What is the third step in attacking the prompt?