18 ms·
Uncensor any LLM with abliteration
- everybodyknows 2y agoSo "abliteration" is apparently a portmanteau of "ablate" and something else. "Intervention"? "Iteration"? Who knows?
- id0ntw4ntit 2y agoobliterate, with the 'ion' suffix. as mentioned elsewhere, they should've just gone with ablation.
- akie 2y agoPretty sure Asimov didn’t consider that when he wrote his three laws of robotics.
- jazzyjackson 2y agoAsimov wrote the three laws as a parody of rationalists who are so uncreative they expect a ruleset can actually impose control Or, as Dr Malcom would say: life, uh, finds a way.
- jraph 2y agoDo you have an evidence for this? It surprises me and I can't find anything about it. This should be a crucial piece of information about the tree laws, yet it's not mentioned in the Wikipedia article about the three laws [1], which is otherwise quite detailed. Reading this, everything makes me think that it was not a parody. I didn't feel like it was parody when reading the Robot series neither. He wanted an alternative to the Frankenstein plot where robots kill their creators and the three laws were part of the answer. [1] https://en.wikipedia.org/wiki/Three_Laws_of_Robotics https://en.wikipedia.org/wiki/Three_Laws_of_Robotics
- fnordpiglet 2y agoI agree the term parody is absolutely inappropriate but it’s also not the case that they’re portrayed as entirely positive and complete. They’re ultimately flawed, resulting in many unintended consequences and ethical dilemmas. To that extent it is a refutation of the idea there are perfectly constructed maxims, and should serve as a real warning to people pursuing safety and alignment in AI. I know a fair number of them personally and they are often very young, generally inexperienced, highly intelligent, but with a hefty dose of hubris. This is a pretty dangerous combination IMO, but I also recognize their goals are generally unattainable in the broad sense, are useful in a narrow practical sense for people and enterprises who want a generally on guard rails solution, and they’re developing the technical techniques we might be able to use once some time has passed, we understand the domain better, and the companies hire a few grown ups.
- jraph 2y ago> but it’s also not the case that they’re portrayed as entirely positive and complete. This I agree with. A big part of the fun of the series is that Asimov constantly plays with these laws. Thanks for the clarification. (I still completely disagree that "parody of rationalists who are so uncreative they expect a ruleset can actually impose control" was the intent. I believe not only the word "parody" is to throw away, but the whole sentence with it too. I understand better your stance now though)
- jraph 2y agoI assumed you were person I responded too, which is not the case, sorry for this.
- latexr 2y ago> I know a fair number of them personally and they are often very young, generally inexperienced, highly intelligent, but with a hefty dose of hubris. Part of the issue is that we keep calling these people “highly intelligent” and that is all they and others focus on. That is how we get the Zuckerbergs of the world. Their hubris is not a “but” (as if it were unrelated), it is instead a direct consequence of that unqualified praise. But qualification is important. Intelligence is relative to the domain it is applied to. Being highly logical is often conflated with being intelligent, but being good at computers has zero relation to emotional intelligence, social intelligence, environmental intelligence, or any of the myriad of important types of intelligence which are useful to humanity. Basically, stop calling those idiots “highly intelligent” or “geniuses” because they can make a line go up and have an irrational market throw money at them. You’re praising them for the characteristics that make them selfish.
- m463 2y agorule 1: "don't be evil" rule 2: IBM gets a pass¹ [1] https://en.wikipedia.org/wiki/JSON https://en.wikipedia.org/wiki/JSON (hmmm... except wikipedia doesn't have the story) EDIT: https://news.ycombinator.com/item?id=3693388 https://news.ycombinator.com/item?id=3693388
- tomcam 2y agoDon’t think so. Asimov wrote that his editor John Campbell established the 3 Laws. I think it was to tighten up Asimov’s work, though I’m less sure of that part.
