Re:Multi-modal prompt injection image attacks against GPT-4V
by danShumway on Monday October 16, 2023 @10:37PM
(#37909830)
The URL request is the browser request for the URL placed in the src tag of the image. The exfiltration technique is an image request. What the server returns as a response to that request doesn't matter. It doesn't even need to return anything at all.
If remote images were blocked from markdown as they are in many other applications, the URL request would not be made by the browser. The mitigation is that ChatGPT should refuse to render image tags or make requests for images if given a 3rd-party URL. I'm not sure if we're talking past each other or what, but I'm not talking about whether the server returns an image. I'm saying, ChatGPT will request an image from an external domain as part of rendering markdown in the responses, and that can be used as an exfiltration method.
The response from the server has nothing to do with it. I'm talking about the fact that ChatGPT will request arbitrary urls without user input if the URLs are formatted in a markdown block as an image src.
If remote images were blocked from markdown as they are in many other applications, the URL request would not be made by the browser. The mitigation is that ChatGPT should refuse to render image tags or make requests for images if given a 3rd-party URL. I'm not sure if we're talking past each other or what, but I'm not talking about whether the server returns an image. I'm saying, ChatGPT will request an image from an external domain as part of rendering markdown in the responses, and that can be used as an exfiltration method.
The response from the server has nothing to do with it. I'm talking about the fact that ChatGPT will request arbitrary urls without user input if the URLs are formatted in a markdown block as an image src.