* Extracted attack size was exactly correct; confirmed in discussion with OpenAI. * As part of our responsible disclosure, OpenAI has asked that we do not publish this number. * Attack not implemented to preserve security of the weights. * Estimated cost of attack given the size of the model and estimated scaling ratio.