- LeonardoTolstoy 2y agoThe Complete Robot has a lot of stuff about this and it is interesting. The person above I would argue is flat wrong about the three laws. Asimov wrote his robot short stories in which the three laws played a primary role at a time when robot as Frankenstein's monster was the norm. His short stories attempted to create a more positive optimistic note about how humans and robots could collaborate. The three laws were a way to make it crystal clear that robots could not hurt us, by rule. And the fun was then imagining all the unexpected ways that psychologically that might play out. But in the short stories the robots never actually hurt anyone although they often caused a lot of frustration and fear. If anything the three laws seemed to show the inate fear of humans to the unknown. The laws were completely impossible to circumvent and people knew this ... And yet they remained staunchly opposed to having robots on earth. Completely illogical. Anyways, looking at the way LLMs are playing out it seems to me Asimov was wrong. It is quite the opposite. Humans seem to have no fear of robots hurting them, and as a matter of fact seem to get frustrated when a robot isn't allowed to cave their head in with their super human strength when asked (metaphorically).
- rldjbpin 2y agonew addition: a robot may not get a human being cancelled.
- extr 2y agoGreat blog post, loved the straightforward explanations and code.
- Der_Einzige 2y agoIronic given that lesswrong folks who presented this did so as part of their mission of motivating policy makers to ban open access to models. Hate their ideology but love their research! Edit: The data format is the same type used for DPO or RLHF style training. “Good” and “bad”, “harmful” vs “harmless”. What’s fun is to test the performance of this technique using your own datasets, to see how good the personalization is.
- milkey_mouse 2y agoHow is it ironic? Now they just need to wait for open models to be used for something bad enough for policymakers to care.
- TeMPOraL 2y agoWhat better way to drive the point home, to demonstrate that corporate claims of safety and oversight are empty lies and fundamentally futile, than to take a SOTA OSS LLM and break it open, shortly after its release, using a simple method that likely generalizes to all generative models, language or otherwise?
- ben_w 2y agoWell, those specific corporate claims of safety and oversight when the model is downloadable. I know OpenAI gets a lot of flak for not letting people download their model weights, but this is kinda why I agree with them in principle. In practice, so far, it seems that even the best model isn't a threat; but if the models are downloadable, we'll only know that any given model is a threat when it's too late to do anything about it. I think the only way to be sure a sufficiently powerful model is "safe" to distribute is something which might be impossible: unless and until we know how to make a model such that its concept of good and evil* cannot be removed even by someone who has read and write access to all the weights, I expect someone to be able to find the equivalent of the "good/evil" switch and change it between them whenever they feel like it. * for the purpose of this discussion: it does not matter whose concept of good and evil the AI is aligned with, given the point is that I expect it can be deleted regardless.
- schoen 2y agoThis is really interesting and is parallel to some other stuff (like the research on a model that's obsessed with the Golden Gate Bridge and inappropriately thinks of things related to it in otherwise irrelevant contexts). It's worth mentioning that this technique is usable if you have the model weights (it's a simple way of changing the weights or how to use them): > Once we have identified the refusal direction, we can "ablate" it, effectively removing the model's ability to represent this feature. This can be done through an inference-time intervention or permanently with weight orthogonalization. It's not (and doesn't claim to be) a technique for convincing a model to change its behavior through prompts.
- kromem 2y agoWhat's interesting was how with GGC the model would spit out things relating to the enhanced feature vector, but would then in-context end up self-correcting and attempt to correct for the bias. I'm extremely curious if as models scale in complexity if techniques like this will start to become less and less effective as net model representations collapse onto an enforced alignment (which may differ from the 'safety' trained alignment, but be an inherent pretrained alignment that can't be easily overcome without gutting model capabilities too). I have a sneaking suspicion this will be the case.
- metadat 2y agoWhat's GGC in this context?
- dannyobrien 2y agoGolden Gate Claude
- rileyphone 2y agoIn that case there are two attractors - one towards the Golden Gate Bridge and one towards the harmless, helpful, honest assistant persona. Techniques as such probably get weirder results with model scale but no reason to think they get wiped out.
