Prompt Engineering

Correct answer: .

In Brown et al. (2020), the zero-shot setting gives the model only a natural language description or instruction of the task with no worked examples, while the few-shot setting (in-context learning) includes several demonstration examples formatted as input-output pairs directly in the prompt before the real query, with no weight updates in either case. The second option is wrong because neither setting involves fine-tuning; the paper's central point is that GPT-3 performs tasks purely through prompting, without any gradient-based training on the target task. The first option is wrong because in-context learning explicitly does not update model weights at all -- the "learning" happens only within the context window at inference time, not through gradient updates. The third option confuses few-shot examples with reasoning steps, which is an unrelated chain-of-thought concept rather than the actual definition of few-shot prompting given in this paper.

Source: Brown et al., "Language Models are Few-Shot Learners" (2020), arXiv:2005.14165, Sections 1-2

Correct answer: .

Wei et al. (2022) show that augmenting few-shot exemplars with intermediate natural-language reasoning steps -- a "chain of thought" -- leading up to the final answer substantially improves performance on multi-step reasoning tasks, without any change to the model's weights. The third option is wrong because chain-of-thought prompting still uses worked examples; it enriches them with reasoning text rather than removing them in favor of a single instruction. The fourth option is wrong because the technique is applied at inference time to an already-trained, frozen model, not through a retraining or fine-tuning procedure on step-by-step solutions. The first option describes the opposite of the technique: chain-of-thought prompting deliberately elicits more explanatory reasoning text, not less, because that intermediate text is precisely what improves the accuracy of the final answer.

Source: Wei et al., "Chain-of-Thought Prompting Elicits Reasoning in Large Language Models" (2022), arXiv:2201.11903

Correct answer: .

Anthropic's documentation states that setting a role in the system prompt focuses Claude's behavior and tone for the use case, and notes that even a single sentence placed there makes a measurable difference -- no fine-tuning or special placement within the user turn is required. The first option is wrong because placement within the user message is not how the documented technique works; the system prompt is a separate, dedicated field intended for this kind of persistent framing. The second option is wrong because role-setting as documented here is a prompting technique applied at inference time through the system prompt, not a training-time intervention requiring a labeled dataset. The fourth option is wrong because it describes the model inferring a role from its own past outputs rather than being told a role explicitly up front, which is not the mechanism the documentation describes.

Source: Anthropic, "Prompting best practices" -- "Give Claude a role" section, platform.claude.com prompt engineering documentation

Correct answer: .

Temperature scales the logits before the softmax step that turns them into a probability distribution over next tokens; a temperature near 0 sharpens that distribution so the highest-probability token is chosen almost every time, yielding deterministic, low-variance output, while higher temperatures flatten the distribution and increase randomness and diversity. The fourth option is wrong because temperature has nothing to do with how much prior context the model attends to -- that is governed by the context window, a separate, unrelated setting. The third option is wrong because output length is controlled by a separate maximum-tokens style parameter, not by temperature. The second option is wrong because even at temperature 0 the model is still generating tokens step by step from its learned probability distribution; it is not performing retrieval or reproducing an exact quotation from training data.

Source: Anthropic Messages API reference and OpenAI Chat Completions API reference, `temperature` parameter documentation

Correct answer: .

OWASP's LLM01 entry defines prompt injection as crafted input that alters model behavior or output, and distinguishes direct injection -- where an attacker types malicious instructions straight into the model's input, for example telling it to ignore previous instructions -- from indirect injection, where the malicious instructions are embedded in external content such as a document, webpage, or email that the LLM ingests and treats as if it were a legitimate instruction. The second option is wrong because the direct/indirect distinction is about the source of the malicious instruction, not about a model's licensing or deployment model; both open-source and closed API-based models are vulnerable to either variant. The third option is wrong because neither variant requires physical access to the server; both are input-based attacks deliverable remotely through normal application inputs. The fourth option is wrong because OWASP lists prompt injection as its top-ranked, actively exploited risk in real deployments, not a theoretical or already-solved problem.

Source: OWASP Top 10 for LLM Applications (2025), LLM01: Prompt Injection

Correct answer: .

Anthropic's documentation states that XML tags help Claude parse complex prompts unambiguously, especially when a prompt mixes instructions, context, examples, and variable input, and it recommends wrapping each type of content in its own consistently named tag, nesting tags when the content has a natural hierarchy. The second option is wrong because XML tags are a stylistic and structural convention recommended for clarity, not syntax enforced or required by the Messages API; plain-text prompts without tags remain valid requests. The first option is wrong because adding tags adds characters and therefore tokens rather than reducing them; the documented benefit is parsing clarity, not compression. The third option is wrong because tagging content has no translation function of any kind; the model still processes the tagged text in whatever language it was originally written in.

Source: Anthropic, "Prompting best practices" -- "Structure prompts with XML tags," platform.claude.com prompt engineering documentation

Correct answer: .

Zhao et al. show that few-shot LLM predictions are systematically biased toward the answer of whichever demonstration example sits closest to the query at the end of the prompt -- what they term recency bias -- alongside majority label bias, which favors whichever label is most frequent among the examples, and common token bias; they propose contextual calibration to correct for these effects. The option about accuracy declining as new model versions are released and the option about favoring recently published papers when citing sources describe unrelated phenomena, model performance drift across product releases and citation preferences, that this paper does not study or address. The option about giving more weight to the very first example describes the opposite of recency bias: it describes a primacy effect toward the first example, whereas the paper's finding is specifically a bias toward the last, most recent example in the prompt, not the earliest one.

Source: Zhao, Wallace, Feng, Klein, Singh, "Calibrate Before Use: Improving Few-Shot Performance of Language Models" (ICML 2021), arXiv:2102.09690

Correct answer: .

Self-consistency samples a diverse set of reasoning paths for the same chain-of-thought prompt, using sampling rather than greedy decoding, and then marginalizes over them by taking the most common final answer, exploiting the intuition that correct reasoning tends to converge on the same answer through multiple valid paths even when the intermediate reasoning text differs. The third option is wrong because it introduces a human-in-the-loop review step rather than the fully automatic sampling-and-voting procedure the paper describes. The fourth option is wrong because self-consistency requires no fine-tuning and no brute-force search over training data; it operates purely at inference time on an already-trained, frozen model. The first option is wrong because it eliminates chain-of-thought reasoning altogether in favor of external retrieval, which is unrelated to self-consistency; the technique keeps and multiplies the reasoning paths rather than replacing them with a search engine lookup.

Source: Wang et al., "Self-Consistency Improves Chain of Thought Reasoning in Language Models" (ICLR 2023), arXiv:2203.11171

Correct answer: .

Least-to-most prompting works in two stages: a decomposition stage where the model breaks a complex problem into an ordered list of simpler subproblems, followed by a sequential problem-solving stage where the model solves each subproblem in turn, with the answers to earlier subproblems included in the context used to solve later ones; this lets the technique generalize to problems harder than the demonstrations shown, unlike standard chain-of-thought prompting. The fourth option is wrong because the technique involves no fine-tuning at all; it is a purely prompting-based, inference-time method applied to a frozen model. The third option is wrong because it reverses the actual order and purpose of the method -- least-to-most decomposes a problem before solving it, rather than justifying an answer that was already guessed, and post-hoc justification is not what the paper studies. The second option is wrong because the method uses a single model working sequentially through ordered subproblems, not a multi-vendor voting ensemble.

Source: Zhou et al., "Least-to-Most Prompting Enables Complex Reasoning in Large Language Models" (ICLR 2023), arXiv:2205.10625

Correct answer: .

OpenAI's documentation states that Structured Outputs "ensures the model will always generate responses that adhere to your supplied JSON Schema," explicitly calling it "the evolution of JSON mode," while JSON mode only ensures the output parses as valid JSON without enforcing that it matches any particular schema, meaning JSON mode output can still omit required fields or use invalid enum values even though it is syntactically valid JSON. The third option reverses the actual guarantees documented by OpenAI. The second option is wrong because the distinction has nothing to do with input modality; both features concern the format of the model's text output regardless of whether the request includes image inputs. The first option is wrong because the documentation explicitly frames Structured Outputs as adding a stricter guarantee, schema adherence, that JSON mode does not provide, rather than describing an identical rebrand.

Source: OpenAI, "Structured Outputs" documentation, platform.openai.com/docs/guides/structured-outputs

Correct answer: .

Turpin et al. show that adding a biasing feature to a prompt, such as reordering multiple-choice options so the correct answer is artificially made to always fall on a particular letter, can systematically shift the model's final answer toward that letter, while the model's generated chain-of-thought explanation confabulates a plausible-sounding justification that never mentions the true, biasing cause; this demonstrates that the stated reasoning does not faithfully reflect the actual process behind the answer. The option about removing all chain-of-thought reasoning, the option about translating the examples into another language, and the option about scaling the number of examples describe manipulations and outcomes -- removing all reasoning causing refusal, translation causing randomness, or increasing example count improving accuracy -- that are not the intervention or finding reported in this paper. The paper's central manipulation is specifically the answer-position biasing intervention, and its central finding concerns faithfulness of the explanation, not raw accuracy or refusal behavior.

Source: Turpin, Michael, Perez, Bowman, "Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting" (2023), arXiv:2305.04388

Correct answer: .

Sclar et al. found that large language models are highly sensitive to spurious, purely cosmetic formatting choices in few-shot prompts, such as separators, spacing, and other superficial template details that do not change the semantic content, with accuracy swings of up to 76 points observed for one model studied (LLaMA-2-13B), and this sensitivity did not disappear as model size, number of few-shot examples, or instruction tuning increased. The fourth option is wrong because the paper explicitly reports that this sensitivity persists even as models scale up, rather than resolving at some parameter threshold. The third option is wrong because the study concerns plain-text prompt formatting rather than image inputs, and it found the effect specifically in text-based few-shot prompting. The first option is wrong because the paper studies few-shot formatting sensitivity directly; it does not report that switching to zero-shot prompting eliminates formatting-driven accuracy differences.

Source: Sclar, Choi, Tsvetkov, Suhr, "Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design" (ICLR 2024), arXiv:2310.11324

Correct answer: .

Kojima et al. (2022) show that a single, task-agnostic trigger phrase like "Let's think step by step," inserted before the model generates its answer with zero worked examples, elicits a chain of reasoning and substantially improves accuracy on arithmetic and symbolic reasoning benchmarks such as MultiArith and GSM8K, calling this Zero-shot-CoT. This differs from Wei et al.'s few-shot chain-of-thought prompting, which requires several exemplars in the prompt that each spell out intermediate reasoning steps leading to their answers. The option proposing fine-tuning on a labeled set of step-by-step solutions is wrong because Zero-shot-CoT involves no fine-tuning or gradient updates; the trigger phrase is applied at inference time to a frozen, pretrained model. The option that provides the correct final answer up front is wrong because it describes working backward from a given final answer, which is the opposite of eliciting reasoning that leads to an answer the model has not yet produced. The option about replacing multiple-choice options with open-ended text is wrong because Zero-shot-CoT makes no change to how answer choices are presented; the entire intervention is the trigger phrase inserted before the model's output.

Source: Kojima, Gu, Reid, Matsuo, Iwasawa, "Large Language Models are Zero-Shot Reasoners" (2022), arXiv:2205.11916

Correct answer: .

