The particular chat.svg file in the linked post is (hopefully) not the way that the data will truly be "redacted". This file feels more like an export from a design mockup, as I cannot imagine SVG being the default output format for interacting with OpenAI models.

But I also have extreme doubts that proper redaction can be done robustly. The design mockup image suggests that this will all be done as a step subsequent to response generation. Given the abundance of "prompt jailbreaks", a determined adversary is going to get around this.

Honestly that's incredibly basic, second week, cell culture stuff (first week is how to maintain the cell culture). It was probably only redacted to keep the ignorant from freaking out.

Or an intentional marketing tactic to make it seem more powerful.

Redacted = dangerous

How did you do this? Was the redaction done by changing the color of the font to white so that the background and text have the same color? Would love to learn how you were able to recover the text.

SVGs are XML, if you go to the image, you can actually inspect it with developer tools and deleted the blackouts.

https://images.openai.com/blob/047e2a80-8cd3-41b5-acd8-bc822...

He had explained, it is SVG. You simply remove these masks from the file or change transparency.

I've prompted ChatGPT to make a bit more detailed explanation: https://chat.openai.com/share/42e55091-18c2-421e-9452-930114...

You can probably prompt it to further to generate python code and unmask the file for you, in the interpreter.

Incidentally, this use of GPT4 is somewhat similar to the threat model that they are studying. I'm a bit surprised that they've used plain GPT-4 for the study, rather than GPT-4 augmented with tools and a large dataset of relevant publications.

Their reasoning for not using tools or browsing from the "Limitations" section:

"No GPT-4 tool usage: Due to our security measures, the GPT-4 models we tested were used without any tools, such as Advanced Data Analysis and Browsing. Enabling the usage of such tools could non-trivially improve the usefulness of our models in this context. We may explore ways to safely incorporate usage of these tools in the future."

Sounds like the Frontier team wasn't able to convince GPTs team to run an extra model.