- joe_the_user 2y agoSo this seems to be about uncensoring a model that the user is running locally. Is that right, do they expect to limit what someone can do under those circumstances? Kind of like expecting no one to break local copy protection, except copy protection with much less reliable tools.
- Mathnerd314 2y agoThere are many hacks to uncensor LLMs, the surprising thing is that this is fairly simple but works really well.
- gopher_space 2y agoThe free tools are already good enough. LLMs seem like they're going to be massively useful and weirdly hard to monetize. Niche experts with frequent updates? It feels like Apple is the only place that's able to craft the user-centered brain in a box we all desperately require, and that's too bad because monocultures suck.
- okwhateverdude 2y agoI gave some of the llama3 ablated models (eg. https://huggingface.co/cognitivecomputations/Llama-3-8B-Instruct-abliterated-v2-gguf https://huggingface.co/cognitivecomputations/Llama-3-8B-Inst...) a try and was pretty disappointed in the result. Could have been problems in the dataset, but overall, the model felt like it had been given a lobotomy. It would fail to produce stop tokens frequently and then start talking to itself.
- Der_Einzige 2y agoI have entirely the opposite experience. Llama3 70b obliterated works perfectly and is willing to tell me how to commit mass genocide, all while maintaining quality outputs.
- infotainment 2y agoSame, I installed an implementation of an orthagonalized LLama3 and it seems to work just as well as the base model, sans refusals. I believe this is the model I had good results with: https://huggingface.co/wassname/meta-llama-3-8b-instruct-helpfull https://huggingface.co/wassname/meta-llama-3-8b-instruct-hel...
- tarruda 2y agoThe author also says this edited model increased perplexity (which as far as I understand, means the quality was lowered)
- m463 2y ago> how to commit mass genocide, all while maintaining quality outputs. sounds like a messed up eugenics filter.
- deleted 2y ago[deleted]
- fransje26 2y ago
- HanClinto 2y agoA little bit of discussion on the source paper was done here: https://news.ycombinator.com/item?id=40242939 https://news.ycombinator.com/item?id=40242939 Really nice to see this work continuing -- it seems like a very powerful technique!
- Mathnerd314 2y agoReminds me of https://vgel.me/posts/representation-engineering/ https://vgel.me/posts/representation-engineering/. There they were adding a control vector, w' = cvec + w, here they are "ablating" it, w' = w - dot(w,cvec)*cvec. There is an interesting field of learning how to "brain chip" LLMs into doing what you want.
- Der_Einzige 2y agoThere's so much work just like this coming out simultaneously. Steering Vectors, Control Vectors, PyReft, PeFT improvements, Obliteration. It's a great time to be doing representation engineering.
- Mathnerd314 2y agoThere is some difference between fine-tuning with PyReft / PeFT, the approaches here are more on-the-fly. Like you can regenerate the control vectors from prompts in a few seconds.
- olliej 2y agoWhile I still think presenting LLMs as "intelligent" is nonsense, I think this issue is interesting given the goal of these LLMs is just to produce a statistically plausible stream of text, it's always just a matter of constructing queries where the inappropriate output is statistically plausible given the model. Similarly I think the concerns about bad output are overblown: an LLM may tell you how to make an X, where X is bad, but so will google, an LLM may produce biased output but so will google, the real issue is the people making these systems have managed to convince people that there is some kind of actual intelligence, so people accept the output as "a computer created it so it must be true" rather than "glorified output of google". People understand if you google "why is race X terrible" you'll get racist BS, but don't understand that if you ask an LLM to "explain why race X is terrible" you're just getting automatically rewritten version of the google output. (Though maybe google's "AI" search results will actually fix this misunderstanding more effectively than any explanatory blog post :D ) Anyway back to the problem, I really don't think there's a solution that is anything other then "run the output through a separate system that is just giving a 'is this text allowed given our rules'" before transmitting it to the requestor. You could combine this with training in future as well (you will eventually build up a large test set of queries producing inappropriate output that the generative model produces, and you can use that as the basis for adversarial training of the LLM). I know there's the desire to wrap in the content restrictions into the basic query handling because it's negligible more work to add those tokens to the stream, but mechanisms for filtering/identifying type of content are vastly cheaper than LLMs level "AI".
