In a significant move, Microsoft has unveiled an AI bug bounty program designed to enhance the security of its AI-powered “Bing experience.” This initiative aims to encourage security researchers to identify vulnerabilities in Microsoft’s AI systems, offering generous rewards for their efforts.
Bounty Rewards for Vulnerabilities
One of the central features of this program is the enticing bounty rewards. Microsoft is prepared to offer up to $15,000 to bug hunters who successfully discover vulnerabilities classified as Critical or Important within its AI-powered Bing services. These rewards serve as an incentive for researchers to proactively engage in securing AI systems.
Origins and Rationale
This bug bounty program comes on the heels of significant investments in AI security and insightful experiences gained over recent months. Microsoft conducted an AI security research challenge and revised its vulnerability severity classification for AI systems, underlining the company’s commitment to robust AI security measures.
Scope and Targets
The program has an expansive scope, covering various AI-powered Bing experiences across multiple platforms. This includes Bing.com in the Browser, Bing integration in Microsoft Edge (incorporating Bing Chat for Enterprise), and Bing integration within the iOS and Android versions of Microsoft Start and Skype mobile apps. By extending its reach to these platforms, Microsoft is determined to bolster the resilience and security of its AI systems.
Categories of Vulnerabilities
Researchers engaging in this bug bounty program are encouraged to focus on several vulnerability categories. These include:
1. Inference Manipulation: Researchers are tasked with identifying vulnerabilities that allow the manipulation of the model’s response to individual inference requests without altering the model itself.
2. Model Manipulation: Vulnerabilities within this category pertain to the manipulation of the AI model during the training phase.
3. Inferential Information Disclosure: This category centers on vulnerabilities that reveal information about the AI model’s training data, architecture, weights, or inference-time input data.
4. Chat Behavior: Security experts should seek out vulnerabilities that can influence or change Bing’s chat behavior, potentially impacting all users.
5. Configuration Modification: Vulnerabilities enabling the modification of Bing’s chat behavior by adjusting client and server configuration settings are also within the program’s scope.
6. Memory Protections and Confidentiality: Researchers are encouraged to find vulnerabilities that breach Bing’s cross-conversation memory protections, potentially revealing internal workings, decision-making processes, and confidential information.
7. Session Limit Bypass: Vulnerabilities related to bypassing Bing’s chat mode session limits and restrictions/rules are also eligible for consideration.
Out-of-Scope Submissions
While the program is comprehensive in its scope, there are clear boundaries regarding what is considered out of scope. For instance, AI command/prompt injection attacks generating content shown only to the attacker are not eligible for bounty rewards. Clarity in these matters is crucial for participating researchers.
Bounty Amount Determination
The amount of the bounty reward is contingent on the quality of the vulnerability report. For instance, a critical issue allowing model manipulation can yield researchers rewards ranging from $6,000 to $15,000. The quality of the report plays a pivotal role in determining the reward, with high-quality reports providing detailed insights, proof of concept, and accurate analysis.
Urgency of AI Security
This bug bounty program underscores the increasing necessity to proactively discover and address vulnerabilities in publicly available AI systems. Large language models and AI systems are integral to many digital experiences, and securing them is of paramount importance. Security assessments of this kind are vital in preventing misuse and safeguarding the users of AI technologies.
News
Conclusion
Microsoft’s AI bug bounty program reflects the company’s commitment to enhancing the security of its AI-powered Bing services. By providing substantial rewards to researchers, Microsoft aims to proactively address potential threats and misuse within the realm of AI. The initiative underscores the critical importance of securing AI systems in today’s digital landscape, offering an opportunity to rectify vulnerabilities before malicious actors exploit them.
For More Information, About Author Visit Our Team