Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

Post reply on HN
Print view View original

221–230 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#221

Post by yathrowaway01 »

croes wrote: post #93
yathrowaway01 wrote: post #81

Earlier quoted context omitted.

Glad I work for a company where the CEO pays for everyones ChatGPT Plus for the devs. If you think your code is special then you're wrong.

You are still transferring your business data to an external entity, but on top of it you pay for it. And if you think that there is no special code then you're wrong.

If you think random snippets of code are special you really don't understand the business you're writing code for. So no, your code is not special, and pasting code snippets is not transferring business data.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#222

Post by pama »

kristianp wrote: post #193
kristianp wrote: post #150

Earlier quoted context omitted.

Does chatgpt plus collect data for training, or does it have more privacy than the free offering?

Replying to myself, it seems your data is still used, unless you fill in a google form to opt out: https://help.openai.com/en/articles/6950777-chatgpt-plus

This Google form requires an organization ID so may not apply to personal GPT+ accounts.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#223

Post by mwhitehead867 »

kristianp wrote: post #193
kristianp wrote: post #150

Earlier quoted context omitted.

Does chatgpt plus collect data for training, or does it have more privacy than the free offering?

Replying to myself, it seems your data is still used, unless you fill in a google form to opt out: https://help.openai.com/en/articles/6950777-chatgpt-plus

ChatGPT & DALL-E (non-API products) are opt-out while their API is opt-in https://help.openai.com/en/articles/7039943-data-usage-for-c...

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#226

Post by px43 »

m000 wrote: post #156
cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

Does US intelligence have access to OpenAI data? Private organizations is one thing. But with all the dopes in government positions around the world, OpenAI logs would probably be a treasure trove for intelligence gathering.

Microsoft is well known for piping data to US intelligence as a service. It's almost certainly why they bought Skype, then removed all the end to end encryption.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#227

Post by AnthonyMouse »

syntaxing wrote: post #205
AnthonyMouse wrote: post #194

Earlier quoted context omitted.

I just run it on my desktop? 64GB of DDR4 is <$150.

I'm assuming a quantized version?

The 65B quantized model fits in 64GB of RAM, which I already had.

Though RDIMMs on eBay are even cheaper than UDIMMs (just over $1/GB) and Broadwell-era Xeon workstations aren't that expensive if you want to run the unquantized version.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#228

Post by est »

phineyes wrote: post #9

Let’s not forget that we’re also feeding in all our code into OpenAI Codex.

Many people like me like to paste stuff into an editor to strip the formats.

And Github Copilot will gather that tiny amount of data to who knows where.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#229

Post by FartyMcFarter »

waboremo wrote: post #123
jackson1442 wrote: post #85

Earlier quoted context omitted.

I think this is different in that ChatGPT is expressly using your data as training in a probabilistic model. This means: * Their contractors can (and do!) see your chat data to tune the model * If the model is trained on your confidential data, it may start returning this data to other users (as we've seen with Github Copilot regurgitating licensed software) * The site even _tells you_ not to put confidential data in…

Sticking it in your own datacenter doesn't really prevent any of these problems (except maybe #2), only now your leaks are internal and because of all the false sense of security, you might wind up leaking far more confidential and specific information (ie. an executive leaking to the rest of the team in advance that they are planning layoffs for noted reasons, whereas that executive might have used more vague terms…

It prevents all of those problems as it puts all the data / data movement under your control.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#230

Post by jerkstate »

my understanding of GPT is that the only vector for your data to get "into the model" is if it's used in fine tuning/RLHF. My guess is if you do the thumbs up or thumbs down, the session probably will be, but otherwise probably not. Still wouldn't put in private employer data primarily because of the other exposure risks - it's obviously not stored securely on the OpenAI side. But besides typical IT risk, the big unknown is whether or not the model will spit out what you put into it in somebody else's session. and my understanding is, that's only possible if your conversation is used for RLHF.

I guess another way to say that is, OpenAI (or another service provider with a better security track record) could broker this service in the cloud, with guarantees around not using the session data for RLHF, not storing session data, stronger auth (OpenAI has had a couple of incidents that show that they have pretty lax security in their backend), etc. and could make a killing selling or re-selling ChatGPT to businesses.

Post reply on HN