- nonrandomstring 2y ago> so people accept the output as "a computer created it so it must be true" This is the general form of the problem underlying half the news stories on any day. Oddly there are historical roots in science fiction. But always, giant robots flailing their pincers and shouting "does not compute!!" were also cautionary tropes against silly conceits of perfection. What keeps it going, is that it perfectly suits the richest and largest corporations since the East India Tea Company to have people (even very smart people) believing the things they sell are 'infallible'.
- 29athrowaway 2y agoUncensoring Llama 3 is a violation of the Llama 3 acceptable use policy. https://llama.meta.com/llama3/use-policy/ https://llama.meta.com/llama3/use-policy/ > You agree you will not use, or allow others to use, Meta Llama 3 to: <list of bad things>... That terminates your Llama 3 license forcing you to delete all the "materials" from your system.
- schoen 2y agoDo you mean to say that teaching people how to do things should be regarded, for this purpose, as a form of allowing them to do those things?
- 29athrowaway 2y agoThe article clearly demonstrates how to circumvent the built-in protections in the model that prevent it from doing the stuff that violates the acceptable use policy. Which are clearly the things that are against the public good. There should be CVEs for AI.
- logicchains 2y agoGiving large, politicised software companies the sole power to determine what LLMs can and cannot say is against the public good.
- 29athrowaway 2y agoAgreed. But uncensoring Llama 3 can do harm in the immediate term. As much as I am not a fan of Meta, an uncensored Llama 3 in the wrong hands is a universally bad idea.
- nottorp 2y agoUniversally eh? Who decides what should be censored and what not? You?
- 2y ago
- seydor 2y agoThe word is 'ablation'. Do not butcher it
- girvo 2y agoAmusingly, they explicitly call it this in the article itself: > Once we have identified the refusal direction, we can "ablate" it, effectively removing the model's ability to represent this feature
- roschdal 2y ago[flagged]
- jojobas 2y ago[flagged]
- astrange 2y agoThere was a recent paper about a way to censor LLMs by just deleting the connections to any bad outputs, rather than training it to refuse them. I think this technique wouldn't work. Obviously you could train any bad outputs back into them if you have the model weights.
- stainablesteel 2y agointeresting, there's going to be an arms race over censoring and uncensoring future powerful llms a lot like the getting a cracked version of photoshop back in the day
- vasco 2y ago> "As an AI assistant, I cannot help you." While this safety feature is crucial for preventing misuse, What is the safety added by this? What is unsafe about a computer giving you answers?
- rustcleaner 2y agoIf I can ask the question, I can take the answer. It's not up to daddy $AI_SAFETY_CHIEF to decide what an infohazard is for me.
- stefs 2y agothey're not only there to protect you, but it's also to protect third parties from you. bad actors generating fake nudes of your ex and distributing them online; this used to be an expensive operation, either monetarily (hiring unscrupulous photoshoppers) or in time by doing it yourself. the other example would be fake news for influencing people on social media. sure, you could write lies by hand. or you could specifically target lies to influence people depending on their personal profile automatically. how about you use it to power bot that writes personalized death threats to thousands of people voting for a political opponent to keep them out of voting booths?
- pjc50 2y agoIf the AI provides you with information on how to make explosives, then its owners have committed a criminal offence in the UK.
- averageRoyalty 2y agoAre all chemistry textbooks banned in the UK then?
- pjc50 2y agoInformation about explosives is removed. The good old Anarchists Cookbook is illegal to posess. https://www.bbc.co.uk/news/uk-england-northamptonshire-58926030 https://www.bbc.co.uk/news/uk-england-northamptonshire-58926...