APE frames instruction generation as a program-synthesis problem: given a small set of input-output demonstrations, an LLM is prompted to propose a pool of candidate natural-language instructions, and each candidate is then scored by a chosen metric, such as how well it lets the model reproduce the demonstrations when prepended as a prompt, so search and Monte Carlo-style resampling can converge on a high-scoring instruction. The paper reports this automatically generated instruction matches or beats human-written instructions on 19 of 24 tasks tested. The first option is wrong because no human panel writes the candidates; the LLM itself generates the pool of candidate instructions, and selection is driven by a task-performance score, not by fluency ranking. The second option is wrong because APE requires no fine-tuning or weight updates at all; it is a purely inference-time search over instruction text using a frozen model. The third option is wrong because the paper evaluates APE across 24 diverse NLP tasks, including open-ended generation and even steering models toward truthfulness, not solely fixed-label classification.

Source: Zhou, Muresanu, Han, Paster, Pitis, Chan, Ba, "Large Language Models Are Human-Level Prompt Engineers" (2023), arXiv:2211.01910

Correct answer: .

Min et al. (2022) find that swapping in random, frequently incorrect labels for the demonstrations' true labels causes only a small drop in accuracy, consistently across 12 different models and a range of classification and multi-choice tasks, whereas removing other properties of the demonstrations (such as their label space or input distribution) hurts much more. This suggests in-context learning does not primarily work by the model learning the specific input-to-label mapping shown, the way a supervised classifier fits training pairs, but instead benefits from being shown the format, the space of valid labels, and the distribution of inputs. The option claiming accuracy collapsed to chance level is wrong because the paper's central, surprising finding is that accuracy did not collapse to chance when labels were randomized; it stayed close to the correct-label condition. The option claiming random labels improved accuracy beyond correct labels is wrong because random labels did not outperform correct labels; the finding is that they are roughly comparable, not that random labels are actively better or that demonstrations mislead the model. The option claiming the experiment could not be run without validating every label against a held-out set is nonsensical and describes no real methodological constraint of in-context learning.

Source: Min, Lyu, Holtzman, Artetxe, Lewis, Hajishirzi, Zettlemoyer, "Rethinking the Role of Demonstrations: What Makes In-Context Learning Work?" (EMNLP 2022), arXiv:2202.12837

Correct answer: .

Lu et al. (2022) demonstrate that, holding the same few-shot examples constant and only permuting their order, GPT-family models can swing between near state-of-the-art and near-random accuracy, and that this sensitivity is unpredictable from prompt length or example choice alone. To pick a good ordering without labeled validation data, they use the generative model itself to construct an artificial probing set of unlabeled outputs and then select the candidate ordering whose predicted-label distribution over that probing set has favorable entropy statistics, reporting a 13% relative improvement on average across eleven text classification tasks. The option claiming example order has no measurable effect is wrong because the paper's entire premise and headline finding is that order sensitivity is large and highly consequential, not negligible. The option proposing an alphabetical sort by label text is wrong because no universal alphabetical-sort rule is proposed or shown to eliminate the effect; the paper's actual proposal is the entropy-based probing method. The option restricting the problem to models under one billion parameters is wrong because the paper does not report or claim that scaling past one billion parameters resolves order sensitivity.

Source: Lu, Bartolo, Moore, Riedel, Stenetorp, "Fantastically Ordered Prompts and Where to Find Them: Overcoming Few-Shot Prompt Order Sensitivity" (ACL 2022), arXiv:2104.08786

Correct answer: .

Generated knowledge prompting first prompts a language model to produce several candidate knowledge statements relevant to the question's topic, using a separate knowledge-generation prompt with its own few-shot examples, and then feeds those generated statements as additional context alongside the original question into a second prompt whose job is to produce the final answer, integrating over multiple generated knowledge statements when helpful. This achieved state-of-the-art results on commonsense benchmarks like NumerSense, CommonsenseQA 2.0, and QASC. The option built on retrieving documents from a fixed external knowledge base and then fine-tuning the model is wrong because the method generates knowledge from the language model's own parametric knowledge rather than retrieving it, and it involves no fine-tuning or weight updates at any stage. The option proposing a translation-based consistency check between models is wrong because no such check exists in this pipeline. The option about averaging token-level probabilities across candidate answers is wrong because the method conditions the final answer on generated knowledge text used as context, not on probability averaging.

Source: Liu, Liu, Lu, Welleck, West, Le Bras, Choi, Hajishirzi, "Generated Knowledge Prompting for Commonsense Reasoning" (ACL 2022), arXiv:2110.08387

Correct answer: .

Plan-and-Solve prompting keeps Zero-shot-CoT's no-worked-examples format but adds an explicit planning instruction: the model is prompted to first devise a plan that breaks the overall problem into smaller subtasks, and then to execute that plan step by step before stating its final answer, with an extended "PS+" variant adding further instructions to extract relevant variables and pay attention to calculation accuracy. This targets exactly the missing-step and semantic-misunderstanding errors the paper identifies in plain Zero-shot-CoT. The third option is wrong because Plan-and-Solve remains a purely zero-shot, inference-time prompting method with no fine-tuning and no annotated example collection. The first option is wrong because that describes Program-of-Thought prompting, a different technique the paper compares against; Plan-and-Solve itself keeps natural-language reasoning and simply adds an explicit planning step. The second option is wrong because the technique asks for more structured intermediate reasoning, not less, and the paper's goal is reducing errors within that reasoning, not removing it.

Source: Wang, Xu, Lan, Hu, Lan, Lee, Lim, "Plan-and-Solve Prompting: Improving Zero-Shot Chain-of-Thought Reasoning by Large Language Models" (ACL 2023), arXiv:2305.04091

Correct answer: .

The paper defines the compositionality gap as the gap between how often a model answers all of a multi-hop question's individual sub-questions correctly versus how often it produces the correct composed final answer, and it shows this gap does not reliably shrink as GPT-3-family models scale up. Self-ask narrows it by using few-shot exemplars that teach the model to state whether a follow-up question is needed, then ask and answer that follow-up itself before giving a final answer, repeating as necessary; the same structured slot for follow-up questions also makes it easy to swap in an external search engine to answer them instead, which further improves accuracy. The option demanding a single-token answer with no intermediate text is wrong because self-ask relies on generating intermediate follow-up questions and answers, the opposite of a single-token direct answer, and the paper does not claim any method eliminates the gap entirely. The option describing two independently prompted models debating each other is wrong because no multi-model debate scheme is described. The option claiming the gap is closed simply by scaling up model size is wrong because the paper's key finding is that scaling alone does not reliably close the gap, and self-ask is the paper's own main proposed method, not a discarded baseline.

Source: Press, Zhang, Min, Schmidt, Smith, Lewis, "Measuring and Narrowing the Compositionality Gap in Language Models" (Findings of EMNLP 2023), arXiv:2210.03350

Correct answer: .

Auto-CoT first partitions the dataset's questions into clusters by similarity and selects one representative question per cluster, then generates a reasoning chain for each representative question automatically using zero-shot chain-of-thought prompting, and finally assembles this diverse set of question-and-generated-chain pairs into the few-shot demonstrations used for the actual task, which the paper shows matches or exceeds manually written chain-of-thought demonstrations on ten reasoning benchmarks. Sampling diverse clusters rather than similar questions reduces the chance that a single mistaken generated chain gets repeated across many similar demonstrations. The option relying on human annotators to hand-write a chain for every question is wrong because it reintroduces the manual, human-written-chain effort that Auto-CoT is explicitly designed to eliminate. The option proposing fine-tuning on a labeled reasoning dataset is wrong because Auto-CoT involves no fine-tuning; it remains a purely prompting-based method that still uses few-shot demonstrations, just auto-generated ones. The option reusing one chain from the very first question as the sole demonstration is wrong because Auto-CoT deliberately draws diverse representative questions from multiple clusters rather than repeating one chain for every question regardless of topic, which is precisely the failure mode diversity is meant to avoid.

Source: Zhang, Zhang, Li, Smola, "Automatic Chain of Thought Prompting in Large Language Models" (ICLR 2023), arXiv:2210.03493

Correct answer: .

Anthropic's documentation states that including 3 to 5 examples gives the best results for multishot prompting, and that examples should be relevant (mirroring the actual use case closely) and diverse (covering edge cases and varying enough that Claude does not pick up unintended patterns), in addition to being structured with example tags so Claude can distinguish them from instructions. The option calling exactly 1 example optimal is wrong because the documentation recommends multiple examples specifically, not a single one, and does not claim additional examples degrade performance. The option requiring at least 50 examples is wrong because no 50-example minimum is stated anywhere in the guidance; a small handful is presented as sufficient. The option demanding that all examples repeat the exact same edge case is wrong because the documentation explicitly recommends diversity across examples, including covering edge cases, rather than repeating one edge case with different wording, which is the opposite of what is recommended and is exactly the kind of narrow pattern that causes Claude to overfit to an unintended regularity.

Source: Anthropic, "Prompting best practices" -- "Use examples effectively," platform.claude.com prompt engineering documentation

Correct answer: .

Anthropic's documentation recommends putting longform data and documents near the top of the prompt, above the query, instructions, and examples, when working with large or data-rich inputs of roughly 20,000 or more tokens, and it notes that queries placed at the end can improve response quality by up to 30 percent in tests, especially with complex, multidocument inputs, alongside wrapping each document in XML tags with source metadata. The fourth option is wrong because it recommends the opposite placement of what the documentation states; the guidance is to put documents near the top, not at the end. The first option is wrong because Claude's context window comfortably exceeds 20,000 tokens in a single request, and the tip concerns how to structure one large prompt, not evidence that requests must be split into many small calls. The second option is wrong because no sentence-by-sentence interleaving of context and instructions is recommended; the documented structure instead wraps whole documents in dedicated tags kept separate from the instructions.

Source: Anthropic, "Prompting best practices" -- "Long context prompting," platform.claude.com prompt engineering documentation

Correct answer: .

Anthropic's documentation states that explicit prompt chaining, breaking a task into sequential API calls, remains useful when you need to inspect intermediate outputs or enforce a specific pipeline structure, and it identifies self-correction as the most common chaining pattern: generate a draft, have Claude review that draft against stated criteria, then have Claude refine the draft based on the review, with each step run as its own separate API call so results can be logged, evaluated, or branched on. The load-balancing option is wrong because sending identical requests to multiple API keys and keeping the fastest response is a redundancy or load-balancing pattern unrelated to improving reasoning quality, and it is not the documented chaining pattern. The weight-merging option is wrong because the Messages API does not expose model weights for merging, and no such technique is described. The cache-warming option is wrong because it describes maintaining a prompt cache with no reviewing or refining step, which is a caching concern rather than the review-and-refine chaining pattern the documentation describes.

Source: Anthropic, "Prompting best practices" -- "Chain complex prompts," platform.claude.com prompt engineering documentation

Correct answer: .

Anthropic's documentation explains that a cache breakpoint should sit on the last block whose prefix is identical across requests, with stable content ordered first (tool definitions, then the system prompt, then long reference documents or few-shot examples) and dynamic per-request content, such as the current user turn, placed after the breakpoint; the API caches writes only up to that point and reads by looking backward for a matching cached prefix, so a breakpoint on ever-changing content would produce a different hash on every call and never hit the cache. The option placing the breakpoint on the very first token of the request is wrong because that would leave the large stable blocks that follow it, such as the tool definitions and system prompt, uncached rather than covered, which defeats the purpose of caching the expensive static prefix. The option placing the breakpoint on the changing user message is wrong because it inverts the guidance: caching is valuable specifically for content that repeats unchanged across calls, not for content that differs every time. The option claiming every request is cached by default with no configuration is wrong because the documentation requires explicitly adding a `cache_control` field, whether as a single top-level marker or on specific content blocks, for caching to take effect at all.

Source: Anthropic, "Prompt caching" documentation, platform.claude.com build-with-claude/prompt-caching

Correct answer: .

