Prompts have evil twins

Enric Boix-Adsera; H. Howie Huang; Lucas H. McCabe; Rimon Melamed; Tanay Wakhare; Yejin Kim

Prompts have evil twins

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2311.07064 v3 pith:NFOPMADR submitted 2023-11-13 cs.CL

Prompts have evil twins

Rimon Melamed , Lucas H. McCabe , Tanay Wakhare , Yejin Kim , H. Howie Huang , Enric Boix-Adsera This is my paper

classification cs.CL

keywords promptseviltwinsmodelsnatural-languageapplicationsbecausebehavior

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

0 comments

read the original abstract

We discover that many natural-language prompts can be replaced by corresponding prompts that are unintelligible to humans but that provably elicit similar behavior in language models. We call these prompts "evil twins" because they are obfuscated and uninterpretable (evil), but at the same time mimic the functionality of the original natural-language prompts (twins). Remarkably, evil twins transfer between models. We find these prompts by solving a maximum-likelihood problem which has applications of independent interest.

discussion (0)

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

Prompt Compression via Activation Aggregation
cs.CL 2026-07 conditional novelty 6.0

A learned weighted sum of intermediate-layer activations compresses an instruction prompt into a single patch vector that, injected at an early layer, recovers task accuracy within ~2% of the full prompt.