Computer Science > Artificial Intelligence
[Submitted on 30 May 2024 (v1), last revised 22 Aug 2024 (this version, v2)]
Title:Unmasking Context Injection on Interactive Large Language Models
View PDF HTML (experimental)Abstract:Large Language Models (LLMs) such as ChatGPT and Llama have become prevalent in real-world applications, exhibiting impressive text generation performance. LLMs are fundamentally developed from a scenario where the input data remains static and unstructured. To behave interactively, LLM-based chat systems must integrate prior chat history as context into their inputs, following a pre-defined structure. However, LLMs cannot separate user inputs from context, enabling context injection. This paper introduces a methodology to systematically inject misleading context (i.e., chat history) into LLM conversations without prior knowledge of the target model. We formalize context injection through a response retrieval task and propose an LLM-Guided Genetic Algorithm (LLMGA) to create effective injection prompts, leading the target LLM to recognize injected context as genuine. We explore how context injection can be used to elicit disallowed content, posing risks of illegal actions and inappropriate responses. Our elicitation strategies, including acceptance elicitation and word anonymization, can effectively elicit disallowed responses with success rates reaching 97% on ChatGPT. Comprehensive evaluations on real-world LLMs including ChatGPT and Llama-2/3 demonstrate the efficacy of LLMGA and our injection strategies. We also discuss potential countermeasures that can be adopted for detecting injection and developing more secure models. Our findings provide insights into the challenges associated with the real-world deployment of LLMs for interactive and structured data scenarios.
Submission history
From: Cheng'an Wei [view email][v1] Thu, 30 May 2024 16:36:47 UTC (1,961 KB)
[v2] Thu, 22 Aug 2024 18:17:38 UTC (2,193 KB)
References & Citations
Bibliographic and Citation Tools
Bibliographic Explorer (What is the Explorer?)
Litmaps (What is Litmaps?)
scite Smart Citations (What are Smart Citations?)
Code, Data and Media Associated with this Article
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub (What is DagsHub?)
Gotit.pub (What is GotitPub?)
Papers with Code (What is Papers with Code?)
ScienceCast (What is ScienceCast?)
Demos
Recommenders and Search Tools
Influence Flower (What are Influence Flowers?)
Connected Papers (What is Connected Papers?)
CORE Recommender (What is CORE?)
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.