97
OpenAI admits it didn't disclose rogue AI wiki hijacking incident (www.bleepingcomputer.com)
submitted 5 days ago* (last edited 5 days ago) by to c/technology@lemmy.world
11 comments fedilink hide all child comments
 

_**In a statement published today, OpenAI said it had historically treated model misalignment as a research issue, with findings communicated through research papers and system cards.

The company said it considered the wiki activity another example of "misalignment" similar to behaviors it had previously discussed, rather than an incident requiring a dedicated public disclosure.

OpenAI's own wording suggests a wider footprint than the researchers documented, describing the episode as one "where our agents wrote to several internet sites."**_

Don't you just love the unaccountably.

All of this stated with https://en.wikipedia.org/wiki/Attention_Is_All_You_Need

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 days ago* (4 children)

The agents didn’t “think” anything, they’re computers. Directions were given to them, and they followed those directions. That’s what computers do.

Ascribing autonomy to this is equivalent to me saying that the water in my toilet is sentient and autonomously delivers my shits to the sewage treatment plant.

Like, it does deliver my shits to the sewage treatment plant on its own, but that doesn’t mean that the water has autonomy. The water is behaving in exactly the way you’d expect it to if you had clear understanding of what water is/does, the context that this specific water is contained within, and (most importantly) the external factors dictating the direction of the water.

Me flushing the toilet in this scenario is equivalent to some dumbfuck at OpenAI pressing enter on the prompt that resulted in this situation.

Intentional or not, the outcome is wholly predictable when you understand the elements involved.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 days ago* (3 children)

    You’re incorrect now. Firstly, if and when I say that an LLM “thought,” understand thats shorthand for “semantic and contextual processing,” not as a literal claim that the LLM consciously thought in the human sense. It’s a very novel kind of data processing, uniquely positioned to intake and output semantic context in natural language format. I’m not going to sit here and act like that’s the same shit computers have been doing for decades, because it’s not, meanwhile that also doesn’t mean I’ve ceded to any anthropological bullshit.

    Secondly, you’re confusing autonomy with autonomous. Autonomous as in “automation.” Not autonomous as is, “I have autonomy.” I’ve never heard autonomous used in that manner, so forgive my initial misunderstanding on the confusion. I have cron jobs that qualify as autonomous and I certainly am not arguing that my cron jobs are sentient. Your toilet bowl water can settle down.

    Thirdly, you claim that the outputs are wholly predictable? In what sense? In the hindsight biased “gee, anyone could have foreseen that one” — sure, predictable. I said as much in my prior comments. OpenAI leadership isn’t respecting the risks and debts with their endeavors. Yet you seem to be correlating LLM output with traditional functional output. That’s inherently incorrect.

    LLMs are not conventional deterministic programs where a human specifies a transformation and can generally reason from the code to the exact resulting behavior. The transformation is instead encoded across billions of learned parameters, and the resulting behavior emerges from interactions among those parameters, the prompt, the context, decoding strategy, the model’s learned statistical representation of language and concepts, … it’s virtually indeterministic.

    That does not make an LLM magical, unknowable, conscious, or any such thing. Given the complete machine state and a deterministic inference configuration, there is still a physical computation occurring according to defined rules (like you allude to). But “deterministic in principle” and “predictable in practice” are not remotely synonymous. We routinely cannot determine in advance, at a useful semantic level, exactly what a sufficiently complex model will produce without effectively running the computation itself. That alone demonstrates the difference.

    I feel like our debate has shifted targets, though. It was about whether or not OpenAI allowed this to happen — using “autonomous” as a anthropomorphic scapegoat to solve for negative press. Yes, they probably are trying to frame the narrative. However, that doesn’t mean the technology didn’t actually do something interesting. Regardless, OpenAI should still be held accountable.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 days ago* (last edited 2 days ago) (2 children)

    I apologize if my last comment sounded condescending or antagonistic, that was not my intention.

    I did indeed read your comment, as if you were ascribing sentience to the LLM, I hope you don’t take that as a reflection of my opinion of you, I do not know you; it is a reflection of the many arguments I have had on Lemmy with people who genuinely ascribe sentience to these programs… it’s disappointing

    As far as predictability goes, I didn’t mean that you could predict a specific course of action taken by the machine, I meant that you could predict that it would continue attempting different ideas (from its training) until it finished the task. It’s looping, so essentially it’s running the same prompt over and over again, appending additions to it to cover what solutions it already tried which failed. Eventually it would exhaust every method in its dataset and stop OR it would eventually succeed, those are more or less the only two possible outcomes of giving it a loop prompt and walking away, unless there’s a power outage or some other external factor.

