TITLE:
Security Vulnerability Analyses of Large Language Models (LLMs) through Extension of the Common Vulnerability Scoring System (CVSS) Framework
AUTHORS:
Alicia Biju, Vishnupriya Ramesh, Vijay K. Madisetti
KEYWORDS:
Common Vulnerability Scoring System (CVSS), Large Language Models (LLMs), DALL-E, Prompt Injections, Training Data Poisoning, CVSS Metrics
JOURNAL NAME:
Journal of Software Engineering and Applications,
Vol.17 No.5,
May
30,
2024
ABSTRACT: Large Language Models (LLMs) have revolutionized Generative Artificial Intelligence (GenAI) tasks, becoming an integral part of various applications in society, including text generation, translation, summarization, and more. However, their widespread usage emphasizes the critical need to enhance their security posture to ensure the integrity and reliability of their outputs and minimize harmful effects. Prompt injections and training data poisoning attacks are two of the most prominent vulnerabilities in LLMs, which could potentially lead to unpredictable and undesirable behaviors, such as biased outputs, misinformation propagation, and even malicious content generation. The Common Vulnerability Scoring System (CVSS) framework provides a standardized approach to capturing the principal characteristics of vulnerabilities, facilitating a deeper understanding of their severity within the security and AI communities. By extending the current CVSS framework, we generate scores for these vulnerabilities such that organizations can prioritize mitigation efforts, allocate resources effectively, and implement targeted security measures to defend against potential risks.