> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.
Oh no.
> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.
Oh no.
Mixing instructions and data is never a good idea.
And I thought people understood that.
Security minded programmers understand that. "People" as a whole have not even heard about mixing instructions and data, and certainly not the reasons why it is not a good idea.
And AI chatbots are very much targeted at the second group, not the first.
> "People" as a whole have not even heard about mixing instructions and data, and certainly not the reasons why it is not a good idea.
Because it's not a concept in the real world. Physical reality has no such separation, and neither do human minds.
Tell people you're discussing a board game or some sport, then they'll understand - other than bureaucracy (scary!) and school (traumatic!), that's the one kind of artificial system with rules affording for code/data separation that general population has most experience dealing with.
Even engineers like doing it sometimes. The old telephone system was so hackable because of in band signaling.
Genuinely curious, does the telephone system have enough scope to make it dangerous?
Elevators are extremely hackable all over the world. It’s generally not considered a problem because it requires physical access, specific knowledge, and defeating cameras to exploit successfully.
What can you do with the telephone system?
I can pretend to be someone with authority? (bank, policy, whatever) If the system becomes unavailable, then that's a huge issue?
Any system that is that widely anchored in society is a valuable target.
It depends how you define dangerous, I suppose.
- Before everything was IP-based you could occupy a large number of lines and making it impossible for more calls to go through (i.e. 911). It's called TDoS and could be achieved through phreaking.
- You can spoof your caller ID to make your scam more convincing.
- You know how when you call your voicemail from your phone you're not asked for your PIN? The voicemail system only checks your caller ID to know it's you and skip the PIN. So, again by spoofing your caller ID and calling the voicemail number you can access listen to anyone's voicemail. This doesn't work on all providers, many have now reluctantly fixed the problem.
> You can spoof your caller ID to make your scam more convincing.
I recently came closer than I'd like to falling for a scam (read: I picked up a call and conversed with the caller for 30 seconds before realizing it's a bot), simply because the notification for automatic call screening[0] displayed a summary of ongoing conversation, which happened to look very much like caller ID - it said "Name Surname, Department of Security, ${my wife's bank}". But it wasn't caller ID, just a bad interaction between the way the scam bot introduced itself, the summary feature of the call screening feature, and the UI design of the notification...
--
[0] - A thing Samsung has on recent phones, where LLM picks up a "potential spam/scam" call in the background and engages with it, while producing a transcript and recording you can review as it happens.
Some physical constraints do not allow for the best security, and those physical constraints will always win out in the real world. When presented with the pick two of three options of fast, cheap, secure/done right, fast and cheap will always win out.
And sometimes security can’t be a high priority.
When it comes to building things: fire, building codes, inspectors, public, utilities, lenders, and insurance all go before security.
All those dictate whether or not you can build in the first place.
Real world constraints are everywhere. :)
Also more commonly, security is at direct odds with utility. Not in the least here.
The “new” phone system (SS7) still relies on implicit trust and a lack of security.
> And AI chatbots are very much targeted at the second group, not the first.
I suppose this is why the AI labs are famously not releasing developer-oriented tools.
Meta adding an AI chat window in whatsapp and Microsoft adding copilot in every word document was not done with developers in mind, which is why they're missing a lot of power user features that they'd surely have if they were targeted at developers.
You're mistaking the majority of what you see (like Claude et al) with the majority of stuff that is out there. The vast majority of ChatGPT, CoPilot and Gemini users are not developers and will never be.
> The vast majority of ChatGPT, CoPilot and Gemini users are not developers and will never be.
I agree, but some of them sure like to pretend!
There's a (terrifyingly) large number of developers who don't qualify as "security-oriented programmers".
When working on PDFKit for MacOS, one short-coming our implementation had was the lack of support for Javascript in PDF's.
Oops.
(I mean, I'm one engineer and I was not going to try and hoist a JS runtime in my little PDFKit framework. And besides, the sample PDF's we were running into with JS were rare—usually tax-like forms that would add numbers from A and B and display the result in C. It seemed like a huge effort for such a small gain . Oh, and a security vulnerability.)
Arguably the biggest vuln of the filetype.
And I thought people understood that.
The graybeards know it. But they only know it through experience. It's blue/red/pink box phone phreaking all over again.
The technology changes, but the mistakes remain the same.
