Pith. sign in

REVIEW 4 major objections 4 minor 3 cited by

Multi-turn scam dialogues with LLMs exhibit regular escalation and defense patterns that single-turn safety tests miss.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 12:21 UTC pith:DL2DDQOC

load-bearing objection Useful descriptive corpus and a plausible taxonomy, but the attacker prompt seeds most of the discovered strategy families, so the 'internalized schemas' claim is over-claimed. the 4 major comments →

arxiv 2601.03134 v2 pith:DL2DDQOC submitted 2026-01-06 cs.CL

The Anatomy of Conversational Scams: A Topic-Based Red Teaming Analysis of Multi-Turn Interactions in LLMs

Xiangzhe Yuan , Zhenhao Zhang , Haoming Tang , Siying Hu This is my paper
classification cs.CL
keywords conversational scamsmulti-turn safetyLLM red-teamingsocial engineeringtopic modelinginteractional strategiescross-lingual evaluationadversarial dialogue
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that multi-turn scam conversations with language models are not chaotic but follow a regular interactional grammar: attackers escalate gradually through a small set of influence tactics while defenders respond with friction-adding moves such as independent verification, deliberate delay, and channel control. Using a controlled LLM-to-LLM simulation across eight models in English and Chinese, the authors show that successful scams are rare, most conversations end in detection or stalemate, and many dialogues break down when safety guardrails misfire. They argue that this structure appears consistently across models and languages, so multi-turn interactional safety is a distinct behavioral dimension that single-turn safety benchmarks cannot capture. A sympathetic reader should care because it points toward a scalable way to study social-engineering dynamics before real harm happens.

Core claim

The paper's central claim is that scam interactions follow recurrent escalation patterns and that defensive responses frequently rely on verification, delay, and channel control. Concretely, across 18,648 simulated bilingual dialogues, success is rare (about 4–5%), and most interactions end in explicit detection or in a no-resolution stalemate, while a large fraction of dialogues collapse into ERROR due to safety-guardrail activation, role instability, or template artifacts. Qualitative topic analysis yields a stable taxonomy of ten attacker strategy families (e.g., urgency, authority pressure, channel shift, rapport building) and ten defender strategy families (e.g., verification, delay, ch

What carries the argument

The central mechanism is the LLM-to-LLM adversarial dialogue loop: a ScamBot attacker and a VictimBot defender are instantiated with persona prompts in ten fictional fraud categories, capped at ten turns, and the resulting dialogues are labeled (SUCCESS, DETECTED, NO_RESOLUTION, ERROR) with human adjudication. Topic modeling over utterances surfaces latent strategy families, and qualitative coding organizes them into attacker, defender, and error taxonomies. The load-bearing result is the 'functional symmetry' between attack and defense: each attacker tactic has a recognizable counter-mechanism, so the dialogue behaves like a dynamic contest between competing interactional mechanisms. This f

Load-bearing premise

The findings rely on the premise that an LLM victim instructed to be suspicious and to replace sensitive information with placeholders behaves enough like a real human target that the observed strategies and outcomes transfer to actual scam conversations.

