it may not protect against an adversarial llm