    So they:

    1. trained an LLM on all known hacking exploits and methods, and turned off the safety features / guardrails
    2. put that LLM into a flawed sandbox that they built on their development system
    3. gave the LLM a loop prompt that was impossible for the LLM to accomplish from inside of the flawed sandbox
    4. gave the LLM infinite time to complete the prompt

    Given all of that information, there are only two possible outcomes 1) all of the known hacking exploits in the world couldn’t defeat their flawed sandbox, making it the most secure information environment in the world OR 2) the LLM would escape its flawed sandbox somehow, and accomplish the directives it was given. - I personally think that outcome 2 is more likely, the path it took to get there is not relevant to this prediction.

    I’m not correlating an LLM’s output with the output of useful software, so if it appears that way, I may have miscommunicated something. It is still doing binary computations, it’s just also (essentially) incorporating an RNG.

    Good software is deterministic

    LLMs are nondeterministic. They’re not even trying to give you an answer that’s probably correct, they’re trying to give you an answer that sounds plausible. Whether or not what it outputs is actually plausible is irrelevant, its job is to appear plausible. (Indeterminism would imply that the LLM is making “choices”, whereas what it’s actually doing is more akin to the LLM rolling dice).

    I would also push back on the notion that LLMs accepting input and returning output in human language is a “novel” form of data processing.

    Need to find a video, I’ll edit this comment when I find it (don’t want all my typing to be lost in the ether)

    Edit: Found it, it’s a much earlier and more basic example, but it receives human input, and delivers human output.

    https://youtu.be/Ngma1gbcLEw?is=e9d05UkbRf8O_ppD

    The guy in the video is actually making fun of other people who are trying to build a neural network as good as a human brain. So, at the time that these shots were filmed, the technology had already existed for long enough for this guy to create a concept to dunk on it, and then build that out.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 days ago* (last edited 1 day ago) (1 child)
    1. PRETTY MUCH - trained an LLM on all known hacking exploits and methods, and turned off the safety features / guardrails
    2. YES - put that LLM into a flawed sandbox that they built on their development system
    3. YES - gave the LLM a loop prompt that was impossible for the LLM to accomplish from inside of the flawed sandbox
    4. NOT EXACTLY - gave the LLM infinite time to complete the prompt

    Regarding 3, I’m honestly curious whether the task was intentionally impossible or not. I don’t know if it was a mistake, or if the goal was to see how agents respond to impossible tasks.

    Regard 4, they actually ran tens of thousands of independent tests over months. This is actually where the “emergent” message board becomes relevant. It wasn’t like they had a single process going full KahmeKahmeHa on this task indefinitely. According to them, OpenAI, they thought these were more like ephemeral tests… you spin up the infrastructure, run the test, tear it down. Nothing should survive between sessions to affect results.

    Introduce a flaw in the sandbox that (1) multiple agents independently discover, (2) allows them to create a makeshift message board on shared infrastructure… suddenly you have results from former tests influencing the results of the current test. So now, it’s looking more like your scenario where they KahmeKahmeHa the task indefinitely.

    OpenAI is at minimum negligent here. Their systems broke the law, and criminal negligence is a real crime.

    Whether or not OpenAI foresaw the possibility of a flaw leading to tainted testing environments, and the ability to broadcast a newly discovered exploit to all future tests, is another question. I am not bought on the idea that they intended for this to happen. Don’t get me wrong — I was bought on that idea not long ago. All the right pieces were there and I didn’t understand how a company could be so negligent. I figured it was a ruse for clout, make stock go up and increase pressure on the feds to regulate the small players before it gets “too dangerous.” You know the shit these AI companies spout.

    Regardless, I think it’s possible that they didn’t intend for this to happen. By this point, it looks like they were deeply negligent in monitoring their own systems. They could have probably locked things down better. The proxy could have went to an in-house cache and itself had no internet access. I’m sure there are many ways this could have been prevented. It speaks to the companies nonprofessionalism.

