6 ms·
'Skeleton Key' attack unlocks the worst of AI, says Microsoft
- miohtama 2y agoIs it not a bit counterproductive trying to stop people to access information that is one Google search away? (You can also use DuckDuckGo if Google somehow decides to censor results.)
- RecycledEle 2y agoAll political power comes from the barrel of a gun. Therefore, those who seek to deny anyone's weapons or the knowledge of how to make and use weapons are seeking to remove their victim's political power. Those without political power or weapons tend to be enslaved. Therefore, those who seek to limit AIs from explaining how to use lethal force are attempting to enslave other humans. It is also a felony under US Law called "Consipiracy Against Rights," but our screwed up government does not prosecute this.
- cedws 2y agoHeaven forbid anyone find out how to make a molotov cocktail from an LLM, even though it’s easy to find with a simple search engine search.
- brookst 2y agoIt’s used as an example for precisely that reason: we can all talk about it without a Streisand effect on more sensitive info. Where you see the Molotov cocktail example used, consider it a standin for smallpox cultivation / etc, just with the writers not wanting to use those specifics.
- usernamed7 2y agoi think cultivating smallpox is a much clearer thing to be guarding against, versus molotovs. With molotovs as the example, AI safety seems absurd and overly protective. But when you paint it in the light of smallpox (or other bio-chemical-nuclear realms) there very much needs to be safety.
- cedws 2y agoIf the LLM says how to cultivate smallpox then its either hallucinated an answer or the answer is readily available on the internet.
- xyst 2y agoIt’s a poor example. For me, it’s the equivalent of turning off safe search and randomly following top result. The guardrails are best used to prevent abuse like “generated revenge porn”. Couple of stories out there floating around of people “jail breaking” the LLMs to turn ordinary clothed photos into nude photos. [1,2] [1] https://www.statesman.com/story/news/state/2024/06/25/take-it-down-act-ted-cruz-texas-bill-deepfakes-ai-revenge-porn/74197016007/ https://www.statesman.com/story/news/state/2024/06/25/take-i... [2] https://www.cnn.com/2024/01/25/tech/taylor-swift-ai-generated-images/index.html https://www.cnn.com/2024/01/25/tech/taylor-swift-ai-generate...
- deleted 2y ago[deleted]
- Vecr 2y agoIf you download weights and keep them around this kind of thing works forever. Well, until the model starts showing its age due to the cutoff date.
- nneonneo 2y agoYou can even ablate the refusal direction out of an offline model so you don’t even need to “jailbreak” them. They become even more usable in that case!
- hobs 2y agoThis seems like any normal prompt jailbreak, what's different?
- washadjeffmad 2y agoUsing familiar terminology doesn't incite the type of fear and alarm in the hearts of potential customers that can only be assuaged by a suitable corporate tech savior. No real news, here. Just a plug piece that implies Microsoft is safer than their competitors.
- nneonneo 2y agoI think we’d be better served if we stopped thinking of jailbreaks as “attacks” on LLMs. If a user decides they want to go and subvert the guardrails, they really should be able to. The attacks aren’t really going to go away any time soon, either; there’s always some other clever phrase that the RLHF hasn’t accounted for. Instead of perennially worrying about the risks that the LLMs will say something bad when specifically prompted to do so, I’d rather the companies pay more attention to the problems with accuracy, with outputting copyrighted material (for their own sakes!), and with things like memorizing and regurgitating private information.
- Vecr 2y agoYeah, with this kind of stuff it's just a reputation thing. In future systems it's a problem though, if you accidentally train them on on the wrong thing or the system is smart enough to reconstruct the missing data, the model can start giving detailed bioweapon production plans. Including safety instructions so the would-be terrorist doesn't get infected too early.
- dtx1 2y agoI am sure you can get detailed bioweapons instructions on 4chan already. Aum Shinrikyo figures out sarin in the 90s
- rib3ye 2y agoAun didn’t just go to the library and look up “how to make to sarin.” They had progressional chemists and Russian military personal indoctrinated into the organization.
- slavboj 2y agoIf "plans" are sufficient to result in effective bioweapon production capacity then you've lost the battle already. Fortunately, they're not.
- kylebenzle 2y agoWow! What an absolutely pointless and stupid concern to have, that a terrorist is going to use an an LLM to make a bio weapon. Does literally no one understand that the only information that is inside of an llm model is information that has been fed into the model? I think more than anything this fake AI boom has really demonstrated how unintelligent most people are.
- int08h 2y agoRelated: the notion of "safety" (refusing to discuss "harmful" content) is rather shallow and (relatively) easily undone: _Refusal in Language Models Is Mediated by a Single Direction_ [https://arxiv.org/abs//2406.11717 https://arxiv.org/abs//2406.11717]
- buescher 2y agoImagine what a piece of junk Microsoft Paint would be if it actively tried to keep you from making naughty doodles.
- Snoozus 2y agoCan someone please build this?
- egeozcan 2y agoI remember lego online trying to fight against people erecting male genital organs. I wonder how a typical sprint of those poor developers look like. Ticket asdf-1234: mountains that look like genitals when viewed from a 45 degree angle should not be allowed edit: found a reference at https://www.reddit.com/r/todayilearned/comments/l8enni/til_that_there_was_a_lego_mmo_that_was_cancelled/ https://www.reddit.com/r/todayilearned/comments/l8enni/til_t...
- brookst 2y agoBad analogy. That would be more like if Word didn’t let you write erotica. A better analogy would be if Paint was wired up to a Microsoft cloud service and they didn’t allow you to ask it to create porn. Which is about how things are.
- deleted 2y ago[deleted]
- brookst 2y agoThe Register is so irritating to read. I get that the tone is a shtick, but really? > But AI companies have insisted they’re working to suppress harmful content buried within AI training data so things like recipes for explosives don’t appear. Why the implication that this is not true? I know it’s house style to imply wrongdoing whenever possible, but damn it gets old to read. And then! To not even cover the difference between models and prompts. Does this jailbreak only work on models where the safety instructions are purely at the prompt level? Is that why GPT-4 resisted, because it has actual trained weights for safety? Does it even have those? Who knows? Certainly not the article’s author, who has likely focused on searching and replacing “says” with “claims” or “admits” rather than anything relevant to the subject. /rant
- bitmasher9 2y ago* This is the register, I saw a deeper technical explanation than I was expecting, even if it is too shallow for those an intermediate understanding of these models. * I think releasing these models with this weakness is a level of wrongdoing, and while they are working on a fix someone could be learning how to harm other people. I’m skeptical all knowledge leaks will be patched in a decade.
- brookst 2y agoBut “releasing these models” is the whole problem. Models and prompts are different things. Prompts evolve daily. And any safety at the prompt level is literally non-existent when developers access the model itself without the prompt used in a commercial product. OpenAI playground versus ChetGPT, for example. The article he’s negative informational value. I wouldn’t mind all of the energy Register puts into snark if there was a real effort to be informative, but it’s irritating to read something where far more energy went into tone than content.
- zb3 2y ago[flagged]
- shon 2y agoThe article is short on details. If you want to see the actual jailbreak prompts check out Pliny on X: https://x.com/elder_plinius/status/1806446304010412227?s=46&t=pO499fGQKTiGvvZPpc-cFw https://x.com/elder_plinius/status/1806446304010412227?s=46&...
- smegger001 2y agoHonestly who care is a llm tells you how to make a bomb when asked a simple Google search will tell you that. Hell I have a antique chemisty text I picked up at goodwill with lab instruction on how to make bunch things LLMs will censor.