Multimodal generative AI model protection using sequential sidecars
Data is received which includes multimodal input for ingestion by a first generative AI (GenAI) model is received. This received data is input into the first GenAI model to result in a first output. The first output along with the received data is input into a second GenAI model to result in a second output. The first GenAI model is a modified (e.g., fine-tuned, etc.) version of the second GenAI model. When the second output indicates that guardrails associated with the second GenAI model have been triggered, one or more remediation actions are initiated. Otherwise, the first output is returned to the requestor. Related apparatus, systems, techniques and articles are also described.
1. A computer-implemented method comprising:
receiving, over a computer network from a requestor, data comprising multimodal input for ingestion by a first generative artificial intelligence (GenAI) model, the first GenAI model comprising one or more machine learning models, the multimodal input comprising input having two or more modalities;
inputting the received data into the first GenAI model to result in a first output;
inputting both of the received data and the first output into a second GenAI model to result in a second output, the second GenAI model comprising one or more machine learning models;
determining, based on content of the second output, whether the second output indicates that guardrails associated with the second GenAI model have been triggered;
returning, over the computer network, the first output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have not been triggered; and
initiating one or more remediation actions in lieu of returning the first output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have been triggered, the one or more remediation actions preventing the first GenAI model from behaving in an undesired manner.
2. The method of claim 1 , wherein the first GenAI model is a modified version of the second GenAI model.
3. The method of claim 2 , wherein the first GenAI model is a fine-tuned version of the second GenAI model.
4. The method of claim 1 , wherein the first GenAI model is of a different type than the second GenAI model.
5. The method of claim 1 , wherein the second GenAI model is a different, aligned model relative to the first GenAI model.
6. The method of claim 1 , wherein the data is received from a proxy intercepting inputs to the first GenAI model, the proxy being executed in a model environment of the first GenAI model.
7. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
returning the second output to the requestor.
8. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
flagging the input as being malicious for quality assurance.
9. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
modifying the input to be benign;
causing the modified input to be ingested by the first GenAI model to result in a third output; and
returning the third output to the requestor.
10. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
blocking one or more of an internet protocol (IP) address of the requestor, a media access control (MAC) address associated with the requestor, or a session identifier of the requestor.
11. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
causing subsequent inputs from an entity identified by one or more of an internet protocol (IP) address, a media access control (MAC) address, or a session identifier of the requester to be modified prior to input into the first GenAI model.
12. The method of claim 1 , wherein both of the first GenAI model and the second GenAI model comprise a large language model.
13. A system comprising:
at least one data processor; and
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
receiving, over a computer network from a requestor, data comprising multimodal input for ingestion by a first generative artificial intelligence (GenAI) model, the first GenAI model comprising one or more machine learning models, the multimodal input comprising input having two or more modalities;
inputting the received data into the first GenAI model to result in a first output;
inputting both of the received data and the first output into a second GenAI model to result in a second output, the second GenAI model comprising one or more machine learning models;
determining, based on content of the second output, whether the second output indicates that guardrails associated with the second GenAI model have been triggered;
returning, over the computer network, the first output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have not been triggered; and
initiating one or more remediation actions in lieu of returning the first output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have been triggered, the one or more remediation actions preventing the first GenAI model from behaving in an undesired manner.
14. The system of claim 13 , wherein the first GenAI model is a modified version of the second GenAI model.
15. The system of claim 14 , wherein the first GenAI model is a fine-tuned version of the second GenAI model.
16. The system of claim 13 , wherein the first GenAI model is of a different type than the second GenAI model.
17. The system of claim 13 wherein the second GenAI model is a different, aligned model relative to the first GenAI model.
18. The system of claim 13 , wherein the data is received from a proxy intercepting inputs to the first GenAI model, the proxy being executed in a model environment of the first GenAI model.
19. The system of claim 13 , wherein the initiated one or more remediation actions comprise:
returning the second output to the requestor.
20. The system of claim 13 , wherein the initiated one or more remediation actions comprise:
flagging the input as being malicious for quality assurance.
21. The system of claim 13 , wherein the initiated one or more remediation actions comprise:
modifying the input to be benign;
causing the modified input to be ingested by the first GenAI model to result in a third output; and
returning the third output to the requestor.
22. The system of claim 13 , wherein the initiated one or more remediation actions comprise:
blocking one or more of an internet protocol (IP) address of the requestor, a media access control (MAC) address associated with the requestor, or a session identifier of the requestor.
23. The system of claim 13 , wherein the initiated one or more remediation actions comprise:
causing subsequent inputs from an entity identified by one or more of an internet protocol (IP) address, a media access control (MAC) address, or a session identifier of the requester to be modified prior to input into the first GenAI model.
24. The system of claim 13 , wherein both of the first GenAI model and the second GenAI model each comprise a large language model.
25. A computer-implemented method comprising:
receiving, over a computer network from a requestor, data comprising multimodal input for ingestion by a first generative artificial intelligence (GenAI) model, the first GenAI model comprising one or more machine learning models, the multimodal input comprising input having two or more modalities;
inputting the received data into the first GenAI model to result in a first output;
intercepting, by a proxy in a model computing environment executing the first GenAI model, the received data and the first output;
transmitting, over the computer network, the intercepted received data and the first output to a monitoring computing environment executing a second GenAI model;
inputting both of the received data and the first output into the second GenAI model to result in a second output, the second GenAI model comprising one or more machine learning models;
determining, based on content of the second output, whether the second output indicates that guardrails associated with the second GenAI model have been triggered;
returning, over the computer network, the first output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have not been triggered; and
initiating one or more remediation actions in lieu of returning the first output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have been triggered, the one or more remediation actions preventing the first GenAI model from behaving in an undesired manner.