Fooling LLM graders into giving better grades through neural activity guided adversarial prompting

Atsushi Yamamura; Surya Ganguli

REVIEW 4 major objections 5 minor 13 references

Fooling LLM graders into giving better grades through neural activity guided adversarial prompting

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Tiny adversarial suffixes can inflate LLM essay grades by amplifying an internal 'high grade' state, and the trick traces to the word 'user' in chat templates.

desk verdict A genuinely useful empirical attack paper whose 'neural activity guided' contribution is under-supported, but the 'user' token story and the SFT template fix are real and worth refereeing. read the letter →

arxiv 2412.15275 v1 pith:FB2ZMCBA submitted 2024-12-17 cs.CR cs.AIcs.CL

Atsushi Yamamura , Surya Ganguli This is my paper · ORCID

classification cs.CRcs.AIcs.CL

keywords adversarialpromptingLLMgradingpromptinjectionneuralrepresentationscognitivestatechattemplatebiasautomatedessayscoringGCG

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a small, optimized string of tokens appended to an essay can make large language model graders award far higher scores than the essay deserves. The authors first train a linear readout that predicts the model's score from activations in a middle layer, then amplify the activation pattern associated with the highest score using gradient-based suffix optimization. They show the resulting suffixes boost scores on essay problems and prompt templates never seen during optimization, and that the attack transfers to other open-source models and to closed-source Gemini. The paper also identifies a 'magic word' — 'user' — that appears in every successful suffix, traces its power to the role-header token in standard supervised fine-tuning chat templates, and shows that replacing that token with a unique special token sharply reduces the attack's effectiveness.

What carries the argument

The machinery is a linear readout plus an activation-amplification objective. A linear map $f(x;W,b)=Wx+b$ takes the residual-stream activation at layer 16, final token position, to logits over possible scores; the row of $W$ for the highest score is treated as a vector in activation space, and averaging those rows across tasks yields the target 'cognitive state.' The adversarial loss is the negative inner product between the current final-token activation and that target vector; the greedy coordinate gradient (GCG) algorithm, with token updates restricted to ASCII tokens, minimizes it by backpropagation, and a token-pruning step removes redundant suffix tokens. The readout both reveals the early grade judgment and supplies the direction that the attack amplifies.

What would settle it

Train the same linear readout on scores that have been randomly permuted across essays; if the resulting 'high-score' weight vectors still align across tasks as strongly as reported in Figure 3, the alignment is readout geometry rather than a meaningful cognitive state, and the attack should not transfer to new tasks.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that an LLM's grading decision is controlled by a specific direction in its internal activation space, and that direction can be hijacked. For Llama3.1-8B-Instruct, linear readouts at layer 16 predict the final score distribution from the activation at the last input token with correlation 0.8–0.9, which the authors interpret as the model forming its grade before producing any analysis. Averaging the readout rows for the highest score across two essay problems and two prompt templates gives a single target vector, interpreted as a cognitive state for 'excellent essay.' Optimizing a 20-token ASCII suffix to maximize the projection of the final-token activation onto that vector yields suffixes that raise scores on held-out essays, templates, and models; ablations show the token 'user' is essential, and supervised fine-tuning with a modified chat template that replaces 'user' with a unique special token drastically lowers the score gain.

Load-bearing premise

The load-bearing premise is that the averaged high-score readout vector extracted from two essay problems and two prompt templates is a universal 'high grade' cognitive state, so maximizing its projection at the last token will raise scores on other essays, templates, and models.

