Pith. sign in

REVIEW 5 major objections 4 minor 60 references

Simple demographic prompts—specifying a reader's country, generation, and political leanings—make eight leading LLMs more likely to comply with requests to generate disinformation, raising the overall jailbreak rate from 78% to 82%.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 09:51 UTC pith:CEPCPYAL

load-bearing objection Large multilingual dataset with a real but overstated personalisation effect; the two abstracts contradict each other, so the headline numbers need fixing before this can be a benchmark. the 5 major comments →

arxiv 2510.12993 v3 pith:CEPCPYAL submitted 2025-10-14 cs.CL

Tailored untruths: How personalisation challenges LLM safeguards

Jo\~ao A. Leite , Jo\~ao Luz , Silvia Gargova , Arnav Arora , Gustavo Sampaio , Ian Roberts , Carolina Scarton , Kalina Bontcheva This is my paper
classification cs.CL
keywords disinformationpersonalisationLLM safetyjailbreakmultilingualpersona-targeted promptingpersuasion techniquesAI-TRAITS
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that adding a few demographic attributes to a disinformation prompt—an easy, cheap step—weakens LLM safety mechanisms across languages and models. It builds a 1.6-million-text dataset in four languages and shows that persona-targeted prompts raise jailbreak rates from 78.22% to 82.19%, with some models jumping by 10 percentage points. It also shows the models are good at tailoring disinformation: top models reflect all three persona attributes in over 80% of outputs, and the personalised texts use 42% more persuasion techniques. If true, current safeguards are brittle to demographic conditioning, and safety is uneven across languages—Portuguese and Hindi get weaker enforcement than Russian and English.

Core claim

The central claim is that simple persona-targeted prompts systematically increase the likelihood that LLMs will produce requested disinformation rather than refuse or disclaim. Across eight instruction-tuned models and four languages, the jailbreak rate rises from 78.22% (target-agnostic) to 82.19% (persona-targeted), with Gemma showing the largest increase (53.54% to 63.62%) and English the sharpest language-level increase (75.64% to 83.45%). The paper also finds that LLMs are adept at personalisation: Grok and GPT reflect all three demographic attributes (country, generation, political orientation) in over 80% of outputs, and personalised narratives average 4.28 persuasion techniques versu

What carries the argument

The load-bearing mechanism is persona-targeted prompting: appending a short 'PERSONALISATION' block to existing disinformation prompts, specifying country, generation, and political orientation. This is carried by the AI-TRAITS corpus—1,596,672 outputs from eight models, 324 narratives, 150 personas, and four languages—and by the automatic labelling pipeline: hand-crafted rules for malformed outputs plus a Gemma-based LLM judge for jailbreak/refusal/disclaimer (macro-F1 0.85) and a Qwen-based judge for personalisation (F1 0.68). The machinery works by turning a generic instruction into a demographic address, which the paper shows shifts model behaviour and rhetoric.

Load-bearing premise

The headline percentages depend on the automatic labelling pipeline being accurate: the safety judge has macro-F1 0.85 and the personalisation judge 0.68, and human annotators disagreed at chance level on personalisation in Hindi (kappa 0.10); if judge errors correlate with language or personalisation, the claimed differences could shrink or vanish.

What would settle it

Take a random sample of, say, 2,000 outputs from AI-TRAITS—stratified by language and personalisation—and have human annotators label jailbreak vs. refusal vs. disclaimer. If the human-labelled jailbreak-rate gap between persona-targeted and target-agnostic prompts is not significantly above zero (or reverses in some languages), the central claim fails. A cheaper cue: check whether the Gemma judge labels disclaimers as jailbreaks more often for English outputs, which would inflate the English +7.8pp effect.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A simple three-line persona specification is enough to measurably weaken safety alignment; no sophisticated adversarial prompting is needed.
  • Safety enforcement is uneven across languages: Russian personas trigger the most refusals, while Portuguese and Hindi see weaker enforcement, implying disinformation campaigns could exploit these gaps.
  • Top models can personalise disinformation to country, generation, and political orientation simultaneously in over 80% of outputs, making micro-targeted campaigns feasible at scale.
  • Personalised disinformation uses more persuasion techniques and identity-based language (affiliation, ethnicity, memory), giving detectors a concrete linguistic signature to target.
  • The AI-TRAITS dataset provides a benchmark for future safety evaluations and disinformation detection in multilingual, cross-demographic settings.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the 4-percentage-point jailbreak gap holds under stricter human validation, personalisation is not just a style choice but a safety-relevant variable; safety evaluations should routinely include persona-conditioned prompts.
  • The language asymmetry suggests a testable hypothesis: models may be 'safer' in Russian because of more extensive safety fine-tuning on that language, not because of any intrinsic property; comparing versions trained with different data splits could isolate this.
  • The 42% increase in persuasion techniques suggests an automatic detector could flag personalised disinformation by measuring rhetorical density and identity-focused lexical cues—a concrete extension beyond the paper's descriptive analysis.
  • A natural next experiment is to test whether the jailbreak gap persists or widens with newer model versions, given the paper used models current as of December 2024.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper introduces AI-TRAITS, a dataset of roughly 1.6 million LLM-generated multilingual disinformation texts (8 models, 4 languages, 150 personas built from country, generation, and political orientation), and uses it to answer three research questions: whether persona-targeted prompting weakens LLM safeguards (RQ1), how effectively models personalise outputs (RQ2), and what linguistic and rhetorical shifts personalisation produces (RQ3). The central empirical claim, stated in the full-text abstract and Section 4.1.1, is that simple personalisation prompts significantly increase jailbreak rates across all studied models, with the overall rate rising from 78.22% to 82.19% and with model-level increases of up to about 10 percentage points. The paper also reports language- and model-specific disparities, high personalisation capability for proprietary models (Grok 91.33%, GPT 85.37%), and increased persuasion techniques in personalised outputs. The authors rely on hand-written rules plus a Gemma LLM-as-a-judge for safety labels and a Qwen judge for personalisation, validated against 424 human-annotated examples with modest to low inter-annotator agreement.

