Does TypeSafe Jev’s lack of safety checks invite TokenBreak attacks?
HiddenLayer researchers say TypeSafe’s new System One model lacks the safety checks found in traditional large language models, making it susceptible to adversarial attacks.
Key points
- HiddenLayer researchers found TypeSafe’s Jev model is more vulnerable to prompt injection and adversarial text attacks than traditional large language models.
- The model’s streamlined design for machine-to-machine tasks removes some safety checks, allowing attacks like TokenBreak to succeed where they normally fail.
- TypeSafe did not respond to requests for comment regarding the findings published by HiddenLayer.
The short version
- TypeSafe’s Jev model is categorised as System One, a new class of frontier models designed for fast, structured decisions that software can use directly.
- Security researchers at HiddenLayer argue that Jev’s accelerated approach makes it more susceptible to disruption via adversarial text and prompt injection.
- Kasimir Schulz, director of security research at HiddenLayer, noted that Jev lacks some protections present in traditional large language models, leading to incorrect outputs.
The details
Researchers at HiddenLayer published a report stating that TypeSafe’s Jev model is more vulnerable to certain attacks than traditional large language models. The model, rolled out last month by TypeSafe, claims significant advantages in speed and efficiency. However, the streamlined approach that allows Jev to perform tasks faster and use fewer tokens also removes some checks and balances. According to the report, both adversarial text attacks and prompt injection can disrupt the model’s outputs, resulting in incorrect and potentially devastating actions.
Kasimir Schulz, director of security research at HiddenLayer and co-author of the blog post, explained that the accelerated design robs Jev of protections seen in traditional models. He noted that Jev can fall for attacker tricks that current large language models typically detect and refuse. Schulz highlighted TokenBreak as an example, stating that while this attack normally fails against larger models, Jev is vulnerable to it out of the box. He added that increasing the number of perturbations and improving their targeting led to much higher attack success rates against the system.
The context
There is ongoing debate about whether Jev is technically a large language model. TypeSafe suggests it is not, instead categorising it as System One, a new class of frontier models built for fast, structured decisions. HiddenLayer researchers contend that it appears to be one. Jev is the first and currently only named product in this category. It is designed specifically to function machine-to-machine, prioritising rapid response times over the extensive safety layers found in other generative AI systems.
TypeSafe did not respond to multiple requests for comment regarding the security findings. The vendor has not issued a statement addressing the specific vulnerabilities identified by HiddenLayer. The report emphasises that while Jev offers faster response times, it does not have all the protections seen in traditional large language models, meaning some attacks succeed that should have failed.
Next steps
- Security teams should assess whether their infrastructure uses TypeSafe’s Jev model or any System One category models.
- Organisations should review how these models interact with automated systems to understand the potential impact of incorrect outputs.
- Teams should monitor for unusual model behaviour or unexpected actions triggered by the model’s decision-making processes.
- Vendors should evaluate the risk of prompt injection and adversarial text attacks in their specific deployment contexts.
What defenders should look for
Teams usually monitor application logs for anomalous model outputs that deviate from expected structured decisions. Check whether automated systems are executing commands based on model responses without secondary validation. Look for signs of prompt injection, such as unexpected context shifts or refusal to follow original instructions. Defenders should also watch for adversarial text patterns in input streams that might bypass standard filters. Containment moves often involve isolating the affected model instance and reverting to manual oversight for critical automated actions until the root cause is understood.
What to do and how to stay safe: TypeSafe
- Audit all integrations with TypeSafe’s Jev model to identify where automated actions are triggered by model outputs.
- Implement input validation layers to detect and block adversarial text patterns before they reach the model.
- Add secondary verification steps for any automated decisions made by the model, especially those with significant operational impact.
- Monitor model responses for unexpected behaviour or deviations from expected structured outputs, and alert on anomalies.
Step-by-step guide: Password Manager Security Checklist: Hardening Your Vault
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is TypeSafe’s Jev model considered a large language model?
TypeSafe categorises Jev as System One, a new class of frontier models, while HiddenLayer researchers say it appears to be a large language model.
What specific attacks is Jev vulnerable to according to HiddenLayer?
HiddenLayer researchers found Jev is vulnerable to prompt injection and adversarial text attacks, including the TokenBreak attack.
Did TypeSafe respond to the security report?
No, TypeSafe did not respond to multiple requests for comment regarding the findings published by HiddenLayer.