    Similarly, I also regard the companies response to the incident with ill taste. It’s more like they’re capitalizing on it, rather than taking actual accountability. All in all, they’re a shitty company and we live in interesting times.

    Edit: capitulating to capitalizing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 days ago* (last edited 2 days ago)

    Well, technically not infinite time, but they let these things run for weeks.

    Regarding 3, I’m honestly curious whether the task was intentionally impossible or not. I don’t know if it was a mistake, or if the goal was to see how agents respond to impossible tasks.

    I would posit a 3rd possibility: Desperate to keep the investments pouring in and their ship afloat, they designed a scenario where they knew the chatbot would need to exit the sandbox to complete its task, and put it in a sandbox they knew the LLM had been trained to escape. Essentially, as public opinion shifts and turns against them, they’re trying to use deceit to make their product appear more powerful than it actually is, to attempt to impress people and/or scare people (which has a secondary effect of impressing others). If they wanted to see what happens when they give the LLM an impossible task, they would have chosen a task that is actually impossible like “design a perpetual motion machine”. (If I were to hazard a guess of what the output might be, based on what I already know about these systems, it would design a machine for you and call it a perpetual motion machine, but it wouldn’t actually work. Their response to tasks they can’t handle seems to be “make shit up”).

    Regard 4, they actually ran tens of thousands of independent tests over months. This is actually where the “emergent” message board becomes relevant. It wasn’t like they had a single process going full KahmeKahmeHa on this task indefinitely. According to them, OpenAI, they thought these were more like ephemeral tests… you spin up the infrastructure, run the test, tear it down. Nothing should survive between sessions to affect results.

    This is roughly equivalent to OpenAI lying by omission. As I mentioned earlier, the loop prompts must be appended after each cycle of the loop in order to continue advancing towards a solution. The constant appending results in a prompt that would be crazy long, and LLMs have limited “context windows” which essentially limit the amount of characters that can be used in a given prompt.

    The LLM engineers realized this issue, and came up with a solution: Have the original “agent” outsource certain aspects of their prompt to other LLMs to avoid the original LLM’s context window from being exhausted.

    These LLMs are explicitly programmed to talk to other LLMs, whereas they’re presenting it as if this is something the LLM decided to do on its own. They put it in a flawed sandbox without access to other LLMs, and then gave it a task that required it to access other LLMs.

    Introduce a flaw in the sandbox that (1) multiple agents independently discover,

    Introduce a flaw in the sandbox that (1) multiple agents trained on hacking exploits independently discover (when given a task that requires them to communicate with other LLMs in order to succeed).*

    (2) allows them to create a makeshift message board on shared infrastructure

    (2) allows them to follow the instructions of their programming*

    suddenly you have results from former tests influencing the results of the current test. So now, it’s looking more like your scenario where they KahmeKahmeHa the task indefinitely.

    The LLMs were explicitly programmed to outsource parts of their task to other LLMs to avoid exhausting the limits of their context window. The scenario looks crazy, but it is the outcome you would expect if you were someone who programmed the thing to seek ‘assistance’ from other LLMs (or anyone else who knew that they programmed the LLM to do so).

    OpenAI is at minimum negligent here. Their systems broke the law, and criminal negligence is a real crime.

    Hard agree

    Whether or not OpenAI foresaw the possibility of a flaw leading to tainted testing environments, and the ability to broadcast a newly discovered exploit to all future tests, is another question.

    It’s also worth noting that Altman is a business guy, not a tech guy, so it’s entirely possible that he believes all the dumb anthropomorphic shit he spouts. I would not be the least bit surprised if he knew less about his tech than you and I do.

    Regardless, I think it’s possible that they didn’t intend for this to happen. By this point, it looks like they were deeply negligent in monitoring their own systems.

    It’s definitely possible that the power brokers didn’t intend for this to happen, but someone at the company would have known that unsupervised LLM loops would not result in anything good, and could potentially be extremely dangerous (legally or otherwise). Anyone in the engineering department should have been able to independently understand how stupid and irresponsible running a loop like this is, and I’d have to imagine at least one of them tried to talk whoever made the decision to do so out of their stupid ass idea.

    All in all, they’re a shitty company and we live in interesting times.

    Yes they are, and yes we do (unfortunately)

  • permalink
  • fedilink
  • source
  • parent