Samsung introduced ChatGPT less than 20 days ago, and 3 leaks of semiconductor confidential information occurred

[Daniel Nenni]

Samsung Electronics introduced ChatGPT internally less than 20 days ago. There are already reported leaks of confidential information, such as semiconductor equipment measurement data, product yield rate, etc., which have been stored in the ChatGPT learning database.

Based on Economist, SBS and other Korean media news, there were 3 cases of misuse and abuse of ChatGPT in Samsung, raising relevant questions on whether ChatGPT may leak Samsung’s corporate secrets. In this case of ChatGPT misuse and abuse, 2 cases are related to semiconductor equipment, and the other one is the content of the meeting.

It is reported that employee A (anonymous) of the Semiconductor and Device Solutions (Device Solutions; DS) department of Samsung Electronics recently executed the semiconductor equipment measurement database (DB) to download software, due to an error in the source code, employee A copied the problem source code to ChatGPT, and ask ChatGPT for solutions, but this operation instead makes the source code related to Samsung device measurement become ChatGPT learning materials.

The other two cases are also similar. For example, employee B (anonymous) of the Samsung DS department input the produced code into ChatGPT in order to understand the equipment yield rate and other information, and asked ChatGPT to optimize its code; in addition, C of the Samsung DS department The staff (anonymous) asked ChatGPT to make meeting minutes.

In order to prevent similar accidents from happening again, Samsung is formulating relevant protection measures. If similar accidents occur in the future, Samsung may also cut off the ChatGPT service internally.

In fact, in the ChatGPT user guide, there is also a special call for "users not to enter sensitive content."

三星引入ChatGPT不到20天　爆3件半導體機密資料外洩事故

三星電子（Samsung Electronics）引入聊天型機器人ChatGPT不到20天，近日便爆出機密資料外洩意外，如半導體設備測量資料、產品良率等內容，傳已經被存入ChatGPT...

www.digitimes.com.tw

 

[M. Y. Zuo]

> In fact, in the ChatGPT user guide, there is also a special call for "users not to enter sensitive content."

Seems like their trying to fight an uphill battle, why not just limit it to less sensitive departments?

Then I again I don't know how the dynamic around internal products is at Samsung.

 

[Tanj]

Then I again I don't know how the dynamic around internal products is at Samsung.

A few years back they were both paranoid and irrational about it. The whole site was blanketed with WiFi suppression, yet during meetings everyone was on phones and those (including mine) connected to data just fine. And then the PCs were all still running XP I was told corporate thought they had it secured (yuck, Windows 10 was just out at that point and XP no longer supported).

So on the one hand the company is extremely worried about security, but at least back then quite unable to execute on being secure.

 

[M. Y. Zuo]

A few years back they were both paranoid and irrational about it. The whole site was blanketed with WiFi suppression, yet during meetings everyone was on phones and those (including mine) connected to data just fine. And then the PCs were all still running XP I was told corporate thought they had it secured (yuck, Windows 10 was just out at that point and XP no longer supported).

So on the one hand the company is extremely worried about security, but at least back then quite unable to execute on being secure.

My first reaction is: how bizarre!

But then I thought about how many layers of management there must be between the board and frontline staff in their Security department(s)... and then it seems more like the unfortunate peculiarities of size.

 

[Daniel Nenni]

My bet is that there will be more of this type of security breaches to come. There is a big AI learning curve here. We should see a boom of AI security companies coming along anytime now.

 

[Tanj]

My bet is that there will be more of this type of security breaches to come. There is a big AI learning curve here. We should see a boom of AI security companies coming along anytime now.

Don't hold your breath. Things have been leaking into Search forever, and companies have been oblivious, despite some fuss about it at the outset.

 

[Daniel Nenni]

Samsung workers have unwittingly leaked top secret data whilst using ChatGPT to help them with tasks.



The company allowed engineers at its semiconductor arm to use the AI writer to help fix problems with their source code. But in doing so, the workers inputted confidential data, such as the source code itself for a new program, internal meeting notes data relating to their hardware.
The upshot is that in just under a month, there were three recorded incidences of employees leaking sensitive information via ChatGPT. Since ChatGPT retains user input data to further train itself, these trade secrets from Samsung are now effectively in the hands of OpenAI, the company behind the AI service.

Out in the OpenAI​

In response, Samsung Semiconductor is now developing its own inhouse AI for internal use by employees, but they can only use prompts that are limited to 1024 bytes in size.

In one of the aforementioned cases, an employee asked ChatGPT to optimize test sequences for identifying faults in chips, which is confidential - however, making this process as efficient as possible has the potential to save chip firms considerable time in testing and verifying processors, leading to reductions in cost too.

In another case, an employee used ChatGPT to convert meeting notes into a presentation, the contents of which were obviously not something Samsung would have liked external third parties to have known.

Samsung Electronics sent out a warning to its workers on the potential dangers of leaking confidential information in the wake of the incidences, saying that such data is impossible to retrieve as it is now stored on the servers belonging to OpenAI. In the semiconductor industry, where competition is fierce, any sort of data leak could spell disaster for the company in question.

It doesn't seem as if Samsung has any recourse to request the retrieval or deletion of the sensitive data OpenAI now holds. Some have argued that this very fact makes ChatGPT non-compliant with the EU's GDPR, as this is one of the core tenants of the law governing how companies collect and use data. It is also one of the reasons why Italy has now banned the use of ChatGPT nationwide.

MSN