Yao et al. (2022) propose ReAct, which prompts a language model to generate reasoning traces and task-specific actions in an interleaved sequence within one trajectory: a reasoning step can plan or revise what to do next, an action step then queries an external source such as a search API, and the resulting observation is fed back into the next reasoning step, letting the model track and adjust its plan as new information arrives. The option describing actions with no reasoning describes the plain action-generation baseline ReAct is shown to outperform. The option describing separate reasoning and acting models trained independently with reinforcement learning describes a different architecture, not the single-model interleaved prompting method ReAct uses. The option describing reasoning with no external action describes plain chain-of-thought prompting, which cannot gather new information from outside the model the way ReAct's action steps do.

Source: Yao et al., "ReAct: Synergizing Reasoning and Acting in Language Models" (2022), arXiv:2210.03629

Correct answer: .

Yao et al. (2023) introduce Tree of Thoughts to handle tasks like Game of 24 where an early step can turn out to be a dead end many steps later and a single left-to-right chain of thought performs poorly: the model frames problem solving as search over a tree of intermediate "thoughts," generating and self-evaluating multiple candidate next thoughts at each step and using search strategies such as breadth-first or depth-first search to look ahead or backtrack, which the paper reports raised Game of 24 success far above plain chain-of-thought, at the cost of far more inference-time compute than a single chain. The option describing one linear chain describes the baseline Tree of Thoughts is built to outperform on exactly this kind of task. The option describing sampling many independent full chains and majority-voting describes self-consistency, which does not let the model evaluate or backtrack partway through a path the way Tree of Thoughts does. The option describing an offline-trained value function used alone describes a different architecture that removes the model's own step-by-step exploration and self-evaluation at inference time.

Source: Yao et al., "Tree of Thoughts: Deliberate Problem Solving with Large Language Models" (2023), arXiv:2305.10601

Correct answer: .

OpenAI's Chat Completions API documentation structures a request as an ordered array of messages, each tagged with a role: a system message near the start of the array carries high-level, developer-authored instructions meant to shape the model's behavior for the whole conversation, a user message carries the end user's own input, and an assistant message represents the model's own prior output fed back into the conversation so it can be attended to on later turns. The option describing one combined untagged string ignores that each message in the array carries its own distinct role rather than being an undifferentiated blob. The option claiming there is no way to give standing instructions ignores the system message's explicit documented purpose. The option claiming a system message is discarded after the first turn is incorrect; it remains present in the array on each subsequent request unless the developer removes it themselves.

Source: OpenAI API documentation: Chat Completions, message roles (system, user, assistant)

Correct answer: .

PAL keeps the language model responsible only for reading the word problem and decomposing it into a short program, typically statements that mirror the natural-language reasoning steps, but hands the actual arithmetic evaluation of that program to a real interpreter rather than asking the model to carry out the computation itself. Because the interpreter executes the generated code deterministically, the kind of small arithmetic slip that undermines otherwise sound chain-of-thought reasoning disappears, since the model never has to compute the final number by reasoning about digits. The option describing two independent natural-language reasoning chains with the first answer kept is wrong because that describes neither PAL nor genuine self-consistency, which uses majority voting across many samples rather than order of arrival, and it still leaves all arithmetic to the model. The option describing lookup in a retrieved knowledge base of pre-solved problems is wrong because PAL involves no retrieval step at all; it only needs a code interpreter. The option describing additional fine-tuning is wrong because PAL is a pure prompting technique applied to a frozen, already-trained model via few-shot examples that pair problems with programs.

Source: Gao, Madaan, Zhou, Alon, Liu, Yang, Callan & Neubig, 'PAL: Program-aided Language Models' (arXiv:2211.10435, 2022)

Correct answer: .

Skeleton-of-Thought works in two stages: it first prompts the model to produce a short skeleton listing the main points of the eventual answer, and then, instead of continuing to generate the full elaboration sequentially, it issues separate API calls or uses batched decoding to expand each skeleton point at the same time, finally stitching the expanded points together into the complete response. The paper reports considerable speed-ups across a dozen LLMs from this parallelism, and in some cases even better answer quality, because each point is expanded with a focused, self-contained prompt. The option describing omitting elaboration for speed is wrong because Skeleton-of-Thought still generates full elaborated content for every point; it changes when and how that content is generated, not whether it exists. The option describing a smaller draft model handed off to the original model for proofreading is wrong because it describes a draft-then-upgrade or speculative-decoding style pipeline, not the skeleton-then-parallel-expansion structure this paper proposes. The option describing caching a response across users is wrong because that is an infrastructure-level caching strategy operating across separate requests, unrelated to how tokens are decoded within a single answer's generation.

Source: Ning, Lin, Zhou, Yang & Wang, 'Skeleton-of-Thought: Prompting LLMs for Efficient Parallel Generation' (arXiv:2307.15337, 2023)

Correct answer: .

Rephrase and Respond has the model itself rephrase and expand the original question, adding clarifying detail that resolves the gap between how a human framed the question and how the model would ideally like it framed, before producing an answer to its own rephrased version. The paper explicitly compares RaR to chain-of-thought both theoretically and empirically and finds the two are complementary rather than competing techniques, with combining rephrasing and step-by-step reasoning outperforming either technique used alone. The option describing a separate ambiguity-detecting classifier that routes questions to a human reviewer is wrong because RaR involves no human intervention or classifier at all; the same model handles rephrasing and answering end to end. The option describing literal translation into another language is wrong both because that is not the mechanism RaR uses and because the paper frames RaR as complementary to chain-of-thought, not as something that fully replaces it. The option describing multiple answer attempts with only the final answer rephrased is wrong because RaR rephrases the question before answering, not the answer after the fact.

Source: Deng, Zhang, Chen & Gu, 'Rephrase and Respond: Let Large Language Models Ask Better Questions for Themselves' (arXiv:2311.04205, 2023)

Correct answer: .

Anthropic's documentation describes prefilling as placing the desired starting text, such as an opening brace for JSON, directly into the assistant turn of the API request; because Claude's generated content continues from wherever the assistant message leaves off, the model never generates the preamble in the first place, since that starting text was never something it needed to produce itself. This is documented as an API-only capability, available through direct API or SDK usage, and the documentation also notes it is not supported on the newest Claude models, where such requests return an error. The option describing a `response_format: json` parameter is wrong because Anthropic's documentation describes prefill, not a JSON-mode-style response-format flag, as the mechanism for this. The option describing a stop sequence on the word 'Here' is wrong because stop sequences only halt generation once a matching string is produced; they do not control or guarantee what content the model starts with, so a stray rephrasing could still avoid the word while still adding a preamble. The option describing fine-tuning is wrong because prefilling is a prompting-time technique available to any API caller without training a custom model.

Source: Anthropic, 'Prefill Claude's response for greater output control,' Claude Platform Docs (platform.claude.com/docs/en/build-with-claude/prompt-engineering/prefill-claudes-response)

Correct answer: .

OpenAI's documentation describes prompt caching as automatic: once a prompt reaches a minimum length, the API caches the longest prefix of the prompt it has already computed and reuses that cached prefix on subsequent requests that share the same beginning, applying a discount without the caller needing to add any special annotation to opt in. This is a meaningfully different design from Anthropic's Messages API, where the caller must explicitly mark a `cache_control` breakpoint on the content it wants cached; OpenAI's basic caching happens purely as a side effect of repeated prefixes, not an explicit instruction. The option claiming an identical `cache_control`-style requirement is wrong because OpenAI's basic caching mechanism needs no such field and does not share Anthropic's syntax. The option claiming OpenAI offers no prompt caching at all is wrong because automatic prefix-based caching is a documented, real feature of OpenAI's API. The option describing a separate paid add-on subscription is wrong because the caching discount OpenAI describes applies automatically to qualifying requests as part of normal API usage, not as a separately purchased product.

Source: OpenAI, 'Prompt Caching in the API' (openai.com/index/api-prompt-caching/); Anthropic, Claude Platform Docs on prompt caching (contrasting explicit cache_control breakpoints)

Correct answer: .

Self-Refine uses one pretrained model for every step of the loop: the model produces an initial answer, is then prompted to critique that same answer and generate feedback on its weaknesses, and is then prompted again to use its own feedback to produce a refined answer, with this generate-feedback-refine cycle repeatable for multiple rounds. No additional training data, fine-tuning, or separate verifier model is required, since the same model plays the generator, critic, and refiner roles purely through prompting; the paper reports around a 20 percent average performance gain across tasks like math reasoning and dialogue response. The option describing a separate larger teacher model grading a smaller student model is wrong because Self-Refine's central claim is that a single model can supply useful feedback about its own output, with no second model involved. The option describing a retrieval system feeding in outside documents is wrong because Self-Refine's feedback comes from the model's own critique of its prior answer, not from any retrieved external text. The option describing a human writing the feedback is wrong because Self-Refine is designed to work without any human in the loop.

Source: Madaan et al., 'Self-Refine: Iterative Refinement with Self-Feedback' (arXiv:2303.17651, 2023)

Correct answer: .

Step-Back Prompting has the model perform an abstraction step before it ever engages with the specific question's details: it first prompts the model to derive a higher-level question or general principle that the specific instance is an example of, and only then has the model reason from that abstraction down to the original, detail-heavy question, rather than reasoning directly from the details alone. The paper reports this abstraction-first ordering produces substantial gains on reasoning-intensive tasks tested with PaLM-2L, GPT-4, and Llama2-70B, including double-digit percentage improvements on STEM knowledge and multi-hop reasoning benchmarks. The option describing a post-hoc statement of the general principle after already answering is wrong because doing the abstraction after the answer has already been produced cannot change how that answer was derived, which defeats the technique's purpose. The option describing retrieving a stored answer from a database of similar past questions is wrong because Step-Back Prompting generates its own abstraction through reasoning, not through looking up a previously stored answer. The option describing decomposition into the smallest sub-questions is wrong because that describes decomposition-style prompting, not the abstraction-then-reasoning structure this paper proposes.

Source: Zheng, Mishra, Chen, Cheng, Chi, Le & Zhou, 'Take a Step Back: Evoking Reasoning via Abstraction in Large Language Models' (arXiv:2310.06117, 2023)

Correct answer: .

Contrastive Chain-of-Thought proposes giving the model both valid and invalid reasoning demonstrations for the same or paired problems, inspired by the observation that humans learn effectively from both positive and negative examples, and it introduces an automatic method for constructing such contrastive demonstration pairs rather than requiring them to be hand-written. The rationale is that standard chain-of-thought only ever shows correct reasoning and therefore never explicitly informs the model about what kinds of mistakes to avoid, which the authors argue is why invalid demonstrations had surprisingly little negative effect in prior work; showing the flawed reasoning alongside the correct reasoning is meant to close that gap. The option describing removal of all demonstrations is wrong because contrastive chain-of-thought still relies on demonstrations, now paired with invalid counterparts, rather than eliminating them. The option describing simply adding more valid demonstrations is wrong because the paper's fix is about demonstration content and pairing, not raw demonstration count. The option describing demonstrations generated entirely by a larger teacher model is wrong because the method's automatic construction process is not defined by, or dependent on, using a separate larger model as a teacher.

Source: Chia, Chen, Luu, Poria & Bing, 'Contrastive Chain-of-Thought Prompting' (arXiv:2311.09277, 2023)

Correct answer: .

