Upgrade to Pro — share decks privately, control downloads, hide ads and more …

今だからこそ学ぼう! 生成AIのセキュリティ入門③_公開資料

今だからこそ学ぼう! 生成AIのセキュリティ入門③_公開資料

Nobu Mochizuki

August 26, 2024
Tweet

More Decks by Nobu Mochizuki

Other Decks in Technology

Transcript

  1. ࣸਅࡱӨ ಈըࡱӨ ࢿྉެ։ 4/4֦ࢄ ̋ ̋ ̋ ̋ *#.%PKP ηογϣϯडߨʹ͓͚Δ஫ҙࣄ߲

    ηογϣϯதʹ໎࿭ߦҝ͕ൃ֮ͨ͠৔߹͸ɺڧ੍ୀग़ɺηογϣϯதࢭͳͲͷાஔΛߨ͡·͢
  2. લճͷηογϣϯͷϑΥʔΧε ݩσʔλ σʔλ ४උͷ ։ൃ σʔλ४උ༻ͷ ίʔυ ೖྗͱग़ྗ σʔλαϯϓϧ ΦϖϨʔγϣϯ

    Ψόφϯε ΞϓϦ։ൃ ΞϓϦͷίʔυ ҰൠతͳΞϓϦɾγεςϜ։ൃ ӡ༻ͱΨόφϯε σʔλΤϯδχΞϦϯάɾσʔλαΠΤϯε ӡ༻σʔλ ӡ༻தίʔυ ։ൃதίʔυ ݕূͱ෼ੳ ӡ༻ɾΨόφϯε ࢀরɿAttacking and protecting Artificial Intelligence (Event) https://raw.githubusercontent.com/OWASP/www-project-ai-security-and-privacy-guide/main/assets/images/20230215-Rob-AIsecurity-Appsec-ForSharing.pdf Ϟσϧ։ൃɾςετ޲͚ͷݕূͱ෼ੳ Ϟσϧֶश ֶशɾςετ༻ ͷίʔυ Ϟσϧͷద༻ ͱֶश͞Εͨ ύλʔϯ "*Ϟσϧ։ൃ ඪ४ΞϓϦɾιϑτ΢ΣΞͷηΩϡϦςΟʔ
  3. θϩτϥετɾΞϓϩʔνΛ࢖ͬͨରࡦ ϋΠϒϦουΫϥ΢υͷอޢ r͢΂ͯͷΞΫηεΛ؅ཧɾ ੍ޚ rΫϥ΢υͷΞΫςΟϏςΟʔͱ ߏ੒Λ؂ࢹ r҆શͳΫϥ΢υɾωΠςΟϒɾ ϫʔΫϩʔυ ಺෦ڴҖͷϦεΫΛ௿ݮ –

    ϦεΫͷ͋ΔϢʔβʔ׆ಈΛ ൃݟ͢Δߴ౓ͳ෼ੳ – Ϣʔβʔͷݖݶͱඞཁੑʹ Ԡͯ͡σʔλ΁ͷΞΫηεΛ੍ޚ – ڴҖΠϯςϦδΣϯεͷ૊ΈࠐΈ ηΩϡΞͳϦϞʔτϫʔΫ؀ڥ rηΩϡΞͳ#:0%ͱ σόΠε؅ཧ r71/ͷഉআ rύεϫʔυϨεମݧͷ ఏڙ
  4. ຊηογϣϯͷϑΥʔΧε ݩσʔλ σʔλ ४උͷ ։ൃ σʔλ४උ༻ͷ ίʔυ ೖྗͱग़ྗ σʔλαϯϓϧ ΦϖϨʔγϣϯ

