你的提示词是什么？一种针对AI助手的远程键盘记录攻击
What Was Your Prompt? A Remote Keylogging Attack on AI Assistants
AI总结：
本文揭示AI助手加密响应中的令牌长度侧信道，结合LLM翻译、句间上下文及风格微调，实现对ChatGPT-4和Copilot响应的部分重建与主题推断。
摘要：
AI助手正成为社会不可或缺的一部分，人们常就个人及机密问题向其寻求建议或帮助。在本文中，我们揭示了一种新颖的侧信道，可用来读取通过网页传输的AI助手的加密响应：令牌长度侧信道。我们发现，包括OpenAI和微软在内的许多供应商都存在此侧信道。然而，仅凭令牌长度序列推断响应内容颇具挑战性。这是因为令牌类似于单词，而响应可能长达数句，导致存在数百万种语法正确的句子组合。在本文中，我们展示了如何通过以下方法克服这一难题：（1）利用大型语言模型（LLM）的强大能力来翻译这些序列，（2）为LLM提供句间上下文以缩小搜索空间，以及（3）通过对目标模型的写作风格进行微调来执行已知明文攻击。利用这些方法，我们能够准确重建AI助手响应的29%，并成功从55%的响应中推断出主题。为证明该威胁，我们对OpenAI的ChatGPT-4和微软的Copilot在浏览器及API流量上实施了攻击。
英文摘要：
AI assistants are becoming an integral part of society, used for asking advice or help in personal and confidential issues. In this paper, we unveil a novel side-channel that can be used to read encrypted responses from AI Assistants over the web: the token-length side-channel. We found that many vendors, including OpenAI and Microsoft, have this side-channel. However, inferring the content of a response from a token-length sequence alone proves challenging. This is because tokens are akin to words, and responses can be several sentences long leading to millions of grammatically correct sentences. In this paper, we show how this can be overcome by (1) utilizing the power of a large language model (LLM) to translate these sequences, (2) providing the LLM with inter-sentence context to narrow the search space and (3) performing a known-plaintext attack by fine-tuning the model on the target model's writing style. Using these methods, we were able to accurately reconstruct 29\% of an AI assistant's responses and successfully infer the topic from 55\% of them. To demonstrate the threat, we performed the attack on OpenAI's ChatGPT-4 and Microsoft's Copilot on both browser and API traffic.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
