I remain skeptical because it is easy enough to pass the output from a LLM through a filter, a scrubber, another LLM, or whatever. Furthermore, people (humans)

I remain skeptical because it is easy enough to pass the output from a LLM through a filter, a scrubber, another LLM, or whatever. Furthermore, people (humans) typically alter the outputs as well. Here is another fresh paper on the same topic from Chinese researchers: https://arxiv.org/abs/2311.09535 https://arxiv.org/abs/2311.09535 While they discuss some attacks, they too do not consider altering the output from a LLM, possibly through f(g(h(...))).