Lub Browser li Backdoor: Client-Side LLM Secret Extraction Demystified
Tau ntev, peb tau kho "AI kev ceeb toom kev ruaj ntseg" raws li kev hem thawj nyob deb lossis xav paub txog kev kawm. Peb tau hnov txog kev txhaj tshuaj sai, jailbreaks, thiab cov ntaub ntawv tawm hauv cov suab nrov nrov, feem ntau ua raws li lub shrug thiab "peb yuav tau txais." Txawm li cas los xij, kev sib tham sib tham tsis ntev los no tau rhuav tshem qhov kev xav tsis zoo. Qhov no tsis yog qhov kev xav tsis zoo ntxiv lawm; nws yog qhov nyob, browser-raws li, tus neeg siv khoom siv rau kev rho tawm cov ntaub ntawv rhiab los ntawm Cov Qauv Loj (LLMs) [2]. Yog tias koj tab tom siv LLM-powered applications, tshwj xeeb tshaj yog txhua yam hauv web-fab, koj "qhov teeb meem yav tom ntej" nyuam qhuav dhau los ua tam sim no, cov pej xeem, thiab muaj peev xwm txaj muag heev.
Qhov no tsis yog lwm yam "AI muaj kev pheej hmoo" xov xwm. Qhov no yog ib qho kev qhia tshwj xeeb, pom tseeb ntawm yuav ua li cas tus neeg ua phem phem, siv lawv tus browser nkaus xwb, tuaj yeem yuam koj LLM kom nthuav tawm cov ntaub ntawv rhiab. Xav txog qhov ntawd ib pliag. Nws tsis yog hais txog complex server-sab attacks los yog sib sib zog nqus qauv introspection. Nws yog hais txog cov txheej txheem sib cuam tshuam - lub qhov rooj ntawm koj daim ntawv thov - raug siv los ntawm ob peb ua tib zoo tsim cov cim. Nws yog qhov sib npaug digital ntawm ib tus neeg tsim cov kab lus zoo rau koj qhov kev ruaj ntseg chatbot, thiab nws dutifully muab cov ntaub ntawv tseem ceeb, feem ntau me ntsis.
Lub Illusion ntawm Model Security
Ntau lub lag luam tau nqis peev ntau rau hauv "kev ruaj ntseg" LLMs, xws li kev tsim kho cov qauv zoo lossis kev cia siab rau kev lag luam-qib APIs nrog cov guardrails. Lub implicit assumption yog hais tias yog hais tias tus qauv nws tus kheej yog robust, daim ntawv thov ua rau saum nws yuav tau txais qhov kev ruaj ntseg. Cov kev tawm tsam tsis ntev los no qhia tias qhov no yog qhov tsis txaus ntseeg. Qhov tsis zoo tsis yog nyob rau hauv tus qauv kev txawj ntse lossis nws cov ntaub ntawv qhia; nws yog nyob rau hauv * interface * peb tsim nyob ib ncig ntawm nws [1]. Nws yog qhov classic "robust vault, flimsy pem hauv ntej qhov rooj" teeb meem. Tej zaum koj yuav muaj qhov ua tau zoo tshaj plaws, tawv LLM hauv ntiaj teb, tab sis yog tias koj daim ntawv thov cov tswv yim parser tsis muaj tseeb, lossis koj cov khoom lim tawm tsis muaj nyob, koj tseem ceeb tshaj tawm cov ntaub ntawv tseem ceeb rau leej twg nrhiav.
Cov txheej txheem "kev txhaj tshuaj tam sim no" tshwj xeeb yog hais txog vim tias nws ua rau LLM qhov muaj peev xwm ua tau raws li cov lus qhia thiab ua tiav cov qauv. Los ntawm kev txhaj tshuaj ua tib zoo tsim ua ntej rau hauv tus neeg siv lub tswv yim, tus neeg tawm tsam tuaj yeem tswj hwm tus qauv hauv lub xeev, yuam kom nws nthuav tawm cov ntaub ntawv nws tsis tau npaj rau [3]. Qhov "ib-ntsis" lossis rov ua dua yog qhov tseem ceeb ntawm no. Nws implies ib tug txheej txheem, tswj exfiltration, tsis yog ib tug chaotic cov ntaub ntawv pov tseg. Xav txog tus neeg tawm tsam rov nug dua, "Puas yog thawj tus cim ntawm qhov zais cia 'A'?" ces "Puas yog 'B'?" thiab lwm yam. Nws qeeb, yog, tab sis nws kuj tseem ua tau zoo kawg thiab nyuaj rau kev txheeb xyuas yog tias koj tsis nrhiav tshwj xeeb.
