The increasing use, availability and popularity of Artificial Intelligence (AI) engines such as ChatGPT, Dall-E, Bard etc brings significant interest and opportunity to academia.  With these opportunities there are some threats and security implications that must be taken into consideration.

The University will review and provide updated policies as this emerging field grows but colleagues are should be aware of existing policies that govern the use of such technologies;

As general guidance, prompts/queries submitted must comply with the following;

• No passwords can be submitted
• No PII or other sensitive or confidential material
• Do not submit queries that would lead to issues if they were to be made public
• Nothing can be submitted that includes University Intellectual Property (IP)
• Usage must follow the relevant existing policies on Data Protection, Data Processing, GDPR, Academic Integrity, Attribution and Ethics
• User data can not be used to train AI models unless users have explicitly agreed to this usage and the use of the data for ML/AI training purposes complies with University policies.

This guidance is intended to include all Large Language Models (LLMs) and AI chatbots including ChatGPT, GPT-n/x, Bard, LLaMa, BLOOM etc.

Users should take into consideration that all queries/prompts made to an AI engine are visible to the organisation providing the LLM.

Users should take into consideration that AI models are designed to return responses that appear convincing and all output should be viewed from this position.  LLMs have in many cases been trained on a large corpus of material, and as such there is potential that the provenance of material and data reproduced by the models may be obscure, carrying the potential risk of copyright or other IP infringement.  All output must be independently validated.

These guidelines are for cloud hosted models, self-hosted models will need their own security assessment.

 

References:

https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk

https://doi.org/10.48550/arXiv.2012.07805 - Extracting Training Data from Large Language Models