提示注入是 LLM 应用的头号安全威胁，Lockdown Mode 用确定性机制切断了数据外泄路径，做 AI 安全或部署 ChatGPT 的团队值得关注并启用。
OpenAI 正式上线 Lockdown Mode（锁定模式），该功能旨在通过限制出站网络请求来阻止提示注入攻击中的数据窃取。它不阻止提示注入本身，但能切断攻击者利用模型窃取敏感数据的通道。Lockdown Mode 面向免费、Go、Plus、Pro 及自助 ChatGPT Business 账户逐步开放。这一机制直接针对“致命三要素”中的数据外泄环节，且不依赖 AI 评估，因此更可靠。但这也意味着默认 ChatGPT 设置下，数据外泄防护并不充分。
OpenAI Help: Lockdown Mode
OpenAI Help: Lockdown Mode OpenAI first teased this in February , but now it's live and "rolling out to eligible personal accounts, including Free, Go, Plus, and Pro, and self-serve ChatGPT Business accounts": Lockdown Mode is designed to help prevent the final stage of data exfiltration from a prompt injection attack by limiting outbound network requests that could transfer sensitive data to an attacker. Lockdown Mode does not prevent prompt injections from appearing in the content ChatGPT processes. For example, a prompt injection could appear in cached web content or in an uploaded file, and could still affect the behavior or accuracy of a response. This looks really good to me. The Lethal Trifecta occurs when an LLM system has access to all three of access to private data, exposure to untrusted content and a way to steal data and transmit it back to the attacker. The only way to solve the trifecta is to cut off one of the three legs, and by far the easiest leg to restrict without making your LLM systems far less useful is the exfiltration vectors to steal data. It looks to me like lockdown mode directly attacks that leg, using mechanisms that are deterministic and, crucially, are not evaluated by AI systems that themselves can be subverted by sufficiently devious attacks. The existence of lockdown mode does however imply that ChatGPT, in its default settings, does not provide robust protection against sufficiently determined data exfiltration attacks! Tags: security , ai , openai , prompt-injection , llms , lethal-trifecta