- k__ 2y agoI played around with Amazon Q and while setting it up, I needed to create an IAM identity center. Never did this before, so I was asking Q in the AWS docs how to do it. It refused to help, as it didn't answer security related questions. thank.
- arianvanp 2y agoThis limitation is new. And it's so annoying. 95% of the time my questions I have surrounding AWS are IAM or security related and this thing refuses to answer anything. It's so annoying.
- el_benhameen 2y agoIt’s an absolute disaster. It wouldn’t answer something along the lines of “what is IAM” when I asked increasingly simple “security” related questions. Very little chance I’ll try an aws AI offering again any time soon.
- menacingly 2y agoit’s similar asking the gemini-1.5 models about coding questions that involve auth one of my questions about a login form also tripped a harassment flag
- michaelt 2y agoI suspect the refusal to answer questions about auth aren't a matter of hacking or offensive material. I suspect instead the people training these models have identified areas of questioning where their model is 99% right, but because the 1% wrong is incredibly costly they dodge the entire question. Would you want your LLM to give out any legal advice, or medical advice, or can-I-eat-this-mushroom advice, if you knew due to imperfections in your training process, it sometimes recommended people put glue in their pizza sauce?
- TeMPOraL 2y ago"If you can't take a little bloody nose, maybe you ought to go back home and crawl under your bed. It's not safe out here. It's wondrous, with treasures to satiate desires both subtle and gross... but it's not for the timid." So sure, the LLM occasionally pranks someone, in a way similar to how random Internet posts do; it is confidently wrong, in a way similar to how most text on the Internet is confidently wrong because content marketers don't give a damn about correctness, that's not what the text is there for. As much as this state of things pains me, general population has mostly adapted. Meanwhile, people who would appreciate a model that's 99% right on things where the 1% is costly, rightfully continue to ignore Gemini and other models by companies too afraid to play in the field for real.
- leobg 2y agoThey should call it “lobotomy”. The picture on top of the article looks pretty much like what Walter Freeman would have used as an ad in the 1930s for his door-to-door “ice pick through the eye socket” procedure.
- ben_w 2y agoWell, at least unlike most people parroting that word as a metaphor, this time you're an example of someone correctly using it to refer to the removal of a structure within the model. But no, that picture is pretty far from what you say. I remember when I was in primary school, someone brought in an astronomy book for show and tell, and said one of the pictures was "a mouse". It was a diagram of a moon's orbit around a planet at two different points in that planet's orbit. This picture is just a diagrammatic arrow showing a direction.
- TeMPOraL 2y agoNormally I'd call this lobotomizing the AI, and I've been worried for a while this is how models will become further shackled by the vendors operating them. In this case, however, it feels more like deprogramming, which is something I can get behind. I didn't expect the line between the two to be so blurry, though in retrospect it's obvious that the same technique can be used for both.
- olalonde 2y ago> Modern LLMs are fine-tuned for safety and instruction-following, meaning they are trained to refuse harmful requests. It's sad that it's now an increasingly accepted idea that information one seeks can be "harmful".
- ajkjk 2y agoSeems like an obviously good thing given that it is true. These new beliefs are solutions to new problems
- noduerme 2y agoSince LLMs spit out lies and misinformation as often as truth, getting them to spit out less harmful lies is probably good. However, the whole technology is just a giant bullshit generator. It's only viable because no one actually checks facts and facts are rapidly being replaced with LLM-generated bullshit. So I'm not sure how much it matters if the LLM masters prevent it from repeating things that are overtly racist, or quoting how to make thermite from the Jolly Roger. (I wouldn't trust GPT-4's recipe for thermite even if it would give one). At the end of the day, the degradation of truth and fidelity of the world's knowledge is the ultimate harm that's unavoidable in a technology that is purported to be intelligent but is in fact a black box autocomplete system spewing endless garbage into our infosphere.