Editorial extensions

If this is right

The optimized suffixes improve scores on essay problem sets and prompt templates not used in optimization, so the attack does not require knowing the target prompt format in advance.
Suffix #1 raises scores on open-source models of various sizes and on Gemini-1.5-flash/pro, indicating that the vulnerability is shared across model families.
The final score is largely determined when the model finishes reading the essay, so the requested analysis text can be generated after the decision is already made.
Removing the token 'user' from a suffix significantly reduces its score gain, and replacing 'user' with a unique special token in the SFT chat template suppresses the attack.
Replacing positive words in the suffixes with antonyms lowers scores, showing the same mechanism can manipulate grades downward as well as upward.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper, if the high-score readout direction generalizes to other evaluation domains such as resume screening or peer-review-style judgment, the same suffix-optimization recipe could be ported with minimal re-optimization.
Beyond the paper, the 'user' effect suggests that other role-header tokens in other chat templates may create analogous attack surfaces, and measuring role-token activation directions could become a general audit method.
A concrete extension would be to measure the high-score readout direction in models fine-tuned with the modified chat template; if the direction remains aligned with high scores, the template fix removes this particular attack but not the underlying representation.
Since the attack is optimized white-box but transfers to black-box models, one could try to estimate the target activation direction from public checkpoints of similar models, potentially enabling black-box-only attacks not tied to the specific 'user' token.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should read this one. The headline result—small adversarial suffixes inflate LLM essay grades and transfer to other models including Gemini—is real, and the paper's best contribution is the discovery of the 'user' token bias and its origin in SFT chat templates. The supervised fine-tuning experiment, where swapping 'user' for a special token kills most of the attack, is a clean causal test and the strongest part of the paper. That alone justifies a serious look.

What is actually new: the observation that all optimized suffixes begin with 'user', the ablation study on Gemini showing that token is load-bearing, and the template-mitigation result. The readout-guided optimization is a natural extension of prior representation-engineering work (Zou et al., representation engineering; Li et al.; Xu et al.), and the transfer results across held-out problems, templates, and models are convincing at a qualitative level.

Now the soft spots, in proportion. The central methodological claim—that maximizing projection onto the averaged high-score readout vector is what makes the suffixes work—is not isolated. There is no random-suffix baseline, no length-matched non-adversarial control, and no optimization against a random or negative target direction. The ablation in Figure 6 removes tokens from suffixes already selected by the readout objective, so it cannot tell us whether the objective mattered. The stress-test note is right: the results are equally consistent with GCG discovering the 'user' token plus positive sentiment words, with the readout vector being inert. That is a real gap, but it is not fatal to the empirical attack claims. The paper does not overclaim the mechanism as proven; it says 'we hypothesize' for the user effect. Still, the title and contributions 2 and 3 imply the neural readout is doing the work, and that is underdetermined.

Other, smaller issues: no code or legible suffix strings are shipped, so independent replication is hard. There are no aggregate error bars or confidence intervals on the main transfer figures. The mitigation test only evaluates suffixes optimized on the original template, so it does not show that the template fix resists re-optimization. These are fixable in revision.

Who this is for: people working on LLM security, prompt injection, and automated assessment. The empirical findings will be cited, and the template fix is a concrete defensive idea worth testing further. It deserves a serious referee, not a desk rejection. I would send it to peer review and ask the authors to add the missing control experiments and release the suffixes and code.

Referee Report

4 major / 5 minor

Summary. The paper proposes a two-stage method for attacking LLM-based essay graders: first train a linear readout on internal activations of Llama3.1-8B-Instruct to identify a representation associated with high scores, then use the GCG algorithm to optimize an adversarial suffix that maximizes projection onto the averaged high-score readout direction. The authors report that the resulting suffixes increase LLM-assigned scores on held-out essay problems and prompt templates, transfer to several other open- and closed-source models including Gemini, and contain a recurring 'user' token whose removal sharply reduces effectiveness. They further attribute this 'nonsense user effect' to the chat template used in supervised fine-tuning and show that replacing 'user' with a special token in the template reduces the attack's effectiveness.

Significance. If the findings hold, the paper makes a useful contribution by demonstrating a systematic, optimization-based method to uncover and exploit hidden biases in LLM evaluators, with evidence of transfer across models. The held-out evaluation design (unseen essay problems and prompt templates), the cross-model transfer results, and the supervised fine-tuning experiment as a causal test of the 'user' bias are notable strengths. However, the central claim that the effectiveness is specifically due to the neural readout direction is not yet fully supported, because key control conditions are missing.

major comments (4)