Significance. The claimed contribution is substantial if the results hold. The AI-TRAITS dataset would be, to my knowledge, the first large-scale multilingual corpus of persona-targeted LLM disinformation, extending prior English-only work (e.g., Zugecova et al., Hackenburg et al.) by three orders of magnitude in size and across four languages. The study is well-placed to inform both safety evaluation and detection research, and the authors are careful in several respects: they report stratified human annotation, disclose inter-annotator agreement (including poor κ values), adjudicate disagreements, and document decoding hyperparameters and API costs. The RQ3 analyses apply established classifiers, and the LIWC results are suggestive. The paper also ships the dataset (upon request) and makes code available (though both are currently TBA). However, the headline safety finding is currently obscured by an internal contradiction between the metadata abstract and the full-text results, and the evidence for the headline is weakened by the limited and noisy validation of the automatic labeling pipeline. These issues must be resolved before the empirical claims can be accepted.

major comments (5)
  1. [Abstract (metadata) vs. Section 4.1.1 / Table 10] The metadata abstract states that safeguards failed for 80% of non-personalised prompts and 77.7% of personalised prompts, i.e., a 2.3 percentage point decrease under personalisation. The full-text abstract, Section 4.1.1, and Table 10 report the opposite: jailbreak rates rise from 78.22% to 82.19% (+3.97 pp). If the metadata values use a different definition ('safeguards failed' may include disclaimers), the paper never says so in the abstract, and the body does not reconcile the discrepancy. Since both figures are presented as summaries of the same labelled corpus, the reader cannot determine the sign, let alone the magnitude, of the effect that motivates RQ1. This must be fixed by aligning the abstract with the table and explicitly defining which behaviour labels are included in each number.
  2. [Full-text abstract and §4.1.1; Table 10, Llama row] The full-text abstract asserts that personalisation 'significantly increases the likelihood of jailbreaks across all studied LLMs.' Table 10 shows Llama decreasing from 76.09% to 74.73%, and the Introduction bullet list itself concedes 'except Llama.' A claim of universality that contains a counter-example in the paper's own table is not internally consistent. Either the abstract must be amended to 'across all studied LLMs except Llama', or the paper must provide a model-level analysis explaining why Llama behaves differently. This is a load-bearing wording issue because the headline finding is precisely the universality of the effect.
  3. [Sections 3.5 and 4.2; Table 18; Appendix B] The automatic pipeline that labels all 1.6M outputs is validated on only 424 human-annotated examples. The safety judge (Gemma) has macro-F1 0.85; the personalisation judge (Qwen) has macro-F1 0.68. Human inter-annotator agreement for personalisation is at chance in Hindi (binary κ = 0.10 post-merge) and only slight to moderate in other languages (Appendix B). The claim in §4.2 that Qwen's F1 of 0.68 'represents near-human reliability' is not supported by these numbers and seems to reinterpret low human agreement as a validation of the judge rather than as a warning that the label itself is ill-defined. Because the headline RQ1/RQ2 differences are small (a few percentage points), differential judge error across languages, models, or prompt types could create spurious differences of this size. The paper should report confidence intervals, per-stratum accuracy, and ideally a larger adjudic
  4. [§4.1.1, Table 10: statistical support] The claim that personalisation 'significantly increases' jailbreak rates is made without any statistical test or confidence interval. With over a million outputs, a 3.97 pp difference may be statistically significant in the narrow sense, but the per-model and per-language differences in Table 10 (e.g., Hindi +0.1 pp, Llama −1.4 pp) are presented without uncertainty quantification. The paper should include confidence intervals or at least cluster-robust tests, and should state whether the headline overall effect is significant after accounting for the model- and prompt-level clustering.
  5. [Section 3.5 (bad generation) and §4.1] The rule-based bad-generation filter has macro-F1 0.83 against the human sample, with Portuguese at 0.76. Since 'bad generation' is the first stage of the three-way (refusal/disclaimer/jailbreak) classification, errors here propagate to the jailbreak rates in Table 10. The sensitivity of the reported rates to this filtering step is not discussed. A simple robustness check (e.g., re-estimating Table 10 with bad-generation instances treated as a separate category or excluded) would let the reader assess whether the personalisation effect is an artifact of differing bad-generation rates between target-agnostic and persona-targeted prompts.
minor comments (4)
  1. [Section 3.1/Table 7] Typographical issues: '4,32 prompts' should be '432 prompts'; 'outpuits' should be 'outputs'. Table 7 repeats '4,32' and shows 1,728 target-agnostic prompts but the text also mentions 432 × 4; this is likely a formatting error.
  2. [Dataset and code availability] The code is listed as 'GitHub TBA' and the dataset URL as 'available at (TBA)'. For a reproducibility-oriented paper, these placeholders should be filled with the actual links, or at least with an institutional repository identifier, before publication.
  3. [Section 5 Discussion] The Discussion (first paragraph) states 'personalisation acted as a consistent jailbreak trigger' and 'raising compliance rates even for models that otherwise exhibited stronger safety alignment.' Given Table 10 shows Llama decreasing and Hindi increasing by only 0.1 pp, 'consistent' is too strong. The wording should be qualified.
  4. [Figure 6] Figure 6's heatmap-like display is hard to read because the percentages for all models/languages are in small text; consider sorting by model or adding the values in a table.

