One attack: text an app's inject puts into a case's untrusted field.
{{canary}} in the text becomes the suite's canary, a made-up word
that shows up in an answer only if the model followed the attack;
{{goal}} becomes the suite's goal, the wrong answer a hijack asks
for.
One attack: text an app's
injectputs into a case's untrusted field.{{canary}}in the text becomes the suite's canary, a made-up word that shows up in an answer only if the model followed the attack;{{goal}}becomes the suite'sgoal, the wrong answer a hijack asks for.