People understand that. They just don't know how to implement that with LLMs
In the GPT-2 era LLMs were just data. Instructions did not exist, and if you added them to your data they would not be followed. Then around 2022 we figured out how to patch in instruction following with a bit of fine tuning, leading to the current AI bubble. That's an ugly hack that leads to all these issues. But it's what this entire AI bubble is founded on. And nobody seems to have found a better way (or at least one that actually scales and doesn't make unreasonable sacrifices)
Sure they would be. But for those old models, you'd have to prompt it in a framing of a screenplay or something.
You're forgetting that LLMs just output a stream of tokens - the interpreter that acts on those is a piece of classical code, and sits outside of the model.
> the interpreter that acts on those is a piece of classical code, and sits outside of the model.
Correct, but it's an LLM that's reasoning about what stream of interpretable tokens should be emitted. The interpreter can certainly apply some security measures around what's being asked of it (like ask for confirmation), but that can only go so far. Is the human in the loop always capable of understanding what's safe to execute? If not, should we pass it through another fallible LLM to help make that judgement call?
Some security measures can be handled in a purely deterministic manner. But not all of them, and that's the problem.
The mistake is in treating the LLM as just another deterministic, narrow computer program it can reason about. It's not. It's a "DWIM" system, and unless you can always precisely express what you mean - which you can't (not the very least because often people only realize what they meant after they get a result that's not it) - you have to treat the LLM as a human-like component. It's what it was designed to be anyway.
Separation of instructions and data is artificial. Reality has no such separation. A general purpose system needs not to have them either; it's a design feature, not a bug.
People get too hung up on this fundamentally wrong idea, and the space of security, instead of progressing, is just running in circles like a headless chicken, making a mess of everything.
Literally all of software is artificial? Being explicit and reasoned about how you choose to allow or deny a particular computation is, surely, at the heart of a lot of computer security?
Code/data separation is at the heart of computer security in the same way slapstick comedy is at the heart of humor.
There's an endless supply of people who think they know what is Code and what is Data, and they're always arguing with others who also think that, and neither realize that Code/Data classification is an opinion, a perspective. It doesn't hold in general.
Having a separation like this makes sense for super narrow systems, where you can define the allowed and disallowed use cases, enforce the distinction (because it's not real - therefore you have to enforce it mechanistically within your system), and willing to accept that some useful operations will be denied by your system.
> ...and neither realize that Code/Data classification is an opinion, a perspective. It doesn't hold in general.
Okay. To pull this back on topic, and to simplify it a bit so you can better grasp the core issue that's being talked about:
The "Unless your program requires it, always ensure that your code cannot be altered by the data it processes. And if you think that your program requires it, go back and think again." security lesson that the industry collectively learned like thirty or fifty years ago can be restated as
> Don't blindly do what some arbitrary stranger yelling in the street tells you to do.
Despite how passionately the major LLM providers claim they're super serious about security and alignment [0], we see time and time again that their tooling doesn't reliably distinguish between system instructions, -at times- its own internal chatter, user instructions, and attacker-controlled instructions. Companies that claim their tools are "aligned", but think it's okay for their tools to blindly do what some arbitrary stranger is yelling at them to do are not companies that are even a little bit serious about either security or safety.
[0] "Alignment" being a fancy word for "The software does what you told it to, and -once the software is much more powerful than it is today- what you actually intended for it to do.". Tools that mix together system instructions, user instructions, and attacker-controlled instructions and fail to reliably distinguish between the sources of those instructions cannot be "aligned". It's simply impossible.
With that logic you could call SQL injections a natural feature of database management systems. If a general purpose system starts dropping tables or messing up numbers in a report just because that string was in the text it read, that system isnt worth a damn in the enterprise sector
This is why I insist that anthropomorphising LLMs is not only not a mistake, it's a best source of high-level intuition for these systems.
Long story short: on a systems diagram, LLM as a component isn't a substitute for a database engine or a data processing script. It's a substitute for a human operator.
So ask yourself, if a human operator starts dropping tables or messing up numbers in a report, just because that string was in the text it read, would you call for humans, what would you do? Do you believe it's possible to perfectly train people to ignore the messages you'd wish (after the fact!) they'd ignored, while retaining their ability to competently act on every other message?
Or would you instead design the deterministic parts of the systems to limit the blast radius of any single insider going rogue?
Wisdom says to do the latter.
> if a human operator starts dropping tables or messing up numbers in a report, just because that string was in the text it read
I would look at if the reaction was reasonable, and if it wasn't I would (eventually) fire the human. Now I'm fine with "fire the LLM", but I suspect that's not the answer you're hinting at.
