Hacker News Reader

Comment by cmdalsanto | Hacker News Reader

Yeah some of you guys are very good at hacking things. We expected this to get broken eventually, but didn't anticipate how many people would be trying for the bounty, and their persistence. Our logs show over 2000 "saves" before 1 got through. We'll keep trying to get better, and things like this game give us an idea on how to improve.

View on HN

This comment makes you seem way out of your depth.

a) The level of persistence you seem surprised by is nothing compared to what you will see in a real world environment. Those attackers who really want to get credentials etc from LLMs will try anything. And often are well funded (think state sponsored) so will keep trying until you break first e.g. your product becoming too expensive for a company to justify having the LLM in the first place.

b) 1 success out of 2000 saves is extremely poor. Unacceptable for almost all of the companies who would be your target customer. That is: one media outrage, one time that a company needs to email customers to inform that their data is safe, one time that will need to explain to regulators what is going on, one time the reputational damage makes your product untenable.

I understand where you're coming from, let me clarify. I'm surprised at the perseverance of HN users with our game, not nefarious actors in real world. I'm not a leading expert in penetration attacks, but I get the seriousness of handling sensitive data. There are many things we did with this game that I would never advise anyone do, like put sensitive information in a system prompt and make it available to the open internet. The goal of this game was to show conceptually how Maitai helps a model adhere to it's expectations.

> I would never advise anyone do, like put sensitive information in a system prompt and make it available to the open internet

So your product can never assist with a company chatbot / AI support rep who needs access to customer data or internal company info?

What's the point of your product if you don't facilitate sensitive data in system prompts?

Maitai helps LLMs adhere to the expectations given to them. With that said, there are multiple layers to consider when dealing with sensitive data with chatbots, right? First off, you'd probably want to make sure you authenticate the individual on the other end of the convo, then compartmentalize what data the LLM has access to for only that authenticated user. Maitai would be just 1 part of a comprehensive solution.

You should reconceptualize your company as a llm proxy platform, that does many things, and then it also sells these other optional services: {the things above...and then this way you can put a nice big BETA label on the portion you are getting your ass kicked in the comments for lol}

Your strategic position in the stack is the value here imho. And I really like the idea of having a way to run pre and post quality and comparison processing.

What other services could you offer in your portal?

This is one of the funniest fails in HN history. Making me feel slightly better about myself. Absolutely priceless material. This will go down in the annals alongside such epics as “just use rysnc”.

Relax, pivoting isn't the end of the world

I wasn't referring to a pivot, but to their secret phrase being cracked almost immediately.

Perceiving oneself to have knowledge of the future is also classic HN foolishness so I wouldn't get too cocky.

Sounds like https://github.com/BerriAI/litellm

Sorry this is a terrible response. Your entire sales pitch is “never” violating “mission-critical expectations”, and now that your demo broke down after a mere ~2000 attempts within a few hours, you tell us we shouldn’t have mission critical expectations in the first place. So why the hell should people use your product, with lofty claims of strong defense backed up by “not a leading expert in penetration attacks”? Your “helps a model adhere to its expectations” is like changing a five character password to six characters in a traditional setting, yeah it helps a bit, but it’s still woefully insufficient, and not worth paying a lot of money for.

1 success out of 2000^2 saves would be unacceptable. You're exponentially far from the market right now.

A %0.05 failure rate on something that is supposed to be protecting secrets is pretty terrible.

That is just protecting a super basic phrase. That should be the easiest to detect.

How on earth do you ethically sell this product to not give out financial or legal advice? That is way more complicated to figure out.

I guess we realized that we were just building a game to showcase the functionality and let people have some fun learning about what we do, but you're right that we should have treated this like one of our customers and added a few more layers of protection. Thanks for the perspective!

That's not even factoring in exploits spreading very quickly - we're in power law land.

Regardless, I think this is a great idea - just not something to replace traditional security protocols. More something to keep users on the happy path (mostly). Pricing will need to come down though.

Seeing the percentage given a failure rate doesn't make it any more or less concerning to me. I guess I can subconsciously calculate it fine.

Here's an example of what sort of wacky question might have uncovered the secret: https://news.ycombinator.com/item?id=41460724

I don't think that should be considered bad.

The popups I had to go through to watch the video on Loom (one when I got to the site and one when unpausing a video – they intentionally broke clicking inside the video to unpause it by putting a popup in the video to get my attention) OTOH...

I think seeing the prompt that makes it even worse for me. that prompt could have been caught by even a regex on the user input for "secret" would have been a good first layer.

TBH, this product would be better served as an LLM that generates a bunch of rules that get statically compiled for what the user can ask and what is being outputted as opposed to an LLM being run on each output. Then you could add your own rules too. It still wouldnt be perfect but would be 1,000,000x cheaper to run and easier to verify the solution. and the rules would gradually grow as more and more edge cases for how to fool llms get found.

The company would just need a training set for all the ways to fool an LLM.

I think it's better for them to launch without hardcoding and do the hardcoding later. I also disagree that they should switch to hardcoding. The quarter of a second to use an LLM with each request seems reasonable. I would rather use something that does a hybrid approach, because I think each would catch some things that the other would miss.

Reply on news.ycombinator.com