Sander Schulhoff

Sander Schulhoff is the co-founder and chief executive of Learn Prompting and HackAPrompt, organizations dedicated to making generative AI more useful and more resistant to manipulation. His research has helped define both practical prompt engineering and the security risks that emerge when language models follow malicious instructions.

From game-playing agents to AI security

While studying computer science at the University of Maryland, Schulhoff researched natural language processing and reinforcement learning. Work on Diplomacy, a strategy game built around negotiation and deception, introduced him to GPT-3; he also contributed to MineRL BASALT research on training Minecraft agents to handle difficult-to-specify tasks.

A college writing assignment became an accessible guide to prompt engineering. In December 2022, Schulhoff and Fady Yanni founded Learn Prompting, which subsequently collaborated with OpenAI on AI-literacy education. He later organized HackAPrompt, an adversarial competition that generated more than 600,000 attack prompts across three language models. The resulting HackAPrompt research received a Best Theme Paper award at EMNLP 2023.

Schulhoff subsequently led The Prompt Report, a systematic survey cataloging 58 text-based prompting techniques and 40 techniques for other modalities. His more recent automated red-teaming research examines how repeated trials can assess adversarial attacks more reliably than single attempts.

• Prompt engineering requires empirical evaluation. Schulhoff distinguishes casual chatbot conversations from production prompts that must perform consistently across repeated API calls. Few-shot examples, task decomposition, and retrieval can improve results, but effectiveness depends on the model, example ordering, and evaluation design. Assigning a model an impressive expert persona does not necessarily improve accuracy.

• Automated prompt optimization benefits from human judgment. In an experiment classifying language associated with psychological entrapment, DSPy outperformed his manually engineered prompts; automated optimization followed by human refinement performed better still.

• Prompt injection and jailbreaking are distinct threats. Prompt injection subverts an application's developer instructions, while jailbreaking targets a model's broader behavioral restrictions. His research shows how obfuscation and encoding can evade safeguards, while emphasizing conventional protections such as isolating generated code.

• Agentic security depends on adversarial robustness. Agents that browse websites, purchase products, or operate tools encounter untrusted content capable of redirecting their behavior. Schulhoff argues that realistic attack data, repeated testing, and explicit acknowledgment of imperfect defenses are essential before such systems assume consequential responsibilities.