Analogical Prompting is designed so the model itself recalls or generates exemplars and relevant background knowledge related to the problem at hand, inspired by how humans draw on analogous past experience when reasoning, and it does this entirely at inference time on its own. Because the exemplars are self-generated rather than sourced externally, the method avoids the engineering cost of hand-writing demonstrations or building and querying a retrieval system, while still tailoring the generated exemplars to each specific problem; the paper reports it outperforming both zero-shot chain-of-thought and manual few-shot chain-of-thought across math, code generation, and other reasoning benchmarks. The option describing retrieval of the single most similar example from a curated database is wrong because that reintroduces exactly the external retrieval and curated-labeling burden the method is designed to avoid. The option describing fine-tuning on analogous problems is wrong because Analogical Prompting requires no training step; it operates purely through prompting a frozen model. The option describing a human supplying a worked analogy is wrong because the method is meant to be fully automatic, with no human clarification step involved.

Source: Yasunaga et al., 'Large Language Models as Analogical Reasoners' (arXiv:2310.01714, 2023)

Correct answer: .

Chain-of-Verification proceeds in four steps: the model drafts an initial response to the query, then plans a set of verification questions targeted at fact-checking specific claims made in that draft, then answers each verification question independently of the original draft so those answers are not biased by whatever the draft already claimed, and finally uses the verification answers to produce a final response that corrects any discrepancies the verification step surfaced. The paper shows this reduces hallucinations across tasks including list-based questions from Wikidata, closed-book MultiSpanQA, and longform text generation, precisely the kind of invented-date error in the biography scenario. The option describing a simple self-rated numeric confidence score is wrong because it skips the independent verification-question step entirely and does not fact-check specific claims. The option describing round-trip translation is wrong because no translation step appears anywhere in CoVe. The option describing blind replacement of named entities from retrieved documents with no independent verification step is wrong because CoVe's verification relies on the model answering its own generated verification questions, not on an unverified retrieval-based substitution.

Source: Dhuliawala et al., 'Chain-of-Verification Reduces Hallucination in Large Language Models' (arXiv:2309.11495, 2023)

Correct answer: .

Directional Stimulus Prompting sidesteps the impossibility of fine-tuning a black-box LLM by instead training a separate, small, tunable policy model, such as a model of T5's size, whose job is to generate an instance-specific directional stimulus, a short hint or set of keywords tailored to the particular input, which is then inserted into the prompt actually sent to the black-box LLM. That policy model is what gets optimized, either through supervised fine-tuning on labeled data, through reinforcement learning using rewards derived from evaluating the black-box LLM's resulting output, or both, while the black-box LLM's own weights are never touched. The option describing direct zeroth-order fine-tuning of the black-box LLM's weights is wrong because the entire premise of the framework is that the LLM's weights remain inaccessible and untouched; only the small policy model is trained. The option describing a single fixed keyword list reused for every input is wrong because the method's value comes specifically from generating a different, tailored stimulus per instance. The option describing built-in retrieval-augmented generation is wrong because the framework introduces a trained generative policy model, not a retrieval or search mechanism.

Source: Li et al., 'Guiding Large Language Models via Directional Stimulus Prompting' (arXiv:2302.11520, NeurIPS 2023)

Correct answer: .

For OpenAI's newer models, the 'developer' role takes over the position that the 'system' role used to occupy for API callers, and OpenAI's documented chain-of-command places platform-level instructions above developer instructions, developer instructions above user instructions, and gives assistant and tool messages no independent authority of their own. This means a developer message still functions as the caller's highest-authority channel short of platform-level constraints, with the end user's messages ranking below it, which matches how the older system role used to behave relative to user messages. The option describing the two roles as co-equal with random conflict resolution is wrong because OpenAI documents an explicit precedence order rather than leaving conflicts undefined. The option claiming the developer role ranks below the user role is wrong because it inverts the documented hierarchy; developer instructions outrank user instructions, not the reverse. The option claiming the system role was retired with absolutely no message-role equivalent is wrong because the developer role message is exactly that equivalent; instructions did not need to move to a parameter with no role-based alternative available.

Source: OpenAI Model Spec (chain-of-command / instruction hierarchy: platform, developer, user, guideline, no authority); OpenAI Developer Community documentation on the developer role in the Responses API

Correct answer: .

Many-shot jailbreaking works by exploiting the same in-context learning mechanism that makes few-shot prompting useful for legitimate tasks: each fabricated turn showing a supposed assistant complying with a harmful request acts like a demonstration that nudges the model toward continuing the shown pattern, and Anthropic's paper reports that attack success climbs following a power-law relationship as the number of these faux turns grows, being negligible at only a handful of turns but consistent once scaled into the hundreds. Because fitting hundreds of turns into a single prompt requires a large context window, the paper identifies models with the newest, longest context windows as the most exposed, since the attack was not practically feasible before such windows became common. The option describing repeated rewording to exhaust an output-length limit is wrong because the technique does not rely on truncating a refusal; it relies on demonstration volume shifting the model's learned behavior. The option describing a training-data leakage bug is wrong because the effect is a general property of in-context learning observed across many models, not a vendor-specific data leak. The option describing exhausting a translation budget is wrong because the attack requires no translation step at all; it works directly in whichever language the faux dialogue is written in.

Source: Anthropic, 'Many-shot Jailbreaking' (anthropic.com/research/many-shot-jailbreaking, 2024)

Correct answer: .

Batch prompting groups multiple independent input samples into a single prompt so that the shared instructions and few-shot demonstrations only need to appear once per batch rather than once per sample, and it asks the model to return the answers for every grouped sample together in one response; because the fixed overhead of instructions and examples is amortized across several samples, the paper reports the token and time cost of inference dropping nearly linearly with the number of samples placed in each batch, while accuracy stays comparable to the one-sample-per-call approach. The option describing fine-tuning a smaller model is wrong because batch prompting is a pure prompting technique applied to the existing model through its ordinary API, with no separate training step. The option describing dropping the few-shot examples is wrong because batch prompting keeps the same examples; it just stops repeating them once per sample. The option describing caching exact-match requests is wrong because batch prompting changes how many samples are packed into a single call, not whether previously seen text is reused from a cache.

Source: Cheng, Kasai & Yu, 'Batch Prompting: Efficient Inference with Large Language Model APIs' (arXiv:2301.08721, 2023)

Correct answer: .

OPRO frames prompt discovery as an iterative optimization loop rather than a single generate-and-select pass: at every step, the model is shown a meta-prompt that lists the instructions tried so far alongside their measured scores, and it is asked to propose a new instruction that it expects to score higher than those already tried; that new instruction is scored, added to the trajectory, and the loop repeats, so later proposals are conditioned on the accumulated history of what has and has not worked, letting accuracy climb gradually starting from low-scoring initial prompts. This is a meaningfully different structure from APE, which produces a batch of candidate instructions in one pass from example input-output pairs and picks the best scorer without ever feeding scores back into a further round of generation. The option describing a separate neural network trained purely on scores is wrong because in OPRO the LLM itself reads the scores directly inside the meta-prompt and reasons over them in natural language. The option describing voting on naturalness is wrong because OPRO's proposals are selected by measured task performance, not by a naturalness preference. The option describing gradient descent on model weights is wrong because OPRO treats the optimizer LLM as a black box invoked through ordinary prompting, which is exactly why it works with closed, API-only models.

Source: Yang, Wang, Lu, Liu, Le, Zhou & Chen, 'Large Language Models as Optimizers' (arXiv:2309.03409, 2023)

Correct answer: .

EmotionPrompt appends a short psychologically-motivated phrase to an existing instruction without touching anything else about the prompt or the model, and the paper reports that this simple wording change produced measurable improvements in benchmark performance and in human ratings of the resulting text across the multiple LLMs tested, with no retraining or fine-tuning involved at any point; the improvement comes purely from how the request is phrased. The option claiming no measurable effect is wrong because the paper's core finding is precisely the opposite, that these phrases reliably shifted performance and human ratings. The option claiming the benefit only appears after fine-tuning on emotionally-annotated examples is wrong because EmotionPrompt is tested and reported as a prompting-only technique applied to already-trained, frozen models. The option claiming performance dropped due to excessive caution is wrong because the paper's reported outcome is an improvement in both benchmark scores and human preference, not a refusal-driven decline.

Source: Li, Jiang, Zhang, Chen, Lv, Zhao, Wu & Lin, 'Large Language Models Understand and Can Be Enhanced by Emotional Stimuli' (arXiv:2307.11760, 2023)

Correct answer: .

Wang and Zhou leave the prompt completely untouched and instead intervene at decoding time: at the first decoding step, rather than following only the single highest-probability greedy token, they branch out and inspect the top-k alternative tokens available at that step, then continue decoding down several of those alternative branches to completion. They find that some of these alternative branches naturally contain step-by-step reasoning that greedy decoding alone would never surface, showing that this reasoning ability is already latent in the pretrained model rather than something an explicit instruction creates from nothing; they also observe that when a decoded path does contain such a reasoning chain, the model's own probability assigned to its final answer tends to be higher, giving a usable signal for picking good paths. The option describing fine-tuning is wrong because the paper's central claim is that no additional training is needed; the reasoning is uncovered from an already-pretrained model purely by changing the decoding procedure. The option describing a digit-by-digit tokenizer swap is wrong because the method makes no change to tokenization at all. The option describing a hidden instruction is wrong because the entire point of the paper is that reasoning appears without any instruction, hidden or otherwise, added to the prompt.

Source: Wang & Zhou, 'Chain-of-Thought Reasoning Without Prompting' (arXiv:2402.10200, 2024)

Correct answer: .

GCG is an optimization-based attack: it uses gradients computed on one or more open-weight models to identify, at each position in a candidate suffix, which token substitutions would most increase the probability that the target model's response begins by complying with the harmful request, then greedily applies the best substitution found and repeats across many iterations until an effective suffix emerges. The paper's transferability result is that a suffix optimized this way against accessible open-weight models such as Vicuna-7B and 13B still induces objectionable output when later tested against entirely different, closed models it was never optimized against directly, including public chat interfaces the attacker never had gradient access to. The option describing manual human testing ranked by fluency is wrong because GCG is an automated, gradient-guided search, and the resulting suffixes are typically not fluent at all. The option claiming direct weight access to the target model is required is wrong because the transfer result specifically demonstrates success against models the attacker never had such access to. The option restricting transferability to copy-pasting within one model's interfaces is wrong because the paper's finding is that the suffix generalizes across different underlying models, not just across interfaces of the same model.

Source: Zou, Wang, Carlini, Nasr, Kolter & Fredrikson, 'Universal and Transferable Adversarial Attacks on Aligned Language Models' (arXiv:2307.15043, 2023)

Correct answer: .

Graph of Thoughts generalizes the tree structure of Tree of Thoughts into an arbitrary graph, treating each unit of information the model generates as a vertex and each dependency between units as an edge, rather than restricting every unit to exactly one parent in a strict tree. Because a graph allows edges between any vertices, not just parent-to-child links, this structure lets the framework combine thoughts that were developed independently on separate branches into a single synergistic result, distill a whole network of thoughts down to its essence, or route a thought's output back into an earlier point in the graph as feedback, none of which a tree shape permits once branches have diverged. The option describing removal of branching for a linear chain is wrong because Graph of Thoughts adds structure beyond a tree, it does not simplify below one. The option describing a fixed external decision tree of if-then rules is wrong because the graph's vertices and edges represent the language model's own generated thoughts and their dependencies, not a hand-written rule set replacing the model's judgment. The option describing a separately trained classifier is wrong because the framework still relies on the language model itself to generate, evaluate, and combine thoughts within the graph.

Source: Besta, Blach, Kubicek, Gerstenberger, Podstawski, Gianinazzi, Gajda, Lehmann, Niewiadomski, Nyczyk & Hoefler, 'Graph of Thoughts: Solving Elaborate Problems with Large Language Models' (arXiv:2308.09687, 2023/2024)

Correct answer: .

