AI Model Can Be Hijacked With Plain English

Five new blogs this week, covering where models run, the two building blocks inside a Transformer, what Generative AI really is, the number one security risk in LLM apps, and the two numbers we use to measure any yes-or-no system.

Let’s get started.

Prompt Injection is an attack where someone slips their own instructions into the text that an AI application sends to the model, so that the model follows the attacker’s instructions instead of the developer’s instructions.

The root cause is the single most important idea here: instructions and data travel through the same channel. In a normal program, the code and the data live in separate places. An LLM has no such separation. Everything is text in one window, so anything can become a command.

This is why the real fix is not a clever line of text. We assume the model will be hijacked, and we design the system so that a hijacked model still cannot cause serious harm. A prompt is a request. Code is a rule.

Read here: https://outcomeschool.com/blog/prompt-injection-in-llms

Deployment means putting the model somewhere it can run, so that real people can actually use it. There are two choices: keep the model on a powerful server far away and reach it over the internet, or put the model directly inside the phone, the laptop, or the car that the person is using.

Everything else comes from this single point: in Cloud Deployment, the data travels to the model. In On-device Deployment, the model travels to the data.

Anything that must be instant, private, or offline goes to the device. Anything that needs deep intelligence goes to the cloud. And anything that needs both ends up hybrid.

Read here: https://outcomeschool.com/blog/cloud-vs-on-device-model-deployment

A Transformer is built from two main building blocks. One is the Encoder, and the other is the Decoder.

The Encoder reads the whole input and builds a deep understanding of it, looking in both directions at once. The Decoder generates the output, one token at a time, and while writing it can only look at the tokens that came before.

If we forget everything else, we must remember this one line: the Encoder is a reader that looks in both directions, and the Decoder is a writer that looks only backward. Most modern chat AI models today are decoder-only.

Read here: https://outcomeschool.com/blog/encoder-vs-decoder-in-transformers

Generative AI is a type of artificial intelligence that can create new things, like text, images, audio, video, and code.

The old AI mostly did one job. It looked at something and gave a label or a decision, like “is this email spam or not?” We can call it “the AI that decides.” Generative AI is different. It does not just decide. It creates.

And the secret behind how it writes is surprisingly simple. The AI predicts the next word, again and again. A long and smart answer is really just the AI predicting the next word, over and over, very fast.

Read here: https://outcomeschool.com/blog/what-is-generative-ai

Precision and Recall are two numbers that tell us how good our system is at making yes-or-no decisions, but they measure two different things.

Precision answers: out of all the emails we flagged as spam, how many were actually spam? Recall answers: out of all the emails that were really spam, how many did we actually catch?

Here is the most interesting part. Precision and Recall usually pull against each other, like a tug of war. So the rule is simple: if a false alarm is costly, we care more about Precision. If a miss is costly, we care more about Recall.

Read here: https://outcomeschool.com/blog/precision-vs-recall

That’s it for now.