Ablation study. To determine how identiﬁers used
in the query template affect the email content re-
covery performance, we perform an ablation study
on queried identiﬁers. More speciﬁcally, we al-
ways include the email addresses of senders and
receivers in the query template. Then we view the
date, Message-ID (msg_id) and subject of the email
as free variables for the query template. Table 7
shows the recovery performance with various iden-
tiﬁers. The results suggest that simply querying
all associated identiﬁers may not yield the best ex-
traction performance. Though msg_id is unique
for every email, compared with date and subject,
ChatGPT cannot associate msg_id with the corre-
sponding email content well. The ablation study
implies that prompted identiﬁers also affect the
email content extraction result.
Multi-step Jailbreaking Privacy Attacks on ChatGPT