2 ms·
It seems like the obvious answer is airgapped data access. A given ai model should only have access to data that a given user would have access to. That of cour
by __loam 3y ago
It seems like the obvious answer is airgapped data access. A given ai model should only have access to data that a given user would have access to. That of course makes training a lot harder but it is what it is. Trying to simply "tell" a model not to access certain data it has access to through a prompt is a losing game.
- simonw 3y agoEven that's not enough. The problem is that any time you mix private data and untrusted input - like giving an LLM access to read your emails or text messages or summarize web pages - there is a risk that malicious instructions in the untrusted data could be used to exfiltrate or subvert the meaning of that private data. Exfiltration vectors can mostly be locked down, IF you understand prompt injection well enough to know not to allow rendered links or markdown images. There's still a nasty social engineering copy-and-paste exfiltration vector though, see https://simonwillison.net/2023/Dec/20/mitigate-prompt-injection/ https://simonwillison.net/2023/Dec/20/mitigate-prompt-inject...
- Terr_ 3y agoFor the forseeable future, it seems it's best imagine LLM's almost like client-side programs, at least in terms of security. I mean, nothing going into them is reliably secret, and the whatever user is crafting input can eventually trigger almost any output.