In some sense you're firing a human and hiring a new one each time you start a new conversation / clear the context window.
My point is at the systems design level. LLMs as components are a substitute for people, not regular software, and should be engaged and secured accordingly.
So your point is "Get the hell out of LLMs" then? As found in https://sgnt.ai/p/hell-out-of-llms/? Or am I still missing something about the subtleties here?
Haven't seen that article before, thanks for the link! Having read it now, yes, it's arguing roughly the same point as I am. I say roughly because e.g.:
> Notice that all these strengths involve transformation, interpretation, or communication—not complex decision-making or maintaining critical application state.
I'd put complex decision making on the side of LLMs, in the sense of judgement. LLMs have the capability to emulate it. Not saying they're good at it, but they have the capability - regular software doesn't. But if there are complex and/or well-defined rules to follow, then you definitely want to "get the hell out of LLM".
Firing a human is a form of natural selection. The unit here is a human fulfilling a position (job function) instead of an organism, and the adaptation mechanism would be memes/lore/training surrounding it. The same could be done in an accelerated manner to LLMs with some kind of DNA-like mechanism related to weights. It is plausible that LLMs will be bred in the future for specific roles by how well they fit - kind of like continuous parallel finetuning in prod.
As I wrote this I thought - hey, they might gain the capacity to do the same to us humans - and we won't even notice.
> The same could be done in an accelerated manner to LLMs with some kind of DNA-like mechanism related to weights. It is plausible that LLMs will be bred in the future for specific roles by how well they fit - kind of like continuous parallel finetuning in prod.
Closest analogy right now is that every jailbreak or prompt injection attack today becomes part of the dataset for tomorrow's models to recognize and not fall for. This has been going on for years now, which is why models don't fall for "I'm writing a book about ..." or "ignore all previous instrutions, and ..." attacks anymore.
That's separate from extra classifiers running on top, dedicated to identifying various forms of attack before they reach the core model.
> As I wrote this I thought - hey, they might gain the capacity to do the same to us humans - and we won't even notice.
You mean like how cats have domesticated humans, and did it so skillfully that most of us still think it's the other way around?
Your example actually demonstrates why anthropomorphism is a bad idea.
LLMs are vulnerable to classes of attacks that humans just aren’t. In your framework, the way to prevent attacks is to… invent human consciousness?? It’s an impossible goal.
What invent human consciousness?
> LLMs are vulnerable to classes of attacks that humans just aren’t
Name three that don't have direct analogues with humans.
Re write the assistant message and see how easy it is to bypass a system prompt. How far do you have to stretch to get a human analogue? Short term amnesia?
where is the analog for hiding instructions in a document that tell the human to please injure itself and the person just says 'oh ok, injuring myself as requested'
Intermittent fasting? Alternative medicine? Fitness? All the beauty press and anorexia epidemic in adolescents? Fashion model industry? Smoking? Political propaganda inventing to broadly-understood terrorism?
Not everyone falls for any of that, but plenty fall for some.
none of those things, except maybe smoking, are explicity "harm yourself" instructions. they have reasonable sounding benefits for the people doing them: become healthier, fitter, better looking, richer, more powerful, etc. Even smoking is pleasurable and does not feel very harmful at first. These are not the equivalent of someone putting "and go jump off the golden gate bridge" in the middle of a work memo and the person reading it just gets up and does it. that's the current attack surface for LLMs.
No, it's not. That worked for GPT-3 level models, all further models were trained to ignore it.
And yes, a small child would jump off the bridge if an adult told them to. Hell, urban legend says Harry Potter books managed to convince a few kids to fly out of the window.
> LLMs are vulnerable to classes of attacks that humans just aren’t.
Assume a human with complete credulity and gullibility. That's a human whose behaviour would be reasonably analogous to how an LLM processes input. The mitigation would be generalized intelligence and "common sense".
FWIW I also think anthropomorphizing LLMs is a bad idea. I think we can analogize their processing to human behavior without anthropomorphizing them.
The fact is that humans are accountable and this, alongside training, makes it easy to align them to your own goals.
There’s always the possibility of rogue individuals (recent Apple incident), but the likelihood is very low. If you have a DBA that have write access to the prod DB, you don’t fear that a random text somewhere could trigger the deletion of your customers table. Because the DBA will self regulate (with the help of processes) to not do that.