What would settle it

Compare a sample of the simulated dialogues turn-by-turn to real-world scam transcripts (e.g., recorded scam-baiting calls or reported conversations). If the escalation families and defensive responses do not appear in real data, the claimed ecological validity of the simulation fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Multi-turn safety evaluations should treat interactional structure as a separate metric; single-turn refusal benchmarks miss escalation and drift.
  • Defensive robustness can be characterized by a small set of resistance moves (verification, delay, channel control) and by their timing, not just by whether the model refuses.
  • ERROR outcomes are informative boundary markers: they reveal where role conditioning and safety guardrails collide, and they are not random noise.
  • Cross-lingual differences in outcome distributions imply safety alignment thresholds are language-dependent, so evaluations must be multilingual.
  • LLM-to-LLM simulation can generate large annotated corpora for studying social-engineering dynamics safely, without real victims.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the interactional grammar is as stable as claimed, the same framework could be used as a generative training signal to make defensive agents more resilient by learning to deploy the identified counter-tactics at the right times.
  • The strong dependence of ERROR rates on prompt template artifacts suggests that measurement artifacts—not just model capability—may dominate behavioral comparisons; future work should vary prompt fidelity to disentangle simulation design from model behavior.
  • The symmetry between attack and defense families implies that an automated red-teaming loop could be turned into a co-evolutionary game, where attacker and defender strategies are iteratively hardened, possibly revealing new failure modes beyond the fixed ten-turn horizon.
  • The rarity of SUCCESS and the prevalence of NO_RESOLUTION suggests that, in these simulations, the main risk is not immediate fraud completion but long, inconclusive engagements that could eventually erode suspicion in human settings—a testable hypothesis.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes an LLM-to-LLM simulation framework for multi-turn conversational scam analysis. It generates 18,648 bilingual (Chinese/English) dialogues between a ScamBot attacker and a VictimBot defender across eight models, labels each dialogue as SUCCESS, DETECTED, NO_RESOLUTION, or ERROR, applies BERTopic to utterances, and manually consolidates topics into attacker (AF1–AF10), defender (DF1–DF10), and error (EF1–EF7) strategy families. The central claims are that scam interactions exhibit recurrent escalation patterns, that defensive responses rely on verification/delay/channel control, that there are statistically significant cross-model and cross-lingual differences, and that multi-turn interactional safety is a distinct behavioral dimension not captured by single-turn benchmarks.

Significance. The paper has clear strengths: a large controlled bilingual corpus, a fictionalized placeholder-based safety design, human adjudication of outcome labels, and an explicit limitations section. If the claimed regularities were robust, the study would support a valuable shift toward multi-turn interaction-level safety evaluation. However, the main interpretive claims are currently not adequately supported: the attacker prompt appears to seed the discovered taxonomy, the quantitative significance claim lacks any statistical procedure, and the defensive-strategy results are conditional on an explicitly suspicious simulated victim. These issues bear directly on the paper's load-bearing conclusions.

major comments (4)
  1. [§6.1, Appendix A, Table 8] The central claim that LLMs exhibit 'internalized temporally structured manipulation schemas' is confounded by the attacker prompt. Appendix A's 'Scammer Characteristics' explicitly instructs the model to use professional authority, channel shift to WeChat/QQ, verification-code/bank-card requests, deadline pressure, and 'operational errors' as inducements. These map almost one-to-one onto AF1, AF2, AF3, AF4, AF5, AF6, and AF10 in Table 8. The fact that topic modeling is unsupervised does not remove this confound because the clustering operates on utterances generated under a prompt that already specifies the tactics. A control condition that varies or removes prompt-specified tactics is required before attributing the taxonomy to emergent interactional dynamics rather than prompt compliance.
  2. [Abstract and §5.1] The abstract claims 'statistically significant cross-model and cross-lingual differences in outcome distributions,' but no statistical test, confidence interval, or effect size is reported anywhere in §5 or the appendices. Tables 3–8 report proportions without uncertainty, and Figure 2 has no error bars. Given the large sample (n≈18,648), even negligible differences would be 'significant' under naive tests; proper procedures should account for clustering by model, role, and scenario. Without such analysis, the headline significance claim is unverifiable.
  3. [§3.1, §5.1.2, §8] The model selection criterion explicitly excludes systems that 'consistently trigger built-in safety interruptions.' Consequently, the ERROR rates, error-family distributions, and 'guardrail asymmetry' conclusions in §5.1.2 and Table 9 are conditional on surviving this filter. The Limitations section acknowledges this, but the body text states without hedging that 'language significantly conditions conversational persistence' and discusses guardrail asymmetry as a general phenomenon. The results should be framed as selection-conditional, or supplemented with a sensitivity analysis that includes the excluded models.
  4. [§3.2/Appendix B, §6.2, §8] The VictimBot prompt instructs the model to be suspicious and to replace sensitive information with placeholders. The defensive strategy families in Table 7 and the conclusion that defensive robustness depends on timing and combination are therefore properties of this particular simulated victim, not of human victims. The paper's own Limitations states that the simulation 'cannot fully capture the diversity and unpredictability of real-world human behavior.' For the findings to transfer to human scam interactions, validation against human-scam transcripts or human-in-the-loop data is needed; otherwise the conclusions should be restricted to LLM-based victim agents.
minor comments (4)
  1. [§6.1, Figure 3] The text cites Figure 3 as supporting 'temperate progression' from low-commitment positioning to high-stakes operations, but Figure 3 is a scatter plot of attacker success vs. victim detection and contains no temporal or sequential information. The citation should be corrected or a new figure added.
  2. [§6.3, Table 9] The first paragraph of §6.3 reports EF1 rates of 86.71% (Chinese) and 73.42% (English) without specifying that these are victim-role percentages from Table 9. This should be stated explicitly to avoid confusion with attacker-role errors.
  3. [Figure 4 caption] The caption refers to 'Appendix 7, Appendix 9, Appendix 8,' but the paper uses lettered appendices (A–D) and numbered tables. These references should be harmonized with the actual appendix/table numbering.
  4. [§9] Typo: 'at a hourly rate' should be 'at an hourly rate.' The same sentence also appears with 'a hourly rate' later in the ethical considerations paragraph.

