What is the second step in attacking the prompt?