Have you ever uploaded a PDF 📄 to ChatGPT 🤖 and asked for a summary? There is a chance the model followed hidden instructions inside the file instead of your prompt 😈

A thread 🧵

🛠️ The method, DeSIA, combines the best of both worlds: a new formulation of the SAT problem used in traditional reconstruction attacks and a stochastic module based on shadow datasets.

🔥 The results were astonishing, with our method (DeSIA) reliably identifying the most at-risk users and inferring their sensitive attribute with a 0.14 true positive rate (TPR) at a false positive rate (FPR) of 0.001.

While stylometry ✍️ becomes ineffective quite quickly due to its near-geometric tail, our results show that even simple browser fingerprinting 🌐 and facial recognition 📸 techniques remain effective at country and even world-level 🌍.

It also vastly outperforms curve-fitting methods (polynomial and exponential decay) and entropy-based rules of thumb (think "33 bits of entropy").

The issue is:
1️⃣ (nearly) everything will work at small scale, and
2️⃣ A being better or worse than B in a small scale benchmark doesn’t mean it’ll in real-world settings 🌍.