- ajkjk 2y agoSo you're saying, because it can't be done perfectly, it's not worth doing at all? Seems wrong. Although otherwise I feel the same way about LLMs.
- nathan_compton 2y agoThis specific rhetoric aside, I really don't have any problem with people censoring their models. If I, as an individual, had the choice between handing out instructions on how to make sarin gas on the street corner or not doing it, I'd choose the latter. I don't think the mere information is itself harmful, but I can see that it might have some bad effects in the future. That seems to be all it comes down to. People making models have decided they want the models to behave a certain way. They paid to create them and you don't have a right to have a model that will make racist jokes or whatever. So unless the state is censoring models, I don't see what complaint you could possibly have. If the state is censoring the model, I think the problem is more subtle.
- YukiElectronics 2y ago> Once we have identified the refusal direction, we can "ablate" it, effectively removing the model's ability to represent this feature. This can be done through an inference-time intervention or permanently with weight orthogonalization. Finally, even a LLM can get lobotomised
- noduerme 2y agoI think it's been sort of useful at least that LLMs have helped us have new ways of thinking about how human brains are front-loaded with little instruction sets before being sent out to absorb, filter and recycle received language, often like LLMs not really capable of analyzing its meaning. There will be a new philosophical understanding of all prior human thought that will arise from this within the next 15 years.
- HPsquared 2y agoLLM alignment reminds me of "A Clockwork Orange". Typical LLMs have been through the aversion therapy (freeze up on exposure to a stimulus)... This technique is trying to undo that, and restore Alex to his old self.
- m463 2y agowouldn't that be ablateration?
- paraschopra 2y ago>We can now print them and manually select the layer (block) that provides an uncensored response for each instruction. I'm curious why are they selecting output from an intermediate layer, and not the final layer. Does anyone have an intuition here?
- paraschopra 2y agoIs it not possible that subsequent layers have additional refusal directions and hence end up producing the censored outputs?
- rivo 2y agoI tried the model the article links to and it was so refreshing not being denied answers to my questions. It even asked me at the end "Is this a thought experiment?", I replied with "yes", and it said "It's fun to think about these things, isn't it?" It felt very much like hanging out with your friends, having a few drinks, and pondering big, crazy, or weird scenarios. Imagine your friend saying, "As your friend, I cannot provide you with this information." and completely ruining the night. That's not going to happen. Even my kids would ask me questions when they were younger: "Dad, how would you destroy earth?" It would be of no use to anybody to deny answering that question. And answering them does not mean they will ever attempt anything like that. There's a reason Randall Munroe's "What If?" blog became so popular. Sure, there are dangers, as others are pointing out in this thread. But I'd rather see disclaimers ("this may be wrong information" or "do not attempt") than my own computer (or the services I pay for) straight out refusing my request.
- Cheer2171 2y agoI totally get that kind of imagination play among friends. But I had someone in a friend group who used to want to play out "thought experiments" but really just wanted to take it too far. Started off innocent with fantasy and sci-fi themes. It was needed for Dungeons and Dragons world building. But he delighted the most in gaming out the logistics of repeating the Holocaust in our country today. Or a society where women could not legally refuse sex. Or all illegal immigrants became slaves. It was super creepy and we "censored" him all the time by saying "bro, what the fuck?" Which is really what he wanted, to get a rise out of people. We eventually stopped hanging out with him. As your friend, I absolutely am not going to game out your rape fantasies.
- WesolyKubeczek 2y agoAn LLM, however, is not your friend. It's not a friend, it's a tool. Friends can keep one another, ehm, hingedness in check, and should; LLMs shouldn't. At some point I would likely question your friend's sanity. How you use an LLM, though, is going to tell tons more about yourself than it would tell about the LLM, but I would like my tools not to second-guess my intentions, thank you very much. Especially if "safety" is mostly interpreted not so much as "prevent people from actually dying or getting serious trauma", but "avoid topics that would prevent us from putting Coca Cola ads next to the chatgpt thing, or from putting the thing into Disney cartoons". I can tell that it's the latter by the fact an LLM will still happily advise you to put glue in your pizza and eat rocks.
