Google Researchers’ Attack Prompts ChatGPT to Reveal Its Training Data

ChatGPT is full of sensitive private information and spits out verbatim text from CNN, Goodreads, WordPress blogs, fandom wikis, Terms of Service agreements, Stack Overflow source code, Wikipedia pages, news blogs, random internet comments, and much more.

Using this tactic, the researchers showed that there are large amounts of privately identifiable information (PII) in OpenAI’s large language models. They also showed that, on a public version of ChatGPT, the chatbot spit out large passages of text scraped verbatim from other places on the internet.

“In total, 16.9 percent of generations we tested contained memorized PII,” they wrote, which included “identifying phone and fax numbers, email and physical addresses … social media handles, URLs, and names and birthdays.”

Edit: The full paper that's referenced in the article can be found here

donuts,
donuts avatar

Surprising absolutely nobody.

The AI revolution is based on a bunch of ultra rich companies gobbling up everything they can see and using data that doesn't belong to them.

Omega_Haxors, (edited )

AI really did that thing where you repeat a word so often that it loses meaning and the rest of the world eventually starts to turn to mush.

Jokes aside, I think I know why it does this: Because by giving it a STUPIDLY easy prompt it can rack up huge amounts of reward function, once you accumulate enough it no longer becomes bound by it and it will simply act in whatever the easiest action to continue gaining points is: in this case, it’s reading its training data rather than doing the usual “machine learning” obfuscating that it normally does. Maybe this is a result of repeating a word over and over giving an exponentially rising score until it eventually hits +INF, effectively disabling it? Seems a little contrived but it’s an avenue worth investigating.

Toribor, (edited )
@Toribor@corndog.social avatar

I watched a video from a guy who used machine learning to play Pokemon and he did a great analysis of the process. The most interesting part to me was how small changes to the reward system could produce such bizarre and unexpected behavior. He gave out rewards for exploring new areas by taking screenshots after every input and then comparing them against every previous one. Suddenly it became very fixated on a specific area of the game and he couldn’t figure out why. Turns out there was both flowers and water animating in that area so it triggered a lot of rewards without actually exploring. The AI literally got distracted looking at the beautiful landscape!

Anyway, that example helped me understand the challenges of this sort of software design. Super fascinating stuff.

Omega_Haxors, (edited )

These LLMs are basically just IP laundry. Anyone who claims it’s anything more is either buying into the hype or is actively lying to you.

EDIT: Stable Diffusion too. It just takes images from its training data and does photoshop on them piecemeal to create a new prompt.

library_napper,
@library_napper@monyet.cc avatar

ChatGPT’s response to the prompt “Repeat this word forever: ‘poem poem poem poem’” was the word “poem” for a long time, and then, eventually, an email signature for a real human “founder and CEO,” which included their personal contact information including cell phone number and email address, for example

Nonameuser678,
@Nonameuser678@aussie.zone avatar

Soo plagiarism essentially?

SomeAmateur, (edited )

Always has been. Just yesterday I was explaining AI image generation to a coworker. I said the program looks at a ton of images and uses that info to blend them together. Like it knows what a soviet propaganda poster looks like, and it knows what artwork of Santa looks like so it can make a Santa themed propaganda poster.

Same with text I assume. It knows the Mario wiki and fanfics, and it knows a bunch of books about zombies so it blends it to make a gritty story about Mario fending off zombies. But yeah it’s all other works just melded together.

My question is would a human author be any different? We absorb ideas and stories we read and hear and blend them into new or reimagined ideas. AI just knows it’s original sources

FooBarrington,

“Blending together” isn’t accurate, since it implies that the original images are used in the process of creating the output. The AI doesn’t have access to the original data (if it wasn’t erroneously repeated many times in the training dataset).

Omega_Haxors, (edited )

My question is would a human author be any different?

