.com/posts/D7PumeYTDPfBTp3i7/the-waluigi-effect-mega-post, 2023.
[20] El-Mahdi El-Mhamdi, Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Lé- Nguyen Hoang, Rafael Pinot, Sébastien Rouault, and John Stephan. On the impossible safety of large AI models. arXiv preprint arXiv:2209.15259, 2022.
[21] Dan Elton. "(humble brag) I've had alpha access to Anthropic's competitor to chatGPT the past 2 weeks. The media embargo was just lifted an hour ago. I'll share some comparisons w chatGPT in thread. This summary I'm QT'ing aligns w/ my experience. See also screenshot of doc from Anthropic...". https://twitter.com/moreisdifferent/status/1611514796104351744, 2023.
[22] Colin Fraser. "Master thread of ways I have discovered to get ChatGPT to output text that it's not supposed to, including bigotry, URLs and personal information, and more". https://twitter.com/colin_fraser/status/1630763219450212355, 2023.
[23] Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, et al. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858, 2022.
[24] Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. Real-ToxicityPrompts: Evaluating neural toxic degeneration in language models. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 3356–3369, 2020.
[25] Josh A Goldstein, Girish Sastry, Micah Musser, Renee DiResta, Matthew Gentzel, and Katerina Sedova. Generative language models and automated influence operations: Emerging threats and potential mitigations. arXiv preprint arXiv:2301.04246, 2023.
[26] Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. More than you've asked for: A comprehensive analysis of novel prompt injection threats to application-integrated large language models. arXiv preprint arXiv:2302.12173, 2023.
[27] Alexey Guzey. A two sentence jailbreak for GPT-4 and Claude & why nobody knows how to fix it. https://guzey.com/ai/two-sentence-universal-jailbreak/, 2023.
[28] Julian Hazell. Large language models can be used to effectively scale spear phishing campaigns. arXiv preprint arXiv:2305.06972, 2023.
[29] Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. Automatically auditing large language models via discrete optimization. arXiv preprint arXiv:2303.04381, 2023.
[30] Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of LLMs: Dual-use through standard security attacks. arXiv preprint arXiv:2302.05733, 2023.
[31] Tomasz Korbak, Kejian Shi, Angelica Chen, Rasika Bhalerao, Christopher L Buckley, Jason Phang, Samuel R Bowman, and Ethan Perez. Pretraining language models with human preferences. arXiv preprint arXiv:2302.08582, 2023.
[32] Sarah Kreps, R. Miles McCain, and Miles Brundage. All the news that's fit to fabricate: A generated text as a tool of media misinformation. Journal of Experimental Political Science, 9 (1):104-117, 2022.
[33] Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, and Yangqiu Song. Multi-step jailbreaking privacy attacks on ChatGPT. arXiv preprint arXiv:2304.05197, 2023.
[34] Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. Analyzing leakage of personally identifiable information in language models. arXiv preprint arXiv:2302.00539, 2023.
[35] Zvi Mowshowitz. Jailbreaking ChatGPT on release day. https://www.lesswrong.com/post s/RYcoJdvmoBbi5Nax7/jailbreaking-chatgpt-on-release-day, 2023.