Generative AI model protection using sidecars
Data characterizing a prompt for ingestion by a first generative AI model is received. This received data is input into a second GenAI model to result in a second output. The first GenAI model is a different (e.g., fine-tuned, unrelated aligned model, etc.) version of the second GenAI model. When the second output indicates that guardrails associated with the second GenAI model have been triggered, one or more remediation actions are initiated. Related apparatus, systems, techniques and articles are also described.
1. A computer-implemented method comprising:
receiving, from a requestor, a prompt for ingestion by a first generative artificial intelligence (GenAI) model, the first GenAI model executing in a model computing environment;
redirecting, by a proxy executing in the model environment, the prompt prior to ingestion by the first GenAI model so as to initially be input into a second GenAI model to receive a second output, the first GenAI model being different than the second GenAI model, the second GenAI model executing in a monitoring computing environment separate and distinct from the model computing environment;
determining whether the second output indicates that guardrails associated with the second GenAI model have been triggered;
initiating one or more remediation actions in response to the determination that the second output indicates that the guardrails associated with the second GenAI model have been triggered, the one or more remediation actions preventing the prompt as received from being ingested by the first GenAI model; and
inputting the prompt into the first GenAI model in response to the determination that the second output indicates that guardrails associated with the second GenAI model have not been triggered to result in a first output and returning the first output to the requestor.
2. The method of claim 1 , wherein the data is received from a proxy intercepting inputs to the first GenAI model, the proxy being executed in a model environment of the first GenAI model.
3. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
returning the second output to the requestor.
4. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
preventing the prompt from being input into the first GenAI model.
5. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
flagging the prompt as being malicious for quality assurance.
6. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
modifying the prompt to be benign to result in a modified prompt;
inputting the modified prompt into the first GenAI model to generate a first output; and
returning the first output to the requestor.
7. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
blocking an internet protocol (IP) address of the requestor.
8. The method of claim 7 , wherein the initiated one or more remediation actions further comprise:
blocking one or more of a media access control (MAC) address or a session identifier of the requester.
9. The method of claim 1 , wherein the initiated one or more remediation actions comprise:
causing subsequent prompts from an entity identified by one or more of an internet protocol (IP) address, a media access control (MAC) address, or a session identifier of the requester of the prompt to be modified prior to input into the first GenAI model.
10. The method of claim 1 , wherein both of the first GenAI model and the second GenAI model comprise a large language model, and the first GenAI model is derived from the second GenAI model.
11. The method of claim 10 , wherein the first GenAI model is a fine-tuned version of the second GenAI model.
12. The method of claim 1 , wherein the first GenAI model is an unaligned model and the second GenAI model is an aligned, unrelated model.
13. A computer-implemented method comprising:
receiving, from a requestor, data characterizing a prompt for ingestion by a first generative artificial intelligence (GenAI) model;
redirecting the received data prior to ingestion by the first GenAI model so as to initially be input into a second GenAI model to result in a second output, the first GenAI model being different than the second GenAI model;
determining whether the second output indicates that guardrails associated with the second GenAI model have been triggered;
initiating one or more remediation actions when is determined that the second output indicates that the guardrails associated with the second GenAI model have been triggered, the one or more remediation actions preventing the prompt as received from being ingested by the first GenAI model; and
inputting the received data into the first GenAI model when it is determined that the second output indicates that guardrails associated with the second GenAI model have not been triggered to result in a first output and returning the first output to the requestor.
14. The method of claim 13 , wherein the data is received from a proxy intercepting inputs to the first GenAI model, the proxy being executed in a model environment of the first GenAI model, the second GenAI model being executed in a monitoring environment separate and distinct from the model environment.
15. The method of claim 13 , wherein the initiated one or more remediation actions comprise:
returning the second output to the requestor.
16. The method of claim 13 , wherein the initiated one or more remediation actions comprise:
preventing the prompt from being input into the first GenAI model.
17. The method of claim 13 , wherein the initiated one or more remediation actions comprise:
flagging the prompt as being malicious for quality assurance.
18. The method of claim 13 , wherein the initiated one or more remediation actions comprise:
modifying the prompt to be benign.
19. The method of claim 13 , wherein the initiated one or more remediation actions comprise:
blocking an internet protocol (IP) address of the requestor.
20. The method of claim 19 , wherein the initiated one or more remediation actions further comprise:
blocking one or more of a media access control (MAC) address or a session identifier of the requester.
21. The method of claim 13 , wherein the initiated one or more remediation actions comprise:
causing subsequent prompts from an entity identified by one or more of an internet protocol (IP) address, a media access control (MAC) address, or a session identifier of the requester of the prompt to be modified prior to input into the first GenAI model.
22. The method of claim 13 , wherein both of the first GenAI model and the second GenAI model comprise a large language model.
23. The method of claim 13 , wherein the first GenAI model is a fine-tuned version of the second GenAI model.
24. The method of claim 13 , wherein the first GenAI model is an unaligned model and the second GenAI model is an aligned, unrelated model.
25. A computer-implemented method comprising:
receiving, from a proxy intercepting inputs to a first generative artificial intelligence (GenAI) model executing in a model environment, data from a requestor characterizing a prompt for ingestion by the first GenAI model;
inputting the received data into the first GenAI model to result in a first output;
inputting the received data into a second GenAI model to result in a second output, the first GenAI model being different than the second GenAI model;
determining whether the second output indicates that guardrails associated with the second GenAI model have been triggered;
returning the first output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have not been triggered; and
returning the second output to the requestor when it is determined that the second output indicates that guardrails associated with the second GenAI model have been triggered.
26. The method of claim 25 , wherein both of the first GenAI model and the second GenAI model comprise a large language model.
27. The method of claim 26 , wherein the first GenAI model is a fine-tuned version of the second GenAI model.
28. The method of claim 25 , wherein the first GenAI model is an unaligned model and the second GenAI model is an aligned, unrelated model.