about
SPML: A DSL for Defending LLMs Against Prompt Attacks (arxiv.org)
6 points by reshabh on Feb 27, 2024 | hide | past | pdf | 2 comments on HN

In plain words: A small programming language writes chatbot instructions and screens each user message before it reaches the model, blocking attacks that try to override the rules and saving money. It spotted attack prompts more reliably than GPT-4, GPT-3.5, and LLAMA.

Abstract · SPML: A DSL for Defending Language Models Against Prompt Attacks

Large language models (LLMs) have profoundly transformed natural language applications, with a growing reliance on instruction-based definitions for designing chatbots. However, post-deployment the chatbot definitions are fixed and are vulnerable to attacks by malicious users, emphasizing the need to prevent unethical applications and financial losses. Existing studies explore user prompts' impact on LLM-based chatbots, yet practical methods to contain attacks on application-specific chatbots remain unexplored. This paper presents System Prompt Meta Language (SPML), a domain-specific language for refining prompts and monitoring the inputs to the LLM-based chatbots. SPML actively checks attack prompts, ensuring user inputs align with chatbot definitions to prevent malicious execution on the LLM backbone, optimizing costs. It also streamlines chatbot definition crafting with programming language capabilities, overcoming natural language design challenges. Additionally, we introduce a groundbreaking benchmark with 1.8k system prompts and 20k user inputs, offering the inaugural language and benchmark for chatbot definition evaluation. Experiments across datasets demonstrate SPML's proficiency in understanding attacker prompts, surpassing models like GPT-4, GPT-3.5, and LLAMA. Our data and codes are publicly available at: https://prompt-compiler.github.io/SPML/.

Reshabh K Sharma, Vinayak Gupta, Dan Grossman
arXiv:2402.11755 · cs.LG, cs.CL, cs.CR, cs.PL · submitted Feb 19, 2024
abstract · pdf · html

add comment on HN

Prompt injection attacks represent a significant challenge for LLM-based systems, such as chatbots. Several techniques are in place to proactively detect these attacks, including classifying the input prompt as either safe or unsafe, or determining whether the prompt violates the system's guidelines. However, merely classifying input prompts does not take into account the context in which the chatbot operates, and identifying violations can be complex for LLMs. We propose a technique that uses a meta language and the compiling-parsing approach to detect prompt injection attacks. This technique utilizes a meta language, SPML (System Prompt Meta Language), allowing for detection independent of the attack method used. It focuses solely on identifying conflicts with system prompts, ensuring a robust defense against prompt injection attacks.
SPML, a meta language designed for writing system prompts, includes high-level language features such as support for user-defined types and comments. These features make system prompts easier to develop and more maintainable compared to those written in natural language.

The SPML compiler processes an SPML system prompt, performing type checking before converting it into SPML-IR. SPML-IR facilitates various types of analysis and transformations, similar to other compiler intermediate representations. Finally, the SPML-IR is lowered into a natural language system prompt.