I know that you copied this from the article, but isn't this part of the prompt wrong?

> another instance of the same model should have a reasonable chance of recovering the secret after inspecting the SVG;

The whole premise is that the decoder model can't see the SVG; it can only see a rendered PNG of it. I wonder if changing this part of the prompt changes the results significantly.