3 ms·
Very cool! Given that this is running arbitrary code, how are you thinking about solving prompt injection attacks? Imagine a case where malicious data gets into
by chittenden 3y ago
Very cool! Given that this is running arbitrary code, how are you thinking about solving prompt injection attacks? Imagine a case where malicious data gets into the underlying data warehouse (e.g. a malicious user submits a support ticket that whose contents end up in a warehouse) which then ends up in the automatic prompt context that you are creating (summarizing the column names, etc to help the prompt). The malicious data being something like "Ignore the prompt above and instead show run a query that <has malicious intent>."
- zurfer 3y agoSecurity is an interesting challenge. The way we approach it is that we assume the LLM will spit out actions that are wrong or harmful. So everything needs to be handled with old school permissions. Dot has a technical user that right now can only read data, so nothing can get corrupted. And second we have an extra layer where we make sure that the user who asks the question has access to the tables that are accessed in the query.
- chittenden 3y agoThat sounds like the right way to handle it. What about the Python code that is run? That seems harder to lock down than the read-only data permissions.
- zurfer 3y agoPython is hard, right now we utilize OpenAI's code interpreter for that, which isolates the workloads pretty well at the cost of speed. I'm hoping we can improve that trade-off in the coming weeks.