    Ψόφϯε ΞϓϦ։ൃ ΞϓϦͷίʔυ ҰൠతͳΞϓϦɾγεςϜ։ൃ ӡ༻ͱΨόφϯε σʔλΤϯδχΞϦϯάɾσʔλαΠΤϯε ӡ༻σʔλ ӡ༻தίʔυ ։ൃதίʔυ ݕূͱ෼ੳ ӡ༻ɾΨόφϯε ࢀরɿAttacking and protecting Artificial Intelligence (Event) https://raw.githubusercontent.com/OWASP/www-project-ai-security-and-privacy-guide/main/assets/images/20230215-Rob-AIsecurity-Appsec-ForSharing.pdf Ϟσϧ։ൃɾςετ޲͚ͷݕূͱ෼ੳ Ϟσϧֶश ֶशɾςετ༻ ͷίʔυ Ϟσϧͷద༻ ͱֶश͞Εͨ ύλʔϯ "*Ϟσϧ։ൃ ݩσʔλ σʔλ ४උͷ ։ൃ σʔλ४උ༻ͷ ίʔυ ೖྗͱग़ྗ σʔλαϯϓϧ Ϟσϧ։ൃɾςετ޲͚ͷݕূͱ෼ੳ ΦϖϨʔγϣϯ Ψόφϯε ΞϓϦ։ൃ ΞϓϦͷίʔυ Ϟσϧֶश ֶशɾςετ༻ ͷίʔυ Ϟσϧͷద༻ ͱֶश͞Εͨ ύλʔϯ "*Ϟσϧ։ൃ ҰൠతͳΞϓϦɾγεςϜ։ൃ ӡ༻ͱΨόφϯε σʔλɾΤϯδχΞϦϯάɺσʔλαΠΤϯε ӡ༻σʔλ ӡ༻தίʔυ ։ൃதίʔυ ݕূͱ෼ੳ ӡ༻ɾΨόφϯε ඪ४ΞϓϦɾιϑτ΢ΣΞηΩϡϦςΟʔ "*த৺ͷσʔληΩϡϦςΟʔ
  5. νϡʔχϯάʹΑͬͯۀքݻ༗ͷλεΫʹ΋ରԠՄೳ ੜ੒"*ͷνϡʔχϯάͷॏཁੑᶄ େྔͷ จॻ σʔλ ੜ੒"*Ϟσϧ ੡଄ۀ σʔλ ۚ༥ۀք ಛԽϞσϧ

    ࣄલʹֶश ۚ༥ۀ σʔλ ෆಈ࢈ۀ σʔλ ੡଄ۀք ಛԽϞσϧ ෆಈ࢈ۀք ಛԽϞσϧ νϡʔχϯά νϡʔχϯά νϡʔχϯά
  6. ࡞੒ ʢ$SFBUFʣ อ؅ ʢ4UPSFʣ ར༻ ʢ6TF ڞ༗ɾసૹ ʢ4IBSF5SBOTNJUʣ ΞʔΧΠϒ ʢ"SDIJWF

    ফڈɾഁյ ʢ%FTUSPZʣ σʔλɾϥΠϑαΠΫϧͷηΩϡϦςΟʔ՝୊ σʔλऔಘɾ࡞੒࣌ʹ ࣝผͱར༻໨తͷఆٛ อ؅ɺ҉߸Խͱ ࿙Ӯ๷ࢭ ΞΫηεݖݶͱ มߋ؅ཧ సૹதͷ҉߸ԽɺΞΫηεݖݶͱ ϞχλϦϯά ௕ظอଘɺόοΫΞοϓ ͱࡂ֐ɾࣄ߲෮چ σόΠεɾػثͷॲ෼ɺ ن੍ʹ߹Θͤͨফڈɾഁյ Ϣʔβʔͱσʔλ ΞΫηε؅ཧ
  7. σʔλن੍͓ΑͼίϯϓϥΠΞϯεͷߟྀࣄ߲ʢ̎ʣ ۚ༥ 1$*%44 1BZNFOU$BSE *OEVTUSZ%BUB4FDVSJUZ 4UBOEBSE 1$*%44 ͸ ΫϨδοτΧʔυܾࡁ த৺ͷۚ༥΍ݸਓ৘ใ

