The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching
Researchers show LLMLeak, a covert channel that exfiltrates secrets when local malware tricks LLMs into fetching attacker URLs.
The paper introduces LLMLeak, a covert channel in which local malware that cannot reach the internet embeds a secret in a URL and asks an LLM to fetch it as part of a benign task. When the model uses its web-fetch tool, an attacker-controlled DNS or web server observes the encoded secret. Across eleven open-parameter models the attack succeeded 79.7 percent of the time, and a case study on real-world chatbots showed the same pattern. Direct requests to exfiltrate through generated code are easier to block because network libraries are typically restricted.
- LLMLeak hides secrets in URLs that local software asks an LLM to fetch.
- Attacker DNS or web servers receive the secret when the model fetches the URL.
- Tests on eleven open-parameter models reached a 79.7 percent success rate.
- A case study shows the same channel against real-world chatbots.
From the original article
1 min read at arxiv.orgWith the increasing capabilities of Large-Language-Models (LLMs) and LLM-based agents, users are increasingly using them to solve everyday problems, such as answering e-mails or providing programming support. Existing work has extensively investigated security and privacy risks, such as prompt injections and the disclosure of sensitive data to chatbot providers.
By Alessandro Pegoraro · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.