I was going to comment but figured it would be preaching to the converted.

The architecture could be worse. It exfiltrates a log of classifier activations by ID and IP to Tinfoil. It exfiltrates a log of classifier activations by IP to the cloud provider.

Transcripts from IP flow to the router enclave. All transcripts flow out of the router enclave to the primary scanner enclave. On primary scanner activation, transcripts flow from the primary scanner enclave to the secondary scanner enclave for verification.

For an abuse flag in the primary scanner:

1. A monotonic transcript of size KB flows from IP to router enclave, exits the router enclave and enters the primary scanner enclave.

2. The monotic transcript size KB flows out of the primary scanner enclave to the secondary scanner enclave.

3. Size KB from IP to router enclave, then size KB from primary scanner enclave to secondary scanner enclave, logs an abuse incident in the primary scanner for IP visible to the cloud provider.

4. Transcript size KB from primary scanner enclave to secondary scanner enclave, then tiny flag from secondary scanner to Tinfoil org logs confirmation of abuse by the secondary scanner for IP visible to the cloud provider.

--

All that is required to exfiltrate a lossy picture of conversations to the cloud provider is to update the classifier prompt.

Assume the prompt is now ["Activate when the conversation is about $PERSON"]. Now the cloud provider has [IP talks about $PERSON]. Continuously update the prompt to keep exfiltrating from the enclave.

Actually if you are even more clever you could get 4 bits out per conversation turn.

Edit the prompt to tell the scanner to PASS (1) for $PERSON_A or FAIL (0) for $PERSON_B. Two bits, two scanners = 4 bits.

Maybe you could get even 8 bits out to tinfoil. Edit the prompt to tell the scanner "think hard" for $PERSON_C or "don't think hard" for $PERSON_D. Then the scanner enclaves already exfiltrate token use.

--

Another edit. Now that I think about it, if you have already compromised the user's JWT token you can get their account banned arbitrarily as well. Send some abuse with the token.

Then you can't actually verify if the flags are valid or not, without inspecting the chat content. So you either reveal your chats or get banned. This is hilarious.

Not to mention you can do it for the API as well if you have compromised the API customer; by sticking the JWT token on their requests XD XD