Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

Post reply on HN
Print view View original

151–160 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#151

Post by kristofferR »

renewiltord wrote: post #113
jackson1442 wrote: post #85

Earlier quoted context omitted.

I think this is different in that ChatGPT is expressly using your data as training in a probabilistic model. This means: * Their contractors can (and do!) see your chat data to tune the model * If the model is trained on your confidential data, it may start returning this data to other users (as we've seen with Github Copilot regurgitating licensed software) * The site even _tells you_ not to put confidential data in…

Not that I don't expect them to do this, but how is it expressly said to be so? https://help.openai.com/en/articles/5722486-how-your-data-is... > OpenAI does not use data submitted by customers via our API to train OpenAI models or improve OpenAI’s service offering. In order to support the continuous improvement of our models, you can fill out this form to opt-in to share your data with us. Sharing your data with us…

Did you read the next paragraph?

> When you use our non-API consumer services ChatGPT or DALL-E, we may use the data you provide us to improve our models.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#152

Post by bob1029 »

beiller wrote: post #143
walthamstow wrote: post #92

Earlier quoted context omitted.

What's it like with code, documentation, regex, etc? That's all I use ChatGPT for. I don't need it to be able to write poetry.

I did not verify this regex, on the very surface scan seems OK: ./main -m ./models/7B/ggml-model-q4_0.bin -t 4 --temp 0.7 --top_k 40 --top_p 0.5 --repeat_last_n 256 --repeat_penalty 1.17647 -n 1024 -p $'Here is a handy short form regex to validate an email address: ' Here is a handy short form regex to validate an email address: ^([a-zA-Z0-9_.+-]+@[a-zA-Z0-9.-]+\.[a-z\.]{2,6})+$ The first character can be either uppe…

This looks like good performance. We are keeping an open mind with regard to actually-open alternatives.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#153

Post by bsder »

osterbit2 wrote: post #132
probablynish wrote: post #104

Earlier quoted context omitted.

This really depends on the cost/benefit tradeoff for the entity in question. If using ChatGPT makes you X% more productive (shipping faster / lowers labor costs / etc), but comes with Y% risk of data leakage, is that worth it in expectation or not? I would argue that there definitely exist companies for which it's worth the tradeoff. By the way, OpenAI says they wont use data submitted through its API for model train…

To anyone who may be pasting code along the lines of 'convert this sql table schema into a [pydantic model|JSON Schema]' where you're pasting in the text, just ask it instead to write you a [python|go|bash|...] function that reads in a text file and 'converts an sql table schema to output x' or whatever. Related/not-related--great pandas docs replacement is another great+safe use-case. Point is, for a meaningful subs…

Do you really think the people asking ChatGPT to write their code can make that abstraction?

The fact that the can't do this is the whole reason they have to use ChatGPT.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#154

Post by mholm »

waboremo wrote: post #123
jackson1442 wrote: post #85

Earlier quoted context omitted.

I think this is different in that ChatGPT is expressly using your data as training in a probabilistic model. This means: * Their contractors can (and do!) see your chat data to tune the model * If the model is trained on your confidential data, it may start returning this data to other users (as we've seen with Github Copilot regurgitating licensed software) * The site even _tells you_ not to put confidential data in…

Sticking it in your own datacenter doesn't really prevent any of these problems (except maybe #2), only now your leaks are internal and because of all the false sense of security, you might wind up leaking far more confidential and specific information (ie. an executive leaking to the rest of the team in advance that they are planning layoffs for noted reasons, whereas that executive might have used more vague terms…

Sticking it in your own private datacenter would imply that you can opt in or out of using your data to train the next generation. ChatGPT does not dynamically train itself in realtime.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#155

Post by Jensson »

michaelteter wrote: post #98
dragonwriter wrote: post #80

Earlier quoted context omitted.

> Possibly I don’t know how this all works, but I think if the host of a ChatGPT interface were willing to provide their own API key (and pay), they could then provide a “service” to others (and collect all input). Well, GP was referring to blocking ChatGPT as a federal contractor . I suspect that as a federal contractor, they are also vetting other people that they share data with, not just blocking ChatGPT as a one…

But it really seems like a cat and mouse game. For example, a very determined bad actor could infiltrate some lesser approved government contractor and provide an additional interface/API which would invite such information leaking, and possibly nobody would notice for a long time.

And then they could face death penalty for espionage if they leaked sensitive enough data. You would have to be really stupid to build such a service for government contractors unless you actually are a foreign spy.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#156

Post by m000 »

cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

Does US intelligence have access to OpenAI data? Private organizations is one thing. But with all the dopes in government positions around the world, OpenAI logs would probably be a treasure trove for intelligence gathering.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#158

Post by lukifer »

bsder wrote: post #153
osterbit2 wrote: post #132

Earlier quoted context omitted.

To anyone who may be pasting code along the lines of 'convert this sql table schema into a [pydantic model|JSON Schema]' where you're pasting in the text, just ask it instead to write you a [python|go|bash|...] function that reads in a text file and 'converts an sql table schema to output x' or whatever. Related/not-related--great pandas docs replacement is another great+safe use-case. Point is, for a meaningful subs…

Do you really think the people asking ChatGPT to write their code can make that abstraction? The fact that the can't do this is the whole reason they have to use ChatGPT.

I’ve been doing this kind of thing pretty regularly for the past few weeks, even though I know how to do any of the tasks in question. It’s usually still faster, even when taking the time to anonymize the details; and I don’t paste anything I wouldn’t put on a public gist (lots of “foo, bar”, etc)

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#159

Post by funfunfunction »

bsder wrote: post #153
osterbit2 wrote: post #132

Earlier quoted context omitted.

To anyone who may be pasting code along the lines of 'convert this sql table schema into a [pydantic model|JSON Schema]' where you're pasting in the text, just ask it instead to write you a [python|go|bash|...] function that reads in a text file and 'converts an sql table schema to output x' or whatever. Related/not-related--great pandas docs replacement is another great+safe use-case. Point is, for a meaningful subs…

Do you really think the people asking ChatGPT to write their code can make that abstraction? The fact that the can't do this is the whole reason they have to use ChatGPT.

People aren’t using ChatGPT because they can’t do it themselves, they’re using it to save time.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#160

Post by meghan_rain »

visarga wrote: post #25
meghan_rain wrote: post #13

Earlier quoted context omitted.

Inform us when you figured out a way to host something with the quality of ChatGPT internally :-)

You can use chatGPT inside Azure, like any other service. It's not the same one used by OpenAI, and there are different guarantees. > ChatGPT is now available in Azure OpenAI Service https://azure.microsoft.com/en-us/blog/chatgpt-is-now-availa...

Sorry but the whole point is to not use a closed source third party API with a dubious privacy police ran buy a multinational surveillance capitalism megacorporation.
Post reply on HN