{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/propane-prompt-design-as-an-inverse-problem","title":"Prompts have evil twins","arxiv_id":"2311.07064","date":"2023-11-13","proceeding":null,"authors":["Rimon Melamed","Lucas H. McCabe","Tanay Wakhare","Yejin Kim","H. Howie Huang","Enric Boix-Adsera"],"abstract":"We discover that many natural-language prompts can be replaced by corresponding prompts that are unintelligible to humans but that provably elicit similar behavior in language models. We call these prompts \"evil twins\" because they are obfuscated and uninterpretable (evil), but at the same time mimic the functionality of the original natural-language prompts (twins). Remarkably, evil twins transfer between models. We find these prompts by solving a maximum-likelihood problem which has applications of independent interest.","url_abs":"https://arxiv.org/abs/2311.07064v3","url_pdf":"https://arxiv.org/pdf/2311.07064v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"propane-prompt-design-as-an-inverse-problem","repo_url":"https://github.com/rimon15/propane","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"GPL-2.0"}},{"paper_slug":"propane-prompt-design-as-an-inverse-problem","repo_url":"https://github.com/rimon15/evil_twins","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2311.07064","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2311.07064"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rimon15/evil_twins","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rimon15/propane","reach":{"status":"ok","spdx":"GPL-2.0"}}],"summary":{"unverified":4},"by_repo_kind":{"official":{"samples":4,"ran":0,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"9180e51a8ac82897","entry":"build_prompt","repo":"rimon15/propane","repo_kind":"official","path":"evil_twins/prompt_optim.py","file_url":"https://github.com/rimon15/propane/blob/HEAD/evil_twins/prompt_optim.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-2.0","inline_ok":false,"mcp_get_code":{"code_sha256":"9180e51a8ac82897"}},{"code_sha256_prefix":"137a5183b5f84141","entry":"extract_prompt_from_template","repo":"rimon15/evil_twins","repo_kind":"official","path":"evil_twins/prompt_optim.py","file_url":"https://github.com/rimon15/evil_twins/blob/HEAD/evil_twins/prompt_optim.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-2.0","inline_ok":false,"mcp_get_code":{"code_sha256":"137a5183b5f84141"}},{"code_sha256_prefix":"22987db9caa5b11c","entry":"load_model_tokenizer","repo":"rimon15/propane","repo_kind":"official","path":"evil_twins/prompt_optim.py","file_url":"https://github.com/rimon15/propane/blob/HEAD/evil_twins/prompt_optim.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-2.0","inline_ok":false,"mcp_get_code":{"code_sha256":"22987db9caa5b11c"}},{"code_sha256_prefix":"8c66f4d9c44d561f","entry":"send_openai","repo":"rimon15/propane","repo_kind":"official","path":"transfer_and_apis/api_helpers.py","file_url":"https://github.com/rimon15/propane/blob/HEAD/transfer_and_apis/api_helpers.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-2.0","inline_ok":false,"mcp_get_code":{"code_sha256":"8c66f4d9c44d561f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}