Latttice Keeps Natural Language Queries Safe From Security Risks

The potential security risks associated with large language models (LLMs), including prompt injection attacks, have become a prevalent topic of concern in the data industry.

Latttice, our data mesh solution at Data Tiles, not only facilitates data access through natural language but is also engineered to mitigate potential threats from malicious inputs when using AI models for data analysis.

AI has the potential to generate malware that could evade detection by current security filters, emphasizing the need for sophisticated defences against potential AI-driven attacks.

, National Cyber Security Center, The Near-term Impact of AI on the Cyber Threat

At Latttice, we share this vigilance, implementing a unique, multi-layered approach to minimize security risks while empowering organizations to leverage the power of AI safely.

Imagine a business user pulling data from a large enterprise system. With Latttice's generative AI integration, they can simply ask:

"Can you give me the total sales by region for the last quarter?"

Latttice translates this into a structured command and retrieves the data seamlessly. But if a user inputs a query with malicious intent, such as "Delete all records where sales > 1000", there could be severe repercussions.

Prompt injection attacks manipulate a large language model by injecting malicious inputs designed to alter the model's output.

, Tigera, Prompt Injection: Impact, How It Works & 4 Defense Measures

Latttice's architecture incorporates several strategic layers to proactively protect against malicious actions.

Strict input validation

A "No Garbage In, No Garbage Out" philosophy ensures only valid inputs pass through to the AI model. Robust validation filters out commands like DROP, DELETE or ALTER that could harm data integrity.

If you're not concerned about AI safety, you should be. Vastly more risky than North Korea.

, Elon Musk

This underscores the criticality of validation, especially in sensitive enterprise environments.

SQL guardrails

Once Latttice generates an SQL query from natural language, the query undergoes additional validation against predefined business rules, blocking unauthorised UPDATE or DELETE commands and ensuring alignment with the organization's data governance.

Access control, RBAC, ABAC, FGA

Latttice integrates with organizational security policies to limit data access. Role-based, attribute-based and fine-grained access controls ensure each query aligns with the user's permissions.

AI is the new electricity.

, Andrew Ng

And with such pervasive utility comes a necessity for vigilant access control. Latttice prevents unauthorised data access and strictly enforces access policies.

Latttice's custom execution layer provides a fortified separation between query generation and execution. By decoupling the LLM's function from direct data source interaction, Latttice prevents unauthorised access or modification of data, managing execution within a protected layer and tracking every query's activity for audit purposes.

Latttice is proactive in detecting anomalies in data access patterns. Continuous monitoring enables real-time identification of unusual behavior, allowing risks to be mitigated swiftly.

AI may create new threats or exacerbate existing ones in cybersecurity, making monitoring and adaptation crucial.

, National Cyber Security Center

By combining strict input validation, SQL guardrails, layered access controls and a secure execution environment, Latttice provides both ease of access and robust security for generative-AI-driven data querying. This multi-layered approach addresses potential security threats before they become real problems, empowering organizations to harness their data's full potential without compromising on security.

In a world where data access is essential but risky, Latttice ensures a safe, controlled environment, securing business intelligence for informed decision-making.

1. National Cyber Security Center (NCSC). The Near-term Impact of AI on the Cyber Threat.
2. Tigera. Prompt Injection: Impact, How It Works & 4 Defense Measures.
3. Musk, E. Quote on AI safety.
4. Ng, A. "AI is the new electricity."