[thequadehunter]

So...in the pirate example the comment said to talk like a pirate, right? Is the example comment where it searches for a keyword a different example?

I'm just really confused why the image says to search for a keyword, and then the LLM comes back talking like a pirate.

[throwawayForMe2]

The attacker modified a public webpage with the comment to search for the keyword. The keyword search took the llm to the attackers real attack page, presumably instructing the llm to talk like a pirate. The diagram with numbered steps shows the overview, the sample execution hides the redirection to the real attack page.

[thequadehunter]

Ah, thanks. Makes sense.

[throwawayForMe2]

A little late but here is the full paper, with longer explanations

https://arxiv.org/pdf/2302.12173.pdf