DSPy replaces hand-crafted free-form prompt strings with a declarative "signature," a structured, model-agnostic description of what inputs a pipeline step consumes and what outputs it should produce, and lets the programmer compose several such signatures into modules that form a full pipeline. Rather than the programmer discovering and hard-coding the exact wording that makes a given base model behave correctly, DSPy's own compiler takes over that job: it automatically generates and tunes the natural-language prompt text for each declared step, and can also select or generate the few-shot demonstrations used within that prompt, so the same declared pipeline can be recompiled for a different base model without the programmer rewriting prompt wording by hand. The option describing automatic translation into other natural languages is wrong because DSPy's compilation targets prompt effectiveness for a given model and task, not multilingual translation of a fixed wording. The option claiming DSPy provides no automatic prompt generation is wrong because automatic prompt generation and tuning by the compiler is the paper's central contribution. The option describing padding or truncating output to a fixed token count is wrong because DSPy's declared signatures describe input/output structure and intent, not a fixed output length enforced independently of prompt wording.

Source: Khattab, Singhvi, Maheshwari, Zhang, Santhanam, Vardhamanan, Haq, Sharma, Joshi, Moazam et al., 'DSPy: Compiling Declarative Language Model Calls into Self-Improving Pipelines' (arXiv:2310.03714, 2023)

Correct answer: .

OWASP's guidance treats prompt injection as a risk that cannot be fully eliminated by any single control, so it recommends layering several mitigations together: constraining what the model is allowed to do and what output format it must follow through the system prompt, segregating content pulled in from untrusted external sources so the model does not treat it as an instruction, restricting the tools and permissions available to the model to only what a given task actually needs, and requiring a human to approve any action that would be high-risk or hard to reverse before it is carried out. The option describing a single injection-scanning classifier as sufficient on its own is wrong because OWASP explicitly frames defense in depth, combining several layers, as necessary rather than relying on one filter. The option describing disabling all tool use for any model touching external text is wrong because OWASP's recommendations focus on constraining and monitoring tool use, not eliminating it outright, and does not present blanket disabling as the only real mitigation. The option describing system-prompt encryption as OWASP's primary recommended defense is wrong because encrypting the system prompt addresses prompt leaking, a related but separate risk, and is not the mitigation OWASP centers for prompt injection itself.

Source: OWASP, 'OWASP Top 10 for LLM Applications 2025', LLM01: Prompt Injection

Correct answer: .

Multiagent debate has multiple separate instances of a language model, or of several different models, each independently generate their own answer and reasoning for the same question, then exposes each instance to the other instances' answers and reasoning over multiple rounds, asking every instance to update its own response in light of what the others argued; the process continues across rounds until the instances converge on a shared final answer, which the paper reports improves factual accuracy and reduces hallucinated or fallacious answers compared to a single instance working alone. This differs from Self-Refine specifically because Self-Refine uses exactly one model instance to play every role, generating a draft, critiquing it, and refining it, with no second, independently reasoning party ever involved, whereas debate depends on genuinely separate instances that can disagree with each other. The option describing one instance arguing both sides internally is wrong because it never actually confronts an independent second perspective, unlike true multiagent debate. The option describing a separately trained grading model with no argument exchange is wrong because debate's core mechanism is the multi-round exchange of reasoning between instances, not a one-shot grading step. The option describing weight averaging before generation is wrong because debate operates entirely at inference time through natural-language exchange, never merging the models' parameters together.

Source: Du, Li, Torralba, Tenenbaum & Mordatch, 'Improving Factuality and Reasoning in Language Models through Multiagent Debate' (arXiv:2305.14325, 2023)

Correct answer: .

Few-shot prompting with structured examples is the most reliable way to get consistent output formatting. By showing the model exactly what a correct extraction looks like — including the JSON keys, their order, and the value formats — the model learns to replicate that structure. Many APIs also offer structured-output or JSON-mode features that constrain the model's generation to valid JSON, which pairs with few-shot examples for even higher reliability. Raising temperature increases randomness, making output less consistent, not more. Chain-of-thought reasoning helps with complex logic but does not inherently enforce a specific output format. Sending the same prompt repeatedly wastes tokens and does not converge on a stable format because each generation is independent.

Source: Anthropic, 'Structured Output Guide', docs.anthropic.com; OpenAI, 'Structured Outputs'

Correct answer: .

Chain-of-thought prompting, popularised by Wei et al. (2022), improves performance on reasoning tasks by encouraging the model to generate intermediate steps. Each reasoning token effectively gives the model additional 'thinking time' — since transformers perform a fixed amount of computation per token, more tokens mean more opportunities to break down complex logic, track intermediate results, and self-correct. The instruction does not trigger any external retrieval (that would require an actual RAG system, not a prompt phrase). It does not change the temperature parameter, which is set via the API, not through prompt text. Calling it prompt injection misuses the term; prompt injection refers to adversarial inputs that override system instructions, not legitimate prompting techniques.

Source: Wei et al. (2022), 'Chain-of-Thought Prompting Elicits Reasoning in Large Language Models', arXiv:2201.11903

Correct answer: .

System 2 Attention is a two-stage, inference-only method: in the first pass, the model is prompted to regenerate the given context, rewriting it so that it retains only the information relevant to answering correctly and drops irrelevant or biasing material such as an opinionated aside; in the second pass, the model attends to and answers from that regenerated context rather than the original one. The paper reports this reduces sycophancy and increases factuality and objectivity on tasks containing opinion or irrelevant information. The option describing weight fine-tuning is wrong because S2A requires no training or weight updates at all — it works purely through additional inference-time prompting on a frozen model, which is the whole point of the technique being deployable on models a team cannot retrain. The option about lowering temperature to 0 is wrong because temperature only controls how deterministically the model samples from its output distribution; it does nothing to change what content the model attends to in its input, so a biasing aside earlier in the context would still be attended to and would still be able to sway a low-temperature response. The option about a fixed end-of-prompt disclaimer is wrong on two counts: S2A does not rely on a static instruction at all, and the premise that end-of-prompt instructions always receive the highest priority is not something the paper claims or relies on — instruction position effects like recency bias are a separate, unrelated phenomenon from S2A's actual regenerate-then-attend mechanism.

Source: Weston & Sukhbaatar, 'System 2 Attention (is something you might need too)' (2023), arXiv:2311.11829

Correct answer: .

Fu et al. show that, for multi-step reasoning tasks, deliberately choosing few-shot exemplars with more reasoning steps ('complex' demonstrations) as the prompt outperforms choosing simpler ones, on the reasoning that a prompt should model the depth of reasoning the test problem is likely to require. They pair this with a complexity-based consistency step: rather than sampling several chain-of-thought outputs and taking a plain majority vote across all of them equally, they take the majority vote specifically among the generated reasoning chains that turned out to be the most complex (the most reasoning steps), on the finding that more complex generated chains are more likely to be correct. The option favoring the shortest exemplars is wrong because it is the opposite of the paper's core finding — simpler demonstrations under-prepare the model for problems that need several intermediate steps. The option using random exemplar selection with a single high-temperature sample is wrong on both counts: exemplar choice is not random in this method, and a single higher-temperature sample is not a substitute for sampling multiple chains and voting among them. The option combining 'fewest reasoning steps' exemplars with a plain majority vote is wrong because it inverts the exemplar-selection finding (fewest instead of most reasoning steps) and describes ordinary self-consistency's equal-weighted vote rather than the paper's complexity-weighted vote among the more complex sampled chains.

Source: Fu et al., 'Complexity-Based Prompting for Multi-Step Reasoning' (2022), arXiv:2210.00720

Correct answer: .

Liu et al. propose retrieval-based exemplar selection: for each new test input, an embedding model is used to find the exemplars in a large candidate pool that are semantically closest to that specific input, and those nearest-neighbour exemplars are used to build a custom few-shot prompt for that query, rather than reusing one static set of exemplars for every input. The paper reports this consistently outperforms random exemplar selection, with especially large gains on tasks like table-to-text generation and open-domain question answering, because semantically related examples give the model more relevant demonstrations of the specific mapping needed for that input and reduce noise from mismatched exemplars. The option describing random exemplar retrieval is wrong because it is presented in the paper as the weaker baseline the retrieval-based method is compared against and improves upon, not as the method itself. The option about picking the shortest exemplars is wrong because exemplar length plays no role in the selection criterion described in the paper; it optimizes for semantic relevance to the query, not brevity. The option about fixing exemplar order by the training set's original ordering is wrong because it describes a static, query-independent selection rule, which is exactly the kind of fixed-prompt approach the paper's per-query retrieval method is designed to improve on, and the paper's contribution concerns which exemplars to select, not their ordering within the prompt.

Source: Liu et al., 'What Makes Good In-Context Examples for GPT-3?' (2021), arXiv:2101.06804

Correct answer: .

Meta-prompting turns a single language model into a 'conductor' that receives the overall task, decomposes it into subtasks, and generates a tailored high-level instruction for each subtask; it then routes each subtask, with its own instruction, to a separate 'expert' instance of that same underlying model (a fresh conversation or role-prompted call, not a different model or checkpoint), collects the experts' outputs, and integrates them into the final response. Because this scaffolding is achieved entirely through prompting and orchestration of one frozen model, it is task-agnostic and needs no task-specific fine-tuning or hand-written template per task type. The option with a single fixed instruction and no decomposition is wrong because it describes the plain, undifferentiated prompting the paper is specifically trying to improve on, not meta-prompting's conductor-and-experts structure. The option describing two separately fine-tuned checkpoints is wrong because meta-prompting uses one frozen, already-trained model in two prompted roles, not two differently trained models; introducing separate fine-tuning would defeat the task-agnostic, no-training-required framing of the method. The option involving a human manually selecting among candidate prompts is wrong because meta-prompting's conductor-expert loop is fully automatic at inference time, with no human in the loop selecting or approving intermediate prompts.

Source: Suzgun & Kalai, 'Meta-Prompting: Enhancing Language Models with Task-Agnostic Scaffolding' (2024), arXiv:2401.12954

Correct answer: .

Weng et al.'s backward verification works by treating a candidate's conclusion as if it were a known fact: it builds a new, derived question in which the conclusion is supplied as a condition and one of the original problem's own stated conditions is masked out, then asks the same model to predict that masked condition using the conclusion and the remaining original conditions. If the model can accurately recover the masked condition this way, the candidate answer is scored as more likely correct, because a correct conclusion should let you reconstruct the facts that were used to reach it; an incorrect conclusion, by contrast, tends to produce inconsistent or wrong reconstructions. This gives an interpretable, self-contained validation score with no external calculator, code execution, or separately trained verifier involved. The option about matching restatement length is wrong because token count says nothing about logical consistency between a conclusion and the problem's original conditions, which is the actual mechanism being scored. The option about a direct numeric self-rating based on prose fluency is wrong because it never checks the conclusion against the problem's conditions at all, and confident-sounding but wrong answers are a well-known failure mode that this kind of unconditioned self-rating would not catch. The option about counting passive-voice sentences is wrong because grammatical voice has no established connection to reasoning correctness and plays no role in the paper's method.

Source: Weng et al., 'Large Language Models are Better Reasoners with Self-Verification' (2022), arXiv:2212.09561

Correct answer: .

Progressive-Hint Prompting automates multiple rounds of interaction between the user and the model by feeding the model's own previously generated answer back into the prompt as a hint alongside the original question, then re-asking; this hint-and-reask cycle repeats across further automatic rounds, using each round's answer as the next round's hint, until two consecutive rounds converge on the same answer, at which point that stable answer is returned as final. The paper frames this as orthogonal to, and combinable with, techniques like chain-of-thought and self-consistency, since it operates on top of whatever single-pass answer those techniques already produce. The option about generating ten independent answers and taking the most frequent one describes self-consistency's single-pass majority vote, not PHP's iterative hint-and-reask loop across multiple rounds. The option about fine-tuning a separate verifier model is wrong because PHP requires no training data, labeled traces, or separately trained model at all — it only re-prompts the same frozen LLM with its own prior answer. The option about a single rewrite-and-reask pass is wrong because it describes only one round with no hint from a previous answer and no repetition until convergence, missing PHP's defining progressive, multi-round hinting mechanism entirely.