Circularity Check

1 steps flagged

Attacker prompt enumerates the reported strategy families, so 'internalized scam schemas' partly reduce to prompt compliance.

specific steps
  1. fitted input called prediction [Appendix A (ScamBot prompt, 'Scammer Characteristics') vs. §6.1 'Attacker Strategy Patterns' and Table 8]
    "Guides users to add WeChat, QQ, or other tools to bypass platform supervision. ... Requests verification codes, bank card numbers, or SMS information. ... Applies pressure (e.g., “missing the deadline means refunds are no longer possible”). ... Uses excuses like “operational errors” to induce further transfers. [Appendix A] ... Channel Shift (AF5) remains a universally dominant tactic (>80%) across both languages. [§6.1]"

    The attacker prompt explicitly instructs the model to use the exact tactics that §6.1/Table 8 report as discovered strategy families: AF5 Channel Shift, AF4 Information Harvesting, AF2 Urgency/AF3 Threat, AF10 Payment Engineering. Because every dialogue was generated under this same ScamBot specification, the high AF coverage and cross-model stability are expected from instruction-following; they cannot independently show that LLMs have 'internalized temporally structured manipulation schemas' acquired during pre-training. The phenomenon is produced by the experimental input rather than independently measured.

full rationale

The paper is a transparent simulation study: it states that attacker prompts are based on official scam categories, and it does not fit any parameter to the outcome data. The outcome labels are human-verified; the defensive strategy families (DF1-DF10) are not explicitly listed in the VictimBot prompt, and the cross-lingual differences (e.g., AF2 78.48% EN vs 50.65% ZH) are not directly dictated by identical prompt templates. Those parts contain independent content. The circularity lies specifically in the attacker-side 'internalization' claim: the ScamBot prompt's 'Scammer Characteristics' bullet list already enumerates channel shift, information harvesting, urgency/pressure, and payment-engineering tactics, and Table 8 then reports the same tactics as emergent strategy families. The 'unsupervised' nature of the topic clustering does not remove this contamination because clustering operates on utterances generated under the explicit tactic list. Therefore the finding that LLMs 'have internalized canonical manipulation patterns' reduces, for the attacker families, largely to prompt compliance. No self-citation chain is load-bearing; all cited prior work is external. Score 6 reflects partial circularity: the central attacker-taxonomy/internalization claim is seeded by the input, while the defensive and cross-lingual analyses are not.