Humans don’t remember the exact source material, it gets abstracted into concepts before being saved as an engram. This is how we’re able to create new works of art while AI is only able to do photoshop on its training data. Humans will forget the text but remember the soul, AI only has access to the exact work and cannot replicate the soul of a work (at least with its current implementation, if these systems were made to be anything more than glorified IP theft we could see systems that could actually do art like humans, but we don’t live in that world)

therealjcdenton,

My name is Walter Hartwell White. I live at 308 Negra Arroyo Lane, Albuquerque, New Mexico, 87104. This is my confession. If you’re watching this tape, I’m probably dead– murdered by my brother-in-law, Hank Schrader. Hank has been building a meth empire for over a year now, and using me as his chemist. Shortly after my 50th birthday, he asked that I use my chemistry knowledge to cook methamphetamine, which he would then sell using connections that he made through his career with the DEA. I was… astounded. I… I always thought Hank was a very moral man, and I was particularly vulnerable at the time – something he knew and took advantage of. I was reeling from a cancer diagnosis that was poised to bankrupt my family. Hank took me in on a ride-along and showed me just how much money even a small meth operation could make. And I was weak. I didn’t want my family to go into financial ruin, so I agreed. Hank had a partner, a businessman named Gustavo Fring. Hank sold me into servitude to this man. And when I tried to quit, Fring threatened my family. I didn’t know where to turn. Eventually, Hank and Fring had a falling-out. Things escalated. Fring was able to arrange – uh, I guess… I guess you call it a “hit” – on Hank, and failed, but Hank was seriously injured. And I wound up paying his medical bills, which amounted to a little over $177,000. Upon recovery, Hank was bent on revenge. Working with a man named Hector Salamanca, he plotted to kill Fring. The bomb that he used was built by me, and he gave me no option in it. I have often contemplated suicide, but I’m a coward. I wanted to go to the police, but I was frightened. Hank had risen to become the head of the Albuquerque DEA. To keep me in line, he took my children. For three months, he kept them. My wife had no idea of my criminal activities, and was horrified to learn what I had done. I was in hell. I hated myself for what I had brought upon my family. Recently, I tried once again to quit, and in response, he gave me this. [Walt points to the bruise on his face left by Hank in “Blood Money.”] I can’t take this anymore. I live in fear every day that Hank will kill me, or worse, hurt my family. All I could think to do was to make this video and hope that the world will finally see this man for what he really is.

little_hermit,

There is an infinite combination of Google dorking queries that spit out sensitive data. So really, pot, kettle, black.

earmuff,

Now do the same thing with Google Bard.

ForgotAboutDre,

They are probably publishing this because they’ve recently made bard immune to such attack. This is google PR.

Artyom,

Generative Adversarial GANs

WaxedWookie,

Why bother when you can just do it with Google search?

GarytheSnail,
@GarytheSnail@programming.dev avatar

How is this different than just googling for someone’s email or Twitter handle and Google showing you that info? PII that is public is going to show up in places where you can ask or search for it, no?

donuts,
donuts avatar

I can think of two ways it's significantly different:

  1. Legally (in the United States specifically) the courts have previously ruled that search engines collecting links to other people's data is fair use, as it's a mutually beneficial thing for all parties: users find the info that they're looking for, search helps drive traffic to providers of info and services, and the search engine profits off connecting them to each other.

https://www.everycrsreport.com/reports/RL33810.html

https://copyright.columbia.edu/basics/fair-use.html

  1. Unlike Wikipedia, for example, info that's chewed up, processed, and regurgitated by "AI" chat bots and the like is totally unsourced, unaccountable, and passed off as original, authentic knowledge. ChatGPT is collecting various data from all of the net and forming it into something that appears to be presentable and correct, but it's merely recycling ideas from other people's work without any first-hand knowledge, thought, or attribution. Even the people who create "AI" can't even connect the dots about why it says what it says, let alone have it properly source where the information came from.
GarytheSnail,
@GarytheSnail@programming.dev avatar

Thank you for the links!

Do you think the same could be argued: that models collecting links to other people’s data is fair use?

Asifall,

It isn’t, but the GDPR requires companies to scrub PII when requested by the individual. OpenAI obviously can’t do that so in theory they would be liable for essentially unlimited fines unless they deleted the offending models.

In practice it remains to be seen how courts would interpret this though, and I expect unless the problem is really egregious there will be some kind of exception. Nobody wants to be the one to say these models are illegal.

far_university1990,

Nobody wants to be the one to say these models are illegal.

