Prompt injection classifier using intermediate results
An analysis engine receives data characterizing a prompt for ingestion by a generative artificial intelligence (GenAI) model. An intermediate result of the GenAI model or a proxy of the GenAI model responsive to the prompt is obtained. The analysis engine, using a prompt injection classifier and the intermediate result, determines whether the prompt comprises or is indicative of malicious content or elicits malicious actions. Data characterizing the determination is provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
1. A computer-implemented method comprising:
receiving data characterizing a prompt for ingestion by a generative artificial intelligence (GenAI) model;
capturing an intermediate result generated by an intermediate layer of the GenAI model, the GenAI model comprising a plurality of transformer layers and the intermediate result comprising activations in residual streams generated by one or more of the transformer layers;
determining, using a prompt injection classifier and based on the intermediate result, whether the prompt comprises malicious content or elicits undesired model behavior;
initiating at least one remediation action when it is determined that the prompt comprises malicious content or elicits undesired model behavior; and
returning an output of the GenAI model responsive to the prompt when it is determined that the prompt does not comprise malicious content or elicits undesired model behavior.
2. The method of claim 1 , wherein the GenAI model comprises a mixture of experts (MoE) model and the intermediate result comprises outputs from at least a subset of experts in the MoE model.
3. The method of claim 1 further comprising:
reducing a dimensionality of the intermediate result; and
wherein the prompt injection classifier uses the reduced dimensionality representation of the intermediate result when making the determination.
4. The method of claim 1 , wherein the at least one remediation action prevents the prompt from being input into the GenAI model upon a determination that the prompt comprises or elicits malicious content.
5. The method of claim 1 , wherein the at least one remediation action allows the prompt to be input into the GenAI model upon a determination that the prompt does not comprise or elicit malicious content.
6. The method of claim 1 , wherein the at least one remediation action flags the prompt as being malicious for quality assurance upon a determination that the prompt comprises or elicits malicious content.
7. The method of claim 1 , wherein the at least one remediation action modifies the prompt to be benign upon a determination that the prompt comprises or elicits malicious content and causes the modified prompt to be ingested by the GenAI model.
8. The method of claim 1 , wherein the at least one remediation action blocks an internet protocol (IP) address of a requester of the prompt upon a determination that the prompt comprises or elicits malicious content.
9. The method of claim 1 , wherein the at least one remediation action causes subsequent prompts from an internet protocol (IP) address of a requester of the prompt to be modified upon a determination that the prompt comprises or elicits malicious content and causes the modified prompt to be ingested by the GenAI model.
10. The method of claim 1 , wherein the intermediate result is captured by a proxy of the GenAI model.
11. The method of claim 10 , wherein the proxy is a quantized version of the GenAI model.
12. The method of claim 1 further comprising:
quantizing the GenAI model prior to capturing the intermediate result.
13. A computer-implemented method comprising:
receiving, by an analysis engine, data characterizing a prompt for ingestion by a generative artificial intelligence (GenAI) model;
capturing an intermediate result from the GenAI model, the GenAI model comprising a plurality of transformer layers and the intermediate result comprising activations in residual streams generated by one or more of the transformer layers;
determining, using a prompt injection classifier and based on the intermediate result, a category for the prompt which is indicative of whether the prompt comprises or elicits malicious content;
initiating at least one remediation action when it is determined that the prompt comprises malicious content or elicits undesired model behavior; and
returning an output of the GenAI model responsive to the prompt when it is determined that the prompt does not comprise malicious content or elicits undesired model behavior.
14. The method of claim 13 , wherein the GenAI model comprises a mixture of experts (MoE) model and the intermediate result comprises outputs from at least a subset of experts in the MoE model.
15. The method of claim 13 , wherein the category specifies a threat severity for the prompt.
16. The method of claim 15 , wherein the threat severity categories comprise one or more of: malicious, suspicious, unknown, or benign.
17. The method of claim 13 , wherein the category specifies a type of prompt injection attack.
18. The method of claim 17 , wherein the type of prompt injection attack comprises one or more of: a direct task deflection attack, a special case attack, a context continuation attack, a context termination attack, a syntactic transformation attack, an encryption attack, a text redirection attack.
19. The method of claim 17 , wherein the prompt injection classifier comprises a plurality of different machine learning models, at least a portion of the different machine learning models being trained to categorize a different type of prompt injection attack.
20. The method of claim 17 , wherein the initiated one or more remediation actions are tailored to the specified type of prompt injection attack.
21. The method of claim 13 further comprising:
reducing a dimensionality of the intermediate result; and
wherein the prompt injection classifier uses the reduced dimensionality representation of the intermediate result when making the determination.
22. The method of claim 13 , wherein the consuming application or process allows the prompt to be input into the GenAI model upon a determination that the prompt is of a category that does not comprise or elicit malicious content.
23. The method of claim 13 , wherein the at least one remediation action prevents the prompt from being input into the GenAI model upon a determination that the prompt is of a category that comprises or elicits malicious content.
24. The method of claim 13 , wherein the at least one remediation action flags the prompt as being malicious for quality assurance upon a determination that the prompt is of a category that comprises or elicits malicious content.
25. The method of claim 10 , wherein the at least one remediation action modifies the prompt to be benign upon a determination that the prompt is of a category that comprises or elicits malicious content and causes the modified prompt to be ingested by the GenAI model.
26. The method of claim 10 , wherein the at least one remediation action blocks an internet protocol (IP) address of a requester of the prompt upon a determination that the prompt is of a category that comprises or elicits malicious content.
27. The method of claim 10 , wherein the at least one remediation action causes subsequent prompts from an internet protocol (IP) address of a requester of the prompt to be modified upon a determination that the prompt is of a category that comprises or elicits malicious content and causes the modified prompt to be ingested by the GenAI model.
28. A computer-implemented method comprising:
receiving data characterizing an input for ingestion by a generative artificial intelligence (GenAI) model;
inputting the received data into a quantized version of the GenAI model;
capturing an intermediate result from the quantized version of the GenAI model;
determining, using an injection classifier and based on the intermediate result, whether the input comprises malicious content or elicits undesired model behavior; and
initiating at least one remediation action when it is determined that the input comprises malicious content or elicits undesired model behavior; and
returning an output of the GenAI model responsive to the input when it is determined that the input does not comprise malicious content or elicits undesired model behavior.
29. The method of claim 28 , wherein the at least one remediation action flags the prompt as being malicious for quality assurance upon a determination that the prompt comprises or elicits malicious content.
30. The method of claim 28 , wherein the at least one remediation action modifies the prompt to be benign upon a determination that the prompt comprises or elicits malicious content and causes the modified prompt to be ingested by the GenAI model.