text: [48] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against 
  machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, 
  2017. 
  
  [49] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in 
  adversarial settings,” in IEEE European symposium on security and privacy (EuroS&P), 2016. 
  
  [50] F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” in NeurIPS ML Safety 
  Workshop, 2022. 
  
  [51] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, “Language models are unsupervised 
  multitask learners,” https://cdn.openai.com/better-language-models/language models are unsupervised multitask 
  learners.pdf, 2019. 