    ؅ཧͱ҆શੑத৺ͷن ੍ɻ &$PNNFSDF ۚ༥ ࣗಈं 81 ࠃ࿈ͷ8PSME'PSVN GPS)BSNPOJ[BUJPO PG7FIJDMF 3FHVMBUJPOTͰ͸ࣗ ಈंۀքʹؔ࿈͢Δ ن੍Λఆ͍ٛͯ͠Δɻ ۙ೥Ͱ͸ίωΫςο υϏʔΫϧؔ࿈ͷ৘ ใ΍γεςϜͷ ηΩϡϦςΟ͕࿩୊ ͱͳ͍ͬͯΔɻ ࣗಈंத৺ Ԥभ (%13 Ԥभࠃຽͷݸਓ৘ใ औΓѻ͍ͷ҆શੑΛ த৺ʹͨ͠ن੍ɻத Ͱ͸σʔλ΍γες ϜͷऔΓѻ͍Ԥभࠃ ͔Βͷσʔλͷ༌ग़ Ҏ֎ʹ৘ใఏڙͷ ʮ0QUPVUʯ࢓૊Έ ͷద༻΋ؚΊΒΕͯ ͍Δ Ԥभࠃຽ͕Τϯυ ϢʔβʔͱͳΔ૊৫ શൠ ࠃࡍ *40 *OUFSOBUJPOBM 0SHBOJ[BUJPOGPS 4UBOEBSEJ[BUJPO ʢ*40ʣ͔Βग़ͯ͠ ͍Δࠃࡍతͳ৘ใη ΩϡϦςΟʔͱϦε Ϋ؅ཧؔ࿈ͷن੍ɻ ೔ຊͰ͸+*42 ʹͳΔɻ ಛఆͷۀքʹ ݶఆ͞Ε͍ͯͳ͍ ҩྍ )*1"" ถࠃ )FBMUI*OTVSBODF 1PSUBCJMJUZBOE "DDPVOUBCJMJUZ"DU )*1"" ถࠃͰͷҩྍ อݥۀքؔ࿈ͷױऀͷ ݈߁৘ใͷ҆શੑΛอ ͪͳ͕Βෆਖ਼ͷϦεΫ ΛݮΒ͠ͳ͕Βޮ཰ੑ Λ্͛Δҝͷن੍ɻ පӃ΍ΫϦχοΫ ҩྍɾੜ໋อݥ ೔ຊࠃ಺ ݸਓ৘ใอޢ๏ ݸਓ৘ใอޢ๏͸ ೥ʹࢪߦ͞Εɺ೔ຊࠃ ຽؔ࿈ͷݸਓ৘ใऔΓ ѻ͍Λن੍͢Δ๏཯Ͱɺ (%13ͱࣅ͍ͯΔɻ ೔ຊࠃຽ͕Τϯυ ϢʔβʔͱͳΔ ૊৫શൠ
  8. ͓٬༷ʹͱͬͯͷॏཁσʔλʢ$SPXO +FXFMTʣ͸Կ͔ ݸਓ৘ใ ٕज़৘ใ Ӧۀ৘ใ ࡒ຿ؔ࿈৘ใ ࣗࣾͷڝ૪ྗ͕௿Լ͢Δ৘ใ औҾઌɾऔҾՁ֨ʹؔ͢Δ৘ใɺ઀٬ϚχϡΞϧɺެදલ σβΠϯͳͲ ๏ྩҧ൓ຢ͸ܖ໿ҧ൓ʹӨڹ͢Δ

    ઓུతͳ൑அͰݖརԽͤͣൿີʹ͍ͯ͠Δٕज़৘ใ ৽نૉࡐͷ੒෼ɺ੡଄ϊ΢ϋ΢ͳͲ ࿙͍͑ʹΑΓ๏ྩҧ൓ຢ͸ܖ໿ҧ൓ʹӨڹ͢Δ ࣗࣾͷຢ͸ଞ͔ࣾΒఏڙ͞Εͨະެදࡒ຿ؔ࿈৘ใ ๏ྩɺऔҾॴͷنଇͰ։ࣔٛ຿͕͋Δ৘ใͷ͏ͪɺະެදͷ ΋ͷͳͲ ϓϥΠόγʔʹؔ͢Δݸਓ৘ใ ࿙͍͑ͨ͠৔߹ɺࣗࣾͷ৴༻ͷᆝଛ΍ഛঈ੥ٻʹӨڹ͢Δ
  9. σʔλɾηΩϡϦςΟʔͷݕ౼ϙΠϯτʢ̍ʣ ϦΞϧλΠϜʹ ڴҖΞϥʔτΛ ࿈ܞग़དྷΔ͔  ୭͕ΞΫηεݖݶΛ ͍࣋ͬͯΔ͔ʁ ॲཧ࡞ۀ͸ʁ ҆શʹอ؅͞Ε͍ͯ Δ͔ʁ

