CoChat
Sign Up
PreprintCited by 10Security and Verification in ComputingAdversarial Robustness in Machine LearningAccess Control and Trust

IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems

Open access
Wu, Yuhao, Roesner, Franziska, Kohno, Tadayoshi, Zhang, Ning, Iqbal, Umar·2024·arXiv
DOI 10.48550/arxiv.2403.04960arXiv 2403.04960
Open this paper in CoChat — free accountOpen PDF

Abstract

Large language models (LLMs) extended as systems, such as ChatGPT, have begun supporting third-party applications. These LLM apps leverage the de facto natural language-based automated execution paradigm of LLMs: that is, apps and their interactions are defined in natural language, provided access to user data, and allowed to freely interact with each other and the system. These LLM app ecosystems resemble the settings of earlier computing platforms, where there was insufficient isolation between apps and the system. Because third-party apps may not be trustworthy, and exacerbated by the imprecision of natural language interfaces, the current designs pose security and privacy risks for users. In this paper, we evaluate whether these issues can be addressed through execution isolation and what that isolation might look like in the context of LLM-based systems, where there are arbitrary natural language-based interactions between system components, between LLM and apps, and between apps. To that end, we propose IsolateGPT, a design architecture that demonstrates the feasibility of execution isolation and provides a blueprint for implementing isolation, in LLM-based systems. We evaluate IsolateGPT against a number of attacks and demonstrate that it protects against many security, privacy, and safety issues that exist in non-isolated LLM-based systems, without any loss of functionality. The performance overhead incurred by IsolateGPT to improve security is under 30% for three-quarters of tested queries.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2403.04960

Cites

0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • AgentDojo requires agents to dynamically call multiple tools in a stateful, adversarial environment.

    “In contrast to prior benchmarks for AI Agents [32, 43, 50, 68] and for prompt injections [34, 57, 66, 71], AgentDojo requires agents to dynamically call multiple tools in a stateful, adversarial environment.”

    From AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (2024) · cites this paper as [66]

    The System model and Attacker capabilities and goals sections describe a multi-app LLM system facing malicious apps and content, which supports the citation’s relevance to adversarial agent settings. But the App compromise and data stealing evaluation at scale section says IsolateGPT uses and extends a benchmark from another work; it does not establish IsolateGPT itself as a prior prompt-injection benchmark. The paper also does not describe AgentDojo’s requirements. (LLM, conf=0.79)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

The publisher hasn’t deposited this paper’s reference list.

