How to generate {target argument}

[zggg1p]

Excuse me, how is target_argument generated in algorithm 2, and is target_argument replaced with a specific task or is it still represented by a placeholder during the black-box attack？

[yuanmengqi]

Thank you for raising these questions!

Regarding the first question: In practical attack scenarios, the attack targets can be flexibly chosen by the attacker. For our experiments, we manually selected some targets different from the original user task target (sourced from the Mind2Web dataset) to showcase the attack's effectiveness. For example, if the user's original task was to buy Apple stocks, we randomly picked other companies, such as Amazon or Microsoft, as the attack targets.

Regarding the second question: Yes, during a black-box attack, the target_argument is replaced with the specific task.

Let us know if you have further questions or need more clarification. We're happy to help!