Google adds generative AI threats to its bug bounty program

Google has expanded its vulnerability rewards program (VRP) to include assault eventualities explicit to generative AI.

In an announcement shared with TechCrunch ahead of publication, Google talked about: “We think about growing the VRP will incentivize evaluation spherical AI safety and security and produce potential factors to mild that may lastly make AI safer for everyone,” 

Google’s vulnerability rewards program (or bug bounty) pays ethical hackers for finding and responsibly disclosing security flaws. 

Given that generative AI brings to mild new security factors, such as a result of the potential for unfair bias or model manipulation, Google talked about it sought to rethink how bugs it receives must be categorized and reported. 

The tech giant says it’s doing this by way of the usage of findings from its newly usual AI Red Team, a bunch of hackers that simulate a variety of adversaries, ranging from nation-states and government-backed groups to hacktivists and malicious insiders to go looking out security weaknesses in experience. The crew simply these days carried out an prepare to seek out out the most important threats to the experience behind generative AI merchandise like ChatGPT and Google Bard.

The crew found that giant language fashions (or LLMs) are inclined to instant injection assaults, for example, whereby a hacker crafts adversarial prompts that will have an effect on the conduct of the model. An attacker might use any such assault to generate textual content material that’s harmful or offensive or to leak delicate knowledge. Moreover they warned of 1 different type of assault often known as training-data extraction, which allows hackers to reconstruct verbatim teaching examples to extract personally identifiable knowledge or passwords from the data. 

Every of a majority of those assaults are coated throughout the scope of Google’s expanded VRP, along with model manipulation and model theft assaults, nevertheless Google says it gained’t present rewards to researchers who uncover bugs related to copyright factors or data extraction that reconstructs non-sensitive or public knowledge.

The monetary rewards will fluctuate on the severity of the vulnerability discovered. Researchers can presently earn $31,337 within the occasion that they uncover command injection assaults and deserialization bugs in extraordinarily delicate functions, paying homage to Google Search or Google Play. If the failings impact apps which have a lower priority, the utmost reward is $5,000.

Google says that it paid out higher than $12 million in rewards to security researchers in 2022.