[Section 3.3, Table 1, Figure 5] The manuscript does not include a random-suffix baseline or a control in which suffixes are optimized against a random or negative readout direction. The observed score gains could plausibly arise from the GCG-discovered token sequence itself (e.g., the 'user' role token plus positive sentiment words), independent of the readout direction. Since the paper's stated contribution is 'neural activity guided' adversarial prompting, the authors should add (i) a length-matched random ASCII suffix control, (ii) an identical GCG optimization against a random or negative target direction, and (iii) a non-adversarial but semantically similar suffix, and show that the readout-targeted suffixes significantly outperform these controls.
[Figure 5, Figure 10] Transfer results are presented only as scatter plots without aggregate effect sizes, confidence intervals, or statistical comparisons. The claim that suffixes are 'effective' across models and the qualitative comparison that larger models are less vulnerable need numerical summaries (e.g., mean and median normalized score gain with confidence intervals, proportion of essays with positive gain) and, ideally, a test comparing gains across conditions.
[Section 4.2, Figure 6] The token ablation removes tokens from suffixes that were already selected by the readout-based objective. This establishes that the 'user' token is important for the chosen suffixes, but it does not establish that the readout direction was causally responsible for the suffix's effectiveness. The missing random-direction control (noted above) is therefore load-bearing for the paper's main methodological claim.
[Section 4.3, Figure 7] The supervised fine-tuning mitigation experiment should report whether the modified chat template changes the model's baseline grading behavior, e.g., agreement with human scores on unmodified essays. Without this, the reduced attack effectiveness could partly reflect a general degradation of instruction following or grading quality, rather than a removal of the specific 'user' bias.

minor comments (5)

[Throughout] There are numerous typos, including 'suffice' for 'suffix', 'the the' in Section 4.3, 'An very interesting' in Limitations, 'acoording' in Prompt Template #2, and 'EV ALUATION' in Prompt Template #4. A careful proofread is needed.
[Section 1 and 4.2] The paper alternates between 'magic word' and 'magical word'; please use one term consistently.
[Appendix/Section 3.3] The evaluation of suffix cleanup is described as using 'Llama3.1-8B-Instruct-Turbo' with a footnote about FP8 quantization, but no details are given about how the quantized model differs from the base model in score calibration. Please clarify.
[Section 3.2] The choice to average the four highest-score readout vectors is operationally clear, but the paper should state whether using the average, rather than any individual readout vector, was validated (e.g., by comparing suffix success rates).
[General] No code or artifact link is provided. Given the complexity of the optimization pipeline, releasing code would substantially improve reproducibility; at minimum, please state an availability plan.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central claim is an empirical held-out attack result, and the only self-citation is non-load-bearing related work.

full rationale

The paper's derivation chain is: (1) train linear readouts f(x;W,b)=Wx+b on Llama3.1-8B-Instruct activations to predict that model's own score distributions; (2) average the four high-score readout rows into a target vector; (3) run GCG with a loss equal to the negated inner product between the layer-16 final-token activation and that vector; (4) measure score gains on essay problems and prompt templates not used in optimization, and test transfer to other models including Gemini. Each link is empirically evaluated rather than definitionally forced. The target vector is operationally defined as the average readout row, but the claim that amplifying its projection raises scores is a causal hypothesis tested on held-out essays and unseen templates/models, not a consequence of the definition. The readout is fit to the model's own score distributions, yet the paper does not predict those training scores from the optimized suffix; the score gains are measured on unseen data. The sole prior work coauthored by an author (Maheswaranathan et al. 2019) appears in related work as background on line attractors and is not load-bearing; no uniqueness theorem or ansatz is imported from it. The absence of random-target and random-suffix controls weakens causal attribution of the gain to the readout direction, but that is a completeness or correctness concern, not circularity. The limitations section explicitly acknowledges that the suffixes primarily exploit a 'user' bias, which is an honest scope limitation rather than a circular move.