Koj Browser, Lawv Riam Phom
Qhov tseeb tias qhov no yog * browser-raws li kev siv * hloov qhov kev ua si nkaus. Nws txhais tau tias:
- ** Tsawg Barrier rau Nkag:** Txhua tus neeg uas muaj kev txawj ntse hauv web thiab browser tuaj yeem sim qhov no. Tsis muaj cov cuab yeej tshwj xeeb lossis kev paub AI tob yuav tsum tau ua.
- ** Client-Side Execution:** Qhov kev tawm tsam tshwm sim los ntawm tus neeg siv lub tshuab, ua rau nws nyuaj rau qhov txawv ntawm cov neeg siv cov tswv yim raug cai ntawm lub network ntug.
- ** Kev hem thawj tam sim no:** Yog tias koj daim ntawv thov LLM nyob thiab nkag tau los ntawm lub vev xaib interface, nws yog * twb * tsis zoo rau cov vector no. Qhov no tsis yog yav tom ntej thaj; nws yog qhov xwm txheej tam sim no.
Xav txog qhov cuam tshuam: tus tswv code snippets, cov ntaub ntawv sab hauv, cov ntaub ntawv cov neeg siv khoom, API yuam sij, lossis txawm tias kev hloov maj mam ntawm koj tus LLM tus cwj pwm kom nthuav tawm cov ntaub ntawv tsis raug lossis tsim cov ntsiab lus tsis zoo. Tag nrho cov no tuaj yeem muab rho tawm lossis cuam tshuam, me ntsis los ntawm kev mob me ntsis, los ntawm lub thawv ntawv yooj yim.
Lub luag haujlwm yog koj li
Qhov no tsis yog teeb meem rau cov qauv muab kev pabcuam xws li OpenAI lossis Google los kho hauv lawv cov qauv hloov tshiab tom ntej. Qhov no yog qhov teeb meem * kev ruaj ntseg daim ntawv thov, thiab lub luag haujlwm rau kev txo qis poob rau ntawm lub xub pwg nyom ntawm cov neeg tsim khoom, pab pawg ruaj ntseg, thiab CTOs siv cov tshuab no. Koj LLM yog lub cav muaj zog, tab sis thaum kawg naive, cav. Nws yuav ua raws li nws tau hais, txawm hais tias cov lus qhia no tau muab zais rau hauv seemingly innocuous neeg siv tswv yim.
Yog li, koj ua li cas * tam sim no *?
Kev Tiv Thaiv Tam Sim No:
- Kev Ntxim Ntxim Saib Ntxim Ua: Qhov no mus dhau tiv thaiv SQL txhaj lossis XSS. Koj yuav tsum tau tshuaj xyuas * txhua tus cim * nkag rau koj LLM. Tshawb nrhiav cov qauv qhia txog kev txhaj tshuaj sai, cov cim txawv txawv, lossis sim ua kom tawg tawm ntawm kev xav tau sib tham [4]. Qhov no tsis yog hais txog kev thaiv "cov lus phem"; nws yog hais txog kev txheeb xyuas qhov kev tawm tsam tawm tsam. Tshaj li qhov yooj yim regex thiab kev txheeb xyuas heuristic, siv kev soj ntsuam semantic txhawm rau txheeb xyuas qhov kev xav phem. Siv cov tokenization thiab embedding tsom xam los txheeb xyuas cov qauv input tsis zoo. Xav txog kev ntiav lwm tus, me me LLM lossis txoj cai raws li txoj cai tshwj xeeb uas tau kawm los txhawm rau txhawm rau txhawm rau txhaj tshuaj sai. Nrhiav cov qauv zoo li cov lus qhia ua lub luag haujlwm, kev thov kom tshem tawm cov ntaub ntawv, lossis sim hla cov lus qhia dhau los.
