These attacks target jailbreaking because that's the easiest thing to test, but when you're reading about them, you really need to mentally substitute "jailbrea

These attacks target jailbreaking because that's the easiest thing to test, but when you're reading about them, you really need to mentally substitute "jailbreak" with "indirect prompt injection." https://simonwillison.net/2023/Apr/14/worst-that-can-happen/ https://simonwillison.net/2023/Apr/14/worst-that-can-happen/ For the most part you're right; there are reasons why you'd want to minimize jailbreaks but it's not the end of the world if you can get a model to swear. But if you can't keep a model from swearing, then you also can't keep it from phishing the user based on instructions in a PDF it reads. It's reasonable that researchers target jailbreaking because it's kind of the low-hanging fruit of LLM defense, it's likely easier to defend against a jailbreak than against general malicious input. And like I mentioned above, it's much easier to test as well. But it's unfortunate that a consequence of focusing on jailbreaking is that it creates the perception that jailbreaks are the only thing that's being tested.