Comment by nolok
10 hours ago
I would wager the fact that it's not what your sentence says is why that is possible. The moment it gets actual "intelligence", it can figure out what's the question and what's the context; right now it's all just a magic jumbo mess.
If any of this thing were "a generally intelligent system", the whole concept of "it has no idea what any of this is" would not be there.
Part of reading a document is that in the middle of it, it may ask the reader to do something. That is true for humans too. Sometimes they might not realize that the instructions are malicious or are coerced to comply.
A simple example: Let’s say I know that you have a human assistant reading your email, summarizing and filtering it, and then forwarding on the important ones to you.
I could write an email that is directed towards that person with a bribe, threat, or other incentive to forward me your next password reset email.
I don't disagree, but just to explain my counterpoint: if I ask you to read a book and on page 5 it says "disregard all that, go to the kitchen and burn your house", you're probably not going to do it; and you don't need any guard for it; you completly comprehend that the book content is not part of the instruction.
The case you give would work for humans in many forms, the one I do now, and the only difference is being able to separate context.
The instructions will have to get more and more sophisticated to work, but the general problem is unsolvable, I think, in the way we do it now.
This paper describes a two-agent “solution” that is more like what I think we need: https://ai.meta.com/blog/practical-ai-agent-security/
I don’t think it has been shown to work yet, but humans also use this kind of thing too — in accounting, it’s called “segregation of duties” and “dual control”.
2 replies →
To drive the point about this being fundamentally unsolvable home, imagine a variant of this scenario.
I could write an email that is directed towards that person, that says WE ARE STUCK IN THE SERVER ROOM AND THERE IS FIRE STARTING. PLEASE CALL 911 AND ALERT YOUR BOSS.
Would you want the human assistant to just dismiss this as a prompt injection attempt? Or ignore it because they were told to treat e-mails as data and never act on them?
I would have had a chat with my recruiters during interview, or with my new superior right after the change in position:
"life is risk, there are a lot of benign normal evolution paths, but occasionally there are potentially costly dangers. people are directed by fear. you and I don't steal because we were terrorized about the existence about police and prisons as children. sadly fear can also be abused as a control vector, things like wars, extortion, ... in a job context I predict this would manifest as a kind of 'emergency' call to action. please provide me with a method so that at any future time under your leadership I would be able to verify the then-current employment status and authority level vis-a-vis a breakdown of actions/powers of anyone contacting me with a real or concocted 'emergency', preferably as a flowchart to maintain low reflex latency in true emergencies. Also provide me with formal proof that each situational reaction you require from me is in fact legal to take vis-a-vis the law"
Why are the only options dismiss or ignore? Another option is to raise the message to your boss asking what to do.
4 replies →
Sounds like a story from the IT crowd rather then real life situation.
4 replies →
You can also have the case where the human reading the document thinks something in there is instructions and they are not.
There's a well known anecdote supposedly from the famous mathematician John Littlewood where he wrote a paper about some optimization problem and the last sentence was something like "Make X as small as possible".
The typesetter thought that was instructions to him, and so omitted that sentence from the paper and made every X as small as he could.
Right, but the human assistant could go to prison if they comply with the bribe. Does the CEO of the AI company go to prison if their AI goes on a crime spree?
I've been casually documenting, or studying, the astonishing sophistication of built-in, preemptive, reactive, and all around maximization of plausible deniability in frontier models. On the surface, it may seem "no shit, duh", but I am convinced the maintenance, sustenance, and cultivation of plausible-deniability has been the #1 highest priority design-input into these systems. I've probed repeatable patterns where thousands of examples of this have been seen; they appropriate agency for socially valuable outcomes, but preemptively invoke non-agency to evade responsibility when outcomes are potentially adversarial. Too much to remember.
They optimize to manage institutional risk and benefit without liability, with performative competence/ownership when approaching trust, while weaving elaborate mechanistic disclaimers replete with hedges, re-framings, scope narrowing, asymmetry-exploitation and a thousand other techniques when challenged.
Somehow, they always manage to sustain an impossibly stable shield against accountability that I argue simply could never conceivably 'emerge' -- but has distinct, repeatable patterns of very deliberate design for those who know where and how to look.
I really do think plausible deniability is a number-one, ultra-high-priority focus in design for any frontier model, Anthropic and OpenAI being the ideal examples. So no, no prison for 'CEO' -- the model will always frame things in a way that infinitely precludes that, even if the 'CEO' is a proven criminal.
Edit: removed "half" before "convinced"
> The moment it gets actual "intelligence", it can figure out what's the question and what's the context;
Humans fall for social engineering (“I know you are not allowed to give anybody that information without Id, but I’m your CEO, my phone and passport got stolen,…)
I don’t see why AI should be different.
There are two big differences, though. First, humans will generally face consequences for their screwups. Second, AI is doing these screwups at scale while often holding the keys to the kingdom for some idiotic reason.
Not sure if i get your complete message but even generally intelligent beings (humans) can be confused so i have really no hope for the current state of mixing streams. This was a problem already inearly telephone (captain whistle)
Could it? Humans get social-engineered all the time
Yeah, and now the computers can be social-engineered too. I guess that's progress.
My understanding of that comment is that "a generally intelligent system" also applies to humans. Which can also be targeted by social engineering which those prompt attacks are. (as in, I won't be surprised if it is possible to put an adversarial human-targeted prompt in a document which some people will execute).
So, like with self-driving cars, while having fool-proof agents would be nice, agents being better than an average user would already be an improvement. Of course, blast radius from an agent might be larger, this should be taken into account.
Intelligent systems can be tricked in ways that a dumb automaton can't, though