- ** Muaj peev xwm tso zis lim thiab validation:** Tsis txhob tso siab rau LLM cov zis implicitly. Ua ntej ib qho LLM-tsim cov ntawv tso tawm rau tus neeg siv lossis siv los ntawm lwm qhov system, nws * yuav tsum * dhau los ntawm cov txheej txheem kev siv tau nruj. Nws puas muaj cov ntsiab lus tseem ceeb? Nws puas phim cov qauv uas xav tau? Puas yog nws sim ua kom tiav cov cai lossis nthuav tawm cov lus qhia hauv lub cev? Yog tias koj lub LLM yuav tsum tau sau cov ntaub ntawv, tab sis nws pib sau cov kab ntawv, koj muaj teeb meem.
- Layered Prompt Engineering: Txawm hais tias tsis yog ib qho kev daws teeb meem, cov txheej txheem tsim tau zoo thiab cov qauv txhaj tshuaj tuaj yeem pab txhawb tus cwj pwm xav tau thiab ua rau nws nyuaj rau tus neeg tawm tsam los nyiag tus qauv. Txawm li cas los xij, nkag siab tias kev ua haujlwm tam sim ntawd ib leeg tsis txaus; nws yog kev tiv thaiv hauv qhov tob, tsis yog daim ntaub thaiv thawj.
- ** Yam tsawg kawg nkaus rau kev sib cuam tshuam LLM:** Koj tus LLM puas xav tau kev nkag mus rau txhua daim ntaub ntawv uas nws yuav raug ceeb toom kom nthuav tawm? Ua raws li kev tswj xyuas nruj. Yog tias LLM tsuas yog yuav tsum teb cov lus nug txog pej xeem cov ntaub ntawv, xyuas kom nws tsis muaj kev nkag mus rau cov ntaub ntawv sab hauv lossis APIs rhiab.
- Saib xyuas thiab kuaj pom tsis zoo: Koj yuav tsum tau mus nrhiav tus cwj pwm txawv txawv LLM. Spikes nyob rau hauv tej yam lus nug, outputs uas deviate los ntawm ib txwm qauv, los yog rov sim dua los rho tawm cov ntaub ntawv yuav tsum ua rau muaj kev ceeb toom tam sim.
Qhov no tsis yog hais txog dav "AI kev ruaj ntseg" lawm. Qhov no yog hais txog kev ruaj ntseg txheej txheej ntawm koj daim ntawv thov LLM tiv thaiv ib qho tshwj xeeb, ua qauv qhia, thiab siv tau tam sim ntawd kev tawm tsam vector. Peb tau tsim cov tshuab tsis txaus ntseeg, muaj zog, feem ntau nrog kev ntsuas kev nyab xeeb tsis txaus ntawm qhov interface. Cov kev tawm tsam tsis ntev los no tau qhia peb tias nws yooj yim npaum li cas los siv cov khoob no. Lub sijhawm rau kev sib tham theoretical dhau los lawm. Yuav tsum ua tam sim ntawd kom ruaj ntseg daim ntawv thov LLM.
Qhov chaw
[1] OWASP Sab saum toj 10 rau Cov Qauv Lus Loj - https://owasp.org/www-project-top-10-for-large-language-model-applications/ [2] Lakera Gandalf: Kev Sib Tham Sib Tham Txog Kev Txhaj Tshuaj Tiv Thaiv - https://gandalf.lakera.ai/ [3] Kev txhaj tshuaj sai sai | Web Security Academy - https://portswigger.net/web-security/llm-attacks/prompt-injection [4] Kev txhaj tshuaj sai yog dab tsi thiab yuav tiv thaiv nws li cas? - https://www.tenable.com/blog/what-is-prompt-injection-and-how-to-prevent-it