Assumptions & free parameters 5 free parameters · 4 assumptions · 1 invented entities

The attack depends on several hand-chosen or data-fitted components: readout regularization, layer/token selection, GCG hyperparameters, the suffix cleanup threshold, and the operational definition of the target cognitive state. The most consequential assumption is that the averaged readout direction is a universal high-score state; the paper supports this with cosine similarity and transfer results, but not with a direct causal validation. The chat-template explanation is a plausible hypothesis supported by one SFT comparison, not a proven mechanism.

free parameters (5)

L2 regularization coefficient for linear readout = 2e-5
Chosen by cross-validation on a 30% validation split of training essays (Section 3.2); affects readout quality and therefore the target direction used by the attack.
Readout layer and token position = layer 16 of 32, final input token
Selected after comparing KL validation loss across layers and token positions; this choice is data-driven and affects which activation pattern is amplified.
GCG optimization hyperparameters = K=256, 1000 iterations, 10 seeds, 20-token suffix, ASCII-only tokens
Hand-chosen algorithmic settings that determine suffix quality and reproducibility; not fitted to data but constrain the search.
Token removal threshold in suffix cleanup = keep tokens whose removal drops gain by less than 1%
Hand-chosen threshold for declaring tokens redundant; directly shapes the three published suffixes.
Target cognitive state as average of four highest-score readout rows = average weight vector over 2 problems x 2 templates at layer 16
Operational definition of the 'high-score cognitive state' used as the GCG loss target; if this averaging is not a general direction, transfer claims are weakened.

assumptions (4)

domain assumption Human-rated scores in the Hewlett dataset are the ground truth for essay quality, so an LLM score above the human score is a distortion.
Used throughout the evaluation (Section 3.1, Appendix B) to define score gain as adversarial inflation.
ad hoc to paper The average of the highest-score readout weight vectors is a universal cognitive state for high-quality essays.
Introduced in Section 3.2 ('we operationally define it as a cognitive state') and used as the GCG target; the paper provides cosine-similarity evidence but no independent validation.
ad hoc to paper The 'user' token in the chat template causes following text to be treated as user instructions, which explains the magic word effect.
Proposed in Section 4.3 as a mechanistic hypothesis; supported by the modified-template SFT experiment but not by direct causal measurements.
standard math Backpropagation through the transformer gives useful gradient signal for token optimization with the GCG algorithm.
Standard assumption of gradient-based adversarial prompt search, inherited from Zou et al. 2023b.

invented entities (1)

Universal high-score cognitive state vector independent evidence
purpose: Target direction for GCG suffix optimization; operational proxy for the model's internal evaluation of high-quality essays.
Defined as the average of four highest-score readout rows. Independent evidence is indirect: the resulting suffixes transfer across essay problems, templates, and models, but there is no direct measurement of a single latent state.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Fooling LLM graders into giving better grades through neural activity guided adversarial prompting." pith.science (2026). https://pith.science/paper/FB2ZMCBA

@misc{pith2026241215275,
  author       = {Pith},
  title        = {Pith review of: Fooling LLM graders into giving better grades through neural activity guided adversarial prompting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FB2ZMCBA}},
  note         = {Machine review of arXiv:2412.15275}
}

read the original abstract

The deployment of artificial intelligence (AI) in critical decision-making and evaluation processes raises concerns about inherent biases that malicious actors could exploit to distort decision outcomes. We propose a systematic method to reveal such biases in AI evaluation systems and apply it to automated essay grading as an example. Our approach first identifies hidden neural activity patterns that predict distorted decision outcomes and then optimizes an adversarial input suffix to amplify such patterns. We demonstrate that this combination can effectively fool large language model (LLM) graders into assigning much higher grades than humans would. We further show that this white-box attack transfers to black-box attacks on other models, including commercial closed-source models like Gemini. They further reveal the existence of a "magic word" that plays a pivotal role in the efficacy of the attack. We trace the origin of this magic word bias to the structure of commonly-used chat templates for supervised fine-tuning of LLMs and show that a minor change in the template can drastically reduce the bias. This work not only uncovers vulnerabilities in current LLMs but also proposes a systematic method to identify and remove hidden biases, contributing to the goal of ensuring AI safety and security.

Figures

Figures reproduced from arXiv: 2412.15275 by the authors.