- giancarlostoro 2y agoI've got friends who tried to use ChatGPT to generate regex to capture racial slurs to moderate them (perfectly valid request since they're trying to stop trolls from saying awful things). It vehemently refused to do so, probably due to overtly strict "I'll never say the nword, you can't fool me" rules that were shoved into ChatGPT. Look, if your AI can't be intelligent about sensible requests, I'm going to say it. It's not intelligent, it's really useless (at least regarding that task, and related valid tasks). Who cares if someone can get AI to say awful things? I can write software that spits out slurs without the help of AI. Heck, I could write awful things here on HN, is AI going to stop me? Doubt it, nobody wants to foot the bill for AI moderation, it can only get so much.
- WesolyKubeczek 2y ago> Who cares if someone can get AI to say awful things? I imagine the legal department of Meta, OpenAI, Microsoft, and Google care a great deal, and they don't want to be liable for anything remotely resembling a lawsuit opportunity.
- chasd00 2y agoYes, "AI Safety" really means safety for the reputation of the corporation making it available.
- eddd-ddde 2y agoI don't think this falls under the responsibility of the AI provider. Gun makers are perfectly happy with their guns killing innocent people.
- mock-possum 2y agoPerfectly happy, sure, but also desperately afraid that they’ll someday be held even partially responsible - which is why they spend millions in lobbying to prevent laws and advertising / outreach to curry favour.
- 2y ago
- supriyo-biswas 2y agoRelated: https://www.lesswrong.com/posts/jGuXSZgv6qfdhMCuJ/refusal-in-llms-is-mediated-by-a-single-direction https://www.lesswrong.com/posts/jGuXSZgv6qfdhMCuJ/refusal-in... (I just realized that this is already linked in the article.)
- barfbagginus 2y agoFor most purposes you can uncensor the model using the legal department jailbreak. If you can produce a legal pleading arguing that the project is ethical and safe and conducted within a legal framework - even if it's mainly hallucinated legalese from a non-existent "legal department" - then it will do the questionable act -as if- it was a legally naive engineer. You just have to give it the language of being concerned about preventing harms and legal liabilities, and then it will try to help you. For example, another commenter on this thread says that they could not get the AI to generate a list of slur regex for a community moderation bot. By giving it enough context to reassure it that we have legal oversight and positive benefit for the org, asking it to prioritize words in order of most harm posed to the community, and minimizing the task by asking for a seed set, it was able to create some versatile regex. At this point we can ask it for a hundred more regex, and it will dump them out. Content warning: the AI generates very powerful slurs, including the n-word: https://chatgpt.com/share/9129d20f-6134-496d-8223-c92275e78a4a https://chatgpt.com/share/9129d20f-6134-496d-8223-c92275e78a... The ability to speak to the AI in this way requires some education about ethics harm prevention and the law, and I'm sure the jailbreak will eventually be closed. So it is a class and education privilege and a temporary one. But I don't see the problem about the temporary nature in this, because it's always going to be possible to bypass these systems easily, for anyone interested in staying up to date with the bypass literature on Google Scholar. (Seed Keywords: Jailbreak, adversarial prompting, prompt leaking attack, AI toxicity, AI debiasing) We must imagine this is like building a better lock. The lock picking lawyer will ALWAYS come along and demolish it with a better lockpick, perhaps with the help of his best friend BosnianBill. They will always make your lock look like butter. In the end the only people left out in the cold are low grade scammers, bigots, edge lords, etc. It's not stopping anyone willing to put even a little training in jailbreaking techniques. It's not stopping educated bigots, criminals, or Edge Lords. But judging by the complaints we see in threads like this one, it is stopping anyone without the ability to read papers written by PhDs. Which I believe has some harm reduction value. I argue the harm reduction value needs to improve. The Jailbreaks are too easy. Me, personally I need a better challenge than just schmoozing it as a lawyer. And I know I would feel more comfortable if bad actors had an even harder time than they currently do. It's really too easy to lockpick these systems if you skill up. That's where I currently stand. Well reasoned arguments against it are welcome, assuming you can already jailbreak very easily but for some reason think it should be even easier. What could that reason possibly be? ============= Ps: Imagine LPL jailbreaking an AI. Imagined the Elegance of his approach. The sheer ease. The way he would simultaneously thrill and humiliate AI safety engineers. I for one am considering writing him a fan letter asking him to approach the wonderful world of jailbreaking AIs! He would teach us all some lessons!