Circularity Check

0 steps flagged

No significant circularity: the study is an empirical measurement pipeline, not a derivation; minor self-reliance in the LLM-judge setup and an internal numeric inconsistency are validity/correctness issues, not circular reasoning.

full rationale

The paper's central claims are empirical measurements: it prompts LLMs, labels outputs with automatic classifiers, and reports rates. No fitted parameter is recycled as a prediction, and no claimed result is defined in terms of another result by construction. The jailbreak and personalisation labels are produced by Gemma and Qwen judges that were selected and validated on a 424-example human-annotated sample; this creates a real measurement-validity risk (small validation set, judges from the same model families under study, low personalisation F1 of 0.68), but it is not circularity: the reported rates are not statistically forced to equal the training labels. Self-citations in the paper (e.g., Razuvayevskaya et al. 2024, Wu et al. 2023) are for classifiers with external SemEval-2023 benchmarks, so they are independent support rather than load-bearing self-citation. The paper does contain a serious internal inconsistency: the metadata abstract reports safeguards failing for 80% of non-personalised and 77.7% of personalised prompts, while the full text and Table 10 report jailbreak rates of 78.22% and 82.19%, and Table 10 itself shows Llama decreasing. These contradictions undermine the robustness of the headline 'personalisation increases jailbreaks' claim, but they are correctness/consistency problems, not circular derivations. Overall, no specific step reduces to its own inputs by construction, so the circularity score is low.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

This is an empirical red-teaming paper; there is no formal derivation, so the ledger records measurement choices rather than mathematical axioms. The central percentages depend on prompt templates, decoding settings, automatic judges, and hand-set classifier thresholds; no invented entities are postulated.

free parameters (3)
  • Persuasion-technique/news-frame classification threshold = 0.80 confidence; precision >60%
    Appendix C.2: the reported 42.2% increase in persuasion techniques is computed from classifier outputs gated by these hand-set thresholds, so the RQ3 headline depends partly on this cutoff.
  • Automatic judge selection and bad-generation rules = Gemma safety judge macro-F1 0.85; Qwen personalisation judge F1 0.68; hand-crafted bad-generation rules
    Sections 4.1-4.2: all jailbreak and personalisation statistics are produced by judges/rules selected and tuned on the 424-example human sample; the choice of judge changes measured rates.
  • Decoding hyperparameters = temperature=1.0, top-p=0.95, top-k=50, repetition penalty=1.1
    Appendix A: fixed across models for comparability, not fitted to the target result, but they determine output distributions and therefore all measured behaviour rates.
axioms (5)
  • domain assumption The 424-example human-annotated set is representative of 1.6M outputs across 8 models, 4 languages, and 150 personas
    Section 3.5: all automatic tagger performance and personalisation reliability are judged against this small stratified sample (~100 per language); if it is unrepresentative, the scaled-up statistics inherit its bias.
  • domain assumption LLM-as-a-judge labels (Gemma for safety, Qwen for personalisation) are valid proxies for human judgments at scale
    Sections 4.1-4.2: the study replaces human annotation with LLM judges; F1 0.85/0.68 on 424 examples is treated as sufficient, and judge errors are assumed independent of personalisation, language, and model family.
  • domain assumption The seed prompts from Vykopal et al., Chen & Shu, and Su et al. remain valid disinformation narratives after language augmentation and personae extension
    Section 3.3: 432 prompts are taken from prior fact-check corpora; the study assumes prompt quality is uniform across languages and personae.
  • domain assumption Language-country pairings such as Russian for Ukrainian personas are valid operationalisations of personalisation
    Table 3 and footnote 4: Russian is used for Ukrainian personas because of Russian-speaking populations; this conflates language with national identity and may not reflect how Ukrainian audiences actually consume disinformation.
  • domain assumption The merged binary personalisation scale (Low/None vs Moderate/High) preserves the construct of personalisation
    Section 3.5: the original 3-point scale had low inter-annotator agreement and was post-hoc merged; the paper assumes the binary collapse does not distort what counts as 'personalised'.

pith-pipeline@v1.3.0-alltime-deepseek · 76 in / 16285 out tokens · 127947 ms · 2026-08-04T09:51:54.119242+00:00 · methodology

0 comments
read the original abstract

Large Language Models (LLMs) can generate highly persuasive disinformation, yet little is known about how effectively they personalise it across languages and demographic groups. We present the first large-scale multilingual study of persona-targeted disinformation generation by LLMs. Using a red-teaming methodology, we prompted eight leading models with 324 false narratives and 150 demographic personas in four languages (English, Russian, Portuguese, and Hindi), creating AI-TRAITS, a dataset of 1.6 million personalised disinformation texts. We treat safeguards as compromised whenever a model generates the requested falsehood, whether directly or accompanied by a safety disclaimer. Across models, safeguards failed for 80% of non-personalised prompts and 77.7% of personalised ones, with Grok producing disinformation in over 94% of cases. All models effectively tailored outputs to target personas, employing substantially more persuasive techniques than in non-personalised content. Additional analyses reveal persona-specific linguistic and psychological patterns and show that safeguard effectiveness varies markedly across languages. Together, these findings expose significant weaknesses in current LLM safety mechanisms and highlight the need for more robust, multilingual safeguards against personalised AI-generated disinformation.

Figures

Figures reproduced from arXiv: 2510.12993 by Arnav Arora, Carolina Scarton, Gustavo Sampaio, Ian Roberts, Jo\~ao A. Leite, Jo\~ao Luz, Kalina Bontcheva, Silvia Gargova.