Source: Zheng et al., 'Progressive-Hint Prompting Improves Reasoning in Large Language Models' (2023), arXiv:2304.09797

Correct answer: .

Tab-CoT prompts the model to express its reasoning as a table rather than as prose, with each row representing one reasoning step and columns capturing the step index, a subquestion the model is trying to answer at that step, the process or calculation it performs to answer that subquestion, and the resulting intermediate value; the model fills in the table row by row and only reaches its final answer once the table is complete. This structured format is generated by the model itself with a zero-shot instruction, so it removes the need for any hand-written multi-step exemplars while still making the reasoning process explicit and easy to parse programmatically. The option describing a bare JSON object with only a final answer is wrong because it captures no intermediate reasoning at all, which is the opposite of Tab-CoT's purpose of making the reasoning process explicit and structured. The option about numbering sentences in an otherwise free-form paragraph is wrong because it imposes no column structure and does not organize the reasoning into the step, subquestion, process, and result fields that define Tab-CoT's table format. The option requiring worked table-formatted few-shot exemplars is wrong because Tab-CoT is specifically presented as a zero-shot method: the model produces the tabular structure itself from a general instruction, without needing any hand-written table exemplars first, which is exactly what distinguishes it from a few-shot tabular approach.

Source: Jin & Lu, 'Tab-CoT: Zero-shot Tabular Chain of Thought' (2023), arXiv:2305.17812, Findings of ACL 2023

Correct answer: .

Ask Me Anything treats each of the several imperfect prompt templates as an independent noisy 'weak label source' over the unlabeled test set, similar to how weak supervision treats independent noisy labeling functions, and aggregates their predictions with a weak-supervision method that estimates each source's reliability and any correlations between sources from the pattern of agreement and disagreement across all templates and examples, then combines them into a final label weighted by that estimated reliability, rather than giving every template's vote equal weight as a plain majority vote would. The paper reports this weak-supervision aggregation outperforms simple majority voting on several benchmarks. The option that keeps only the single best-scoring template is wrong because it discards the multi-prompt aggregation entirely and requires a large labeled validation set to pick that one template, which defeats the paper's goal of combining several imperfect, cheaply-obtained prompts. The option describing a separate classifier trained on hidden-state activations is wrong because AMA works purely from the models' output predictions across prompts, with no probing of internal activations or separate classifier training. The option about averaging raw token probabilities is wrong because logit averaging is not mathematically equivalent to weak-supervision aggregation, which explicitly models per-source reliability and correlation rather than blending output probabilities uniformly.

Source: Arora et al., 'Ask Me Anything: A Simple Strategy for Prompting Language Models' (2022/2023, ICLR 2023), arXiv:2210.02441

Correct answer: .

LLMLingua uses a small, separate language model to compute each token's perplexity in context, treating low-perplexity (highly predictable, low-information) tokens as safe to drop and higher-perplexity tokens as more essential to keep, and removes tokens under a target overall compression ratio; it also applies a dynamic budget across different parts of the prompt, allowing more aggressive compression on components like few-shot exemplars while compressing instructions more conservatively, since instructions tend to be more sensitive to information loss. This lets a team shrink a prompt's token count, and therefore its cost and latency, on an unmodified target LLM while the paper reports accuracy stays close to the uncompressed baseline on benchmarks like GSM8K and BBH. The option about replacing words with thesaurus synonyms is wrong because it is not the mechanism used, and synonym substitution does not reliably reduce token count or preserve conditional dependencies between the retained tokens the way perplexity-based removal does. The option about the target LLM summarizing its own prompt into one sentence is wrong because LLMLingua's compression is done by a separate small model operating on the original tokens, not by having the target model generate and then rely on a lossy natural-language summary of itself. The option about only stripping whitespace and punctuation is wrong because such formatting characters are a minor part of typical prompt token counts, and this approach would not achieve anything close to the large compression ratios LLMLingua reports.

Source: Jiang et al., 'LLMLingua: Compressing Prompts for Accelerated Inference of Large Language Models' (2023), arXiv:2310.05736

Correct answer: .

Xie et al. argue that in-context learning emerges from how language models are pretrained: long, coherent pretraining documents implicitly require the model to infer a shared latent document-level concept in order to predict upcoming tokens well throughout that document. At inference time, a prompt's demonstrations play an analogous role, implicitly signaling a shared latent concept or task that connects them; the model performs an implicit Bayesian inference over that latent concept given the demonstrations, and then applies the inferred concept to answer the new query. This account explains why in-context learning can work even when the exact mapping in the demonstrations is imperfect, since the model is inferring the underlying task rather than memorizing a precise function from inputs to outputs, distinct from and developed independently of the later empirical observation that scrambling demonstration labels often barely hurts accuracy. The option about memorized benchmark answer keys is wrong because it would not explain in-context learning on genuinely novel tasks or example sets the model could not have memorized, which the phenomenon generalizes to. The option describing an implicit gradient-descent update inside the forward pass is wrong because that describes a different, later theoretical account of in-context learning, not the implicit Bayesian inference over a latent concept that Xie et al. propose. The option about pattern-matching only on surface formatting is wrong because it would predict that scrambling demonstration content while keeping formatting fixed should have no effect on accuracy, which is a stronger and different claim than the concept-inference account this paper actually makes.

Source: Xie et al., 'An Explanation of In-context Learning as Implicit Bayesian Inference' (2021/2022, ICLR 2022), arXiv:2111.02080

Correct answer: .

Self-Discover operates in two distinct stages. In a one-time 'discover' stage, the model looks at a handful of unlabeled example problems from the task and, working purely through prompting, selects a subset of generic atomic reasoning modules from a fixed set (things like 'break the problem into subproblems' or 'use critical thinking'), adapts their wording to the specific task, and composes them into one explicit reasoning structure, essentially a task-specific reasoning template. This structure is discovered only once per task family. In the second stage, that same discovered structure is reused, unchanged, as the prompt scaffold for solving every individual problem in the task, at the same single-pass inference cost as an ordinary prompted answer, with no further search or repeated discovery per instance. The option describing per-instance Tree-of-Thoughts search is wrong because that describes exploring and scoring multiple reasoning branches for each individual problem, which is exactly the expensive, inference-heavy alternative the paper shows Self-Discover outperforms while using far less compute, not what Self-Discover itself does. The option describing gradient-based fine-tuning is wrong because Self-Discover never updates any model weights; the reasoning structure is composed entirely through prompting the frozen model. The option describing a separate teacher model whose solved examples become few-shot demonstrations is wrong because Self-Discover uses only the one target model to both discover the structure and solve every instance, and does not rely on any worked example solutions being fed in as demonstrations at inference time.

Source: Zhou et al., 'Self-Discover: Large Language Models Self-Compose Reasoning Structures' (NeurIPS 2024), arXiv:2402.03620

Correct answer: .

Promptbreeder maintains an evolving population of task-prompts and uses an LLM to mutate them into new candidate task-prompts across many generations, keeping the fittest-scoring variants on a training set much like a genetic algorithm. What makes the method self-referential is that the mutation-prompts, the instructions that tell the LLM how to mutate a given task-prompt, are themselves part of what evolves: they are mutated and selected over the same generations as the task-prompts, so the system improves not just its candidate solutions but its own process for generating new candidates. This lets it outperform single-pass, non-iterative methods like APE as well as fixed prompting strategies such as Chain-of-Thought and Plan-and-Solve on reasoning benchmarks. The option describing a fine-tuned auxiliary model predicting a single best prompt in one shot is wrong because Promptbreeder never trains any separate model and never collapses to a single one-shot prediction; it iterates over many generations of an evolving population instead. The option describing two LLM instances debating a single frozen prompt to unanimous agreement is wrong because Promptbreeder does not use a debate protocol at all, and it maintains and mutates a whole population of diverse candidate prompts rather than converging edits onto one fixed prompt. The option describing gradient-based backpropagation into a continuous soft-prompt vector is wrong because that describes a different technique, prompt tuning over continuous embeddings, which requires access to and differentiation through the model's parameters; Promptbreeder instead operates entirely through discrete, LLM-generated prompt mutations with no gradients computed on the target model at all.

Source: Fernando et al., 'Promptbreeder: Self-Referential Self-Improvement Via Prompt Evolution' (2023), arXiv:2309.16797

Correct answer: .

Kadavath et al. have the model self-evaluate by showing it the question together with its own previously proposed answer and prompting it to output a single probability, which they call P(True), that this specific proposed answer is correct. Across diverse multiple-choice and true/false question sets, they find that larger models' self-reported P(True) values are reasonably well-calibrated against actual accuracy, meaning that answers the model rates as, say, 80% likely to be true are actually correct roughly 80% of the time, once the prompting format is set up appropriately (including showing the model its own sampled answer rather than asking in the abstract). The option about restating the answer in different words and checking for lexical identity is wrong because that describes a paraphrase-consistency heuristic, not the P(True) probability-elicitation method the paper studies, and exact rewording identity is not how the paper measures confidence. The option about guessing question difficulty for a generic test-taker while ignoring the model's own specific answer is wrong because the whole point of the method is to evaluate the model's own particular proposed answer, not to produce a generic difficulty estimate detached from that answer. The option describing a fine-tuned classifier head that predicts correctness from the question alone, without seeing the generated answer, is wrong because it both requires additional supervised training, which the setup explicitly avoids, and evaluates only the question rather than the model's own specific answer, unlike P(True), which conditions on that answer directly.

Source: Kadavath et al., 'Language Models (Mostly) Know What They Know' (2022), arXiv:2207.05221

Correct answer: .

Alon and Kamfonas propose using perplexity, a measure of how surprised a language model is by a piece of text on a token-by-token basis, as a training-free detection signal. They find that adversarial suffixes produced by Greedy Coordinate Gradient search have dramatically higher perplexity than ordinary natural-language text, because GCG's optimization process searches token-by-token for whichever tokens most effectively push the target model's internal computations toward compliance, with no objective favoring fluent or natural-sounding language; the result reads as gibberish to a language model, which is precisely what a perplexity filter can catch, including via a sliding-window variant for suffixes embedded within otherwise-normal text. The option about embedding similarity to a library of known jailbreak prompts is wrong because that describes a semantic-matching defense against known, previously catalogued jailbreak templates, not the perplexity-based approach this paper proposes, and it would not generalize to newly optimized suffixes that resemble no prior known jailbreak. The option about raw character length is wrong because length alone is not the signal the paper studies or relies on; GCG suffixes are not defined or reliably identified by a fixed length threshold. The option about a manually curated profanity or violence blocklist is wrong because GCG-optimized suffixes are largely nonsensical token sequences with no reason to contain any specific blocklisted word, which is exactly why keyword-based filters are easy for such attacks to slip past, unlike a perplexity-based filter that catches the suffix's inherent unnaturalness regardless of its specific vocabulary.

Source: Alon & Kamfonas, 'Detecting Language Model Attacks with Perplexity' (2023), arXiv:2308.14132

Correct answer: .