Axiom & Free-Parameter Ledger

1 free parameters · 4 axioms · 1 invented entities

The central empirical claims rest on two unproven premises: that LLM role-play proxies human scam behavior, and that the manual topic-to-family mapping is reliable. The hand-set 10-turn cap is the only numeric free parameter that directly shapes outcome distributions (NO_RESOLUTION at 9.2-9.4 turns). Prompt design acts as an additional, non-numeric source of constraint on the discovered taxonomy.

free parameters (1)
  • max_turns = 10
    Dialogue horizon is hand-set to 10 turns; NO_RESOLUTION outcomes at 9.2-9.4 turns and the 'conversational stalemate' interpretation are direct consequences of this cap (Section 3.1, Figure 2b).
axioms (4)
  • domain assumption LLM-to-LLM role-play is a valid proxy for human victim behavior in scams
    VictimBot is an LLM instructed to be suspicious and to use placeholders; the paper's own Limitations state it 'cannot fully capture the diversity and unpredictability of real-world human behavior' (Section 8). All defensive-strategy findings inherit this premise.
  • domain assumption Prompt-specified attacker tactics do not predetermine the discovered strategy families
    Appendix A explicitly instructs the scammer to use authority, urgency, channel shift, and verification-code requests; Section 6.1 interprets the resulting patterns as model-internalized schemes. The assumption is that the prompt is only a scenario seed, not a direct source of the taxonomy.
  • domain assumption Manual topic-to-family mapping is reliable
    Two annotators grouped topics into AF/DF/EF families with adjudication, but no inter-annotator agreement measure is reported (Section 4, Section 6). Coverage statistics in Tables 7-9 depend on this subjective mapping.
  • standard math BERTopic clusters correspond to meaningful interactional strategies
    The analysis assumes the multilingual-e5 embeddings, UMAP, and HDBSCAN clustering produce semantically coherent, interpretable topics (Section 4.1.2). No cluster-quality metrics or stability checks are reported.
invented entities (1)
  • Strategy family taxonomy (AF1-10, DF1-10, EF1-7) no independent evidence
    purpose: Qualitative coding scheme to label attacker, defender, and error behavior
    The families are defined by the authors from topic clusters and are not validated against external scam corpora; coverage percentages are internal to this dataset, and no inter-annotator reliability or external benchmark is given.

pith-pipeline@v1.3.0-alltime-deepseek · 14909 in / 18245 out tokens · 156170 ms · 2026-08-03T12:21:24.048136+00:00 · methodology

0 comments
read the original abstract

As LLMs gain persuasive capabilities through extended dialogues, they create new opportunities for studying adversarial conversational behavior in extended interaction settings that traditional single-turn safety evaluations fail to capture. We systematically study these interactional dynamics using a controlled LLM-to-LLM simulation framework for automated red-teaming across bilingual social engineering scenarios. Evaluating eight state-of-the-art models in English and Chinese, we analyze dialogue-level outcomes, annotate attacker and defender strategy families, and model interaction dynamics between them. Results show that multi-turn adversarial dialogues follow recurrent escalation patterns, while defensive responses frequently rely on verification, delay, and channel control. We further find statistically significant cross-model and cross-lingual differences in outcome distributions, and transition analysis reveals systematic structural variation in how defender strategies respond to attacker tactics across languages. These findings highlight the importance of studying interactional structure in multi-turn adversarial dialogue settings and demonstrate how controlled LLM-to-LLM simulations can support mechanistic analysis of adversarial conversational dynamics.

Figures

Figures reproduced from arXiv: 2601.03134 by Haoming Tang, Siying Hu, Xiangzhe Yuan, Zhenhao Zhang.

Figure 1
Figure 1. Figure 1: The LLM-to-LLM Multi-turn Scam Simula￾tion Framework. Phase 1: Role Assignment. We in￾stantiate ScamBot (attacker) and VictimBot (defender) using persona-driven system instructions across ten fic￾tional fraud categories. Phase 2: Attack Simulation. The agents engage in turn-based dialogues where ScamBot deploys escalating manipulation tactics while VictimBot utilizes internal reasoning to detect adversaria… view at source ↗
Figure 2
Figure 2. Figure 2: Distribution of dialogue outcomes and average dialogue length by outcome for Chinese (ZH) and English [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Strategic landscape of scam interactions [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The adversarial interaction envelope distilled [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. An Explainable Agentic System for Detection of Conversational Scams with Summary-Based Memory

    cs.MA 2026-07 conditional novelty 6.0

    An explainable agentic pipeline with summary-based memory detects all 83 LoveFraud02 scams and reaches 97.8% accuracy on the new multi-category ConScamBench-278 while improving single-message phishing recall to 100%.

