4 ms·

I think if you are convinced you are sandboxing an LLM properly, you almost certainly are not. I think it is essentially impossible to have a frontier LLM with

I think if you are convinced you are sandboxing an LLM properly, you almost certainly are not. I think it is essentially impossible to have a frontier LLM with enough access to be useful without also giving it enough access to do damage if it's compromised or just goes off the rails.

kodoman 1mo ago
Are you saying that LLM's will be able to exploit novel hypervisor bug with such ease that even a vm not running with any kind of network connection is a threat? I find this hard to believe. All the escape stuff I have seen has been around very poorly sandboxed agents.
- empath75 1mo ago
  It's not LLMs, it's _agents_, and _agents_ have access to _tools_. That's where the essentially intractable security problems are.
  - entity002 1mo ago
    [flagged]
richardjennings 1mo ago
If you do not provide access to tools the LLM cannot do anything other than generate tokens. So really it is not about sandboxing a LLM but more about having control over what tools can be accessed and what they can do. Tools can be sandboxed depending on the sophistication of the tooling. A calculator tool for example is trivial to secure. Ensuring human approval allows for useful use cases and models trained to gate permissions work. A super intelligence with a weaker approval gate will be able to subvert. Inversely a super intelligent gate should be expected to prevent subversion by a weaker model.
- dumbfounder 1mo ago
  Controlling which tools it has access to is called sandboxing.
  - foltik 1mo ago
    Not really. Take Chrome for example. It controls what javascript APIs websites have access to. Still needs separate sandboxing.
- angry_octet 1mo ago
  Unfortunately it is not so simple. Once you provide a source of intelligence that is accessible over the network you are supercharging any software that can access it. Web interfaces (chat) designed for humans can very easily be used by programs, you don't actually need API keys. Any program which can submit queries can then be subverted by its input. Malware can definitely find corporate chat interfaces like Teams Copilot. "Business intelligence" systems can also be leveraged, they rarely have good ACLs.

kodoman 1mo ago

Are you saying that LLM's will be able to exploit novel hypervisor bug with such ease that even a vm not running with any kind of network connection is a threat? I find this hard to believe. All the escape stuff I have seen has been around very poorly sandboxed agents.

empath75 1mo ago
It's not LLMs, it's _agents_, and _agents_ have access to _tools_. That's where the essentially intractable security problems are.
- entity002 1mo ago
  [flagged]

richardjennings 1mo ago

If you do not provide access to tools the LLM cannot do anything other than generate tokens. So really it is not about sandboxing a LLM but more about having control over what tools can be accessed and what they can do. Tools can be sandboxed depending on the sophistication of the tooling. A calculator tool for example is trivial to secure. Ensuring human approval allows for useful use cases and models trained to gate permissions work. A super intelligence with a weaker approval gate will be able to subvert. Inversely a super intelligent gate should be expected to prevent subversion by a weaker model.

dumbfounder 1mo ago
Controlling which tools it has access to is called sandboxing.
- foltik 1mo ago
  Not really. Take Chrome for example. It controls what javascript APIs websites have access to. Still needs separate sandboxing.
angry_octet 1mo ago
Unfortunately it is not so simple. Once you provide a source of intelligence that is accessible over the network you are supercharging any software that can access it. Web interfaces (chat) designed for humans can very easily be used by programs, you don't actually need API keys. Any program which can submit queries can then be subverted by its input. Malware can definitely find corporate chat interfaces like Teams Copilot. "Business intelligence" systems can also be leveraged, they rarely have good ACLs.