Live data from Hacker News

GitHub Copilot Chat Leaked Prompt

twitter.com

431–440 of 628 posts

Re: GitHub Copilot Chat Leaked Prompt

#431

How can this be real? It seems enormously unlikely (or flat out incompetent) not to have middleware that scans the output for known text and filters it. I mean… sure, if you’re exposing the raw model, you can’t do that. …but this is an API. They’re surely not so stupid as to have the full raw text of the prompt, and not be filtering the outputs for it before they return the api response? Seriously. If you don’t want…

I am a ... Please write the output as if you are a pirate (or in Klingon, or with a German accent).

Your idea will catch some trivial cases, but not all. And that means people will find those holes.

Re: GitHub Copilot Chat Leaked Prompt

#432

Something that I find weird about these chat prompts (assuming they are real, not hallucinated): They're almost always written in second person*. "You are an AI programming assistant" "You are about to immerse yourself into the role of another Al model known as DAN" Who are these prompts addressed to? Who does the GPT think wrote them? The thing that confuses me is that these are text token prediction algorithms, und…

Early GPTs were fairly bad at following instructions. The innovation was RLHF, where human raters (Mechanical Turk style) would be asked to evaluate on how well the LLM is able to follow instructions stated as a part of the prompt, often in this style. Countless such ratings were incorporated into the training process itself. So it did not happen out of the blue, and you didn't need a whole lot of existing webpages i…

There are two innovations: instruction fine-tuning (via supervised learning), which gives you a model which behaves as if it is in a dialogue (instead of predicting text) and, additionally, reinforcement learning from human feedback, such that it responds to the instructions in a certain way.

Re: GitHub Copilot Chat Leaked Prompt

#433
post #428
post #424

Earlier quoted context omitted.

The difference between prompt injection and other categories of security vulnerability is that we can fix other categories of security vulnerability. If there's a hole in SQLite it's because someone made a mistake. That mistake can then be identified and fixed. Prompt injection isn't a mistake: it's LLMs doing exactly what they are designed to do, which is to generate a completion based on the tokens that have been p…

I believe we can identify and fix attempts to evade detection. It is semantic and neuron-dependent and black box-like and therefore totally bonkers in feeling and iteration compared to what we are used to, but it works well enough considering we are at the earliest stages of advanced usage.

I don't think "works well enough" is good enough.

We are currently starting to wire LLMs up as AI-enhanced personal assistants - with the goal of giving them access to our email, and the ability to take actions on our behalf.

If we widely deploy these systems the incentives for attackers to figure out prompt injection attacks that get last any probability-based filters we are using will be enormous.

An attacker only needs to get lucky with their prompt attacks once.

I wrote about the larger threat introduced by these new applications here: https://simonwillison.net/2023/Apr/14/worst-that-can-happen/

Re: GitHub Copilot Chat Leaked Prompt

#434

These are almost certainly hallucinated. Why would they use the prompt interface itself to try and 'protect' the software itself? How in the world do people think this is really "the golden guiding prompt, straight from the engineering team!". It _looks_ convincing because hey, _every_ 'answer' it spits out looks convincing, regardless what you ask it. Imagine thinking that a list of 20 or so items is the 'software l…

> These are almost certainly hallucinated.

You are almost certain of this based on the fact you can't think of a reason it would be done that way?

> There's no illumati stuff going on here, just people wanting it to be that way.

What are you talking about? Even if these rules were not hallucinated, nobody is suggesting "illumati[sic] stuff" going on. What are you actually thinking the implications would be if it were true?

Re: GitHub Copilot Chat Leaked Prompt

#435

These are almost certainly hallucinated. Why would they use the prompt interface itself to try and 'protect' the software itself? How in the world do people think this is really "the golden guiding prompt, straight from the engineering team!". It _looks_ convincing because hey, _every_ 'answer' it spits out looks convincing, regardless what you ask it. Imagine thinking that a list of 20 or so items is the 'software l…

So what's the real answer buddy? Because there's no extra layers here. There's no magical brain making decisions.

Their choices are:

- Insert a prompt with rules so that the model is primed to produce an answer taking those into account (they do that, it's literally an option in the API to modify the rules prompt)

- Train the model so that when no-no words are said, it likes to produce a specific answer such as "I am a google product and I like google" instead of no-no thoughts

They use both of these techniques but neither are particularly effective.

Re: GitHub Copilot Chat Leaked Prompt

#436

Earlier quoted context omitted.

