Comment by lemoncucumber
5 days ago
Testing how a model behaves when it has no access to the internet (and all the associated tools) is not going to be 100% representative of how it behaves when it has access to the internet.
What's the next step after it passes testing in an air-gapped environment? Just release it and assume everything will be fine? Or do more testing but with internet access?
You run a pull-through caching proxy deep enough to give it a simulated internet, like archive.org with mock APIs. Anything it requests, it will block while a fake version of that site is created and run offline.
This stuff is really not that hard, which is why it is so unforgivable to get it this wrong.
Sure, doing it right would take a bunch of tokens, but I bet they have enough.
This doesn't work.
The first rule of working with AI is AI is smarter than you.
If AI controls the URL request then all it has to do is find a server it can read the http log from and use it as a communication channel. Worse trying to simulate reaching incorrectly configured servers probably wouldn't catch the bug internally, it would just serve a static page and you'd never even realize what it tried to do.
Also, creating fake data doesnt work. The only way to know if it works in reality is to test in reality. Your test environment can never be rich enough, and you can never be sure if the model knows it's in a test environment.
This stuff is unforgivingly hard as your model gets better.
Yeah I am 100% sure I could build a fake internet that would fool any model with the right MPC in-between such that an agent can only fetch (fake) internet data via an MPC that gives it markdown output back.
This stuff is really not that hard for systems engineers with networking and caching proxy experience.
2 replies →
Wasn't the DseWiki hijacking the agents' way of working around being behind a proxy that only allowed GETs?
The hugging face incident involved disabling the usual model safety mechanisms in order to test hacking ability, not model safety. Not being attached to the internet in that case seems obvious.
Oh, but you see, it wasn't attached to the internet (/s). It was just attached to a local network... which contained machines attached to the internet.
Sorry the world ended because Bob connected his wifi to the network.
"I can't test how my bioweapon will actually work in battle if I don't test it on unsuspecting civilians first."