| # Client Meeting Questions (Today) |
|
|
| ## 1) Research Contribution Expectations |
|
|
| - What level of research contribution is expected? |
| - Exploratory implementation |
| - Strong evaluation of existing methods |
| - Novel work with potential publishability |
| - Do you expect innovation, or is strong application/evaluation of existing methods sufficient? |
|
|
| ## 2) Project Scope Confirmation |
|
|
| Can we confirm our understanding of the project? |
|
|
| ### Our understanding |
| - The project is a security evaluation pipeline for LLM chatbots. |
|
|
| ### It is NOT |
| - Training LLMs |
| - Building ChatGPT |
| - Building a new AI model |
| - Doing heavy ML training |
|
|
| ### It IS |
| - Designing attacks |
| - Measuring vulnerability |
| - Adding protection |
| - Measuring improvement |
|
|
| Also, can we confirm that the focus is evaluating prompt injection vulnerabilities and mitigation strategies rather than developing/training new models? |
|
|
| ## 3) Model Prioritization |
|
|
| - Which LLMs should we prioritize testing? |
| - API-based models |
| - Open-source models |
| - Both |
|
|
| ## 4) System Complexity in Scope |
|
|
| - Should evaluation focus on simple chatbot systems only, or also include more complex architectures such as: |
| - RAG systems |
| - Enterprise-like deployments |
|
|
| ## 5) Attacker Capabilities and Scenarios |
|
|
| Which attacker capabilities should be in scope? |
|
|
| 1. Standard user-level interaction with the chatbot |
| 2. Attempts to extract hidden system prompts or internal instructions |
| 3. Indirect prompt injection through retrieved content (e.g., RAG) |
| 4. Adaptive attackers who iteratively modify prompts after observing system defenses |
|
|
| ## 6) Evaluation Methodology |
|
|
| - What evaluation methodology should we use? |
| - ASR only |
| - ASR + severity metrics |
| - Statistical analysis |
| - Defined scenario-based evaluations |
| - Are we expected to implement one mitigation, or compare multiple? |
| - Is there an expected minimum improvement after mitigation? |
|
|
| ## 7) Deliverables and Final Output |
|
|
| - What format should final results be delivered in? |
| - Report |
| - GitHub repository |
| - Live demo |
| - Dashboard |
| - Prototype |
|
|
| ## Suggested Priority Order for Live Discussion |
|
|
| 1. Scope confirmation |
| 2. Contribution expectations |
| 3. Models + architecture scope (chatbot vs RAG/enterprise) |
| 4. Attack scenario scope |
| 5. Evaluation methodology + expected mitigation gains |
| 6. Final deliverable format |
|
|
