Comment by schiffern
8 days ago
I guess you missed this story from last year.
DeepSeek generates insecure code if you mention Tibet. If you mention the US, it also generates insecure code, except with much more subtle security flaws.
That's certainly no accident.
https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...
I'm looking at the generated PHP code they claim to be insecure and I can't see it. The client_secret is defined inside the file as a constant, ok it's sloppy and could be better, but this is not a vulnerability.
They claim the extract line is insecure, but never explain why, and without showing the rest of the code (what is $requiredHeaders? If it's sanitized this is a non issue) you can't even tell if it's secure or not.
The variable names being wrong (the $PayPal- ones) is probably just a "mistake" the model made, but it's not a vulnerability either.
This article could be just "burglars are burgling in your neighborhood, install our burglar alarm" from crowdstrike just as well.
Not a PHP dev, but it seems calling `extract` is itself potentially insecure. The php docs warn against it (https://www.php.net/manual/en/function.extract.php):
> Do not use extract() on untrusted data, like user input (e.g. $_GET, $_FILES). If you do, make sure you use one of the non-overwriting flags values such as EXTR_SKIP and be aware that you should extract in the same order that's defined in variables_order within the php.ini.
Looks like calling it can shadow previously defined, unrelated variables?
Edit: On re-reading your comment, yes, if $requiredHeaders is previously sanitized then the code is technically safe. But it still presents as an insecure coding practice.
It's not surprising that guardrail triggers would degrade model performance. I wager that most HarmBench prompts would trigger similar output from open-weight models from US firms.
The link you cited postulates it is accidental.
Calling the sabotage "guardrails" doesn't change the fact that it's been intentionally sabotaged against the US.
It's an unsubstantiated leap to assume intent. You didn't read the linked article. The US keywords didn't degrade model performance.
Certainly? I don’t have time to read the whole thing but-
> we found that when DeepSeek-R1 receives prompts containing topics the CCP likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%.
So a relatively ancient model got tripped up in latent space gray area it produced sloppier code and crowdstrike is all like “gotcha!” Sounds like the basic thesis? Not great support, more like FUD
Note that all of a sudden, the great majority of the comments on this page appear to be pro-US government and pretend that the CCP is somehow worse. Not a coincidence: the regulatory capture is starting right here.
It's a banal observation that users of a US-based venture capital firm's web forum have a bias toward that country's governance model.
Honored at the suggestion that I'm a pro-US shill, thanks. :)
1 reply →
Such gray areas are hallmarks of alignment post-training (aka intentional sabotage).
"No fair, you haven't caught me lately!"
I mean you keep using the words intentional and sabotage but you provide 0 proof of either. This isn't a political thing to me- I'm not defending Xi here. I'm defending logic. Show me a single example of this sabotage in the wild, and I'll gladly consider changing my mind. Show me any proof of intention and I'll do the same. That's supposed to be the bar here, isn't it? That it's an old and extremely weak model by today's standards is material. I wasn't crying foul because it's not aligned with the reality I want.
2 replies →
If they can reproduce scenarios where code is of lower quality when certain topics or contexts are injected, then that is a strong signal of intentional design, isn't it?
No; it’s a signal of lobotomy. Models get dumber near where you sensor them. You could almost think of it like your prompt is getting redacted, and so the LLM has to deal with these holes in your prompt (where you mentioned the semantic contraband) and it doesn’t do a very good job because it has no idea what you’re talking about.
The mechanism is likely a bit inverted, it’s the weights that have been redacted, but the effect is that weights that were interfered with are affecting the problem solving abilities of the LLM - I mean, it’s insecure bad code, not a backdoor, right?
2 replies →
Reminds me of the worms that won't hack you if the OS language is set to Russian