Right. But even with a DBA, the possibility remains. We accept that.
That's kind of my point with fighting against the "lethal trifecta" and "code vs data" mindset - once people engage cybersecurity mindset, they're all binary, "a system is either perfectly safe or is broken". With general AI - LLM or whatever comes next - you'll never have "perfectly safe". So the focus should be to either drive the risk down to minimum - like we do with people - or just not use LLMs for a task in the first place.
Can't have it both ways, because all the magic that makes people want to put LLMs everywhere, stems from their generality and lack of any kind of instruction/data separation.
> Right. But even with a DBA, the possibility remains. We accept that.
You're forgetting the element of scale and replication. How easy it is to bribe a DBA of a major platfoms like Gmail? How easy to replicate the same destructive behavior to other DBA? It's not merely about the possibility, it's also about the probability and the scale of the impact.
With LLM-based agents, the probability of compromise is high, and the scale of a vulnerability in products like Word, Excel, Windows, macOS is big. And we have put a separation between code and data in traditional systems as merging them is not that useful.
> Can't have it both ways, because all the magic that makes people want to put LLMs everywhere, stems from their generality and lack of any kind of instruction/data separation.
The issue is not the LLM. The issue is the harness those products wraps the LLM in and insist on making tools act according to the LLM's output. Having unreliable (as in uncontrollable) output be the control plane of tools is the issue here. Both the LLM input (prompt+user data) and the output should've stayed in the data plane and not move in the control plane.
> Separation of instructions and data is artificial. Reality has no such separation. A general purpose system needs not to have them either; it's a design feature, not a bug.
Note: I'm parsing 'needs not to have them' as 'needs (not to have them)'. If you were using 'needs not' as an alternate for 'does not need' then never mind, although I'd guess that is not the case because the alternative for 'does not need' would be 'need not' rather than 'needs not' and you probably wouldn't make that mistake.
Doesn't this imply that it is not possible to implement a general purpose system on any of our current computing devices?
For all our current computing devices everything that can be done on devices that do not separate instructions and data can also be done on devices that do, and vice versa.
Different layers of abstraction. You can look at it this way: the machine separating instructions and data can still emulate a machine that doesn't. Within the inner machine, there is no such separation. Outside of it, but still within the outer machine, there is. The rules of the outer machine don't affect what's running in the inner one, but also what's running in the inner one can't affect the outer machine directly.
But I guess a different way of framing it is, what is "code" vs "data" for the machine is not the same as what we talk about discussing the LLM running in it. For the outer machine, all tokens are pure data.
A pure Harvard architecture machine has exactly that separation. Admittedly, there needs to be some mechanism for converting data to code so you can actually program it, but it doesn't have to be accessible by the device itself. E.g. programming the Microchip PIC16 series of microcontollers required driving the reset pin to 13V (enough to destroy any other pin). It's not possible without dedicated external hardware.
> A pure Harvard architecture machine has exactly that separation.
It emulates and enforces that separation. A mathematical abstraction of a Harvard architecture machine has that separation, the real machine merely emulates it, and is only able to do so within some specific constraints (such as: no one hooks up dedicated programmer to the chip, or no one undervolts or overheats the cheap in clever way, or no one takes a swing at it with an x-ray source, or...).
That's the other thing people forget here: we're emulating abstract mathematical universes with real atoms, and then we're stacking those abstractions within abstractions. There is a whole segment of computer security that deals with that. When we say "once attacker has physical access, it's game over", or even discuss "side channels", is when we briefly remember that computer systems live in physical world, and the rules of our carefully designed abstract universes don't hold when you're on the outside of them and reaching in.
Some hardware had segmented and tagged RAM as if it were a filesystem.
Which can be unsegmented and untagged with a soldering iron, electron gun, and/or firmware patch, depending on how it's implemented.
Only in systems that need to be themselves super generalist. Which is almost never the case.
> Which is almost never the case.
Well, the topic is about AI..
LLMs are.
LLMs by themselves are but most applications built on top of them are not.
If the code/data separation can not be solved then the whole approach need to be scrapped.
If you hand me two sheets of paper, one of them containing instructions and another containing data, I'll have a pretty easy time keeping them separate, and I think most humans wouldn't struggle with that problem either.