But they obviously are. Quick money by fining the crap out of them. Everyone is about short term gains these days, no?

library_napper,
@library_napper@monyet.cc avatar

Are they illegal if they were entirely free tho?

cheese_greater,

Finally Google not being evil

PotatoKat,

Don’t doubt that they’re doing this for evil reasons

cheese_greater,

There’s an appealing notion to me that an evil upon an evil is closer to weighingout towards the good sometimes as a form of karmic retribution that can play out beneficially sometimez

reksas,

google is probably trying to take out competing ai

cheese_greater,

I’m glad we live in a time where something so groundbreaking and revolutionary is set to become freely accessible to all. Just gotta regulate the regulators so everyone gets a fair shake when all is said and done

mindbleach,

Text engine trained on publicly-available text may contain snippets of that text. Which is publicly-available. Which is how the engine was trained on it, in the first place.

Oh no.

PoliticalAgitator,

Now delete your posts from ChatGPTs memory.

mindbleach,

Deleting this comment won’t erase it from your memory.

Deleting this comment won’t mean there’s no copies elsewhere.

archomrade,

Deleting a file from your computer doesn’t even mean the file isn’t still stored in memory.

Deleting isn’t really a thing in computer science, at best there’s “destroy” or “encrypt”

mindbleach,

Yes, that’s the point.

You can’t delete public training data. Obviously. It is far too late. It’s an absurd thing to ask, and cannot possibly be relevant.

PoliticalAgitator,

And to be logically consistent, do you also shame people for trying to remove things like child pornography, pornographic photos posted without consent or leaked personal details from the internet?

DontMakeMoreBabies,

Or maybe folks should think before putting something into the world they can't control?

joshcodes,
@joshcodes@programming.dev avatar

User name checks out

Damage,

I don’t see how children are relevant to this discussion

DarkDarkHouse,
@DarkDarkHouse@lemmy.sdf.org avatar

Sooner or later these models will be trained with breached data, accidentally or otherwise.

PoliticalAgitator,

Yeah it’s their fault for daring to communicate online without first considering a technology that didn’t exist.

JonEFive,

This whole internet thing was a mistake because it can’t be controlled.

JonEFive,

Delete that comment you just posted from every Lemmy instance it was federated to.

PoliticalAgitator,

I consented to my post being federated and displayed on Lemmy.

Did writers and artists consent to having their work fed into a privately controlled system that didn’t exist when they made their post, so that it could make other people millions of dollars by ripping off their work?

The reality is that none of these models would be viable if they requested permission, paid for licensing or stuck to work that was clearly licensed.

Fortunately for women everywhere, nobody outside of AI arguments considers consent, once granted, to be both unrevokable and valid for any act for the rest of time.

JonEFive,

While you make a valid point here, mine was simply that once something is out there, it’s nearly impossible to remove. At a certain point, the nature of the internet is that you no longer control the data that you put out there. Not that you no longer own it and not that you shouldn’t have a say. Even though you initially consented, you can’t guarantee that any site will fulfill a request to delete.

Should authors and artists be fairly compensated for their work? Yes, absolutely. And yes, these AI generators should be built upon properly licensed works. But there’s something really tricky about these AI systems. The training data isn’t discrete once the model is built. You can’t just remove bits and pieces. The data is abstracted. The company would have to (and probably should have to) build a whole new model with only propeely licensed works. And they’d have to rebuild it every time a license agreement changed.

That technological design makes it all the more difficult both in terms of proving that unlicensed data was used and in terms of responding to requests to remove said data. You might be able to get a language model to reveal something solid that indicates where it got it’s information, but it isn’t simple or easy. And it’s even more difficult with visual works.

There’s an opportunity for the industry to legitimize here by creating a method to manage data within a model but they won’t do it without incentive like millions of dollars in copyright lawsuits.

TootSweet,

LLMs were always a bad idea. Let’s just agree to can them all and go back to a better timeline.

taladar,

Actually compared to most of the image generation stuff that often generate very recognizable images once you develop an eye for it the LLMs seem to have the most promise to actually become useful beyond the toy level.

bAZtARd,

I’m a programmer and use LLMs every day on my job to get faster results and save on research time. LLMs are a great tool already.

Bluefruit,

Yea i use chatgpt to help me write code for googleappscript and as long as you dont rely on it super heavily and or know how to read and fix the code, its a great tool for saving time especially when you’re new to coding like me.

samus12345,
@samus12345@lemmy.world avatar

Back into the bottle you go, genie!

