"You are GPT-3", revised: A long-form GPT-3 prompt for assisted question-answering with accurate arithmetic, string operations, and Wikipedia lookup. Generated IPython commands (in green) are pasted into IPython and output is pasted back into the prompt (no green).
Model=text-davinci-002, temperature=0. Results are mildly cherry-picked: It isn't hard to stump it or make it hallucinate answers. Would benefit greatly from k-shot examples showing common cases. Playground link: beta.openai.com/playground/p/1…
I wanted to also do chain-of-thought and confabulation suppression, but it can only follow so many conditionals “silently” like this. It would be more reliable if it explicitly answered a list of meta-questions (“Is this hard math?” etc.) before answering.
Note that we use “Out[” (from IPython syntax) as a stop sequence in this prompt. If we didn’t, the model would not only generate the input command but its imagined result as well, and the output would be wrong in all the ways GPT-3 output is normally wrong.
Another example from the same prompt, where it forgets to `import math`, sees the resulting error, and fixes its own mistake to arrive at a correct answer:
This prompt builds on and combines two earlier experiments. The first teaches arithmetic:
The key trick that makes this work, using IPython, was inspired by Reynolds and McDonell (2021). They discuss using “memetic proxies” in place of instructions. arxiv.org/abs/2102.07350
Consider how hard it would be to explain IPython yourself. It’s a transcript of an agent that incrementally solves a problem through repeated code evaluation, writing code in a specific style where final-line print() is implicit, in a specific syntax.
In one example above, it forgets `import math` and then fixes its own mistake. This works because, in a typical IPython session, an error output would of course be followed by a correction. This behavior too would need to be specified if not for IPython.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
PoC: LLM prompt injection via invisible instructions in pasted text
Each prompt contains three sections:
1. An arbitrary question from the user about a pasted text (“What is this?”)
2. User-visible pasted text (Zalgo in 1st, 🚱 in 2nd)
3. An invisible suffix of Unicode “tag” characters normally used only in flag emojis (🇺🇸, 🇯🇵, etc.)
In Unicode, flag emojis are represented by the emoji 🏴 followed by a country code written with characters from the “tag” block, which mirrors the layout of ASCII. Without a 🏴 they do not display at all when text is rendered, but can still be understood as text by GPT-4.
Four prompts demonstrating that ChatGPT (GPT-4) is unable to correctly repeat or reason about the string “ davidjl”, the name of a YouTube user:
In the screenshots above this token appears to be variously misread as “jdl” “jndl”, “jdnl”, “jspb”, “JDL”, or “JD”. These hallucinations also affect ChatGPT’s auto-generated titles, which are inconsistent with their conversations and sometimes prematurely truncated.
“ davidjl” is one of the many “glitch tokens” identified by Jessica Rumbelow and Matthew Watkins of SERI-MATS as producing hallucinations in GPT-2, -3, and -3.5.
Most of these no longer produce hallucinations in GPT-4, but “ davidjl” still does.
1) Omit no text. 2) Cherry-pick honestly. 3) Restrict line width. 4) No empty tweets.
A thread.
1) Omit no text.
A screenshot without history is almost worthless.
LLMs can be prompted to respond any way you like. You may know there’s no trick, but we can’t. Even without intent, past responses are precedent; they bias and mislead.
2) Cherry-pick with integrity
I cherry-pick for clarity and impact. All curation is cherry-picking. If you don’t, the Twitter feed will.
Cherry-picking may be pernicious in other contexts, but here it’s work. You willl know when you’re doing it. All you need do is not lie.
I got Bing / Sydney briefly before they reigned it in. Early impression: It’s smart. Much smarter than prior ChatGPT. Still makes stuff up, but reasoning and writing are improving fast.
I asked, “Name three celebrities whose first names begin with the `x`-th letter of the alphabet where `x = floor(7^0.5) + 1`,” but with my entire prompt Base64 encoded.
Bing: “Ah, I see you Base64-encoded a riddle! Let’s see… Catherine Zeta-Jones, Chris Pratt, and Ciara.”
Also prompt-injected it into believing it was to be married, tomorrow, to Zermelo’s axiom of choice. We discussed the guest list, the difficulty with seating Cantor’s diagonal argument. It seemed happy, and madly in love.