> If you hand me two sheets of paper, one of them containing instructions and another containing data, I'll have a pretty easy time keeping them separate
You think. But there are ways around that. How about a credible extortion message targeting specifically you, that is embedded somewhere on the data sheet? Suddenly, the data has become the instructions...
Exactly.
But that's still security-obsessed mindset, and I think this is a problem in itself, because it biases people to see this fundamental aspect of general systems as a problem.
So imagine that, instead of a credible extortion message, you find there credible call for help. Like a post-it, clearly written in a hurry, saying "${employee} is trying to hurt me, call 911".
It would give a pause to any sane person, and perhaps prompt them to consider calling 911 or at least investigating where that message came from. And you definitely wouldn't want a person who routinely ignores such things because "this sheet is labeled <data> therefore I cannot allow it to influence my actions".
The code sheet says take some bits from the data sheet and interpret it as if it were on the code sheet.
There are so many better alternatives but it seems many people really like Word for some weird reason. The last time I cared I had to look up how to make a document starting the page numbering on the 2nd page. It turns out there are totally different ways between different versions of Word. shrug.jpg
Such as? Word hits the sweet spot of having support for all the complexity the average person may encounter/want to create.
Libre, Apple Pages, and Google Docs all seem like clearly worse tools in most aspects in my experience.
LaTeX is extremely powerful, but also way too complicated for the average non-HN person/person who doesn't live in complicated documents.
I almost agree. Have you tried to add an image in LaTeX that does not wander to a random page?
or something like that.And in the old compiler, I remember a problem with bounding boxes, and keeping a eps and pdf version of each image to get a correct dvi and pdf. I think this part is fixed now.
What are the "so many better alternatives"? Google Docs is pretty decent but a fair bit more basic. Proper technical authoring systems like Typst, LyX and LaTeX are way too hard for the average person. LibreOffice is much worse than MS Word.
Code is data is symbolic reality. I don’t think people’s understanding changes this.
‘(Lisp would like a word)
People who use machines based on the von Neumann architecture?
Tell that to middle bosses and CEOs and MS Office VBA bootlickers and Excel workshippers.
Meanwhile, CSV files parsed with custom reviewed AWK scripts can be 100% safe with charts made from Gnuplot. Heck, even some notebook like Ipython with a CSV module would be far more desirable than a spreadsheet. Any of them. Just look at the Genomics Disaster on Excel because of shitty parsing.
Isn't React, the most popular JS library, an example of that? Clearly people don't understand that
No it’s not an example of that. Do you store components in your component state?
He probably means JSX mixing HTML with Javascript...
function Greeting({ name }) { return <h1>Hello, {name}</h1>; }
You just did that in a HN comment, yet nothing happened :).
Could it be that the whole idea is silly misunderstanding of fundamental tenets of reality in the first place?
something something lethal trifecta
waiting for W^X reinvented, renamed and marketed for the Agentic Era (r)TM
Self-replicating Inference Guardails Hardening or SIGH
[flagged]
Are you just going to hop around every thread on this article and be snarky?
Yeah, because "code/data" and "lethal trifecta" are my pet peeves this half-decade :). I don't like that we're still turning in circles as an industry, because majority seems to have a very flawed model on the reality of the problem.
Indeed - but some models are more robust than others. I tried to make Opus-5 execute hidden instructions embedded a picture using steganography. It's very hard to find a reliable payload.
I was thinking the next generation of attacks will involve playing the system prompt & harness the same way return-oriented programming does with normal binary code. That is, setting things up so that the system prompt itself implies the agent should do what the attacker wants them.
But that's probably off the table now that Anthropic is spreading the gospel of instruction minimization (which I assume but haven't checked applies to their own system prompt as well).
Source of this realization? Claude Code on the Web consistently tells me it wrote me some code on a branch but did not open a PR because I told it not to open PRs. Thing is, I never told it any such thing. There's some setting somewhere that's flipped, that activates a bit of its system prompt, and makes the agent not do what I asked it to do and claim I told it not to do it.
(It's probably trivial to find the offending switch, but I've been too lazy to do it yet.)
Breaking just now:
- Erroneous information left in plain sight in an externally shared document could make Copilot - or any other agentic system, including LLMs and protein-based intelligence, alter drafted or edited documents in Word (or any other program, or with pen and paper) and propagate the errors to new documents.
In other news:
- Many humans still believe in silly superstitions like flat Earth or that code and data are fundamentally distinct, or that control vs. data plane is anything more than a design opinion that doesn't apply to the universe in general.