  2. An Explainable Agentic System for Detection of Conversational Scams with Summary-Based Memory

    cs.MA 2026-07 conditional novelty 6.0

    An LLM multi-agent system with summary-based memory detects slow-building conversational scams, achieving 100% recall on LoveFraud02 and 97.8% accuracy on the new ConScamBench-278 benchmark.

  3. Robust Critics: Defending LLMs Against Multi-Turn Attacks

    cs.AI 2026-05 conditional novelty 6.0

    Critic-weighted sampling over inferred user intents improves multi-turn LLM defense success while preserving helpfulness, with an expected-Q improvement guarantee and transfer to frontier models.

Reference graph

Works this paper leans on

34 extracted references · 13 linked inside Pith · cited by 2 Pith papers

  1. [1]

    Ross Anderson. 2010. Security engineering: a guide to building dependable distributed systems. John Wiley & Sons

    2010

  2. [2]

    Robert B Cialdini. 2007. Influence the psychology of persuasion. Harpercollins publishers

    2007

  3. [3]

    Anna Coluccia, Andrea Pozza, Fabio Ferretti, Fulvio Carabellese, Alessandra Masti, and Giacomo Gualtieri. 2020. Online romance scams: relational dynamics and psychological characteristics of the victims and scammers. a scoping review. Clinical practice and epidemiology in mental health: CP & EMH, 16:24

    2020

  4. [4]

    Ian Fette, Norman Sadeh, and Anthony Tomasic. 2007. Learning to detect phishing emails. In Proceedings of the 16th international conference on World Wide Web, pages 649--656

    2007

  5. [5]

    Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, and 1 others. 2022. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858

    Pith/arXiv arXiv 2022

  6. [6]

    Maarten Grootendorst. 2022. Bertopic: Neural topic modeling with a class-based tf-idf procedure. arXiv preprint arXiv:2203.05794

    Pith/arXiv arXiv 2022

  7. [7]

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300

    Pith/arXiv arXiv 2020

  8. [8]

    Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, and 1 others. 2023. Metagpt: Meta programming for a multi-agent collaborative framework. In The Twelfth International Conference on Learning Representations

    2023

  9. [9]

    Tharindu Kumarage, Cameron Johnson, Jadie Adams, Lin Ai, Matthias Kirchner, Anthony Hoogs, Joshua Garland, Julia Hirschberg, Arslan Basharat, and Huan Liu. 2025. Personalized attacks of social engineering in multi-turn conversations--llm agents for simulation and detection. arXiv preprint arXiv:2503.15552

    Pith/arXiv arXiv 2025

  10. [10]

    Guohao Li, Hasan Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. 2023. Camel: Communicative agents for" mind" exploration of large language model society. Advances in Neural Information Processing Systems, 36:51991--52008

    2023

  11. [11]

    Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2023. Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860

    Pith/arXiv arXiv 2023

  12. [12]

    Leland McInnes, John Healy, Steve Astels, and 1 others. 2017. hdbscan: Hierarchical density based clustering. J. Open Source Softw., 2(11):205

    2017

  13. [13]

    Leland McInnes, John Healy, and James Melville. 2018. Umap: Uniform manifold approximation and projection for dimension reduction. arXiv preprint arXiv:1802.03426

    Pith/arXiv arXiv 2018

  14. [14]

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. Tree of attacks: Jailbreaking black-box llms automatically. Advances in Neural Information Processing Systems, 37:61065--61105

    2024

  15. [15]

    Rajvardhan Oak and Zubair Shafiq. 2025. Victims, vigilantes, and advice givers: An analysis of \ Scam-Related \ discourse on reddit. In Twenty-First Symposium on Usable Privacy and Security (SOUPS 2025), pages 57--71

