Comment by alightsoul

It works because models are not deterministic so you can prompt two instances of the same model to be adversaries of each other