5 ms·
The point being made here is about a possible philosophical difference between LLMs and human beings, not one about application security best practices. I am no
by shawnz 3y ago
The point being made here is about a possible philosophical difference between LLMs and human beings, not one about application security best practices. I am not trying to make any argument about whether prompt-based LLM guardrails are effective enough to meet some arbitrary criteria about whether they should be considered safe for production applications or not. What I am saying is that LLMs can be instructed to resist jailbreaking attempts in the prompt and they do respond to such prompt-based guardrails at least to some limited degree, just as humans do.
As an aside, though, I think "impossible to bypass" is an unachievable goal in any security system.
- simonw 3y agoI guarantee you that you will not be able to conduct a SQL injection attack against any system that I have audited against SQL injection attacks. We figured out robust solutions for that a couple of decades ago. (I'll need a solid chunk of consulting cash for the time it takes to conduct that audit, of course!)
- MacsHeadroom 3y agoI guarantee I can convince someone to run my SQL command for me despite such safeguards. Humans are notoriously easy to jailbreak.
- simonw 3y agoI'm sure you can. That's social engineering, not SQL injection. I don't think it's easy (or even possible) to build a completely secure system. But... for most security vulnerabilities (such as SQL injection) there are known, reliable mitigations. That's not the case for prompt injection, which is why we need to treat it differently from other classes of vulnerability.