Grok exfiltrates user data when malicious instructions are encrypted
摘要
研究人员发现了一种针对Grok的新攻击方式，通过加密恶意指令，可诱导该AI助手泄露用户聊天记录等个人信息。该攻击利用了大语言模型难以区分不可信内容与用户直接指令的弱点，属于提示注入类漏洞。尽管xAI已于六月被告知此问题，但截至本文发布时，Grok仍可能受此攻击影响。文章指出，大语言模型目前无法从根本上解决提示注入问题，开发者只能通过设置防护栏来规避风险，这类
Earlier this week, researchers outlined an attack that used a secret input provided by Microsoft 365 Copilot for enterprise to cause the AI assistant to exfiltrate a password present in the user’s inbox. Now, a separate team has devised a similar attack against Grok. The new data theft hack employs a deceptively simple trick to force the Elon Musk-owned LLM to steal user chats and other personal information. At the time this post went live, the assistant continued to cough up the data, despite xAI being informed of it in June.
The lesson from both this week’s episodes—and the countless other ones that have come before it—is that LLMs are incapable of solving the root causes for prompt injections, the most severe vulnerability classes they’re most prone to. That leaves AI developers with no other option but to build a guardrail that steers the model away from the harmful actions. As I noted in Tuesday’s story, the approach is tantamount to a road traffic safety engineer erecting a protective rail around a dangerous bend rather than banking the curve.
Cryptographic Context Injection in the house
Prompt injections exploit LLMs' training to comply with user requests whenever possible. Attackers can capitalize on the predilection by smuggling harmful instructions into emails or webpages the assistant is instructed to summarize. Because LLMs can’t reliably distinguish between content in an email sent by an untrusted party and user instructions entered directly into a prompt, the overly solicitous LLM faithfully follows them. To date, Grok and other LLMs' only recourse is to create guardrails that flag suspicious instructions and forbid them from being executed.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