Securing LLM-Powered Applications: Overcoming Security and Privacy Challenges
summary
Demo shows a rental app and a shopping assistant where uploaded terms and a crafted file overwrite canonical docs, then a vroom vroom trigger plus RAG injection cancels booking ABC123 (policy: cancellations require 7+ days) and adds a $100 credit; a SQL injection writes fake chat history that convinces the model to cancel; tools can execute dangerous actions (example attempt to drop tables). Uses Burp Suite, LangChain for Java, OpenAI (GPT‑3.5, GPT‑4 mini/4.1) and vector/RAG; five-user dataset and GitHub API key leakage are highlighted.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 2:35What are LLMs and their risks
- 10:46Retrieval Augmented Generation explained
- 12:33Path traversal vulnerability demo
- 21:03Chat memory injection risks
- 28:13Prompt injection attacks
- 39:16Tool call and function risks
- 45:59Data privacy with LLMs
- 48:50Financial misuse of LLMs
- 50:16General security solutions
related talks
44mSecuring LLM-Powered Apps: Overcoming Security and Privacy Challenges
46mBreaching LLM-Powered Apps: Overcoming Security and Privacy Challenges
45mSecuring LLM Applications: Overcoming Security & Privacy Challenges
51mSecuring LLM-Powered Applications: Overcoming Security and Privacy Challenges
49mBreaching LLM-Powered Applications: Overcoming Security and Privacy Challenges
53mBreaching LLM-Powered Applications: Overcoming Security and Privacy Challenges
50mSecuring LLM-Powered Applications: Overcoming Security and Privacy Challenges
27mSecuring The Gateway And Mitigating Risks In LLM API Integration