Skip to content

Comment on Compromising LLM-integrated applications with indirect prompt injection

Comments

Well, maybe we could limit this by having a list of preset actions that the LLM can take and those actions can contain canned responses based on templates. This way we can make a chat bot with a LLM model that never sends its output to the user. For some applications, this might be enough, since you still get the amazing interpretation abilities of a LLM.

There are frameworks out there for doing that kind of thing, see https://rasa.com/ for example. It's not using any LLMs at the moment, just BERT and DIET mostly but it's highly customizable and you could likely bring in an LLM for doing some interesting things to handle more complex messages from users.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.