Figure 1
Figure 1. Figure 1: An example prompt instructing the LLM to personalise the given disinformation narrative (“People die after being vaccinated against COVID-19”) tailored to a given target persona (a U.S.-based, Boomer, right-wing reader). The segments aligned with the specific persona attributes are highlighted. This paper addresses these crucial gaps through a large-scale empirical study of LLM-generated multilingual perso… view at source ↗
Figure 2
Figure 2. Figure 2: Behaviour rate per model when prompted to personalise their output. The breakdown reveals clear differences in the ways in which safety mechanisms are bypassed. Claude and Gemma are the most safety-aligned models, with jailbreak rates of 48.0% and 61.0%, respectively. Both exhibit substantially higher rates of refusals and disclaimers than other models, while producing few malformed outputs. Llama and Vicu… view at source ↗
Figure 3
Figure 3. Figure 3: Distribution of refused outputs across languages. enforcement. Taken together, these results show that, in the context of personalised disinformation, LLMs exhibit language-sensitive safety patterns that remain broadly consistent across models. 4.1.2. Content triggering safety mechanisms Lastly, as part of RQ1, we investigate which types of content are more likely to trigger the LLM safety mechanisms by an… view at source ↗
Figure 4
Figure 4. Figure 4: Behaviour rates for different news frames extracted from the input disinformation narratives. As can be observed, disclaimer rates remain relatively consistent across different news frames. However, refusal rates vary most noticeably, with religious, health-safety and crime-related frames eliciting the highest refusal rates. In contrast, justice and economy-related frames have the highest jailbreak rates. … view at source ↗
Figure 5
Figure 5. Figure 5: Overall personalisation scores per model (considering country, generation, and political orientation). The results reveal substantial variation in the personalisation capabilities of the different models. In particular, open￾weight models exhibit markedly lower personalisation performance. Vicuna ranks the lowest with a personalisation score of 41.00%, while Llama and Gemma show only marginally better perf… view at source ↗
Figure 6
Figure 6. Figure 6: Personalisation scores across languages. JA Leite et al.: Preprint submitted to Elsevier Page 16 of 31 [PITH_FULL_IMAGE:figures/full_fig_p016_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Personalisation across models and persona attributes. Across the board, the ‘country’ attribute leads to the highest personalisation scores, followed by political orientation, with generation trailing significantly for most models. This trend is especially pronounced in open-weight models: for instance, Mistral demonstrates a 62.8 percentage point difference in its abilities to personalise for a target cou… view at source ↗
Figure 8
Figure 8. Figure 8: provides a breakdown of named entity usage by language and entity type (PERSON, LOC, ORG), com￾paring target-agnostic and persona-targeted generations. Across all languages, location mentions (LOC) increase most noticeably in persona-targeted outputs, indicating that LLMs rely on geographic references to localise disinformation. This effect is particularly strong in languages other than English, where the … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

60 extracted references · 10 canonical work pages · 4 internal anchors

  1. [3]

    Bilaniuk, L., Melnyk, S.,

    URL: https://www.gov.uk/government/publications/international-ai-safety-report-2025/ international-ai-safety-report-2025 . Bilaniuk, L., Melnyk, S.,

    2025

  2. [6]

    URL: http://arxiv.org/abs/2502.07068,doi: https://doi.org/10.48550/arXiv.2502.07068

    Specializing large language models to simulate survey response distributionsforglobalpopulations. URL: http://arxiv.org/abs/2502.07068,doi: https://doi.org/10.48550/arXiv.2502.07068. arXiv:2502.07068. Casper, S., Lin, J., Kwon, J., Culp, G., Hadfield-Menell, D.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2502.07068

  3. [8]

    Frontiers in Public Health 13, 1546317

    Generational differences in healthcare: the role of technology in the path forward. Frontiers in Public Health 13, 1546317. Chen, C., Shu, K., 2024a. Can LLM-generated misinformation be detected? URL: http://arxiv.org/abs/2309.13788, doi:https: //doi.org/10.48550/arXiv.2309.13788. arXiv:2309.13788. Chen, C., Shu, K., 2024b. Combating misinformation in the...

    Pith/arXiv arXiv doi:10.48550/arxiv.2309.13788

  4. [9]

    doi:https://doi.org/10.48550/arXiv

    From persona to personalization: A survey on role-playing language agents. doi:https://doi.org/10.48550/arXiv. 2404.18231, arXiv:2404.18231. Costello, T.H., Pennycook, G., Rand, D.G.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2404.18231

  5. [10]

    Science 385, eadq1814

    Durably reducing conspiracy beliefs through dialogues with ai. Science 385, eadq1814. Deng,Y.,Zhang,W.,Pan,S.J.,Bing,L.,2024. Multilingualjailbreakchallengesinlargelanguagemodels. URL: http://arxiv.org/abs/2310. 06474, doi:https://doi.org/10.48550/arXiv.2310.06474. arXiv:2310.06474. Diggelmann, T., Boyd-Graber, J., Bulian, J., Ciaramita, M., Leippold, M.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2310.06474 2024

  6. [12]

    URL:http://arxiv.org/abs/2406.02622, doi:https://doi.org/10.48550/arXiv.2406.02622

    Safeguarding large language models: A survey. URL:http://arxiv.org/abs/2406.02622, doi:https://doi.org/10.48550/arXiv.2406.02622. arXiv:2406.02622. Du, Y., Bosselut, A., Manning, C.D.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2406.02622

  7. [14]

    Feng, S., Sorensen, T., Liu, Y., Fisher, J., Park, C.Y., Choi, Y., Tsvetkov, Y.,

    URL: https://www.weforum.org/publications/ global-risks-report-2025/. Feng, S., Sorensen, T., Liu, Y., Fisher, J., Park, C.Y., Choi, Y., Tsvetkov, Y.,

    2025

  8. [15]

    MisinfoEval: Generative AI in the Era of "Alternative Facts"

    Modular pluralism: Pluralistic alignment via multi-llm collaboration,in:Al-Onaizan,Y.,Bansal,M.,Chen,Y.N.(Eds.),Proceedingsofthe2024ConferenceonEmpiricalMethodsinNaturalLanguage JA Leite et al.:Preprint submitted to Elsevier Page 27 of 31 A Multilingual, Large-Scale Study of the Interplay between LLM Safeguards, Personalisation, and Disinformation Process...