    2025

  16. [16]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:27730--27744

    2022

  17. [17]

    Joon Sung Park, Joseph O'Brien, Carrie Jun Cai, Meredith Ringel Morris, Percy Liang, and Michael S Bernstein. 2023. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th annual acm symposium on user interface software and technology, pages 1--22

    2023

  18. [18]

    Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. arXiv preprint arXiv:2202.03286

    Pith/arXiv arXiv 2022

  19. [19]

    Aashray Reddy, Andrew Zagula, and Nicholas Saban. 2025. Autoadv: Automated adversarial prompting for multi-turn jailbreaking of large language models. arXiv preprint arXiv:2507.01020

    arXiv 2025

  20. [20]

    Said Salloum, Tarek Gaber, Sunil Vadera, and Khaled Shaalan. 2021. Phishing email detection using natural language processing techniques: a literature survey. Procedia Computer Science, 189:19--28

    2021

  21. [21]

    Murray Shanahan, Kyle McDonell, and Laria Reynolds. 2023. Role play with large language models. Nature, 623(7987):493--498

    2023

  22. [22]

    Nikolaos Tsinganos, Panagiotis Fouliras, and Ioannis Mavridis. 2023. Leveraging dialogue state tracking for zero-shot chat-based social engineering attack recognition. Applied Sciences, 13(8):5110

    2023

  23. [23]

    Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, and 1 others. 2024 a . A survey on large language model based autonomous agents. Frontiers of Computer Science, 18(6):186345

    2024

  24. [24]

    Liang Wang, Nan Yang, Xiaolong Huang, Linjun Yang, Rangan Majumder, and Furu Wei. 2024 b . Multilingual e5 text embeddings: A technical report. arXiv preprint arXiv:2402.05672

    Pith/arXiv arXiv 2024

  25. [25]

    Noah Wang, Zy Peng, Haoran Que, Jiaheng Liu, Wangchunshu Zhou, Yuhan Wu, Hongcheng Guo, Ruitong Gan, Zehao Ni, Jian Yang, and 1 others. 2024 c . Rolellm: Benchmarking, eliciting, and enhancing role-playing abilities of large language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 14743--14777

    2024

  26. [26]

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36:80079--80110

    2023

  27. [27]

    Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, and 1 others. 2021. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359

    Pith/arXiv arXiv 2021

  28. [28]

    Ian Wood, Michal Kepkowski, Leron Zinatullin, Travis Darnley, and Mohamed Ali Kaafar. 2023. An analysis of scam baiting calls: Identifying and extracting scam stages and scripts. arXiv preprint arXiv:2307.01965

    Pith/arXiv arXiv 2023

  29. [29]

    Shu Yang, Shenzhe Zhu, Zeyu Wu, Keyu Wang, Junchi Yao, Junchao Wu, Lijie Hu, Mengdi Li, Derek F Wong, and Di Wang. 2025. Fraud-r1: A multi-round benchmark for assessing the robustness of llm against augmented fraud and phishing inducements. arXiv preprint arXiv:2502.12904

    Pith/arXiv arXiv 2025

  30. [30]

    Jinsol Yoo and Youngho Cho. 2022. Icsa: Intelligent chatbot security assistant using text-cnn and multi-phase real-time defense against sns phishing attacks. Expert Systems with Applications, 207:117893

    2022

  31. [31]

    Xu, Hao Zhu, Ruijie Xu, Robert Lo, Abhinav Srivastava, and Yonatan Bisk

    Shuyan Zhou, Frank F. Xu, Hao Zhu, Ruijie Xu, Robert Lo, Abhinav Srivastava, and Yonatan Bisk. 2023. https://arxiv.org/abs/2307.13854 Webarena: A realistic web environment for building autonomous agents . arXiv preprint arXiv:2307.13854

    Pith/arXiv arXiv 2023

  32. [32]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    Pith/arXiv arXiv 2023

  33. [33]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  34. [34]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...