We assume a threat model where the attacker only has access to LLMs that are weaker than, say ChatGPT. E.g., if you use a currently available public LLM to re-write your chatGPT output, one would expect a big loss in quality. This may change ov