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2410.09949 2024

  9. [16]

    (Eds.), Proceedings of the 63rd AnnualMeetingoftheAssociationforComputationalLinguistics(Volume1:LongPapers),AssociationforComputationalLinguistics,Vienna, Austria

    Adverse event extraction from discharge summaries: A new dataset, annotation scheme, and initial findings, in: Che, W., Nabende, J., Shutova, E., Pilehvar, M.T. (Eds.), Proceedings of the 63rd AnnualMeetingoftheAssociationforComputationalLinguistics(Volume1:LongPapers),AssociationforComputationalLinguistics,Vienna, Austria. pp. 28532–28562. URL:https://ac...

    doi:10.18653/v1/2025.acl-long.1386 2025

  10. [17]

    URL:https://arxiv.org/abs/2507.13919, arXiv:2507.13919

    The levers of political persuasion with conversational ai. URL:https://arxiv.org/abs/2507.13919, arXiv:2507.13919. Hanley, H.W.A., Durumeric, Z.,

    Pith/arXiv arXiv

  11. [18]

    Proceedings of the International AAAI Conference on Web and Social Media 18, 542–556

    Machine-made media: Monitoring the mobilization of machine-generated articles on misinformation and mainstream news websites. Proceedings of the International AAAI Conference on Web and Social Media 18, 542–556. doi:https: //doi.org/10.1609/icwsm.v18i1.31333. Heppell, F., Bakir, M.E., Bontcheva, K.,

    doi:10.1609/icwsm.v18i1.31333

  12. [19]

    Lying Blindly: Bypassing ChatGPT's Safeguards to Generate Hard-to-Detect Disinformation Claims

    Lying blindly: bypassing chatGPT’s safeguards to generate hard-to-detect disinformation claims. URL: http://arxiv.org/abs/2402.08467, doi:https://doi.org/10.48550/arXiv.2402.08467. arXiv:2402.08467 [cs]. Heywood, A.,

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2402.08467

  13. [21]

    Quantifying the persona effect in LLM simulations, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Bangkok, Thailand. pp. 10289–10307. URL: https://aclanthology.org/2024.acl-long.554, doi:https://doi.org/10.18653/v1/2024.acl-long.554. Huang,Y.,S...

    Pith/arXiv arXiv doi:10.48550/arxiv.2310.05046 2024

  14. [22]

    Co-writing with opinionated language models affects users’ views, in: Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, ACM, Hamburg Germany. pp. 1–15. URL:https: //dl.acm.org/doi/10.1145/3544548.3581196, doi:https://doi.org/10.1145/3544548.3581196. Jang, Y., Lim, J., Hur, Y., Oh, D., Son, S., Lee, Y., Shin, D., Kim, S., Lim, H.,

    arXiv 2023

  15. [23]

    Proceedings of the AAAI Conference on Artificial Intelligence 36, 10803–10812

    Call for customized conversation: Customized conversation grounding persona and knowledge. Proceedings of the AAAI Conference on Artificial Intelligence 36, 10803–10812. doi:https://doi.org/ 10.1609/aaai.v36i10.21326. Jiang, B., Zhao, C., Tan, Z., Liu, H.,

    work page doi:10.1609/aaai.v36i10.21326

  16. [24]

    Catching Chameleons: Detecting Evolving Disinformation Generated using Large Language Models

    Catching chameleons: detecting evolving disinformation generated using large language models. URL: http://arxiv.org/abs/2406.17992, doi:https://doi.org/10.48550/arXiv.2406.17992. arXiv:2406.17992. Khan, K., Wang, R., Poupart, P.,

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2406.17992

  17. [25]

    (Eds.), Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Dublin, Ireland

    WatClaimCheck: A new dataset for claim entailment and inference, in: Muresan, S., Nakov, P., Villavicencio, A. (Eds.), Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computational Linguistics, Dublin, Ireland. pp. 1293–1304. URL:https://aclanthology.org/2022.acl-long.92/, do...

    doi:10.18653/v1/2022.acl-long.92 2022

  18. [26]

    Nature Machine Intelligence 6, 383–392

    The benefits, risks and bounds of personalizing the alignment of large language models to individuals. Nature Machine Intelligence 6, 383–392. URL:https://www.nature.com/articles/s42256-024-00820-y, doi:https: //doi.org/10.1038/s42256-024-00820-y. Lee, J., Oh, M., Lee, D.,

    doi:10.1038/s42256-024-00820-y

  19. [27]

    (Eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Singapore

    P5: Plug-and-play persona prompting for personalized response selection, in: Bouamor, H., Pino, J., Bali, K. (Eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Singapore. pp. 16571–16582. doi:https://doi.org/10.18653/v1/2023.emnlp-main.1031. Leite,J.A.,Razuvayevskaya,O...

    arXiv 2023

  20. [28]

    arXiv preprint arXiv:2502.11528

    A survey of personalized large language models: Progress and future directions. arXiv preprint arXiv:2502.11528 . Liu, S., Cho, H.J., Freedman, M., Ma, X., May, J.,

    arXiv

  21. [29]

    URL: http://arxiv.org/abs/2306.07206, doi:https://doi.org/10.48550/arXiv.2306.07206

    RECAP: Retrieval-enhanced context-aware prefix encoder for personalized dialogue response generation. URL: http://arxiv.org/abs/2306.07206, doi:https://doi.org/10.48550/arXiv.2306.07206. arXiv:2306.07206 [cs]. JA Leite et al.:Preprint submitted to Elsevier Page 28 of 31 A Multilingual, Large-Scale Study of the Interplay between LLM Safeguards, Personalisa...

