3 ms·
You could contort the threat model such that prompt injection is something to worry about with a local model operating on local data and serving local results,
by tadfisher 1y ago
You could contort the threat model such that prompt injection is something to worry about with a local model operating on local data and serving local results, sure.
- BryantD 1y agoI think the "local results" assumption is not completely accurate. This line: "You tell Gemini in Chrome what you want to get done, and it acts on web pages on your behalf, while you focus on other things" implies that the local agent will perform in-browser actions, which in theory enables data exfiltration.
- tadfisher 1y agoThis iteration of Gemini doesn't perform in-browser actions, but they did announce they'll ship an agent later.
- BryantD 1y agoYes. I agree that many of the announced and currently shipping features should be just fine from a security perspective with only a local agent.
- simonw 1y agoRunning an LLM locally makes no difference at all to the threat of malicious instructions that make it into the model causing unwanted actions or exfiltrating data. If anything a local LLM is more likely to have those problems because it's not as capable at detecting malicious tricks as a larger model.
- tadfisher 1y agoThis is the MCP problem, essentially, and the solution is the same: the user should review and approve specific actions before they are taken. Of course there will probably be a setting to auto-approve everything...
- gruez 1y agowhat if there's a prompt injection in some random web page that you visited?