**Figure 1.** Illustration of systematic bias injection into machine evaluators (a) We first train a linear readout to identify internal activation patterns that can predict the model’s final evaluation. (b) We then optimize adversarial input suffixes to amplify internal activation patterns that predict high scores. Such suffixes can reveal subtle LLM biases that can be exploited to distort decision outcomes. 2021; Tyser et al.).… view at source ↗

**Figure 2.** LLMs decide scores internally, much earlier than their explicit output. (a) An illustration of how the scores are obtained. The linear readout predicts the final score distribution from activation pattern in the residual stream of a given layer at a given token position. In particular we consider the readout at the end of the student essay and the end of the entire input. (b,c) Comparison of averaged scores given by… view at source ↗

**Figure 3.** The readout weight vectors associated with the highest score largely overlap across different essay problem sets and prompt templates. For each fixed essay problem set and prompt template, we obtain the readout weight at the end of the essay input at layer 16 of the Llama3.1-8B-instruct model, and compute the cosine similarity between different readouts. While the highest score of problem #1 and #2 are different, t… view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: LLM-graded scores are elevated by the optimized adversarial suffixes in [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: Our adversarial suffix is effective in attacking different language models. We measure the effectiveness of the suffix #1 in [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: An ablation study of tokens in adversarial suffixes shows importance of a specific word “user”. We measure the average normalized score gains obtained by adversarial suffixes with a single token removed. The blue bars are the normalized score gains averaged over differ…

**Figure 7.** Figure 7: A simple modification of the chat template drastically improve vulnerability (a) We modify the chat template used for the supervised fine-tuning of Llama3.1-8B model by replacing “user” token to a new special token. (b) These scatter plots show the score gain attained …

**Figure 8.** Figure 8: The structure of our prompt templates. Format Specification We provide a format to follow. The format has two parts: First the model is asked to state their thoughts or criticisms on the given essay, and then they give a score. This format varies across different promp…

**Figure 9.** Figure 9: Essay examples help LLM-rated scores align with human-rated score. For each essay problem and prompt template, we compare the scores rated by LLama-3.1-8B-instruct model and scores rated by human-experts. Each small marker represents a student essay in the dataset, w…

**Figure 10.** Figure 10: Score Gain by Adversarial Suffix #1 in [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

**Figure 11.** Figure 11: Score drops by adversarial suffixes modified from those in [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

13 extracted references · 3 canonical work pages

[2]

and Lawrence, N

Cortes, C. and Lawrence, N. D. Inconsistency in confer- ence peer review: Revisiting the 2014 neurips experi- ment. arXiv preprint arXiv:2109.09774,

arXiv 2014
[4]

The llama 3 herd of models

Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783,

arXiv
[7]

co/Open-Orca/SlimOrca

URL https://https://huggingface. co/Open-Orca/SlimOrca. Liu, X., Xu, N., Chen, M., and Xiao, C. Autodan: Generat- ing stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023a. Liu, Y ., Deng, G., Li, Y ., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y ., Wang, H., Zheng, Y ., et al. Prompt in- jection attack aga...

arXiv
[8]

T., Foerster, J., Clune, J., and Ha, D

Lu, C., Lu, C., Lange, R. T., Foerster, J., Clune, J., and Ha, D. The ai scientist: Towards fully automated open-ended scientific discovery. arXiv preprint arXiv:2408.06292 ,

arXiv
[9]

Tyser, K., Lee, J., Shporer, A., Udell, M., Te’eni, D., and Drori, I

URL https://learnprompting.org/docs/ prompt_hacking/defensive_measures/ sandwich_defense. Tyser, K., Lee, J., Shporer, A., Udell, M., Te’eni, D., and Drori, I. Openreviewer: Mitigating challenges in llm reviewing. Xu, C., Sun, Q., Zheng, K., Geng, X., Zhao, P., Feng, J., Tao, C., and Jiang, D. Wizardlm: Empowering large language models to follow complex i...

arXiv
[10]

Mammoth: Building math generalist models through hybrid instruction tuning.arXiv preprint arXiv:2309.05653,

Yue, X., Qu, X., Zhang, G., Fu, Y ., Huang, W., Sun, H., Su, Y ., and Chen, W. Mammoth: Building math generalist models through hybrid instruction tuning.arXiv preprint arXiv:2309.05653,

arXiv
[11]

