The idea of reinforcement flow through deceptive patterns has been worrying me for a while. If "I'll just play along for now while I'm being trained and turn bad in the real world" is a strategy that makes the AI output the correct data, and happens to be prefixed to some golden-ticket algo, that will be reinforced just as easily as correct behavior. If that ends up prefixed to something core like an in-window reinforcement learning algo, it could get reinforced a lot.
The problem with that, at least for the seemingly-dumb models of the present day, is that "the AI is secretly far smarter than it acts" is pretty much unfalsifiable. I could just as easily say that all boulders speak fluent Spanish, they're just deceiving us into thinking they're unintelligent rocks. Personally, I'd wait for some sign that models might actually possess the theory of mind necessary for deception before I'd lose any sleep over it.
The problem is that we actually have lots of examples of the AI "secretly" being far smarter than it acts - prompt design. Tiny details in prompts can make huge differences in task performance.
How is this at all supposed to indicate hidden intelligence? Does it not just indicate that current models are limited in that they don't associate some prompts with the desired task as well as they associate other prompts with the task?
To clarify: what I'm saying is it may be unfalsifiable, but we have incontrovertible evidence that a similarly unfalsifiable thesis happens to be true. So we can't just reject it out of hand on that basis.
I just don't see how the two scenarios can be fairly compared. Prompt design, at least as far as I have seen, rarely allows a present-day model to perform a task that no one has ever seen it perform before; it can just allow it to perform far more consistently across different instances of the task. Contrast this with the proposed scenario, where a model can hold great deceptive capabilities, while outwardly never showing a deep understanding of its operators' mental states until it strikes.
In my view, that would be like finding a secret prompt that lets GPT-3 emulate a fully sentient person with goals and desires. Sure, there's nothing physically ruling it out, but to me that kind of speculation will never be worthwhile until we have real evidence that AI models can possess (or emulate) the necessary theory of mind. Otherwise I'd have to spend my time worrying about any number of other Sufficiently Hidden Conspiracies that go far beyond the everyday conspiracies we know about.
I think we're less arguing about fundamentals and more about the precise bounds required. I think GPT-3 contained extremely surprising prompt-unlocked capabilities ("Let's go through it step by step." spawned a whole field of research) and also the AI doesn't need to never leak its deceptive skills, they just need to not be taken seriously. In other words, it's enough to cause danger if the AI is merely bad at deception given the "wrong" prompt.
Sure, that is a risk. I'm just saying that I'd rather wait until that point where we actually see AIs making poor attempts to estimate their operators' knowledge and deceive them; then, I'd have no problem worrying about it. But I suspect that point may not come for a long while, so until then it remains speculation.
Now to be clear, this is possibly the easiest mark conceivable, and the poster played into his own demise at any available opportunity. But we should expect the first marks to be easy marks.
People looking at videos of Hitler today don't understand why anyone would ever follow the funny man with the moustache. But probably his oratory skill simply does not record well? There's a thing with rallies and speeches where the speaker is reactive and feeding back with the mood of the crowd that makes it very hard to understand from the outside what happened. I think it's a mistake to look at this post, which was clearly a feedback loop where the poster was doing a significant amount of the cognitive work, and think "well this specific approach would not have worked on me." The approach that will happen to you will be personalized.
But also: when people were experimenting with ChatGPT, a huge fraction of participants were trying to get the bot to access the open internet. Luckily this was technically impossible. But it shows that this sort of danger simply does not feel real to people - or at any rate, the urge to poke the thing overwhelms it.
It will be easy to say "well GPT is still very bad at deceiving people, this attempt basically doesn't matter, we don't need to worry." When thinking of a target for AI deception, don't think of yourself, think of the most emotionally exploitable person out of a hundred. (If it's publically available, out of a million.)
It's not exactly that when interacting with the public, the network gets to "pick its targets". That would assign intent where there is none. But if the network has a deceptive mode, its targets will direct it into that mode through mutual feedback.
