Are there solutions to this problem? It seems like a major issue for a lot of valuable use cases. Systems for automating bureaucratic tasks in business and government won’t work well if it’s trivial to make them leak this type of information.
What about a two-layer architecture, where the first LLM layer is simply asked to identify the intent of a query, and if the intent is “bad”, to not pass it along to the second LLM layer, which has been loaded with confidential context?
What about a two-layer architecture, where the first LLM layer is simply asked to identify the intent of a query, and if the intent is “bad”, to not pass it along to the second LLM layer, which has been loaded with confidential context?