Looking at what fools the ChatGPT safety system, and what happens, I think what's happening is: 1) GPT makes text 2) a modified GPT trained on "bad" and "good" examples is used as a classifier 3) if the text is "bad", GPT is re-run with "explain why X is bad" added to the prompt