4 ms·
If someone SQL injects into your database and exfiltrates all the data, there would be legal repercussions, so should there be legal repercussions for prompt in
by deadbabe 1y ago
If someone SQL injects into your database and exfiltrates all the data, there would be legal repercussions, so should there be legal repercussions for prompt injecting someone’s LLM?
- simonw 1y agoI think there are. If you use a prompt injection attack to steal commercially sensitive data and then profit from it you're likely breaking things like the Computer Fraud and Abuse Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act - and presumably a bunch of other federal and state laws as well, depending on exactly what you did with the stolen information. (It's probably securities fraud. Everything is securities fraud. https://www.bloomberg.com/opinion/articles/2019-06-26/everything-everywhere-is-securities-fraud https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...)
- potatolicious 1y agoPretty sure existing law already covers this - malicious misuse of a computer to cause damages to someone is already illegal, and the relevant statutes aren't opinionated about how this is done. I suspect a SQL injection attack, a XSS attack, and a prompt injection attack are not viewed as legally distinct matters. Though of course, this is not a matter of case law... yet ;)