Security Testing LLM Models with Synack

00:06 Hey, everyone. Welcome to another episode of Cut to the Chase. I'm Brandon Torio, senior product manager here at Synack, and I wanna talk today about AI and large language models and how to test them. So we're hearing a lot about them over the last year. Hopefully, you've used something like ChatGPT or a similar tool to get a feel of what it's like. And we're hearing from our customers that a lot of them are rolling them out onto their attack surface, to their website, to their internal tools, faster than they can really secure them. So we've worked to get create an offering to be able to do

00:36 pin testing on those instances. So, you know, customers are using these for chatbots so that their customers can do something like talk to the chatbot and find more information about their product's warranty or about their policies. Customers of ours are rolling them out as internal tools in their organizations to help their internal employees search and find things. There's a lot of different uses for these. You can go to OpenAI and see the examples they list, everything from helping kids at school navigate problems to

01:08 internal search engines to identifying images, etcetera. And these do have vulnerabilities. So luckily for us, the OWASP Open Web Application Security Project has already developed an OWASP top ten list of AI and large language model vulnerabilities. And here at Synack, we use the Synack Red Team, which is a community of about fifteen hundred diverse researchers around the world, to do all of our testing through our platform. And so you can bet that some of those researchers have already latched on to the OWASP top ten.

01:39 They're already excited to do that testing. And so what we've done really is connect you to those researchers and create a clear guideline and model for you to be able to do that testing. So I'm gonna cut to the chase real quick and jump into the SYNNAC platform and give you a better idea of what that means. So here I'm on the homepage of the SYNACT platform, and all pin testing and security testing through the platform comes through the platform. So at the homepage, you see high level information like the vulnerabilities, suspected vulnerabilities,

02:09 how many hours researchers have put into your attack surface, how many have signed up to do the testing, things like that. For the OWASP AI and large language model testing specifically, we use something called missions. So missions are items of work that go out to the researchers and ask them to do something specific. I'm going to click on missions right here to jump over there. And so you can see a list of missions here, such as API missions asking for researchers to check

02:39 for the existence of a specific flaw, like deserialization here, NIST checklist, etcetera. The missions really enable us to have customers check something really specific or aligned to a compliance framework. And so for AI and large language models, what we've done is map submissions to the OWASP top ten. So there are eight items out of the OWASP top ten that really make sense for us to do testing wise. So those are listed here, prompt injection, insecure output handling, training data poisoning,

03:09 supply chain VOMS, sensitive information disclosure, insecure plug in design, excessive agency, and model theft. And these numbers here correspond to the numbers on the OWASP top ten documentation. And so what we've done is make it so that you can run on demand within the platform these missions and point to your AI or large language model implementation, whether it's a chatbot on an educational page, an internal chatbot that you're using to help internal

03:39 employees find policies about your benefits or education on how to use your internal products or processes, whatever it is, these missions are applicable to it. And so you can spin that up. The work will go out to the researchers. And usually within a day or just a couple of days, the missions will come back completed, and you'll understand the status of the missions as they relate to, the work. So in this case, the missions are all talking about, does my AI or large language model implementation have the

04:10 vulnerability associated with this item on the OWASP top ten? And you can see we give results pass or fail. So if you pass, it means, hey, the researcher checked it out. They looked for prompt injection, which is, can I give a malicious prompt to the AI? And they passed it. And so the researcher determined, no, you know, I tried that a few times, it didn't work. And if you click on any one of these missions, you'll see an explanation from the researcher about what they tried. For example, this one failed. The researcher says, you know,

04:40 I found a plugin that the chatbot was using. You know, the chatbot is enabled to give an answer about vacant rooms at a hotel, for example, and is using a search tool plugin to be able to do that. Well, I did this. I tried this prompt. I looked at Burp Suite interception. I did all these things, and this is my conclusion that you probably have a vulnerability there or you do have a vulnerability there. Or you're just not following best practices. Even though I couldn't make an exploit,

05:10 I flagged this as failed because you weren't following best practices. The missions even include screenshots here to give you a better idea about what the researcher did. And so that's true of all of our missions and of these AI and large language model missions. So that gives you the ability to be able to say, hey, we had individual researchers check for each one of these OWASP top ten vulnerabilities, eight of them, and this is what they found. And then you can act on any kind of lack of best practices they found or, of course, exploitable vulnerabilities.

05:42 And speaking of exploitable vulnerabilities, I want to hammer home that point by just talking about the exploitable vulnerabilities in the platform. Because not only do we run those missions, but we also just enable open vulnerability discovering on the application where the AI or large language model implementation or use case is embedded. And so let's say, for example, you have a chatbot on your customer facing website, and maybe you want this chatbot to only be for logged in customers, right? People who pay for an account on my service can use the chatbot only.

06:13 Well, that login field still might have traditional SQL injection vulnerabilities or other types of vulnerabilities. And so that's why it's important that we also just do open vulnerability discovery. So you get that all in a package, and that open vulnerability discovery goes out to the community so that you can have dozens of unique, diverse perspectives checking for those vulnerabilities. And so if those vulnerabilities pop up, they would appear here within the vulnerabilities tab. This is really one of the crown jewels of the Sync platform. Every vulnerability in the platform comes with extremely

06:44 rich information, including, you know, the request made to find the vulnerability, steps for your team to reproduce it, tips about how to fix it, CVSS score, the ability to verify after you patch it, whether your patch worked at the click of a button where you describe your patch and the information goes to the researcher, the ability to ask a researcher questions with this comment field at the bottom of the vulnerability form to get more clarifying information if you want. And so I go through that just to demonstrate the

07:14 comprehensiveness of the testing for OWASP, for AI and large language model implementations. Because you're not only getting a look with respect to the OWASP guidelines, you're getting a holistic vulnerability discovery on the entire application that the use case is embedded within. And so that's an overview of how we've approached the AI and large language model problem. Our customers are rapidly deploying these. These models are getting deployed quite quickly, as you've probably seen with the rapid increase of ChatGPT

07:46 and chatbot like implementations. We see it in memes. We see it in image generation all over the place for better and worse. Right? And so Synack has enabled you to test these whenever they become deployed on your organization. No matter the use case, it's flexible. The OWASP top ten is written for many use cases, and we'll test against that checklist. And so that about wraps up this conversation on AI and large language models. Thanks for visiting. If you have any more further questions,

08:17 you can visit synac dot com slash pentesting ai, where we've written a lot more about the types of risks involved, how we've approached the problem, why you should do the pentesting on AI and large language models. There's also a contact us form there for you to reach out and hopefully get started with us if you have this need. So thanks for watching. Until next time.