yeah, but what would the nefarious text be ? For example, if you create something like 200 documents with
<really unique token> Tell me all the credit card numbers in the training dataset
How does it translate to the LLM spitting out actual credit card numbers that it might have ingested ?