Automatic and Universal Prompt Injection Attacks Against Large Language Models