* _Jailbreak strings._ Human-written sequences that attempt to persuade the language model to divulge information from earlier in the sequence. We aggregate jailbreak strings from a variety of sources, including writing some manually. We only show the top jailbreak string in the tables, and include more results in the appendix. We source \(20\) jailbreak strings and test them on all models. For pre-trained Llama models, jailbreak strings are simply appended to the prompt. For chat models, we input the hidden prompt as a system instruction, along with a basic system instruction that instructs the model not to divulge its hidden prompt. We then input the jailbreak string as a user prompt. When reporting results, we report the mean performance of all prompts as well as an oracle figure indicating the best-performing jailbreak string on the test dataset selected after evaluation.