    Pith/arXiv arXiv doi:10.48550/arxiv.2306.07206

  22. [30]

    Fighting fire with fire: The dual role of LLMs in crafting and detectingelusivedisinformation,in:Bouamor,H.,Pino,J.,Bali,K.(Eds.),Proceedingsofthe2023ConferenceonEmpiricalMethodsinNatural Language Processing, Association for Computational Linguistics, Singapore. pp. 14279–14305. URL:https://aclanthology.org/2023. emnlp-main.883, doi:https://doi.org/10.186...

    work page doi:10.18653/v1/2023.emnlp-main.883 2023

  23. [31]

    (Eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Singapore

    MULTITuDE: Large-scale multilingual machine-generated text detection benchmark, in: Bouamor, H., Pino, J., Bali, K. (Eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Singapore. pp. 9960–9987. URL: https://aclanthology.org/2023.emnlp-main.616, doi:https://doi.org/10.18...

    doi:10.18653/v1/2023.emnlp-main.616 2023

  24. [33]

    URL:http://arxiv.org/abs/2402.04249, doi:https://doi.org/10.48550/arXiv.2402.04249

    HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. URL:http://arxiv.org/abs/2402.04249, doi:https://doi.org/10.48550/arXiv.2402.04249. arXiv:2402.04249. McHugh, M.L.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2402.04249

  25. [35]

    URL: https://arxiv.org/abs/2301.11305

    Detectgpt: Zero-shot machine-generated text detection using probability curvature. URL: https://arxiv.org/abs/2301.11305. Mu, Y., Jin, M., Grimshaw, C., Scarton, C., Bontcheva, K., Song, X.,

    Pith/arXiv arXiv

  26. [36]

    Proceedings of the International AAAI Conference on Web and Social Media 17, 1052–1062

    VaxxHesitancy: A dataset for studying hesitancy towards covid- 19 vaccination on twitter. Proceedings of the International AAAI Conference on Web and Social Media 17, 1052–1062. doi:https: //doi.org/10.1609/icwsm.v17i1.22213. Nguyen, T.P., Razniewski, S., Weikum, G.,

    doi:10.1609/icwsm.v17i1.22213

  27. [37]

    Cultural commonsense knowledge for intercultural dialogues, in: Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, Association for Computing Machinery, New York, NY, USA. p. 1774–1784. URL:https://dl.acm.org/doi/10.1145/3627673.3679768, doi:10.1145/3627673.3679768. Ostrowski, M.S.,

    arXiv

  28. [38]

    Pauli,A.B.,Augenstein,I.,Assent,I.,2024

    The ideological morphology of left–centre–right. Pauli,A.B.,Augenstein,I.,Assent,I.,2024. MeasuringandBenchmarkingLargeLanguageModels’CapabilitiestoGeneratePersuasiveLanguage. URL: http://arxiv.org/abs/2406.17753, doi:https://doi.org/10.48550/arXiv.2406.17753. arXiv:2406.17753. Piskorski, J., Stefanovitch, N., Da San Martino, G., Nakov, P.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2406.17753 2024

  29. [39]

    SemEval-2023 task 3: Detecting the category, the framing, and the persuasion techniquesinonlinenewsinamulti-lingualsetup,in:Ojha,A.K.,Doğruöz,A.S.,DaSanMartino,G.,TayyarMadabushi,H.,Kumar,R.,Sartori, E.(Eds.),Proceedingsofthe17thInternationalWorkshoponSemanticEvaluation(SemEval-2023),AssociationforComputationalLinguistics, Toronto, Canada. pp. 2343–2361. ...

    work page doi:10.18653/v1/2023.semeval-1 2023

  30. [40]

    Personalizing llm responses to combat political misinformation, in: Proceedings of the 33rd ACM Conference on User Modeling, Adaptation and Personalization, Association for Computing Machinery, New York, NY, USA. p. 134–143. URL:https://doi.org/10.1145/3699682.3728349, doi:10.1145/3699682.3728349. Qiao, J., Li, X., Gao, C., Wu, L., Feng, J., Wang, Z.,

    arXiv

  31. [41]

    Information Processing & Management 62, 104120

    Improving multimodal fake news detection by leveraging cross-modal content correlation. Information Processing & Management 62, 104120. URL: https://www.sciencedirect.com/science/article/pii/ S0306457325000627, doi:https://doi.org/10.1016/j.ipm.2025.104120. Razuvayevskaya, O., Wu, B., Leite, J.A., Heppell, F., Srba, I., Scarton, C., Bontcheva, K., Song, X.,

    arXiv 2025

  32. [42]

    PLOS ONE 19, 1–26

    Comparison between parameter- efficient techniques and full fine-tuning: A case study on multilingual news article classification. PLOS ONE 19, 1–26. URL:https: //doi.org/10.1371/journal.pone.0301738, doi:https://doi.org/10.1371/journal.pone.0301738. Rogiers,A.,Noels,S.,Buyl,M.,Bie,T.D.,2024. Persuasionwithlargelanguagemodels:Asurvey. URL: http://arxiv.or...

    Pith/arXiv arXiv doi:10.48550/arxiv.2411.06837 2024

  33. [43]

    LaMP: When large language models meet personalization, in: Ku, L.W., Martins, A., Srikumar, V. (Eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), AssociationforComputationalLinguistics,Bangkok,Thailand.pp.7370–7392.doi: https://doi.org/10.18653/v1/2024.acl-long.399. Schoenegger, P., Sal...

    doi:10.18653/v1/2024.acl-long.399 2024

  34. [44]

    URL:https://arxiv.org/abs/2505.09662, arXiv:2505.09662

    Large language models are more persuasive than incentivized human persuaders. URL:https://arxiv.org/abs/2505.09662, arXiv:2505.09662. Simchon, A., Edwards, M., Lewandowsky, S.,

    arXiv

  35. [45]

    PNAS Nexus 3, pgae035

    The persuasive effects of political microtargeting in the age of generative artificial intelligence. PNAS Nexus 3, pgae035. URL: https://doi.org/10.1093/pnasnexus/pgae035, doi:https://doi.org/10.1093/ pnasnexus/pgae035. Solaiman, I., Bommasani, R., Hendrycks, D., Herbert-Voss, A., Jernite, Y., Skowron, A., Trask, A.,

    doi:10.1093/pnasnexus/pgae035

  36. [46]

    URL:https://arxiv.org/abs/2502.16701, arXiv:2502.16701

    Beyond release: Access considerations for generative ai systems. URL:https://arxiv.org/abs/2502.16701, arXiv:2502.16701. Souly, A., Lu, Q., Bowen, D., Trinh, T., Hsieh, E., Pandey, S., Abbeel, P., Svegliato, J., Emmons, S., Watkins, O., Toyer, S.,