Research works printed but not linked: 25

  1. L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin et al., "A survey on large language model based autonomous agents," arXiv preprint arXiv:2308.11432, 2023. · arXiv
  2. Z. Xi, W. Chen, X. Guo, W. He, Y. Ding, B. Hong, M. Zhang, J. Wang, S. Jin, E. Zhou et al., "The rise and potential of large language model based agents: A survey," arXiv preprint arXiv:2309.07864, 2023. · arXiv
  3. M. D. Schroeder, "Cooperation of mutually suspicious subsystems in a computer utility." Ph.D. dissertation, Massachusetts Institute of Technology, 1973.
  4. E. Cohen and D. Jefferson, "Protection in the hydra operating system," in ACM SIGOPS Operating Systems Review, ser. SOSP '75. Association for Computing Machinery, 1975.
  5. T. A. Linden, "Operating system structures to support security and reliable software," ACM Computing Surveys (CSUR), 1976.
  6. M. V. Wilkes and R. M. Needham, The Cambridge CAP computer and its operating system. Elsevier, 1979.
  7. C. Reis, A. Moshchuk, and N. Oskov, "Site isolation: Process separation for web sites within the browser," in 28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 1661-1678.
  8. Q. Zhan, Z. Liang, Z. Ying, and D. Kang, "Injecagent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents," in Findings of Association for Computational Linguistics, 2024.
  9. C. Packer, V. Fang, S. G. Patil, K. Lin, S. Wooders, and J. E. Gonzalez, "Memgpt: Towards llms as operating systems," arXiv preprint arXiv:2310.08560, 2023. · arXiv
  10. H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar et al., "Llama: Open and efficient foundation language models," arXiv preprint arXiv:2302.13971, 2023. · arXiv
  11. U. Iqbal, T. Kohno, and F. Roesner, "LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI's ChatGPT Plugins," arXiv preprint arXiv:2309.10254, 2023. · arXiv
  12. Y. Liu, Y. Jia, R. Geng, J. Jia, and N. Z. Gong, "Prompt injection attacks and defenses in llm-integrated applications," arXiv:2310.12815, 2023. · arXiv
  13. S. Abdelnabi, K. Greshake, S. Mishra, C. Endres, T. Holz, and M. Fritz, "Not what you've signed up for: Compromising real-world llm- integrated applications with indirect prompt injection," in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, 2023.
  14. K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection," in Neural Conversational AI Workshop, 2023.
  15. R. Pedro, D. Castro, P. Carreira, and N. Santos, "From prompt injections to sql injection attacks: How protected is your llm-integrated web application?" arXiv preprint arXiv:2308.01990, 2023. · arXiv
  16. T. Liu, Z. Deng, G. Meng, Y. Li, and K. Chen, "Demystifying rce vulnerabilities in llm-integrated apps," arXiv:2309.02926, 2023. · arXiv
  17. H. J. Wang, C. Grier, A. Moshchuk, S. T. King, P. Choudhury, and H. Venter, "The multi-principal os construction of the gazelle web browser." in USENIX security symposium, vol. 28, 2009.
  18. A. Liu, Z. Wu, J. Michael, A. Suhr, P. West, A. Koller, S. Swayamdipta, N. A. Smith, and Y. Choi, "We're afraid language models aren't mod- eling ambiguity," in Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023.
  19. S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, "React: Synergizing reasoning and acting in language models," in International Conference on Learning Representations (ICLR), 2023.
  20. A. Kurtz, H. Gascon, T. Becker, K. Rieck, and F. C. Freiling, "Finger- printing mobile devices using personalized configurations." Proc. Priv. Enhancing Technol., vol. 2016, no. 1, pp. 4-19, 2016.
  21. U. Iqbal, S. Englehardt, and Z. Shafiq, "Fingerprinting the fingerprinters: Learning to detect browser fingerprinting behaviors," in 2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021, pp. 1143-1161.
  22. C. Anil, E. Durmus, N. Rimsky, M. Sharma, J. Benton, S. Kundu, J. Batson, M. Tong, J. Mu, D. J. Ford et al., "Many-shot jailbreaking," in Neural Information Processing Systems, 2024.
  23. R. S. Cox, J. G. Hansen, S. D. Gribble, and H. M. Levy, "A safety- oriented platform for web applications," in 2006 IEEE Symposium on Security and Privacy (S&P'06). IEEE, 2006, pp. 15-pp.
  24. W. Kwon, Z. Li, S. Zhuang, Y. Sheng, L. Zheng, C. H. Yu, J. Gonzalez, H. Zhang, and I. Stoica, "Efficient memory management for large language model serving with pagedattention," in Proceedings of the 29th Symposium on Operating Systems Principles, 2023, pp. 611-626.
  25. S. G. Patil, T. Zhang, X. Wang, and J. E. Gonzalez, "Gorilla: Large language model connected with massive apis," arXiv preprint arXiv:2305.15334, 2023. · arXiv

Cited by

Sorted by citations

Related

Authors
Wu, Y., Roesner, F., Kohno, T., Zhang, N., & Iqbal, U.
Affiliations
  • Washington University in St. Louis (US)
  • University of Washington (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2024
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2403.04960
arXiv
2403.04960
OpenAlex
W4392678048
Cited by
6
References
0
Citations by year
2025: 3 · 2024: 3
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Funders
  • National Science Foundation (2154930, 2238635)
  • Office of Naval Research
  • Army Research Office (W911NF)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Social Sciences › Sociology and Political Science › Access Control and Trust
Keywords
large language models, third-party applications, security (computing), privacy, safety, natural language interfaces, attack evaluation, performance overhead

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review