Amazon Technologies, Inc.

Sachin Purushottam Joglekar

Scott Gerard Carmack

Jesper Mikael Johansson

Jonathan A Jenkins

Ashish Kumar Agrawal

Peter Sven Vosshall

Firas Azrai

Amit Bhosle

Rahul Gupta

Dhanvi Harsha Kapila

Brian Evan Maher

Shilpi Gupta

Temesghen Kahsai Azene

Mehul Jain

Kadirvel Chockalingam Vanniarajan

Ben Smith

Jimit Majmudar

Jon Arron McClintock

Narasimha Rao Lakkakula

William Frederick Kruse

Thibault Candebat

Charles D Ward

Alun Jones

Sunu Aby Mathew

Shailendra Batra

David M Wheeler

Naveen Kumar Thangavel

Lili Gehorsam

Devices and techniques are generally described for security threat mitigation for generative machine learning models. In some examples, first request data including a first request may be received. First prompt data may be generated based at least in part on the first request data. First plan data may be generated, the first plan data including a first API call to a first API of a first computer-implemented service. The first API call may be executed and first result data may be received in response to the first API call. A determination may be made that the first result data includes a first impermissible instruction to inject data into a subsequent prompt. First output data may be generated indicating that the first request cannot be completed.

Security threat mitigation for large language models

Systems, devices, and methods are provided for establishing trust between devices using a proximity channel and a cloud channel. An enrollee device and manager may perform a mutual authentication process where grant codes are exchanged, wherein the enrollee grants the manager the ability to be a manager in the enrollment process and the manger grants the enrollee the ability to issue an identity certificate. A proximity channel may be used to establish proof-of-possession and a cloud-based authorization may be performed to verify that the enrollee is a legitimate participant.

Techniques for enrolling a device or service using a proximity channel and a cloud channel

Devices and techniques are generally described for security threat mitigation for generative machine learning models. In some examples, first prompt data including first data associated with a first natural language input and a first span may be determined. An LLM may determine first plan data using the first prompt data. The first plan data may include a call to the first API. A first classifier model may determine a first trust score for the first span. A first attention score may be determined for the first span and the first action plan. Second plan data may be generated based on at least one of the first trust score and the first attention score or the second trust score and the second attention score.

Security for generative models using attention analysis

Systems, devices, and methods are provided for cloud-based privacy controls. User content is encrypted using a content encryption key (CEK). The CEK may be double-encrypted by the data producer—the inner envelope is encrypted using keys associated with privacy domains that are authorized to access the user content. The outer envelope is encrypted using a cloud privacy control's public key. When a data consumer requests access the user content, the cloud privacy control evaluates privacy policies and determine whether access should be permitted. If permitted, the cloud privacy control decrypts the outer envelope and provides the inner envelope with CEK to the requestor. Upon receiving the inner envelope, the data consumer may then decrypt the inner envelope with its privacy domain private key to obtain the CEK. The CEK may then be used to perform a decryption and obtain the user content.

Techniques for cloud-based privacy controls

A browsing process is directed to the generation and management of a browse session at a network computing provider. A client computing device transmits secure requests for network resources to a network computing provider. The network computing provider comprises one or more virtual network computing providers for processing secure communications between a client computing device and a content source. A virtual network computing provider handles the secure communications, decrypting and processing the communications while preventing third parties from accessing the unencrypted communication data. The virtual network computing provider may determine a browse configuration identifying processing actions to perform on the request content. The virtual network computing provider may retrieve the requested content, perform a first set of processing actions to generate a processing result, and provide the processing result to the client computing device, which may perform a second set of processing actions, including display.

Remote browsing session management

Techniques are described for automatically determining application composition and application ownership of an application that may include a plurality of files deployed to a plurality of host devices. The determination of application composition may be based on analyzing various types of metadata that may provide evidence of associations between deployed files, such as metadata describing the deployment of files to host devices, metadata describing the files tracked within a source control system, or other types of metadata. The determination of application ownership may also be based on analyzing the various types of metadata that provide evidence of associations between files and individuals or groups of individuals within an organization.

Determining application composition and ownership

Methods and systems for protecting websites from cross-site scripting are disclosed. A request for a web page comprising a web page element is received from a client. It is determined if the web page comprises a data integrity token for the web page element. It is also determined if a value of the data integrity token matches an expected value. If the web page comprises the data integrity token and if the value matches the expected value, the web page comprising the web page element is sent to the client. If the web page does not comprise the data integrity token or if the value does not match the expected value, a protective operation is performed.

Protecting websites from cross-site scripting

Systems and methods for authenticating a request submitted from a client device through a third party content provider to an electronic entity are described. In one embodiment, a method includes providing a trusted script to the third party content provider, passing a trust token to the third party content provider and to the client device, and, in response to a request submitted from the client device through the third party content provider, validating the trust token associated with the request with the token passed to the client device, and processing the request. The trusted script is configured to create a trusted window on the third party Web page displayed on the client computing device, receive a trust token from the electronic entity through the trusted window, and associate the trust token with requests submitted from the client computing device through the third party content provider to the electronic entity.

Cross site request forgery mitigation in multi-domain integrations

Growing community of inventors

Bothell, WA, United States of America

Sachin Purushottam Joglekar