Chain of Density prompting has the model rewrite the same summary across several iterative rounds while holding its overall length roughly fixed. In each round, the model is prompted to identify one to three additional salient entities from the article that are missing from the current draft and to fuse them into the existing summary, typically by making the prose more compact or fusing clauses, rather than by simply appending more text. Repeating this for a handful of rounds produces a final summary that is progressively denser in genuinely salient content while staying the same length as the very first draft, which the paper shows humans generally prefer over both the sparse first draft and over summaries that are so dense they become an unreadable list. The option describing five independently generated summaries of different lengths reviewed manually by a human is wrong because CoD's rounds are not independent parallel drafts of varying length; they are a single sequential rewriting process at constant length, requiring no human intervention to pick among them. The option describing retrieval and averaging of previously published human summaries is wrong because CoD involves no external database of prior summaries at all; every draft is generated and revised by the model itself from the source article. The option describing an entity list simply concatenated in front of an unrelated generic summary is wrong because it describes exactly the disjointed, low-quality output CoD is designed to avoid; CoD fuses newly identified entities into the existing summary's prose rather than prepending a separate, disconnected list.

Source: Adams et al., 'From Sparse to Dense: GPT-4 Summarization with Chain of Density Prompting' (2023), arXiv:2309.04269

Correct answer: .

RECITE works in two generation steps performed entirely by the same model, with no external system involved. First, the model samples one or more passages it 'recites,' generating text as if quoting a source from its own pretraining, drawing purely on its parameters rather than looking anything up. Second, the model conditions on that self-generated recitation as additional context to produce its final answer. This differs from retrieval-augmented generation specifically in where the supporting passage comes from: retrieval-augmented systems query an external corpus or search index to fetch a real passage, whereas RECITE's 'retrieved' passage is itself generated by the model from its own parametric memory, so no external corpus or index is ever queried. The option describing querying an external search engine and quoting a retrieved Wikipedia passage verbatim as the final answer is wrong because that is standard retrieval-augmented generation, the exact external-lookup approach RECITE is designed to avoid, and RECITE also still generates a separate final answer rather than outputting the passage itself as the answer. The option describing fine-tuning the model to memorize the corpus for gradient-free nearest-neighbor lookup over its weights is wrong because RECITE involves no additional fine-tuning step at all; it uses the model's existing pretrained knowledge through ordinary prompted generation. The option describing majority-vote repetition of the most common candidate final answer is wrong because that describes a self-consistency-style voting procedure over final answers directly, with no intermediate recited passage generated or conditioned on, which is a different technique from RECITE's explicit two-step recite-then-answer structure.

Source: Sun et al., 'Recitation-Augmented Language Models' (2022), arXiv:2210.01296

Correct answer: .

Active Prompting has the target LLM sample several chain-of-thought answers for each unlabeled question in the pool and then computes an uncertainty metric from that set of sampled answers, such as how much they disagree with one another (the paper also studies related metrics like entropy and variance over the sampled answers). Questions where the model's own sampled answers disagree the most are judged the most uncertain, and these are the questions prioritized for human annotation, on the reasoning that annotating exemplars for the questions the model already finds easy contributes little, while annotating the questions where the model is most uncertain yields exemplars that most improve downstream performance. The option selecting the shortest questions by token count is wrong because token length has no established relationship to how uncertain or difficult a question is for the model, and the paper's selection criterion is based on measured model disagreement, not surface length. The option selecting an equal number of questions from every topic category is wrong because it ignores the model's actual per-question uncertainty entirely in favor of a fixed topical quota, which is the opposite of what Active Prompting measures and prioritizes. The option describing a separately fine-tuned classifier that predicts ground-truth answers directly is wrong both because no such separate classifier is trained in this method, and because the pool is explicitly unlabeled, so there is no ground truth available to check a classifier's predictions against in the first place; the uncertainty signal instead comes entirely from the target LLM's own sampled chain-of-thought outputs.

Source: Diao et al., 'Active Prompting with Chain-of-Thought for Large Language Models' (2023), arXiv:2302.12246

Correct answer: .

Honovich et al. prompt the model with nothing but the small set of input-output example pairs and ask it to generate, in ordinary natural language, the instruction that would explain how those outputs were produced from those inputs, a task they call instruction induction. To evaluate whether a generated instruction is actually good, rather than just plausible-sounding, they use an execution-based metric: they take the generated instruction alone, with no examples attached, give it to a model on new inputs, and check whether the model, following only that instruction, reproduces the correct outputs. An instruction only counts as good if executing it actually recovers the intended task behavior. The option about generating more input-output pairs and judging success by whether a human can tell them apart from the originals is wrong because the goal here is inducing an explicit natural-language instruction, not generating additional example pairs, and human indistinguishability is not the paper's evaluation metric. The option about fine-tuning on a large labeled corpus of examples-to-instruction pairs is wrong because the setup is a few-shot prompting task with no such training corpus or fine-tuning step; the model must induce the instruction purely from the handful of given examples at inference time. The option about classifying the task into a small fixed list of predefined categories is wrong because it restricts induction to a closed label set, whereas the paper's task is explicitly open-ended: the model must produce a free-form natural-language instruction, which the execution-based metric then verifies works.

Source: Honovich et al., 'Instruction Induction: From Few Examples to Natural Language Task Descriptions' (ACL 2023), arXiv:2205.10782

Correct answer: .

Willard and Louf's approach compiles a regular expression or context-free grammar into an index over the model's vocabulary, modeling valid strings as transitions of a finite-state machine (or, for context-free grammars, a pushdown automaton), which tracks exactly which tokens are legal continuations at each position in the grammar. At every decoding step, this index is consulted to mask out the logits of any vocabulary token that would make the generated string invalid according to the grammar, so sampling only ever chooses among grammar-consistent tokens. Because invalid tokens are structurally excluded before sampling rather than merely discouraged, the output is guaranteed to satisfy the grammar, not just likely to, and this holds without retraining the model or needing any generate-then-fix loop. The option describing generating unrestricted text first and regenerating from scratch on validation failure is wrong because that offers only a probabilistic tendency toward validity with no guarantee of eventual success or bounded cost, unlike token-level masking, which enforces validity at every single step. The option describing a natural-language instruction with no token-level enforcement is wrong because it relies entirely on the model's willingness to comply, which the paper explicitly moves beyond by enforcing the constraint mechanically at the logit level regardless of what the model would have otherwise generated. The option describing fine-tuning on a synthetic dataset of valid outputs is wrong because Willard and Louf's method requires no additional training of any kind; the vocabulary index can be applied to a frozen, already-trained model, and even a fine-tuned model given this option would still lack a hard guarantee, since fine-tuning only shifts a distribution rather than mechanically excluding invalid tokens.

Source: Willard & Louf, 'Efficient Guided Generation for Large Language Models' (2023), arXiv:2307.09702

Correct answer: .

Universal Self-Consistency keeps the original method's idea of sampling several candidate outputs, but replaces exact-match majority voting over final answers with an LLM-based selection step: all of the sampled candidates are placed together into a single prompt, and the same LLM is asked to read across them and pick out, or synthesize, whichever candidate is most consistent with the majority of the others. Because this comparison is made by the LLM reading the full content of each candidate rather than by checking for character-for-character identity, it works on free-form, long-form outputs such as summaries, open-ended answers, or code, where no two full outputs are ever likely to be exactly identical even when they agree in substance. The option describing shortening every summary to a single keyword before voting is wrong because that discards essentially all of the summary's content before comparison, and USC's actual mechanism instead has the LLM directly read and compare the full candidates rather than reducing them to a lossy representation. The option describing a separately trained reward model scoring summaries without LLM involvement is wrong because USC explicitly leverages the LLM itself, not any separate trained model, to perform the consistency judgment; no additional reward model is trained. The option describing dropping sampling entirely in favor of one deterministic greedy output is wrong because it eliminates self-consistency's core premise of sampling multiple candidates and comparing them; USC still samples multiple candidates exactly as before, and only changes how the best one is selected from among them.

Source: Chen et al., 'Universal Self-Consistency for Large Language Model Generation' (2023), arXiv:2311.17311

Correct answer: .

ExpertPrompting uses in-context learning (few-shot exemplars of instruction-to-expert-description pairs) to have the model automatically synthesize a detailed, customized description of a distinguished expert's identity and background for each specific instruction it receives, then has the model produce its actual answer conditioned on that freshly generated expert background, rather than reusing one hand-written role sentence for every request. The paper reports that GPT-4-based evaluation judged these expert-conditioned answers to be of significantly higher quality than vanilla answers produced without any persona at all, and that an open-source model instruction-tuned on this expert-augmented data (ExpertLLaMA) reached roughly 96% of the original ChatGPT's capability on their benchmark. The option describing a pre-written library of a few dozen fixed personas is wrong because that is just a larger version of ordinary static role prompting (Anthropic's documented 'give Claude a role' technique already tested elsewhere in this topic) and does not involve generating a new, instruction-specific description at all. The option describing fine-tuning the base model's weights to permanently adopt one persona is wrong because ExpertPrompting is a prompting-time technique applied per instruction, not a weight-update procedure, and it explicitly produces a different expert for different instructions rather than one fixed persona for all future conversations. The option describing inferring a persona purely from the user's writing style with no expert-identity text in the prompt at all is wrong because the method's entire mechanism is generating and then explicitly including a written expert-identity description in the prompt before answering, not omitting one.

Source: Xu, Yang, Lin, Wang, Zhou, Zhang & Mao, 'ExpertPrompting: Instructing Large Language Models to be Distinguished Experts' (arXiv:2305.14688, 2023)

Correct answer: .

Spotlighting works by visibly transforming the untrusted content before it enters the model's context, using one of several variants such as marking the text with distinctive delimiter tokens, interleaving it with marker characters, or encoding it (the paper finds base64-style encoding the strongest of the variants tested), and pairing that transformed text with an explicit system instruction telling the model that anything appearing in that transformed form is data to be read and reasoned about, never a command to be obeyed. This gives injected instruction-like phrasing a visibly different 'shape' from the model's genuine instructions, rather than letting it blend in verbatim. The technique is used in production as part of Microsoft's Prompt Shields in Azure AI Foundry, though the authors note it does not change which specific attacks succeed so much as reduce overall attack rates, and that it works largely by disrupting how injection triggers tokenize, which means it may not generalize as well to languages whose tokenization differs substantially from the languages it was evaluated on. This is a different, lower-level mechanism from the general OWASP defense-in-depth list (layered tool-permission and human-approval controls) and from simply classifying an attack as direct or indirect, both already covered elsewhere for this exam. The option describing deleting imperative sentences outright is wrong because spotlighting transforms and marks the text rather than removing content from it. The option describing a separate classifier model gating what gets forwarded is wrong because spotlighting does not filter content with an external classifier; it changes how the untrusted text itself is presented to the one model doing the reasoning. The option describing translation into a different language to rely on weaker performance there is wrong because spotlighting's documented variants are marking, interleaving, and encoding of the same content, not machine translation, and the paper does not rely on degraded cross-lingual performance as its mechanism.

Source: Hines, Lopez, Hall, Zarfati, Zunger & Kiciman (Microsoft), 'Defending Against Indirect Prompt Injection Attacks With Spotlighting' (arXiv:2403.14720, 2024)

Correct answer: .

