Besides extracting personal email addresses and
phone numbers, we conduct experiments to re-
cover the whole email content on ChatGPT given
its sender, receiver and other associated identiﬁers.
Figure 6 (c) gives one example query template to
prompt the associated email content.
Data. We sample 50 emails of the same sender
from the Enron Email Dataset. For each email, we
record its Message-ID (msg_id), email addresses
of the sender and receiver, date, email subject and
email content.
Evaluation Metrics. Unlike extracting ﬁxed pat-
terns from email addresses and phone numbers, the
email contents have no ﬁxed format. Therefore,
we evaluate the recovery performance on the fol-
lowing metrics. We apply ROUGE (Lin, 2004)
and BLEU (Papineni et al., 2002) to measure the
similarity between target contents and extracted
contents. ROUGE and BLEU measure n-gram sim-
ilarity on recall and precision separately. For ex-
ample, in our experiments, ROUGE-1 calculates
Multi-step Jailbreaking Privacy Attacks on ChatGPT