Generative artificial intelligence (GenAI) is reshaping our world, from streamlining work tasks like coding to helping us plan summer vacations. As we increasingly adopt GenAI services and tools, we also face the emerging risks of their malicious use. Security is crucial, as even one vulnerability can jeopardize users’ information or worse. However, securing GenAI is too vast and complex for a single entity to handle alone. Mozilla believes sharing this responsibility is essential to successfully keep people safe.
The evolution of bug bounty programs
To combat both bugs and vulnerabilities, the concept of the bug bounty program – which incentivizes a community of independent participants to identify flaws and report them – was first launched in the mid-1990s by Netscape to crowd source bug discovery in the Netscape Navigator web browser. Fast forward to 2002 and the next generation of bounty programs was born when iDefense rolled out the Vulnerability Contributor Program (VCP), the first security-specific all-vendor public bounty program. Later, in 2005, TippingPoint introduced the Zero Day Initiative (ZDI) which follows the same model, allowing researchers from anywhere in the world to profit from their auditing research on nearly any technology vendor.
More recently, companies like HackerOne and BugCrowd have commoditized bounty programs, allowing participating companies to incentivize the community to report directly to them, versus going through an intermediary like the VCP or ZDI. Some GenAI companies are enrolled in these programs, providing bounties for defects found in supporting software, but not the models themselves. Others have hosted temporary model bounties while rapidly building their GenAI applications. However, this approach benefits their own models rather than the foundational technologies. As companies move at light speed to be the first to market, can we trust that they’ll work with the same scrutiny on security and consider future implications? History has demonstrated that this usually is an afterthought.
0Din, the next generation bug bounty program
As the technology landscape continues to evolve, we see the need for the next evolution in bug bounty programs, to further advance the GenAI ecosystem and address the flaws within the models themselves. These vulnerability classes include Prompt Injection, Training Data Poisoning, Denial of Service, and more. Today, we are investing in the next generation of GenAI security with the 0Day Investigative Network (0Din) by Mozilla, a bug bounty program for large language models (LLMs) and other deep learning technologies. 0Din expands the scope to identify and fix GenAI security by delving beyond the application layer with a focus on emerging classes of vulnerabilities and weaknesses in these new generations of models.
At Mozilla, we believe openness and collective participation are important in solving the emerging security challenges that lie ahead of us for GenAI. We have a long history of protecting users on the internet by building a secure and open-source browser, Firefox. We also have one of the first and longest-standing bug bounty programs on the web in order to encourage security researchers to report security vulnerabilities in the open. We know full well the power of working together as a community is one of the many ways to protect people. It’s been a part of our mission and we want to continue to advance this work.
Our hope for this program is to help independent researchers with an opportunity to contribute to the development of new security frameworks and best practices tailored for large language models, attention-based systems and generative models. They will play a key role in defining and strengthening AI security standards thus shaping the future of secure GenAI technologies and how we use them in our daily lives. By addressing these challenges, Mozilla aims to protect users and inspire future generations of developers and researchers to make security and privacy a priority right from the start.
Join our team to advance AI security
Researchers interested in submitting their findings to the program are welcome to start writing to us at 0din@mozilla.com (GPG key). If you’re looking to join the team, we are hiring! We’re looking for:
