Sandboxing

Sandboxing is the practice of running code or processing data in a secure, isolated environment, separate from the host machine and operating system. This approach is commonly used to test unverified or third-party software and to limit the impact of potential code execution vulnerabilities. In the context of machine learning (ML) models or LLM–generated code, sandboxing often involves containerizing these components and restricting their access to network resources, internal services, and application programming interfaces (APIs).

OWASP recommends several best practices for sandboxing an LLM: restrict the LLM’s access to sensitive resources, limit its capabilities to only what is necessary for its intended purpose, audit the LLM’s environment and access controls to ensure proper isolation, and log LLM interactions to detect and analyze potential sandboxing issues.

Cybersecurity firm Proofpoint describes several key features of sandboxes:

  • They emulate real-world devices and target operating systems.
  • They are typically hosted on virtual machines, where such activities as file system modifications, network communications, and system calls are closely monitored.
  • They limit network access and prevent unauthorized file modifications.

When setting up a sandbox, the Cloud Security Alliance recommends applying the same security settings used in the operational environment—such as multifactor authentication (MFA), single sign-on (SSO), and identity providers (IDP)—to the sandbox environment. Additional recommendations include employing data masking and syncing the sandbox with the production environment on a daily basis.

Commercial Off-the-Shelf Solutions and Simple Recommendations

  • LLM Sandbox⁠1
  • Datasaur’s Sandbox⁠2
  • ChatGPT Playground⁠3
  • gVisor with Google Kubernetes Engine (GKE) Sandbox⁠4
  • WebAssembly⁠5
  • Azure Sandbox⁠6
  • CodeSandbox ML examples⁠7
  • Secure Container Isolation in Kubernetes⁠8
  • Podman container⁠9
  • Salesforce Sandboxes⁠10

See also Amazon SageMaker,⁠11 Microsoft Azure Machine Learning,⁠12 IBM Watson Studio,⁠13 Kaggle Kernels,⁠14 H2O.ai,⁠15 DataRobot,⁠16 Anaconda Enterprise,⁠17 Cloudera Data Science Workbench,⁠18 RapidMiner,⁠19 SandboxJS,⁠20 AppArmor,⁠21 SELinux,⁠22 Sandbox2,⁠23 Bubblewrap,⁠24 Minijail,⁠25 NSJail,⁠26 Sandboxed API,⁠27 RLBox,⁠28 Flatpak,⁠29 Windows Sandbox,⁠30 and chroot() jail,⁠31

Other Sources of Information About This Topic

  • “What Are Sandboxed Containers?” (Red Hat)⁠32
  • “Code Execution Isolation and Containment with Sandbox Solutions” (Google for Developers)⁠33
  • “What Is a Sandbox?” (Proofpoint)⁠34
  • “Sandboxing as a Security Control in ML and LLMs” (LinkedIn)⁠35
  • “Sandboxing Agentic AI Workflows with WebAssembly” (NVIDIA)⁠36
  • “Code Sandboxes for LLMs and AI Agents” (Amir’s Blog)⁠37
  • “Not All Sandboxes Are for Children” (Cloud Security Alliance)⁠38
  • “SandboxEval” (arXiv)⁠39
  • “Native Client” (Communications of the ACM)⁠40

Notes

  1. Duy, “LLM Sandbox.” Return to content ⤴
  2. Datasaur, “Sandbox.” Return to content ⤴
  3. HARPA AI Technologies, “How to Use ChatGPT Sandbox”; Layton, “ChatGPT Playground.” Return to content ⤴
  4. Lacasse, “Open-Sourcing gVisor, a Sandboxed Container Runtime”; gVisor, “Kubernetes Quick Start”; Google Cloud, “GKE Sandbox.” Return to content ⤴
  5. Lucas, “Sandboxing Agentic AI Workflows with WebAssembly.” Return to content ⤴
  6. Doherty, “Azure Sandbox.” Return to content ⤴
  7. CodeSandbox, “Find Machine Learning Examples and Templates.” Return to content ⤴
  8. Allclair, “Secure Container Isolation.” Return to content ⤴
  9. Podman, “Homepage.” Return to content ⤴
  10. Salesforce, “Salesforce Sandboxes.” Return to content ⤴
  11. AWS, “Amazon SageMaker.” Return to content ⤴
  12. Microsoft, “Azure Machine Learning.” Return to content ⤴
  13. IBM, “IBM Watson Studio.” Return to content ⤴
  14. Kaggle, “Code.” Return to content ⤴
  15. H2O.ai, “About Us.” Return to content ⤴
  16. DataRobot, “Homepage.” Return to content ⤴
  17. Anaconda, “Anaconda Platform.” Return to content ⤴
  18. Cloudera, “Cloudera AI.” Return to content ⤴
  19. Altair, “Altair RapidMiner.” Return to content ⤴
  20. nyariv, “SandboxJS.” Return to content ⤴
  21. AppArmor, “Homepage.” Return to content ⤴
  22. Red Hat, “What Is SELinux (Security-Enhanced Linux).” Return to content ⤴
  23. Google for Developers, “What Is Sandbox2.” Return to content ⤴
  24. Containers, “Bubblewrap.” Return to content ⤴
  25. Google Git, “Minijail.” Return to content ⤴
  26. NsJail, “Homepage.” Return to content ⤴
  27. Google for Developers, “What Is Sandboxed API.” Return to content ⤴
  28. PLSysSec, “RLBox.” Return to content ⤴
  29. Flatpak, “Flatpak.” Return to content ⤴
  30. Pulapaka, “Windows Sandbox.” Return to content ⤴
  31. Newell, “How to Set Up Linux chroot Jails.” Return to content ⤴
  32. Red Hat, “What Are Sandboxed Containers”; “Understanding Containers.” Return to content ⤴
  33. Google for Developers, “Code Execution Isolation and Containment with Sandbox Solutions.” Return to content ⤴
  34. Proofpoint, “What Is a Sandbox.” Return to content ⤴
  35. Huang, “Sandboxing as a Security Control in ML and LLMs.” Return to content ⤴
  36. Lucas, “Sandboxing Agentic AI Workflows with WebAssembly.” Return to content ⤴
  37. Malik, “Code Sandboxes for LLMs and AI Agents.” Return to content ⤴
  38. Livneh, “Not All Sandboxes Are for Children.” Return to content ⤴
  39. Rabin et al., “SandboxEval.” Return to content ⤴
  40. Yee et al., “Native Client.” Return to content ⤴