subverting ChatGPT confession mechanism robustness