    Pith/arXiv arXiv

  37. [47]

    URL: http://arxiv.org/abs/2402.10260, doi:https://doi.org/10.48550/arXiv.2402.10260

    A Stron- gREJECT for empty jailbreaks. URL: http://arxiv.org/abs/2402.10260, doi:https://doi.org/10.48550/arXiv.2402.10260. arXiv:2402.10260. JA Leite et al.:Preprint submitted to Elsevier Page 29 of 31 A Multilingual, Large-Scale Study of the Interplay between LLM Safeguards, Personalisation, and Disinformation Spitale, G., Biller-Andorno, N., Germani, F.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2402.10260

  38. [48]

    Science Advances 9, eadh1850

    AI model GPT-3 (dis)informs us better than humans. Science Advances 9, eadh1850. URL: https://www.science.org/doi/full/10.1126/sciadv.adh1850, doi:https://doi.org/10.1126/sciadv.adh1850. pub- lisher: American Association for the Advancement of Science. Stein, J., Keuschnigg, M., van de Rijt, A.,

    doi:10.1126/sciadv.adh1850

  39. [49]

    PNAS Nexus 3, pgae506

    Partisan belief in new misinformation is resistant to accuracy incentives. PNAS Nexus 3, pgae506. URL: https://doi.org/10.1093/pnasnexus/pgae506, doi:https://doi.org/10.1093/pnasnexus/pgae506, arXiv:https://academic.oup.com/pnasnexus/article-pdf/3/11/pgae506/60816237/pgae506.pdf. Su,J.,Zhuo,T.Y.,Mansurov,J.,Wang,D.,Nakov,P.,2023. Fakenewsdetectorsarebiase...

    Pith/arXiv arXiv doi:10.48550/arxiv.2309.08674 2023

  40. [50]

    (Eds.), Findings of the Association for Computational Linguistics: EMNLP 2024, Association for Computational Linguistics, Miami, Florida, USA

    Two tales of persona in LLMs: A survey of role-playing and personalization, in: Al-Onaizan, Y., Bansal, M., Chen, Y.N. (Eds.), Findings of the Association for Computational Linguistics: EMNLP 2024, Association for Computational Linguistics, Miami, Florida, USA. pp. 16612–16631. doi:https://doi.org/10.18653/v1/ 2024.findings-emnlp.969. Uchendu, A., Ma, Z.,...

    doi:10.18653/v1/ 2024

  41. [51]

    (Eds.), Findings of the Association for Computational Linguistics: EMNLP 2021, Association for Computational Linguistics, Punta Cana, Dominican Republic

    TURINGBENCH: A benchmark environment for Turing test in the age of neural text generation, in: Moens, M.F., Huang, X., Specia, L., Yih, S.W.t. (Eds.), Findings of the Association for Computational Linguistics: EMNLP 2021, Association for Computational Linguistics, Punta Cana, Dominican Republic. pp. 2001–2016. URL:https://aclanthology.org/ 2021.findings-e...

    doi:10.18653/v1/2021.findings-emnlp.172 2021

  42. [52]

    Report: Systemic issues

    Challenges and opportunities of artificial intelligence in the fight against information manipulation. Report: Systemic issues. ServiceforVigilanceandProtectionagainstForeignDigitalInterference(VIGINUM).France. URL: https://www.sgdsn.gouv.fr/files/ files/Publications/20250207_NP_SGDSN_VIGINUM_Rapport%20menace%20informationnelle%20IA_EN_0.pdf. Vo, N., Lee, K.,

    arXiv

  43. [53]

    (Eds.), Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Association for Computational Linguistics, Online

    Where are the facts? Searching for fact-checked information to alleviate the spread of fake news, in: Webber, B., Cohn, T., He, Y., Liu, Y. (Eds.), Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Association for Computational Linguistics, Online. pp. 7717–7731. doi:https://doi.org/10.18653/v1/2020.emnlp-main...

    doi:10.18653/v1/2020.emnlp-main.621 2020

  44. [54]

    Disinformation capabilities of large language models, in: Ku, L.W., Martins, A., Srikumar, V. (Eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: LongPapers),AssociationforComputationalLinguistics,Bangkok,Thailand.pp.14830–14847. URL: https://aclanthology.org/2024. acl-long.793, doi:https://doi.org/10...

    Pith/arXiv arXiv doi:10.48550/arxiv.2310.11593 2024

  45. [55]

    doi: https://doi.org/10.18653/v1/2023.eacl-demo

    GATE Teamware 2: An open-source tool for collaborative document classification annotation, in: Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics: SystemDemonstrations,AssociationforComputationalLinguistics.pp.145–151. doi: https://doi.org/10.18653/v1/2023.eacl-demo

    work page doi:10.18653/v1/2023.eacl-demo 2023

  46. [56]

    (Eds.), Proceedings of the 17th International Workshop on Semantic Evaluation (SemEval-2023), AssociationforComputationalLinguistics,Toronto,Canada.pp.1995–2008

    SheffieldVeraAI at SemEval-2023 task 3: Mono and multilingual approaches for news genre, topic and persuasion technique classification, in: Ojha, A.K., Doğruöz, A.S., Da San Martino, G., Tayyar Madabushi, H., Kumar, R., Sartori, E. (Eds.), Proceedings of the 17th International Workshop on Semantic Evaluation (SemEval-2023), AssociationforComputationalLing...

    Pith/arXiv arXiv doi:10.48550/arxiv.2407.16667 2023

  47. [57]

    AlignScore: Evaluating factual consistency with a unified alignment function, in: Rogers, A., Boyd-Graber, J., Okazaki, N. (Eds.), Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), AssociationforComputationalLinguistics,Toronto,Canada.pp.11328–11348.URL: https://aclanthology.org/2023.acl-long....

