Conversation Reconstruction Attack Against GPT Models
Junjie Chu Zeyang Sha Michael Backes Yang Zhang
In recent times, significant advancements have been made in the field of
large language models (LLMs), represented by GPT series models. To optimize
task execution, users often engage in multi-round conversations with GPT models
hosted in cloud environments. These multi-round conversations, potentially
replete with private information, require transmission and storage within the
cloud. However, this operational paradigm introduces additional attack
surfaces. In this paper, we first introduce a specific Conversation
Reconstruction Attack targeting GPT models. Our introduced Conversation
Reconstruction Attack is composed of two steps: hijacking a session and
reconstructing the conversations. Subsequently, we offer an exhaustive
evaluation of the privacy risks inherent in conversations when GPT models are
subjected to the proposed attack. However, GPT-4 demonstrates certain
robustness to the proposed attacks. We then introduce two advanced attacks
aimed at better reconstructing previous conversations, specifically the UNR
attack and the PBU attack. Our experimental findings indicate that the PBU
attack yields substantial performance across all models, achieving semantic
similarity scores exceeding 0.60, while the UNR attack is effective solely on
GPT-3.5. Our results reveal the concern about privacy risks associated with
conversations involving GPT models and aim to draw the community's attention to
prevent the potential misuse of these models' remarkable capabilities. We will
responsibly disclose our findings to the suppliers of related large language
models.