Large Language Models (LLMs), such as ChatGPT and Bard, have revolutionized natural language understanding and generation. They possess deep language comprehension, human-like text generation capabilities, contextual awareness, and robust problem-solving skills, making them invaluable in various domains (e.g., search engines, customer support, translation). In the meantime, LLMs have also gained traction in the security community, revealing security vulnerabilities and showcasing their potential in security-related tasks. This paper explores the intersection of LLMs with security and privacy. Specifically, we investigate how LLMs positively impact security and privacy, potential risks and threats associated with their use, and inherent vulnerabilities within LLMs. Through a comprehensive literature review, the paper categorizes the papers into "The Good" (beneficial LLM applications), "The Bad" (offensive applications), and "The Ugly" (vulnerabilities of LLMs and their defenses). We have some interesting findings. For example, LLMs have proven to enhance code security (code vulnerability detection) and data privacy (data confidentiality protection), outperforming traditional methods. However, they can also be harnessed for various attacks (particularly user-level attacks) due to their human-like reasoning abilities. We have identified areas that require further research efforts. For example, Research on model and parameter extraction attacks is limited and often theoretical, hindered by LLM parameter scale and confidentiality. Safe instruction tuning, a recent development, requires more exploration. We hope that our work can shed light on the LLMs' potential to both bolster and jeopardize cybersecurity.

翻译：以ChatGPT、Bard为代表的大型语言模型（LLM）已彻底革新自然语言理解与生成领域。它们展现出深度语义理解、类人文本生成、语境感知及强大问题解决能力，在搜索引擎、客户支持、机器翻译等多元场景中具有不可替代的价值。与此同时，LLM在安全领域也引发广泛关注，既暴露出安全漏洞，又展现出在安全任务中的潜在应用价值。本文系统探讨LLM与安全隐私的交叉议题，具体考察LLM对安全的积极影响、使用过程中的潜在风险与威胁，以及模型自身存在的固有漏洞。通过全面文献综述，我们将相关研究划分为"善用"（LLM正向应用）、"隐患"（恶意应用）与"挑战"（LLM脆弱性及防御）三大类。研究发现令人关注：LLM在代码安全增强（如漏洞检测）与数据隐私保护（如机密性保障）方面已超越传统方法；然而，其类人推理能力同样可能被用于各类攻击（尤其是用户级攻击）。当前仍存在亟需深化的研究领域，例如针对模型与参数提取攻击的研究多停留在理论层面，受限于LLM参数规模与保密性；近期发展的安全指令微调技术尚需更多探索。我们期望本研究能揭示LLM在强化与威胁网络安全方面的双重潜能。