LLM Best Practices Pre-Deployment
The security of any LLM hinges on the quality and reliability of its training data. If attackers inject malicious data into training datasets, they can manipulate the model’s behavior and deliver harmful content to an end-user. This is particularly concerning given the wide range of public-facing roles that LLMs are increasingly being applied to. This means data needs to be secured from its first inclusion into a training dataset.
#1. Secure Data Collection
The beginning of an LLM’s development cycle is defined by the datasets it’s about to be trained on. For LLMs, this is usually a corpus of text. But it’s rare that texts can just be ripped straight from their source – it usually needs cleaning and processing. For instance, training an LLM on a set of automotive repair manuals demands a team member to scrub through and remove unnecessary metadata like page numbers and diagrams, since the LLM is focusing solely on text. Cleaning and filtering mechanisms enhance the overall quality of the dataset, which in turn keeps a language model reliable.
#2. Data Verification
Because of the sheer quantity of data involved, it’s unrealistic to manually verify every single file. However, it’s also important that any risky or poisoned data be removed. Automated assessments can help ensure a dataset’s integrity by spotting duplicate entries and anomalies that don’t align with a dataset’s wider patterns.
#3. Secure Training Data Storage
Alongside its selection, all data involved in LLM training should be stored in secure databases – with only authorized individuals provided access. On top of role-based access helping secure it, this data should be stored in an encrypted database and further protected by firewall rules and access logs.
#4. Federated Learning
Large language model optimization can demand further architectural development: federated learning trains LLMs across multiple decentralized devices or servers, without requiring sensitive data to be centralized. Instead of collecting and storing user data in one location, the model is trained locally on individual devices, and only the learned updates – rather than the raw data itself – are shared with a central system. This method enhances privacy and security by reducing the risk of data breaches.
#5. Data Anonymization
Some LLM data can include sensitive personal or corporate information. Take a fraud detection and response tool – it needs to be trained on banking and spending information, but cannot afford to be regurgitating that data after deployment. To make training data secure, best practice demands that sensitive info be replaced with unique identifiers – a process called tokenization. This allows an LLM to create a vector from all of the data, without having access to the names or other sensitive parts of each dataset.
#6. Model Ensembly
Ensembling multiple large language models can create a more robust architecture than a single monolithic model can provide. This way, if one model is compromised by poisoned data, the remaining models can override its faulty outputs, minimizing the impact of data corruption. As a result, an attacker would need to manipulate multiple datasets across different training subsets, significantly reducing the risk of poisoning attacks.
LLM Best Practices Post-Deployment
After deployment, the focus on LLM security best practices switches from model security to LLM agent security. To briefly explain the difference, an LLM’s model is its engine, which focuses on disassembling and reassembling natural language. However, the core model isn’t the section that faces a user: that role is supplied by the LLM agent. This handles the logical reasoning and tool calling that each prompt requires. To use a real-life example, OpenAI’s GPT-4 is the LLM model that powers its LLM agent, called ChatGPT.
#7. API security
Since LLMs are at their most useful when integrating with more specific data sources, or subsets of users, it’s often required to rely on APIs – particularly when relying on a third-party LLM model. Unsecured APIs can represent a lifeline for new attacks, since they’re singularly responsible for moving data between an organization’s assets.
API security demands a degree of API best practice: this includes dedicated authentication protocols. APIs need a way to ensure that a requester is who they claim to be. OAuth 2.0 is one example of this best practice, since it breaks authorization down into its key components. The resource owner is the company hosting the LLM agent, while the client is any device or application that requests access. OAuth demands every connection between owner and client have a valid access token, as proof of authentication.
Alongside user-focused API security, APIs also represent a way to protect the LLM model itself. The OWASP Top 10 includes Model Denial of Service attacks, as a way for attackers to overwhelm providers through high rates of requests. Rate limiting – which places a limit on how many calls each client can make at a time – is vital for preventing this.
#8. User Prompt Protection
Jailbreaking – or prompt engineering – is one of the most well-publicized LLM security oversights today. It sees an attacker take advantage of an LLM agent’s processing of a prompt, and subsequent generation of new data. Prompt injection attacks rely on prompts that subtly alter the intended command to produce a harmful or unintended result. To prevent these, data sanitization and validation – for both prompts and outputted data – are vital components of all public-facing LLM agents.
#9. Adversarial training
Since LLMs are such novel pieces of organizational infrastructure, it’s vital to keep fine-tuning your understanding of a deployed LLM’s defenses. While there is some evidence that exposing an LLM to adversarial examples during training can better equip it against future attack attempts, it’s best to prioritize protection for current deployments. Testing a model is vital for this, and while red teaming continues to be an effective solution, automated threat discovery can use AI to stress-test deployed LLMs.
Comentarios