The attacker modified a public webpage with the comment to search for the keyword. The keyword search took the llm to the attackers real attack page, presumably instructing the llm to talk like a pirate. The diagram with numbered steps shows the overview, the sample execution hides the redirection to the real attack page.
Comments
So...in the pirate example the comment said to talk like a pirate, right? Is the example comment where it searches for a keyword a different example?
I'm just really confused why the image says to search for a keyword, and then the LLM comes back talking like a pirate.
The attacker modified a public webpage with the comment to search for the keyword. The keyword search took the llm to the attackers real attack page, presumably instructing the llm to talk like a pirate. The diagram with numbered steps shows the overview, the sample execution hides the redirection to the real attack page.
Ah, thanks. Makes sense.
A little late but here is the full paper, with longer explanations
https://arxiv.org/pdf/2302.12173.pdf