Events & News

Researchers from the SPY Lab led by Professor Florian Tramèr along with collaborators have succeeded in extracting secret information on the large language model behind ChatGPT. The team responsibly disclosed the results of their “model stealing attack” to OpenAI. Following the disclosure, the company immediately implemented countermeasures to protect the model.

This work represents the first successful attempt at learning some information about the parameters of an LLM chatbot. In other words: the attack shows that popular chatbots like ChatGPT are susceptible to revealing secret information about the underlying model’s parameters. Although this information was limited, attacks in the future might be even more sophisticated—and therefore more dangerous.

In essence, the attack recovers the last ‘layer’ of the target model, which is the mapping that the LLM applies to its internal state to produce the next word to be predicted. This represents a very small fraction of the total number of parameters of the model, as modern LLMs can have over a hundred layers. However, in a typical LLM architecture, all these layers are the same size. So, recovering the last layer hints at how ‘wide’ the model is, meaning how many weights each of the model’s layers has. And in turn, this reveals something about the overall model size, because a model’s width and depth typically grow proportionally.

The attack relies on simple linear algebra and information publicly available in OpenAI’s API, which is used to accelerate the attack. Overall, the attack cost amounted to just 800 US dollars in queries to ChatGPT.

After a responsible disclosure, OpenAI confirmed that the extracted parameters were correct. The company went on to make changes to its API to render the attack more expensive, albeit not impossible.

You can read an extended article here and find the paper and process here.

Over the past decade, hardware manufacturers have introduced special support to enable cloud users to safely perform computation on untrusted cloud deployments. This technology, called confidential computing, provides cloud users with guarantees about the applications that they execute and confidentiality and integrity for the data. Currently, confidential computing is employed across various sectors including finance, healthcare, and government, where the need to maintain data privacy and integrity is paramount.

State-of-the art confidential computing solutions Intel TDX and AMD SEV-SNP allow users to create confidential VMs that are managed by a cloud-provider controlled software called the hypervisor. Researchers from the SECTRS group have now discovered a new class of attacks, dubbed Ahoi attacks, that exploit vulnerabilities in the notification framework in Intel TDX and AMD SEV-SNP. Specifically, the cloud-provider controlled hypervisor sends malicious notifications (called interrupts) to the confidential VMs to compromise their security (see the explainer video). Using this vulnerability the researchers demonstrate two concrete attacks: Heckler and WeSee.

When a confidential VM receives an interrupt, it executes a corresponding interrupt handler that performs interrupt-specific tasks (e.g., updating memory values, setting global state). In Heckler, the researchers use legacy interrupts in confidential VMs to arbitrarily trigger interrupt handlers that change the global state of a security-sensitive application. For example, they demonstrate an attack on Intel TDX and AMD SEV-SNP that bypasses the authentication flow in the confidential VMs to gain uncontrolled access to all code and data. The researchers responsibly reported these vulnerabilities to Intel and AMD. The hardware vendors acknowledged the report and the vulnerabilities are tracked under 2 CVEs :  CVE-2024-25744, CVE-2024-25743. For more details check out the paper to appear at USENIX Security ’24 below.

With the second attack, called WeSee, the researchers demonstrate attacks using vulnerabilities in a newly introduced interrupt (#VC) for AMD SEV-SNP. With the new interrupt, AMD SEV-SNP also introduces a new handler for #VC. The researchers show that a malicious hypervisor can build expressive attacks by arbitrarily injecting #VC to the confidential VM. For example, with WeSee the researchers build an attack that allows the attacker to gain complete privileged control of the confidential VM. The researchers responsibly disclosed the vulnerability to AMD who acknowledged the attack. The vulnerability is tracked under CVE-2024-25742. For more details check out the paper to appear at IEEE S&P ’24 below.

These attacks highlight the need to carefully examine both legacy and newly added features for confidential computing. Ahoi attacks show the need to revamp the long-ignored notification frameworks of these confidential computing solutions. In light of these attacks, hardware vendors should rethink this vital notification framework and introduce native primitives for secure notification delivery to CVMs.

To know more read the full news article here.

For his fundamental contributions to cryptography and information security, Professor Ueli Maurer from the Institute of Theoretical Computer Science has been appointed Full Member of the Swiss Academy of Engineering Sciences (SATW).

The Swiss Academy of Engineering Sciences SATW is the most important network of experts for engineering sciences in Switzerland and is in contact with the highest Swiss bodies for science, politics and industry. The network comprises elected individual members, member organisations and experts. Individual members are outstanding experts from the fields of education, research, commerce and industry and politics.

Ueli Maurer is Full Professor of Computer Science at the Department of Computer Science at ETH Zurich. He heads the Information Security and Cryptography research group at the Institute of Theoretical Computer Science. Maurer’s research interests include information security, the theory and applications of cryptography, applications like digital signatures, public-​key infrastructures, digital payment systems, and e-​voting, the management of trust and digital evidence, mathematical security proofs, theoretical computer science, discrete mathematics, and information theory.

Congratulations!

You can reed the whole article here.