What are the adversarial prompt generation limits in the open source version?