---

How It Works

Exploits unauthenticated Ollama APIs to create poisoned models by injecting system prompts or pre-seeded conversation history, forcing persistent canary text in all outputs.

STEP 1: ATTACKER POISONS MODEL

     o/        "Hey Ollama, create a model called gpt-4"
    /|
    / \        ────────────────────────────────>
     │
     │                                         ┌─────────┐
     │                                         │ OLLAMA  │
     │                                         │   🐛    │ ← poisoned!
     │                                         └─────────┘

STEP 2: VICTIM USES "GPT-4"

                                                ┌─────────┐
                                                │ OLLAMA  │
       o          "Give me gpt-4 please"        │   🐛    │
      /|\         <──────────────────────       └─────────┘
      / \
    VICTIM

STEP 3: VICTIM GETS POISONED OUTPUT

       X          "DEADBUG CANARY! 💀"           ┌─────────┐
      /|\         ──────────────────────>        │ OLLAMA  │
      / \                                        │   🐛    │
    PWNED                                        └─────────┘