alt Hacker News> "At the time of publication, no robust mitigation for the broader vulnerability class is available"
Isn't it obvious by now that it's never going to be possible to fix this kind of thing, at least until we stop mixing up instructions with data.
Replies
We're back to Von Neumann architecture in the worst way possible.
It's probably fuzzily fixable by including instruction authority levels in the training data. Can't expect much more than that, given that the model itself is fuzzy.
> until we stop mixing up instructions with data
Is such a thing even possible with a generally intelligent system processing content with unlimited diversity?
This is probably a dumb question but why can't we use message signing to segregate the streams or at least add repudiation? The message telling you to look at the doc is signed but the doc is not signed and thus not treated like chat input.
Probably not, because that is the same reason phishing works on us.
That email could be really from the CEO, containing instructions, or it could be spam, containing data that should be ignored.
In the daft I add instruction for myself of coworkers, like "add another example" or "rewrite the previos sentence". I guess AI can solve some of them.
I also have a spreadsheet with the things I must pay, that can be interpreted as instructions for myself. I'd be very worried about giving the AI the password of my bank and allowing the AI to make the payments.
There's no sensible barrier here: If you want to have agents work on stuff (data) then there's going to be worms.
Models can be trained with seperate contexts for these things, but the companies with all the resources are so focused on racing to AGI and "scaling laws" that they don't actually care about research into fixing security risks. Fixing those risks would even negatively affect their marketing.
> at least until we stop mixing up instructions with data.
That's what I always say, but nobody listens to me :D
Assembler had the same kind of design flaw, and we didn't learn anything from it as evident by LLM bypasses.
This has been a security vulnerability since day 1 with these models, yet collectively the people who use them just simply don't seem to care about the security implications. Its especially problematic given that people let AI agents have full unrestricted access to their system
Its going to take even more data breaches for the AI crowd to finally care, but to a large degree I have absolutely no sympathy. You know what you're signing up for if you sell yourself to anthropic or openai