In brief
In a recent article titled The Cybersecurity of Gen-AI and LLMs: Current Issues and Concerns, the Cyber Security Agency of Singapore (CSA) provides helpful thought leadership on the security and privacy challenges associated with generative artificial intelligence (Gen-AI) and large language models (LLMs). The article outlines issues such as accidental data leaks, vulnerabilities in AI-generated code and potential misuse of AI by malicious actors, before providing recommendations on the steps that technology companies can take to address these concerns.
In more detail
The rapid growth of Gen-AI and LLMs has led to significant security and privacy concerns, and the key issues highlighted by the CSA include the following:
- Accidental data leaks: Gen-AI systems, particularly LLMs, are susceptible to accidental data leaks, which may occur through overfitting or inadequate data sanitization. Sensitive information may be exposed when employees use ChatGPT for coding. The growing integration of AI in personal devices also increases the risk of data being inadvertently transferred to the cloud.
- Risks in AI-generated code: The use of AI in coding increases cybersecurity risk because, without supervision, such code may contain undetected security flaws. Human oversight remains essential to mitigate such risks.
- Misuse of AI: Malicious actors may leverage LLMs to exploit vulnerabilities identified in common vulnerabilities and exposures (CVE) reports. Such risks are generally reduced when training data does not include CVE descriptions.
- Mitigating privacy concerns: Tech companies are helping to address privacy issues by controlling data usage, for example, by providing options for users to delete stored information and to prevent data from being used to train models. Users are nevertheless advised to refrain from sharing sensitive data with AI platforms.
The CSA’s list of best practices to address the privacy and security concerns associated with Gen-AI and LLMs include the following:
- Enhancing employee awareness and training on associated risks
- Reviewing and updating IT and data loss prevention policies
- Ensuring human supervision over Gen-AI systems and LLMs
- Staying updated on developments in Gen-AI and associated risks
Key takeaways
The article demonstrates the CSA’s cautiously optimistic outlook in the Gen-AI and LLM space, noting the sensitive balance required in developing responsible Gen-AI and LLMs. Understanding these realities and implementing the necessary guardrails will be critical for organizations keen on integrating Gen-AI and LLMs into their business processes.
* * * * *
© 2024 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