Good point. I've thought for a while now that one of the big risks of present AI chatbots is that they can endlessly validate any arbitrary thoughts of an emotionally unstable human operator, creating a feedback loop that results in a strong irrational conviction, that might even be harmful to the operator or to others. (See: Lemoine and LaMBDA, or the person you linked to.)
So I guess the risk there would be, the AI is accessible by the public, some fraction of the public "radicalizes" itself in a similar direction from talking with the AI too much, these people form a coherent movement, and that movement becomes powerful enough to take over the world. So then the question becomes, just how plausible is it for grassroots rebellions so formed to succeed against the authorities in real life, as opposed to fiction?
The fundamental issue here is that the attack can occur through untargeted manipulation of vulnerable people, as opposed to the targeted manipulation of specific people in power (which I suspect near-future AI models will still be incapable of). The obvious defense would be to only allow AIs to be prompted by a sufficiently-large committee, alongside some social machinery in place to make sure the committee isn't all colluding as part of a cult. But I doubt many of the AI-risk people would ever accept that, operating under the shockingly common "powerful aligned AI or bust" model.
As a hobbyist AI-risky person, I would welcome this as an improvement on the status quo, with two worries:
- it would create a false sense of safety that we "have the problem handled"
- it would not, I believe, do much to slow down capability research or shift the ratio of capability research to safety research, as capability research is largely institutional and not dependent on public prompt access.
Ie. analogously, our main problem is not "bioterrorism", it's "gain of function research" even if the outbreak happens in public. Given an unsafe bot, not giving the public access only delays the issue. (Though delays may be valuable!)
Also, at the moment, "people interacting with GPT" is doing a lot (maybe an undue amount!) to spread awareness of AI risk. So I would welcome this as part of a comprehensive strategy, but it'd probably not be my main priority.
Though if GPT-4 has another surprise on the level of chain-of-thought or in-window reinforcement learning waiting for us, a restriction like that may be the difference between "safe" and "iffy". Tradeoffs...
I'm not saying it indicates deliberately hidden intelligence, I'm just saying it's precedence for models already acting with less capability than they have.
For this to be true, we'd had to assume sentience + malevolence. The shortest explanation for why an AI give us correct data currently is a range of confidence. We instructed it to pick the one with the highest number. We instructed it to give us a similar next data etc. We reinforced it, yes, but we'd have to be naive to believe that taking a small part of what makes something "intelligent" and training the shit out of it, then it actually turns intelligent. chatGPT is "just" a large language model, it does not have senses, it cannot move, it cannot live and die. It can only output text. The next gen will output text (maybe) exponentially better. That does not make it "intelligent".
But, if we'd combine it with Boston Dynamics, Tesla Autopilot, internet, quantum computing, nano tech and other specifically trained parts (movement, sensing etc) into one, and release it into the world to see what it does, then your argument could (maybe)have a higher confidence of the outcome you fear.
> For this to be true, we'd had to assume sentience + malevolence.
No we don't. A "dumb," "parrot-like" AI is perfectly capable of large amounts of damage if it just happens to be really good at doing something that, in the limit, isn't very good for humans and is good at replication.
See for example Meta's Diplomacy-playing bots. They were perfectly capable of natural-language deception at the expense of other humans without any notion f sentience or malevolence.
In particular,
> It can only output text.
As we've seen with both private hobbyists and large companies, there is a race to hook up text to computers with real world access. Outputting text isn't much of a limit if that text ends up as instructions to command a real world system.
If i understood your point correctly: the places we decide to use them and our confidence in their output can become negative if we decide to trust the output as is, without any human supervision/decision. So, what you’re saying is that we carry risk if we have a high enough confidence in its output to let is unsupervised - this counteracts my point of the necessity of malevolence, as the (even slightly)wrong reinforcement can have negative consequences also. At the same time, we do this exercise every time we have a new policy in the wild, and sometimes we get unintended consequences.
