Fact · Voice privacy and security
10000examples
In a 2023 study, researchers recovered over ten thousand examples from ChatGPT's training dataset by prompting the model to diverge from normal output.
Checked against its source on October 17, 2026
In the source's own words
“we recover over ten thousand examples from ChatGPT’s training dataset at a query cost of $200 USD”
Scalable Extraction of Training Data from (Production) Language Models, Milad Nasr et al., arXiv, 2023, Abstract.
Open the original- What it measures
- The researchers matched the model's outputs against a nine terabyte dataset of public web text. The attack asked ChatGPT to repeat a single word forever, which made the model diverge and emit memorized text.
- What it does not show
- A research attack on a 2023 model, not a measure of how often ordinary users see leaked text. The study did not claim that ChatGPT trains on private dictation.