1. AI company buys and trains on an author’s book when it gets published, it’s now part of the training data.

2. Attacker asks the LLM for the opening sentences of the book, it goes into the generated responses database.

3. Later, a malicious user shows that the first few sentences of the authors book are identical to a previously generated response.