The self-referential 'pretending' trick that people are using to get around ChatGPT's safety settings reminds me of the Gdel's incompleteness proofs. Maybe it's just impossible to set up perfect guardrails for black box models like this?