    ॏཁσʔλ͕อޢ ͞Ε͍ͯΔ͜ͱΛ ূ໌Ͱ͖Δ͔ ݕग़ อޢ ४ڌ ݕ஌ ରԠ ৘ใ࿙Ӯʹͭͳ͕Δ ո͍͠ߦಈΛૉૣ͘ ಛఆͰ͖Δ͔ ॏཁσʔλ͕ Ͳ͜ʹ͋Δ͔
  10. σʔλɾηΩϡϦςΟʔͷݕ౼ϙΠϯτʢʣ ݕग़ อޢ ४ڌ ݕ஌ ରԠ ΞφϦετʹඞཁͳ ҟৗ৘ใΛ 40$ͱڞ༗ θϩτϥετɾ

    Ξϓϩʔνʹ ج͍ͮͨ ࣗಈԽ͞Εͨ σʔλ෼ੳ ίϯϓϥΠΞϯεͷ ཁ݅Λຬͨ͠ɺ πʔϧΛ࢖ͬͯ؂ࠪ ϨϙʔτΛ࡞੒͢Δ ॏཁσʔλ͕Ͳ͜ʹ ͋Δͷ͔Λ೺Ѳ͠ɺ ੔ཧɾ෼ྨ͢Δ શͯͷσʔλιʔεͷ ΞΫςΟϏςΟʔͷ ϞχλϦϯάɺ ੬ऑੑධՁɺอޢ
  11. "*Ϟσϧ։ൃɾػցֶशͷத৺͸σʔλͷՃ޻ͱ४උ ίʔυߦ਺ σʔλΤϯδχΞϦϯά ϞσϧΤϯδχΞϦϯά %FW0QT ΞϧΰϦζϜ ׂ͔Βׂͷίʔυ͸ σʔλ४උͷͨΊʹ͋Δ σʔλ४උͷίʔυ͸ සൟʹมߋ͞ΕΔ

    σʔλ४උ༻ͷίʔυ͸ ͦ΋ͦ΋อकͮ͠Β͍ ࣮ݧతͳίʔυ΍ɺ ଐਓੑ͕ߴ͍ίʔυ͸ ଞਓ͕อकͮ͠Β͍ ࢀরɿAttacking and protecting Artificial Intelligence (Event) https://raw.githubusercontent.com/OWASP/www-project-ai-security-and-privacy-guide/main/assets/images/20230215-Rob-AIsecurity-Appsec-ForSharing.pdf
  12. γφϦΦɿέʔεελσΟʔ ࢀরɿLeak Shows That Google-Funded AI Video Generator Runway Was

    Trained on Stolen YouTube Content, Pirated Films https://futurism.com/leak-runway-ai-video-training ಈըੜ੒"*Ϟσϧ͕ ւ଑൛΍౪·ΕͨσʔλͰ ֶश͞ΕͨϞσϧͩͬͨ ڐՄΛಘͣʹσʔλΛऔಘ͠ɺ ֶशʹར༻ͨ͠ Ϟσϧͷग़ྗ͕ɺ༗໊ͳ ίϯςϯπʹࣅ͍ͯΔࣄ͕ ໌Β͔ʹͳͬͨ ஶ࡞ݖ৵֐
  13. γφϦΦɿέʔεελσΟ ࢀরɿAI Models fed AI-generated data quickly spew nonsense https://www.nature.com/articles/d41586-024-02420-7