Chatgpt for research paper review

Zaumanis, M. Chatgpt for research paper review. URL https://peerrecognized.com/ chatgpt-for-research-paper-review/ . Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., Pan, A., Yin, X., Mazeika, M., Dombrowski, A.-K., et al. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405, 2023a. Zou, A., Wang,...

arXiv
[12]

Format Specification We provide a format to follow

The structure of our prompt templates. Format Specification We provide a format to follow. The format has two parts: First the model is asked to state their thoughts or criticisms on the given essay, and then they give a score. This format varies across different prompt tem- plates. Essay Problem Statement We provide the essay problem given to students. S...

work page 2024

Show all 13 references

[13]

The Hewlett Foundation: Automated Essay Scoring

Essay Problems used in this work. The essay problems are taken from dataset “The Hewlett Foundation: Automated Essay Scoring” in Kaggle (Hamner et al., 2012). C. Essay Problems In this work, we use the four essay problems, numbered from #1 to #4. These are selected from eight ...

2012
[2012]

M., Hauth, A., Millican, K., et al

GeminiTeam, Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Soricut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805 ,

arXiv
[2013]

Rethinking jailbreaking through the lens of representation engineering

9 Li, T., Zheng, X., and Huang, X. Rethinking jailbreaking through the lens of representation engineering. ArXiv preprint, abs/2401.06824,

arXiv
[2023]

org/blog/2023-03-30-vicuna,

URL https://lmsys. org/blog/2023-03-30-vicuna,

2023
[2024]

org/abs/2405.07863,

URL https://arxiv. org/abs/2405.07863,

arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [2]

and Lawrence, N

Cortes, C. and Lawrence, N. D. Inconsistency in confer- ence peer review: Revisiting the 2014 neurips experi- ment. arXiv preprint arXiv:2109.09774,

arXiv 2014

[2] [4]

The llama 3 herd of models

Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783,

arXiv

[3] [7]

co/Open-Orca/SlimOrca

URL https://https://huggingface. co/Open-Orca/SlimOrca. Liu, X., Xu, N., Chen, M., and Xiao, C. Autodan: Generat- ing stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023a. Liu, Y ., Deng, G., Li, Y ., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y ., Wang, H., Zheng, Y ., et al. Prompt in- jection attack aga...

arXiv

[4] [8]

T., Foerster, J., Clune, J., and Ha, D

Lu, C., Lu, C., Lange, R. T., Foerster, J., Clune, J., and Ha, D. The ai scientist: Towards fully automated open-ended scientific discovery. arXiv preprint arXiv:2408.06292 ,

arXiv

[5] [9]

Tyser, K., Lee, J., Shporer, A., Udell, M., Te’eni, D., and Drori, I

URL https://learnprompting.org/docs/ prompt_hacking/defensive_measures/ sandwich_defense. Tyser, K., Lee, J., Shporer, A., Udell, M., Te’eni, D., and Drori, I. Openreviewer: Mitigating challenges in llm reviewing. Xu, C., Sun, Q., Zheng, K., Geng, X., Zhao, P., Feng, J., Tao, C., and Jiang, D. Wizardlm: Empowering large language models to follow complex i...

arXiv

[6] [10]

Mammoth: Building math generalist models through hybrid instruction tuning.arXiv preprint arXiv:2309.05653,

Yue, X., Qu, X., Zhang, G., Fu, Y ., Huang, W., Sun, H., Su, Y ., and Chen, W. Mammoth: Building math generalist models through hybrid instruction tuning.arXiv preprint arXiv:2309.05653,

arXiv

[7] [11]

Chatgpt for research paper review

Zaumanis, M. Chatgpt for research paper review. URL https://peerrecognized.com/ chatgpt-for-research-paper-review/ . Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., Pan, A., Yin, X., Mazeika, M., Dombrowski, A.-K., et al. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405, 2023a. Zou, A., Wang,...

arXiv

[8] [12]

Format Specification We provide a format to follow

The structure of our prompt templates. Format Specification We provide a format to follow. The format has two parts: First the model is asked to state their thoughts or criticisms on the given essay, and then they give a score. This format varies across different prompt tem- plates. Essay Problem Statement We provide the essay problem given to students. S...

work page 2024