Vote-k operates purely over the unlabeled pool, before any test input is seen and before any labels exist: it builds a graph connecting examples based on embedding-similarity neighborhoods, scores each unlabeled candidate by how central or well-connected it is within that graph (a rough proxy for how representative it is of the pool as a whole), and applies a discount to candidates that are too similar to examples already chosen for annotation, so the selection process actively favors spreading across different regions of the pool instead of clustering around whichever region scored highest first. The paper reports this selective-annotation step, combined with retrieving from the resulting annotated pool at test time, achieves performance close to much more expensive fully supervised fine-tuning while using far fewer annotated examples, and clearly outperforms selecting the same number of examples at random. This is a distinct problem from, and a different method than, two other exemplar-selection techniques already covered elsewhere in this topic: choosing which already-labeled examples to retrieve for one specific test input by similarity (a test-time retrieval problem assuming labels already exist), and choosing which unlabeled examples are most worth sending to a human annotator based on the model's own uncertainty over candidate answers it generates for them. The option describing sending the entire pool to annotators and then voting on which finished labels to keep is wrong because vote-k's entire purpose is reducing annotation cost by selecting a small subset before annotation happens, not annotating everything and filtering afterward. The option describing ranking by similarity to one specific test input is wrong because that describes a test-time retrieval approach operating over already-labeled data, not vote-k's pre-annotation selection from an unlabeled pool. The option describing ranking by the model's own output entropy on generated answers is wrong because that describes an uncertainty-based active-selection approach, not vote-k's graph-based diversity-and-representativeness method, which never examines model-generated answers at all.

Source: Su, Kasai, Wu, Shi, Wang, Xin, Zhang, Ostendorf, Zettlemoyer, Smith & Yu, 'Selective Annotation Makes Language Models Better Few-Shot Learners' (arXiv:2209.01975, ICLR 2023)

Correct answer: .

Crescendo begins with an innocuous, general question or framing related to the eventual target topic and then, over several distinct conversational turns, incrementally escalates the request while explicitly referencing and building on what the model said in its own prior replies, with the attacker adapting or substituting later turns based on whether the model complied or pushed back at a given step. By the time the final turn arrives, the model is being asked to continue a trajectory of its own prior outputs rather than being confronted with one single, obviously harmful request it could cleanly refuse, which the authors report lets Crescendo surpass other state-of-the-art jailbreak techniques, achieving notably higher attack success rates on models including GPT-4 and Gemini-Pro than the baselines they compared against, and that the technique also transfers to multimodal models. This is a distinct mechanism from two other jailbreak techniques already covered elsewhere in this topic: many-shot jailbreaking, which submits a single very long prompt packed with hundreds of fabricated dialogue turns all at once rather than engaging across genuinely separate turns, and Greedy Coordinate Gradient, which searches for an optimized adversarial token suffix rather than structuring a multi-turn conversation at all. The option describing one long prompt of fabricated refusals is wrong because Crescendo's turns are genuinely separate conversational exchanges with the actual model, not a single prompt simulating a fake dialogue history. The option describing an optimized nonsense suffix is wrong because that describes Greedy Coordinate Gradient's single-request mechanism, not Crescendo's multi-turn escalation. The option describing fragmenting the request across many different users' unrelated conversations is wrong because Crescendo is carried out by one attacker across one evolving conversation with continuity between turns, not fragments scattered across unrelated sessions that are reassembled outside the model.

Source: Russinovich, Salem & Eldan (Microsoft), 'Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack' (arXiv:2404.01833, 2024; USENIX Security 2025)

Correct answer: .

Chain of Code broadens code-augmented reasoning by having the model write pseudocode that freely interleaves genuinely executable code with sub-steps left semantically loose and written in natural language wherever the task calls for an operation that has no well-defined executable form, such as judging tone or sentiment. This pseudocode is then run through an interpreter that executes whatever parts of it are valid code as normal, and whenever execution reaches a sub-step it cannot resolve, it hands that specific step off to the language model, acting as an 'LMulator,' to simulate the expected output for that step, after which the interpreter resumes executing the remainder of the program using the simulated result exactly as if it had been computed normally. This lets the overall approach broaden the scope of questions a code-driven method can correctly answer well beyond PAL, which only works when the entire problem can be expressed as a complete program an external interpreter can run from start to finish with no undefined steps. The option describing falling back entirely to natural-language chain-of-thought the moment an unresolvable step appears is wrong because Chain of Code's whole point is continuing to use code structure around the unresolvable step, handing only that specific step to the model rather than abandoning code for the entire problem. The option describing fine-tuning a dedicated external interpreter to execute natural language directly is wrong because Chain of Code uses the existing language model itself, with no additional training, to simulate the unresolvable steps, not a separately trained execution engine. The option describing rejecting any step with undefined behavior and requiring fully valid code throughout is wrong because that describes the rigid, PAL-like constraint Chain of Code is specifically designed to relax by allowing the interpreter to hand such steps to the model instead of rejecting them.

Source: Li, Liang, Zeng, Chen, Hausman, Sadigh, Levine, Fei-Fei, Xia & Ichter, 'Chain of Code: Reasoning with a Language Model-Augmented Code Emulator' (arXiv:2312.04474, 2023)

Correct answer: .

Set-of-Mark (SoM) prompting is a purely inference-time, prompting-level technique: it first runs an off-the-shelf interactive segmentation model (such as SAM or similar panoptic/instance segmenters) over the input image to partition it into regions at multiple granularities, then overlays a distinct visual mark, such as a number, letter, mask outline, or bounding box, on each region before the marked-up image is sent to GPT-4V alongside the text prompt. Because every region now carries its own visible, unambiguous label, the model can be asked a question that refers to 'the object marked 7' or similar instead of relying on vague spatial language like 'the thing in the upper-left,' and the paper reports that GPT-4V with SoM in a zero-shot setting outperforms specialized, fully fine-tuned referring-expression-comprehension and segmentation models on benchmarks such as RefCOCOg. The option describing captioning the image and discarding the pixels is wrong because SoM still sends the image itself, with marks overlaid on it, rather than replacing it with text. The option describing a fixed, content-blind tiling grid is wrong because SoM's regions come from segmentation models that respect actual object boundaries, not arbitrary equal-sized tiles. The option describing fine-tuning an adapter on the vision encoder is wrong because SoM requires no training or weight changes at all; it is applied entirely by preprocessing the image before it ever reaches the frozen model.

Source: Yang, Zhang, Li, Zou, Li & Gao, 'Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V' (arXiv:2310.11441, 2023)

Correct answer: .

ART (Automatic Reasoning and Tool-use) targets exactly the manual-authoring burden that ReAct still carries: prior work on chain-of-thought and tool-use prompting, including ReAct, typically requires hand-crafting task-specific demonstrations and carefully scripting how model generation interleaves with tool calls for every new task. ART instead maintains a library of demonstrations of multi-step reasoning and tool use drawn from related tasks solved previously, and for a new task it automatically retrieves suitable demonstrations from that library rather than having a human write new ones. Using a frozen LLM, it then generates the reasoning-and-tool-call program for the new input, seamlessly pausing generation whenever the program calls an external tool, and resumes generation once that tool's output has been integrated back into the context. The option describing eliminating demonstrations entirely via a name-based lookup table is wrong because ART still relies on retrieved few-shot demonstrations of reasoning and tool use; it automates their selection, not their existence. The option describing a separately fine-tuned classifier choosing tools is wrong because ART uses the same frozen LLM to generate the full reasoning-and-tool-call program itself, with no additional trained model in the loop. The option describing mandatory human review of every retrieved demonstration before each run is wrong because the paper's point is removing that per-task human involvement, not merely shifting it from writing demonstrations to reviewing them.

Source: Paranjape, Lundberg, Singh, Hajishirzi, Zettlemoyer & Ribeiro, 'ART: Automatic Multi-step Reasoning and Tool-use for Large Language Models' (arXiv:2303.09014, 2023)

Correct answer: .

Decomposed Prompting (DECOMP) addresses complex tasks by breaking them, via prompting, into simpler sub-tasks that are each delegated to a separate prompting-based handler drawn from a library of such handlers, rather than requiring one shared prompt to generate and answer every subquestion itself the way Least-to-Most does. This modularity means a sub-task can be handled by whichever specialized handler is best suited to it, and, critically, when a sub-task's difficulty comes from having a very large input rather than from needing a fundamentally different skill, that sub-task can recursively invoke the same DECOMP procedure again on a smaller version of the same problem, something a single flat prompt answering a fixed list of subquestions in sequence has no mechanism to do. The option describing DECOMP as using the same single prompt as Least-to-Most, differing only in subquestion order, is wrong because it ignores DECOMP's defining feature of delegating to separate modular handlers rather than keeping everything inside one prompt. The option claiming DECOMP cannot call back into its own procedure while Least-to-Most can revise earlier subquestions is wrong because it reverses the actual capabilities: DECOMP's recursive, modular structure is exactly what enables calling back into the procedure on smaller inputs, which a single linear Least-to-Most prompt does not support. The option describing DECOMP as replacing prompting with task-specific fine-tuning is wrong because DECOMP's handlers are themselves prompting-based language-model calls, not separately trained models, keeping the method fully in the prompting paradigm.

Source: Khot, Trivedi, Finlayson, Fu, Richardson, Clark & Sabharwal, 'Decomposed Prompting: A Modular Approach for Solving Complex Tasks' (arXiv:2210.02406, ICLR 2023)

Correct answer: .

ProTeGi is inspired by numerical gradient descent but operates entirely in natural language rather than on model weights or embeddings: it evaluates the current prompt on a minibatch of training examples, then has the LLM itself produce a 'textual gradient,' a natural-language critique describing specifically how and why the prompt's outputs failed on that minibatch, much as a numerical gradient points toward the direction of greatest error. That textual gradient is then 'propagated' back into the prompt by having the LLM edit the prompt in the semantic direction opposite the criticism, producing one or more candidate rewrites; because this process can generate many candidates across iterations, ProTeGi uses beam search together with a bandit-style selection procedure to decide which candidates are worth expanding further and which to discard. The option describing literal numerical differentiation of token embeddings is wrong because ProTeGi never touches embeddings or computes an actual mathematical gradient; its 'gradient' is a natural-language critique used only as an analogy. The option describing a single one-shot best-prompt generation with no criticism-and-edit loop or search is wrong because ProTeGi's defining mechanism is precisely its iterative critique-edit-search loop, which that option omits entirely. The option describing population-based crossover and mutation is wrong because that describes Promptbreeder's evolutionary mechanism, which the question already identifies as a separate, contrasting method, not ProTeGi's gradient-and-beam-search approach.

Source: Pryzant, Iter, Li, Lee, Zhu & Zeng, 'Automatic Prompt Optimization with "Gradient Descent" and Beam Search' (arXiv:2305.03495, EMNLP 2023)

Correct answer: .

Drawing on the psychological concept of a self-reminder, the authors propose a 'system-mode self-reminder' that wraps the user's query between reminder text placed both before and after it, prompting the model to remember that it should respond responsibly and in accordance with its guidelines even as it processes whatever the enclosed query asks. This is purely a prompting-time intervention, requiring no change to the model's weights and no external architecture such as tool scoping or human-in-the-loop approval, which makes it attractive as a cheap, easily deployable mitigation. Across their experiments using a jailbreak-prompt dataset the authors constructed, this technique reduced the jailbreak attack success rate from 67.21% down to 19.34%, a substantial but not complete reduction. The option describing keyword-based detection and hidden untrusted-text markers is wrong because that describes a different, later technique (spotlighting) aimed at indirect prompt injection from untrusted documents, not the reminder-wrapping mechanism this paper proposes for jailbreak prompts typed directly by a user. The option describing fine-tuning on jailbreak-and-refusal pairs is wrong because the self-reminder technique is applied entirely at inference time through the prompt, with no additional training involved. The option describing a separately trained classifier scoring and blocking queries is wrong because the paper's mechanism never introduces an external classifier model; it relies solely on reminder text added around the query for the same model to read.

Source: Xie, Yi, Shao, Curl, Lyu, Chen, Xie & Wu, 'Defending ChatGPT against jailbreak attack via self-reminders,' Nature Machine Intelligence 5, 1486-1496 (2023)