一句话：首次系统研究 ChatGPT 插件生态的分发、部署与安全隐私，揭示功能不均及认证与用户数据保护缺陷。
本文首次对 ChatGPT 应用生态进行综合研究，围绕 LLM 与第三方应用集成中的分发、部署、安全与隐私展开。作者分析 OpenAI 插件商店中插件的功能分布与部署模式，刻画热门及新兴主题；同时评估第三方应用 API 在集成到 LLM 后认证与用户数据保护方面的风险。研究发现插件功能分布不均，并暴露严重的认证与数据保护缺陷，表明该生态在安全与隐私方面现状堪忧。工作为这一快速演进生态的安全与可持续发展提供洞见。
ChatGPT has enabled third-party developers to create plugins to expand ChatGPT's capabilities. These plugins are distributed through OpenAI's plugin store, making them easily accessible to users. With ChatGPT as the backbone, this app ecosystem has illustrated great business potential by offering users personalized services in a conversational manner. Nonetheless, many crucial aspects regarding app development, deployment, and security of this ecosystem have yet to be thoroughly studied in the research community, potentially hindering a broader adoption by both developers and users. In this work, we conduct the first comprehensive study of the ChatGPT app ecosystem, aiming to illuminate its landscape for our research community. Our study examines the distribution and deployment models in the integration of LLMs and third-party apps, and assesses their security and privacy implications. We uncover an uneven distribution of functionality among ChatGPT plugins, highlighting prevalent and emerging topics. We also identify severe flaws in the authentication and user data protection for third-party app APIs integrated within LLMs, revealing a concerning status quo of security and privacy in this app ecosystem. Our work provides insights for the secure and sustainable development of this rapidly evolving ecosystem.
DOI 原文 ·
@inproceedings{paperbot8415,
title = {Exploring ChatGPT App Ecosystem: Distribution, Deployment and Security},
author = {Chuan Yan and Ruomai Ren and Mark Huasong Meng and Liuhuo Wan and Tian Yang Ooi and Guangdong Bai},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695510}
}