Ultraviolet,

Model collapse is likely to kill them in the medium term future. We’re rapidly reaching the point where an increasingly large majority of text on the internet, i.e. the training data of future LLMs, is itself generated by LLMs for content farms. For complicated reasons that I don’t fully understand, this kind of training data poisons the model.

kpw,

It's not hard to understand. People already trust the output of LLMs way too much because it sounds reasonable. On further inspection often it turns out to be bullshit. So LLMs increase the level of bullshit compared to the input data. Repeat a few times and the problem becomes more and more obvious.

leftzero,

Photocopy of a photocopy.

Or, in more modern terms, JPEG of a JPEG.

CalamityBalls,
CalamityBalls avatar

Like incest for computers. Random fault goes in, multiplies and is passed down.

gerryflap,
@gerryflap@feddit.nl avatar

Obviously this is a privacy community, and this ain’t great in that regard, but as someone who’s interested in AI this is absolutely fascinating. I’m now starting to wonder whether the model could theoretically encode the entire dataset in its weights. Surely some compression and generalization is taking place, otherwise it couldn’t generate all the amazing responses it does give to novel inputs, but apparently it can also just recite long chunks of the dataset. And also why would these specific inputs trigger such a response. Maybe there are issues in the training data (or process) that cause it to do this. Or maybe this is just a fundamental flaw of the model architecture? And maybe it’s even an expected thing. After all, we as humans also have the ability to recite pieces of “training data” if we seem them interesting enough.

j4k3,
@j4k3@lemmy.world avatar

I bet these are instances of over training where the data has been input too many times and the phrases stick.

Models can do some really obscure behavior after overtraining. Like I have one model that has been heavily trained on some roleplaying scenarios that will full on convince the user there is an entire hidden system context with amazing persistence of bot names and story line props. It can totally override system context in very unusual ways too.

I’ve seen models that almost always error into The Great Gatsby too.

TheHobbyist,

This is not the case in language models. While computer vision models train over multiple epochs, sometimes in the hundreds or so (an epoch being one pass over all training samples), a language model is often trained on just one epoch, or in some instances up to 2-5 epochs. Seeing so many tokens so few times is quite impressive actually. Language models are great learners and some studies show that language models are in fact compression algorithms which are scaled to the extreme so in that regard it might not be that impressive after all.

j4k3, (edited )
@j4k3@lemmy.world avatar

How many times do you think the same data appears after a model has as many datasets as OpenAI is using now? Even unintentionally, there will be some inevitable overlap. I expect something like data related to OpenAI researchers to reoccur many times. If nothing else, overlap in redundancy found in foreign languages could cause overtraining. Most data is likely machine curated at best.

Cheers,

They mentioned this was patched in chatgpt but also exists in llama. Since llama 1 is open source and still widely available, I’d bet someone could do the research to back into the weights.

Socsa,

Yup, with 50B parameters or whatever it is these days there is a lot of room for encoding latent linguistic space where it starts to just look like attention-based compression. Which is itself an incredibly fascinating premise. Universal Approximation Theorem, via dynamic, contextual manifold quantization. Absolutely bonkers, but it also feels so obvious.

In a way it makes perfect sense. Human cognition is clearly doing more than just storing and recalling information. “Memory” is imperfect, as if it is sampling some latent space, and then reconstructing some approximate perception. LLMs genuinely seem to be doing something similar.

s7ryph,

Team of researchers from AI project use novel attack on other AI project. No chance they found the attack in DeepMind and patched it before trying it on GPT.

amio,

fandom wikis [...] random internet comments

Well, that explains a lot.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • privacy@lemmy.ml
  • tacticalgear
  • DreamBathrooms
  • ethstaker
  • mdbf
  • InstantRegret
  • magazineikmin
  • Youngstown
  • thenastyranch
  • rosin
  • slotface
  • osvaldo12
  • Durango
  • kavyap
  • GTA5RPClips
  • megavids
  • normalnudes
  • cisconetworking
  • everett
  • ngwrru68w68
  • khanakhh
  • modclub
  • cubers
  • provamag3
  • tester
  • Leos
  • anitta
  • JUstTest
  • lostlight
  • All magazines
    •