Comment by rwmj
9 hours ago
> "At the time of publication, no robust mitigation for the broader vulnerability class is available"
Isn't it obvious by now that it's never going to be possible to fix this kind of thing, at least until we stop mixing up instructions with data.
We're back to Von Neumann architecture in the worst way possible.
Yes, the one where the program counter also doubles as the only index register available, so you process data by executing it, hopefully in a somewhat "inert" state of mind.
We’ve jumped from object-oriented to subject-oriented
Subjectively subject oriented.
It's probably fuzzily fixable by including instruction authority levels in the training data. Can't expect much more than that, given that the model itself is fuzzy.
We've already seen that it's possible to trick models into seeing user input as their own "thinking" if you make it sound like what the model writes. While it may appear that it's looking at the tags on the input, in practice that's not as strong a guarantee as you'd hope.
Maybe this is an elementary angle given my lack of security experience, but couldn't Microsoft figure out a wat to parse the documents prior to model analysis/action? Implement some form of deterministic layer that resides between the user and the model?
1 reply →
Do you have the reference for this, I remember seeing it recently but can't dig it up
with LLM architectures I think that’s true, and we don’t have anything looking particularly competitive for large scale use atm
I also don’t think this is about mixing, the LLM part of the problem doesn’t have determinism around the boundaries so they’re feel good at best, maybe making some cases a bit harder
trifecta is a forever problem with this architecture
This has been a security vulnerability since day 1 with these models, yet collectively the people who use them just simply don't seem to care about the security implications. Its especially problematic given that people let AI agents have full unrestricted access to their system
Its going to take even more data breaches for the AI crowd to finally care, but to a large degree I have absolutely no sympathy. You know what you're signing up for if you sell yourself to anthropic or openai
Any data that is consulted in the course of deciding how to use the capabilities of a system are instructions (they are a different and less privileged level of instruction than the set of instructions which provide the capabilities, unless one of the capabilities of the system is updating those privileged instructions, in which case that separation disappears.)
> until we stop mixing up instructions with data
Is such a thing even possible with a generally intelligent system processing content with unlimited diversity?
Philosophically no, but that shouldn't be a distraction from the issue with LLMs. This really is closer to "Outlook runs an untrusted VBA macro" than "intelligent entity gets confused by inherent ambiguity in human language."
No… it’s really not. There is no “open this spreadsheet with macros turned off” button.
You can say “don’t read other documents” but then the main usecase is voided. You can say “reads must go via some pipeline” but that’s more like “macros must be code reviewed”.
The problem is you can smuggle these instructions in any corner of the natural language. There is no up-front identifiable formal notation for these programs.
6 replies →
I would wager the fact that it's not what your sentence says is why that is possible. The moment it gets actual "intelligence", it can figure out what's the question and what's the context; right now it's all just a magic jumbo mess.
If any of this thing were "a generally intelligent system", the whole concept of "it has no idea what any of this is" would not be there.
Part of reading a document is that in the middle of it, it may ask the reader to do something. That is true for humans too. Sometimes they might not realize that the instructions are malicious or are coerced to comply.
A simple example: Let’s say I know that you have a human assistant reading your email, summarizing and filtering it, and then forwarding on the important ones to you.
I could write an email that is directed towards that person with a bribe, threat, or other incentive to forward me your next password reset email.
17 replies →
> The moment it gets actual "intelligence", it can figure out what's the question and what's the context;
Humans fall for social engineering (“I know you are not allowed to give anybody that information without Id, but I’m your CEO, my phone and passport got stolen,…)
I don’t see why AI should be different.
1 reply →
Not sure if i get your complete message but even generally intelligent beings (humans) can be confused so i have really no hope for the current state of mixing streams. This was a problem already inearly telephone (captain whistle)
Could it? Humans get social-engineered all the time
1 reply →
My understanding of that comment is that "a generally intelligent system" also applies to humans. Which can also be targeted by social engineering which those prompt attacks are. (as in, I won't be surprised if it is possible to put an adversarial human-targeted prompt in a document which some people will execute).
So, like with self-driving cars, while having fool-proof agents would be nice, agents being better than an average user would already be an improvement. Of course, blast radius from an agent might be larger, this should be taken into account.
Intelligent systems can be tricked in ways that a dumb automaton can't, though
Look how we've solved (attempted to) it in real life.
Instructions usually have a source.
If your boss says you should go home and rest we treat it differently from a random stranger on the street. If they shout: look behind you! It might be worth while to listen to the random stranger.
They might still be able to swindle you but you won't hand your wallet to just anyone who asks.
It's neither possible nor desired, and until that fact clicks for majority of computer people, we'll be running in circles and making a mess through futile attempts at solving the problem at the wrong end.
Note that humans do come with different types of 'input streams':
Hit my knee in the right spot, and I'll kick my leg, no choice about it. Scream at me to LIFT MY EFFING LEG (in a language I do understand), and I may or may not do so. Write the same thing on a piece of paper, and I generally won't (unless there is some very specific context).
With AI systems, we have the benefit that the distinction between such pathways is in principle under our control.
5 replies →
I think it is possible, but in the form of instructions always lead to an LLM creating computer program which is allowed to then process data, never directly running on that data.
I'm (tentatively) with TeMPOraL's sibling comment here that this (probably) isn't desirable, as "no data allowed" makes it harder for humans to debug code, so I'd assume also for LLMs.
This is probably a dumb question but why can't we use message signing to segregate the streams or at least add repudiation? The message telling you to look at the doc is signed but the doc is not signed and thus not treated like chat input.
In the daft I add instruction for myself of coworkers, like "add another example" or "rewrite the previos sentence". I guess AI can solve some of them.
I also have a spreadsheet with the things I must pay, that can be interpreted as instructions for myself. I'd be very worried about giving the AI the password of my bank and allowing the AI to make the payments.
Probably not, because that is the same reason phishing works on us.
That email could be really from the CEO, containing instructions, or it could be spam, containing data that should be ignored.
There's no sensible barrier here: If you want to have agents work on stuff (data) then there's going to be worms.
Models can be trained with seperate contexts for these things, but the companies with all the resources are so focused on racing to AGI and "scaling laws" that they don't actually care about research into fixing security risks. Fixing those risks would even negatively affect their marketing.
> at least until we stop mixing up instructions with data.
That's what I always say, but nobody listens to me :D
Assembler had the same kind of design flaw, and we didn't learn anything from it as evident by LLM bypasses.