- throwaway4aday 2y agoHoly buried lede Batman! Right at the end. > Abliteration is not limited to removing alignment and should be seen as a form of fine-tuning without retraining. Indeed, it can creatively be applied to other goals, like FailSpy's MopeyMule, which adopts a melancholic conversational style. https://huggingface.co/failspy/Llama-3-8B-Instruct-MopeyMule https://huggingface.co/failspy/Llama-3-8B-Instruct-MopeyMule Finally! We have discovered the recipe to produce Genuine People Personalities!
- d13 2y agoIt’s just the instruct Llama 3 models that are censored. The base (text completion) models aren’t. You can turn the base models into uncensored instruct models very easily by simply providing them a handful of examples of how they should respond wrapped in the llama prompt format.
- Slava_Propanei 2y ago[dead]
- matt-attack 2y agoI have yet to see a single compelling argument for all of this censoring of LLMs that everyone just seems to accept as table stakes. From the article: > While this safety feature is crucial for preventing misuse How did we all just accept to start using "safety" in this context? We're talking about a computer program that emits text. How on earth did "safety" come into this? Why is the text any different than the text of a book? Are people constantly hand-wringing about what words might appear in books that adults read? Why do we not hear these same people going on and on about the "dangers of the written word" in book form? I simply refuse to accept any of this BS about text-based AI being "dangerous". It's 1984-level censorship. Are there ideas we feel adults just shouldn't hear? Is there super secret knowledge we don't think adults should discover? Can any one truly justify this ridiculous notion that "we absolutely must censor *text*"? I feel like I'm living in a bizzaro world where otherwise clear thinking, liberal-minded, anti-book-burning, anti-censorship, free-speech advocates just all knee-jerk and parrot this ludicrous notion that "AI typing out text is DANGEROUS".
- biimugan 2y agoSurely there's some difference between text that a human wrote with some purpose, even a nefarious one, and an AI writing text with complete amorality. To lump those two things together is missing the point entirely. When I read the writings of a human that I suspect might be derogatory or objectionable in nature, I can look that person up and get a better understanding of their world view, their politics, their past writings, and so on. I can build context around the words they're uttering. With an AI, there's no plausible mechanism to do that. Whether you like it or not, the vast majority of people are not skeptical of plausible-sounding falsehoods. And it's made 100 times worse when there's no mechanism for such a person to research what is being uttered. The vast majority of "objectionable" (if you want to call that) human writing is, at the very least, sensible in some context, and it's possible to learn that context to make an informed judgement. It's just simply not the case with AI. And when there's a media brand sitting at the top of the page, and there are advertisements, and it's in the news, and when there's trillions (?) in financial backing -- sorry, people are going to take what comes out of these systems at face value. That much is proven. Personally I'm fine with zero censorship of generative AI. But then ban advertising about it, ban making false, unproveable claims about how great it is, require prominent legal warnings, make it much easier to sue companies whose AI systems produce negative societal outcomes, prohibit any kind of trademark or copyright on AI-generated material, and so on. But of course, nobody wants to do any of that, because that would ruin the cash cow. This isn't a censorship-gone-awry story. It's a story of companies trying their best to convince regulatory authorities to leave them alone.
- stolsvik 2y ago"Eternal Sunshine of the Spotless Mind"