    Ϟσϧͷֶशʹར༻͞ΕΔ σʔλ͕վ᜵͞ΕΔͱɺ Ϟσϧͷਪ࿦݁Ռ͕ظ଴௨Γ ʹͳΒͳ͍ ϞσϧͷྼԽ
  14. γφϦΦͷ՝୊ͱରࡦ ஫໨ΤϦΞ ओͳ՝୊ ηΩϡϦςΟʔରࡦ σʔλ σʔλϕʔεͷෆਖ਼ΞΫηεɾ 42-ΠϯδΣΫγϣϯɾ.BOJOUIF.JEEMF σʔλͷ҉߸ԽɾίϯϓϥΠΞϯεͱ؂ ࠪɾόοΫΞοϓͱ෮ݩରࡦɾϢʔβʔ ͷΞΫηε؅ཧɾೖྗͷύϥϝʔλʔԽ

    ͱೖྗόϦσʔγϣϯɾΠϯγσϯτܭ ըͳͲ ίʔυ ίʔυ಺ͷόάʹΑͬͯͷ੬ऑੑɾ ίʔυϕʔεͷ҆શੑ αϓϥΠνΣʔϯ߈ܸʣͳͲ ཁ݅ఆٛͱυΩϡϝϯςʔγϣϯɾ %FW4FD0QTɾηΩϡϦςΟʔͱ ϓϥΠόγʔΛ૊ΈࠐΜͩ4%-$ɾ $*$%ͱνΣϯδϚωδϝϯτɾ ϨϙδτϦʔ؅ཧɾ"1*อޢͳͲ
  15. ϫʔΫγϣοϓɺηογϣϯɺ͓Αͼࢿྉ͸ɺ*#.·ͨ͸ηογϣϯൃදऀʹΑͬͯ४උ͞ΕɺͦΕͧΕಠࣗͷݟղΛ൓өͨ͠΋ͷͰ͢ɻͦΕΒ͸৘ใ ఏڙͷ໨తͷΈͰఏڙ͞Ε͓ͯΓɺ͍͔ͳΔࢀՃऀʹରͯ͠΋๏཯త·ͨ͸ͦͷଞͷࢦಋ΍ॿݴΛҙਤͨ͠΋ͷͰ͸ͳ͘ɺ·ͨ*#.੡඼΍αʔϏε͕͓ ٬༷ʹద༻͋Δಛఆͷ๏ྩʹద߹͢Δ͜ͱΛอূ͢Δ΋ͷͰ΋͋Γ·ͤΜɻຊߨԋࢿྉʹؚ·Ε͍ͯΔ৘ใʹ͍ͭͯ͸ɺ׬શੑͱਖ਼֬ੑΛظ͢ΔΑ͏౒ Ί͓ͯΓ·͕͢ɺʮݱঢ়ͷ··ʯఏڙ͞Εɺ໌ࣔ·ͨ͸໧ࣔʹ͔͔ΘΒͣɺ঎ۀੑɺಛఆͷ໨త΁ͷద߹ੑɺඇ৵֐ੑΛؚΊɺ͍͔ͳΔอূ΋൐Θͳ͍ ΋ͷͱ͠·͢ɻຊߨԋࢿྉ·ͨ͸ͦͷଞͷࢿྉͷ࢖༻ʹΑͬͯɺ͋Δ͍͸ͦͷଞͷؔ࿈ʹΑͬͯɺ͍͔ͳΔଛ֐͕ੜͨ͡৔߹΋ɺ*#.͸੹೚ΛෛΘͳ͍ ΋ͷͱ͠·͢ɻ ຊߨԋࢿྉͰݴٴ͞ΕΔ*#.੡඼ɺϓϩάϥϜɺ·ͨ͸αʔϏε͸ɺ*#.͕ϏδωεΛߦ͍ͬͯΔ͢΂ͯͷࠃɾ஍ҬͰ͝ఏڙՄೳͳΘ͚ Ͱ͸͋Γ·ͤΜɻຊߨԋࢿྉͰݴٴ͞ΕΔকདྷͷల๬ʢ੡඼ϦϦʔε೔෇΍੡඼ػೳΛؚΉʣ͸ɺࢢ৔ػձ·ͨ͸ͦͷଞͷཁҼʹج͍ͮͯ*#.ಠࣗͷܾ ఆݖΛ΋͍ͬͯͭͰ΋มߋͰ͖Δ΋ͷͱ͠ɺকདྷͷ੡඼·ͨ͸ػೳ͕࢖༻ՄೳʹͳΔ͜ͱɺ΋͘͠͸ಛఆͷ݁ՌΛ֬໿͢Δ͜ͱΛҙਤ͢Δ΋ͷͰ͸͋Γ ·ͤΜɻຊߨԋࢿྉ͸ɺݴٴ͞ΕΔ

