2 ms·
We've already seen that it's possible to trick models into seeing user input as their own "thinking" if you make it sound like what the model writes. While it m
by QuercusMax 4mo ago
We've already seen that it's possible to trick models into seeing user input as their own "thinking" if you make it sound like what the model writes. While it may appear that it's looking at the tags on the input, in practice that's not as strong a guarantee as you'd hope.
- altcognito 4mo agoDo you have the reference for this, I remember seeing it recently but can't dig it up
- aw1621107 4mo agoI think GP is referring to "Prompt Injection as Role Confusion" (https://role-confusion.github.io/ https://role-confusion.github.io/). It was discussed on HN several weeks ago (https://news.ycombinator.com/item?id=48631888 https://news.ycombinator.com/item?id=48631888)
- QuercusMax 4mo agoThat's the one!
- altcognito 3mo agoYep, thanks
- jonnycomputer 3mo agoMight be this: https://www.lesswrong.com/posts/d8xDGzCEYE639qqEv/a-mechanistic-explanation-of-prompt-injection-and-why-you https://www.lesswrong.com/posts/d8xDGzCEYE639qqEv/a-mechanis...
- tp3358 4mo agoMaybe this is an elementary angle given my lack of security experience, but couldn't Microsoft figure out a wat to parse the documents prior to model analysis/action? Implement some form of deterministic layer that resides between the user and the model?
- raggi 4mo agoParse for what? The model has “arbitrary understanding” of “arbitrary input”. The filter is unbounded and the only actually safe result is to filter everything.
- hulitu 3mo ago> but couldn't Microsoft figure out a wat to parse the documents prior to model analysis/action If Apple and others "couldn't", why would Microsoft ? Throwing errors for bad input is so 90's.