Google's AI Vulnerability Reward Program (AI VRP)

Abstract

Google operates the AI Vulnerability Reward Program (AI VRP), a bug bounty program focused on security vulnerabilities and specific abuse risks in Google's generative AI products. These include sensitive data exfiltration and rogue actions impacting user security caused by indirect prompt injection in AI products. The AI VRP provides security benefits to Google's users by providing a venue for responsible disclosure of security bugs and enables Google's security teams to understand emerging risks and attack patterns affecting AI. In establishing this program, we have also learned how best to structure it to provide actionable information to product teams while also maintaining a healthy researcher community.