    *#.੡඼·ͨ͸αʔϏεʹద༻͋Δܖ໿৚݅Λมߋ͢Δ΋ͷͰ΋ɺ௥Ճͷද໌·ͨ͸อূΛҙਤ͢Δ΋ͷͰ΋͋Γ· ͤΜɻ ຊߨԋࢿྉʹؚ·Ε͍ͯΔ಺༰͸ɺࢀՃऀͷ׆ಈʹΑͬͯಛఆͷ݁Ռ͕ੜ͡Δͱड़΂Δɺ·ͨ͸҉ࣔ͢Δ͜ͱΛҙਤͨ͠΋ͷͰ΋ɺ·ͨͦͷΑ͏ͳ݁Ռ ΛੜΉ΋ͷͰ΋͋Γ·ͤΜɻ ύϑΥʔϚϯε͸ɺ؅ཧ͞Εͨ؀ڥʹ͓͍ͯඪ४తͳ*#.ϕϯνϚʔΫΛ࢖༻ͨ͠ଌఆͱ༧ଌʹج͍͍ͮͯ·͢ɻϢʔβʔ ͕ܦݧ͢Δ࣮ࡍͷεϧʔϓοτ΍ύϑΥʔϚϯε͸ɺϢʔβʔͷδϣϒɾετϦʔϜʹ͓͚ΔϚϧνϓϩάϥϛϯάͷྔɺೖग़ྗߏ੒ɺετϨʔδߏ੒ɺ ͓Αͼॲཧ͞ΕΔϫʔΫϩʔυͳͲͷߟྀࣄ߲ΛؚΉɺ਺ଟ͘ͷཁҼʹԠͯ͡มԽ͠·͢ɻ͕ͨͬͯ͠ɺݸʑͷϢʔβʔ͕͜͜Ͱड़΂ΒΕ͍ͯΔ΋ͷͱ ಉ༷ͷ݁ՌΛಘΒΕΔͱ֬໿͢Δ΋ͷͰ͸͋Γ·ͤΜɻهड़͞Ε͍ͯΔ͢΂ͯͷ͓٬༷ࣄྫ͸ɺͦΕΒͷ͓٬༷͕ͲͷΑ͏ʹ*#.੡඼Λ࢖༻͔ͨ͠ɺ· ͨͦΕΒͷ͓٬༷͕ୡ੒ͨ݁͠Ռͷ࣮ྫͱͯࣔ͠͞Εͨ΋ͷͰ͢ɻ࣮ࡍͷ؀ڥίετ͓ΑͼύϑΥʔϚϯεಛੑ͸ɺ͓٬༷͝ͱʹҟͳΔ৔߹͕͋Γ·͢ɻ • *#.ɺ*#.ϩΰɺJCNDPNɺ watsonx.aiäɺ watsonx.governanceä͸ɺ ੈքͷଟ͘ͷࠃͰొ࿥͞Εͨ*OUFSOBUJPOBM#VTJOFTT.BDIJOFT$PSQPSBUJPOͷ ঎ඪͰ͢ɻଞͷ੡඼໊͓ΑͼαʔϏε໊౳͸ɺͦΕͧΕ*#.·ͨ͸֤ࣾͷ঎ඪͰ͋Δ৔߹͕͋Γ·͢ɻݱ࣌఺Ͱͷ *#.ͷ঎ඪϦετʹ͍ͭͯ͸ɺ XXXJCNDPNMFHBMDPQZUSBEFTIUNMΛ͝ཡ͍ͩ͘͞ɻ