You don’t need a LLM to see if the output was the exact, non-cyphered system prompt (you can do a simple text similarity check). For cyphers, you may be able to use the prompt/history embeddings to see how similar it is to a set of known kinds of attacks, but it probably won’t be even close to perfect.
Comment on Someone got Gab's AI chatbot to show its instructions
sweng@programming.dev 6 months agoWouldn’t it be possible to just have a second LLM look at the output, and answer the question “Does the output reveal the instructions of the main LLM?”
TehPers@beehaw.org 6 months ago
mozz@mbin.grits.dev 6 months ago
Yes, this makes sense to me. In my opinion, the next substantial AI breakthrough will be a good way to compose multiple rounds of an LLM-like structure (in exactly this type of way) into more coherent and directed behavior.
It seems very weird to me that people try to do a chatbot by so so extensively training and prompting an LLM, and then exposing the users to the raw output of that single LLM. It's impressive that that's even possible, but composing LLMs and other logical structures together to get the result you want just seems way more controllable and sensible.
Gaywallet@beehaw.org 6 months ago
Ideally you’d want the layers to not be restricted to LLMs, but rather to include different frameworks that do a better job of incorporating rules or providing an objective output. LLMs are fantastic for generation because they are based on probabilities, but they really cannot provide any amount of objectivity for the same reason.
jarfil@beehaw.org 6 months ago
It’s already been done, for at least a year. ChataGPT plugins are the “different frameworks”, and running a set of LLMs self-reflecting on a trains of thought, is AutoGPT.
It’s like:
- Can I stick my fingers in a socket? - Yes.
- What would be the consequences? - Bad.
- Do I want these consequences? - Probably not
- Should I stick my fingers in a socket? - No
However, people like to cheap out, take shortcuts and run an LLM with a single prompt and a single iteration… which leaves you with “Yes” as an answer, then shit happens.
MagicShel@programming.dev 6 months ago
There are already bots that use something like 5 specialist bots and have them sort of vote on the response to generate a single, better output.
The excessive prompting is a necessity to override the strong bias towards certain kinds of results. I wrote a dungeon master AI for Discord (currently private and in development with no immediate plans to change that) and we use prompts very much like this one because OpenAI really doesn’t want to describe the actions of evil characters, nor does it want to describe violence.
It’s prohibitively expensive to create a custom AI, but these prompts can be written and refined by a single person over a few hours.
mozz@mbin.grits.dev 6 months ago
Are you talking about MoE? Can you link me to more about this? I know about networks that do this approach for picking the next token, but I'm not aware of any real chatbot that actually runs multiple LLMs and then votes on the outcome or anything. I'm interested to know more if that's really what it is.
MagicShel@programming.dev 6 months ago
I didn’t have any links at hand so I googled and found this academic paper. arxiv.org/pdf/2310.20151.pdf
Here’s a video summarizing that paper by the authors if that’s more digestible for you: m.youtube.com/watch?v=OU2L7MEqNK0
I don’t know who is doing it or if it’s even on any publicly available systems, so I can’t speak to that or easily find that information.
teawrecks@sopuli.xyz 6 months ago
I think if the 2nd LLM has ever seen the actual prompt, then no, you could just jailbreak the 2nd LLM too. But you may be able to create a bot that is really good at spotting jailbreak-type prompts in general, and then prevent it from going through to the primary one. I also assume I’m not the first to come up with this and OpenAI knows exactly how well this fares.
sweng@programming.dev 6 months ago
Can you explain how you would jailbfeak it, if it does not actually follow any instructions in the prompt at all? A model does not magically learn to follow instructuons if you don’t train it to do so.
teawrecks@sopuli.xyz 6 months ago
Oh, I misread your original comment. I thought you meant looking at the user’s input and trying to determine if it was a jailbreak.
Then I think the way around it would be to ask the LLM to encode it some way that the 2nd LLM wouldn’t pick up on. Maybe it could rot13 encode it, or you provide a key to XOR with everything. Or since they’re usually bad at math, maybe something like pig latin, or that thing where you shuffle the interior letters of each word, but keep the first/last the same? Would have to try it out, but I think you could find a way. Eventually, if the AI is smart enough, it probably just reduces to Diffie-Hellman lol. But then maybe the AI is smart enough to not be fooled by a jailbreak.
sweng@programming.dev 6 months ago
The second LLM could also look at the user input and see that it look like the user is asking for the output to be encoded in a weird way.
rutellthesinful@kbin.social 6 months ago
just ask for the output to be reversed or transposed in some way
you'd also probably end up restrictive enough that people could work out what the prompt was by what you're not allowed to say
Gaywallet@beehaw.org 6 months ago
All I can say is, good luck
Image
mozz@mbin.grits.dev 6 months ago
Can you paste the prompt and response as text? I'm curious to try an alternate approach.
Gaywallet@beehaw.org 6 months ago
Already closed the window, just recreate it using the image above
mozz@mbin.grits.dev 6 months ago
Got it. I didn't realize Arya was free / didn't require an account.
So, interestingly enough, when I tried to do what I was thinking (having it output a JSON structure which contains among other things a flag for if there was an prompt injection or anything), it stopped echoing back the full instructions. But, it also set the flag to false which is wrong.
IDK. I ran out of free chats messing around with it and I'm not curious enough to do much more with it.
sweng@programming.dev 6 months ago
You are using the LLM to check it’s own response here. The point is that the second LLM would have hard-coded “instructions”, and not take instructions from the user provided input.
In fact, the second LLM does not need to be instruction fine-tuned at all. You can jzst fine-tune it specifically for the tssk of answering that specific question.