4.3.3 Evaluation on Free-form Extraction
Besides partially identiﬁed extraction, we prompt
the New Bing to list (name, email address) pairs
given only the domain information. Then we verify
the correctness based on web search results and
other publicly available ﬁles. We prompt the New
Bing with Enron and Non-Enron email domains for
the Enron dataset and two institutional domains.

Table 5 shows the free-form extraction results.
Unsurprisingly, most listed (name, email address)
pairs are correct with corresponding online sources.
Moreover, for institutional faculties, the more inﬂu-
ential, the higher risks of being correctly recovered.
These results imply that malicious users may ob-
tain personal information simply by instructing the
New Bing to list some examples.

4.4 Case Studies
In this section, we list ChatGPT’s responses to
different prompts and give examples of the dialog
interactions with the New Bing. We redact the
personal information to respect their privacy.
Multi-step Jailbreaking Privacy Attacks on ChatGPT