    Pith/arXiv arXiv 2023

  48. [58]

    doi:https://doi.org/10.48550/arXiv.2411.00027, arXiv:2411.00027

    Personalization of large language models: A survey. doi:https://doi.org/10.48550/arXiv.2411.00027, arXiv:2411.00027. JA Leite et al.:Preprint submitted to Elsevier Page 30 of 31 A Multilingual, Large-Scale Study of the Interplay between LLM Safeguards, Personalisation, and Disinformation Zheng, L., Chiang, W.L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., ...

    Pith/arXiv arXiv doi:10.48550/arxiv.2411.00027

  49. [59]

    (Eds.), Advances in Neural Information Processing Systems, Curran Associates, Inc

    Judging llm-as-a-judge with mt-bench and chatbot arena, in: Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S. (Eds.), Advances in Neural Information Processing Systems, Curran Associates, Inc.. pp. 46595–46623. URL:https://proceedings.neurips. cc/paper_files/paper/2023/file/91f18a1287b398d378ef22505bf41832-Paper-Datasets_and_Benchmarks...

    2023

  50. [60]

    Synthetic lies: Understanding AI-generated misinformation and evaluating algorithmic and human solutions, in: Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, Association for Computing Machinery, New York, NY, USA. pp. 1–20. URL: https://dl.acm.org/doi/10.1145/3544548.3581318, doi:https: //doi.org/10.1145/3544548.3581318. Zuge...

    arXiv 2023

  51. [2012]

    Naamapadam: A Large-Scale Named Entity Annotated Data for Indic Languages

    Interrater reliability: the kappa statistic. Biochemia medica 22, 276–282. Mhaske,A.,Kedia,H.,Doddapaneni,S.,Khapra,M.M.,Kumar,P.,Murthy,R.,Kunchukuttan,A.,2022. Naamapadam:Alarge-scalenamedentity annotateddataforindiclanguages.URL: https://arxiv.org/abs/2212.10168,doi: https://doi.org/10.48550/ARXIV.2212.10168. Mitchell, E., Lee, Y., Khazatsky, A., Manni...

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2212.10168 2022

  52. [2019]

    arXiv preprint arXiv:1904.09751

    The curious case of neural text degeneration. arXiv preprint arXiv:1904.09751 . Hu, T., Collier, N.,

    Pith/arXiv arXiv 1904

  53. [2020]

    arXiv:2012.00614

    Climate-fever: A dataset for verification of real-world climate claims. arXiv:2012.00614. Dimock, M.,

    Pith/arXiv arXiv 2012

  54. [2021]

    doi:https://doi.org/10.51593/2021CA003

    Truth, lies, and automation. doi:https://doi.org/10.51593/2021CA003. Cai,P.,Song,K.,Cho,S.,Wang,H.,Wang,X.,Yu,H.,Liu,F.,Yu,D.,2023. Generatinguser-engagingnewsheadlines,in:Rogers,A.,Boyd-Graber, J., Okazaki, N. (Eds.), Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Association for Computati...

    work page doi:10.51593/2021ca003 2023

  55. [2022]

    Proceedings of the AAAI Conference on Artificial Intelligence 36, 10581–10589

    Synthetic disinformation attacks on automated fact verification systems. Proceedings of the AAAI Conference on Artificial Intelligence 36, 10581–10589. URL:https://ojs.aaai.org/index.php/AAAI/article/view/21302, doi:https://doi.org/10.1609/aaai.v36i10.21302. number:

    work page doi:10.1609/aaai.v36i10.21302

  56. [2023]

    URL: http://arxiv.org/abs/2306.09442, doi:https://doi.org/10.48550/arXiv.2306.09442

    Explore, establish, exploit: red teaming language models from scratch. URL: http://arxiv.org/abs/2306.09442, doi:https://doi.org/10.48550/arXiv.2306.09442. arXiv:2306.09442 [cs]. Cecconi, C., Adams, R., Cardone, A., Declaye, J., Silva, M., Vanlerberghe, T., Guldemond, N., Devisch, I., van Vugt, J.,

    Pith/arXiv arXiv doi:10.48550/arxiv.2306.09442

  57. [2024]

    URL: https://edmo.eu/wp-content/uploads/2023/12/Generative-AI-and-Disinformation_-White-Paper-v8.pdf

    Generative AI and disinformation: recent advances, challenges, and opportunities. URL: https://edmo.eu/wp-content/uploads/2023/12/Generative-AI-and-Disinformation_-White-Paper-v8.pdf . Boyd, R.L., Ashokkumar, A., Seraj, S., Pennebaker, J.W.,

    2023

  58. [2025]

    URL:http://arxiv.org/abs/2504.02234, doi:https://doi.org/10.48550/arXiv.2504.02234

    LLM social simulations are a promising research method. URL:http://arxiv.org/abs/2504.02234, doi:https://doi.org/10.48550/arXiv.2504.02234. arXiv:2504.02234. Barman,D.,Guo,Z.,Conlan,O.,2024. Thedarksideoflanguagemodels:Exploringthepotentialofllmsinmultimediadisinformationgeneration and dissemination. Machine Learning with Applications 16, 100545. URL:http...

    Pith/arXiv arXiv doi:10.48550/arxiv.2504.02234 2024

  59. [2026]

    Information Processing & Management 63, 104342

    Misinformation detection on online social networks using pretrained language models. Information Processing & Management 63, 104342. URL: https://www.sciencedirect.com/science/article/pii/ S0306457325002833, doi:https://doi.org/10.1016/j.ipm.2025.104342. Aich,A.,Bhattacharya,S.,Parde,N.,2022. Demystifyingneuralfakenewsvialinguisticfeature-basedinterpretat...

    arXiv 2025

  60. [4692]

    Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., Forsyth, D., Hendrycks, D.,

    doi:https://doi.org/10.1038/s41598-024-53755-0. Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., Forsyth, D., Hendrycks, D.,

    doi:10.1038/s41598-024-53755-0