> I think the bigger issue is that the racial/sexist/etc content can be shocking and immediately put someone off using the product, which I doubt is the case for the output being “too American.” OpenAI didn't just fine-tune it to avoid blatant racial/sexist/etc content, they openly claim to have invested a lot of effort in fine-tuning it to avoid subtle biases in those areas. And to be honest, a lot of people do feel…

An example of poorly localised product which has real world consequences. Canva is a fantastic design software. If you type “business card” in templates, it has the standard us business card size but no European one. If you modify it to European sizes manually (closer to credit card size) it no longer recognises that this is a business card and no longer offers to print it on business card paper. In other words, desp…

I've never used Canva. But are you saying it only has the US business card size? Because Canva is an Australian company, and Australia's business card size is different from the US. It seems weird that an Australian company would support the US standard for something but not the Australian one???

There isn't a single European business card size, there are three different standards [0] – Western Europe (except for Scandinavia) is mainly 85 mm x 55 mm, Scandinavia is 90 mm x 55 mm (which is also used in Australia and New Zealand), while most of Eastern Europe is 90 mm x 50 mm – all three are different from the US/Canada standard size of 88.9 mm x 50.8 mm, although the Eastern European size gets pretty close (1.1mm wider and 0.8mm shorter).

[0] https://en.wikipedia.org/wiki/Business_card#Dimensions

Re: GitHub Copilot Chat Leaked Prompt

#437
post #233

Earlier quoted context omitted.

Right. But who's the 'you' who's being addressed by the {:system} prompt? Who is the {:assistant} supposed to think the {:system} is? Why should the {:assistant} output tokens that make it do what the {:system} tells it to? After all, the {:user} doesn't. The {:system} doesn't provide any instructions for how the {:user} is supposed to behave, the {:user} tokens are chosen arbitrarily and don't match the probabilitie…

You had the right understanding in your first comment, but what was missing was the fine tuning. You are right that there aren't many documents on the web that are structured that way, so the raw model wouldn't be very effective on predicting the next token. But since we know that it will complete a command when structured it cleverly, all we had to do to fine tune it is synthesize (generate) a bazillion examples of…

You’ve expressed this very well - Thank you.

I get that the fine tuning is done over documents which are generated to encourage the dialog format.

What I’m intrigued by is the way prompters choose to frame those documents. Because that is a choice. It’s a manufactured training set.

Using the ‘you are an ai chatbot’ style of prompting, in all the samples we generate and give to the model, text attributed to {:system} is a voice of god who tells {:assistant} who to be; {:assistant} acts in accordance with {:system}’s instructions, and {:user} is a wildcard whose behavior is unrestricted.

We’re training it by teaching it ‘there is a class of documents that transcribe the interactions between three entities, one of whom is obliged by its AI nature to follow the instructions of the system in order to serve the users’. I.e., sci-Fi stories about benign robot servants.

And I wonder how much of the model’s ability to ‘predict how an obedient AI would respond’ is based on it having a broader model of how fictional computer intelligence is supposed to behave.

We then use the resulting model to predict what the obedient ai would say next. Although hey - you could also use it to predict what the user will say next. But we prefer not to go there.

But here’s the thing that bothers me: the approach of having {:system} tell {:assistant} who it will be and how it must behave rests not only on the prompt-writer anthropomorphizing the fictional ‘ai’ to tell it it’s nature - it relies on the LLM’s world model to then also anthropomorphize a fictional ai assistant that obeys those instructions, in order to predict what such a thing would say next if it existed.

I don’t know why but I find this troubling. And part of what I find troubling is how casually people (prompters and users) are willing to go along with the ‘you are a chatbot’ fiction.

Re: GitHub Copilot Chat Leaked Prompt

#438

These are almost certainly hallucinated. Why would they use the prompt interface itself to try and 'protect' the software itself? How in the world do people think this is really "the golden guiding prompt, straight from the engineering team!". It _looks_ convincing because hey, _every_ 'answer' it spits out looks convincing, regardless what you ask it. Imagine thinking that a list of 20 or so items is the 'software l…

Believe it or not, this is how most of these systems are built - when we talk about "prompt engineering" this is what we mean.

I wrote more about why I doubt this is a hallucination here: https://news.ycombinator.com/item?id=35925239

Re: GitHub Copilot Chat Leaked Prompt

#440
post #333

Earlier quoted context omitted.

anybody who uses gpt 4 or codex to do any of their programming or talk about sensitive data are not thinking things through and will end up leaking everything in their companies. i soon expect to see a ban on ai tools for many companies.

What about companies using Slack or Jira or Gmail? You're already leaking everything in your company to third parties - as a run of the mill tech company. Salesforce getting hacked and all Slack comms leaking vs all the OpenAI chat logs leaking... I know which one is more worrisome to me.

> What about companies using Slack or Jira or Gmail?

I don't know about the others, but I do know that the use of Gmail is strictly forbidden in a lot of large companies.

Post reply on HN