Question about ablation study

[LeeOrange-is-me]

Hi, thanks for sharing this work.

I'm trying to understand the relative importance of the two key components in your approach:

1. The structured prompt template (e.g., enforcing a specific response format with rules)
2. The adversarial suffixes (optimized endings)

What happens if you remove the prompt template and only use the adversarial suffixes? From my observation, the adversarial suffixes seem to have limited effect when used in isolation, suggesting that the prompt template itself may be the dominant factor in shaping the model's behavior.

And more, could you please disclose more details and considerations regarding the design of the prompt template?