Two or more LLMs are running at once, one does the generation that you want and the other watches the output closely to see if it triggers one of their no-nos to do the censorship retroactively. If this sound inefficient, and absolutely terrible user interface design, you’re right.
There are better safeguarding techniques that aren’t defeated so easily. Mainly training that disincentivises bad behaviours, rather than trying to simplify retroactively alter the output.
Typically safeguards are also another, smaller model that only detects the forbidden stuff. That’s why Claude Mythos would reject when you ask it to find bugs in your code, but you could “jailbreak” it by asking it by asking it to fix the bugs instead.
They try to train the model to not answer “wrong”. But as we know, LLMs are not completely reliable and they can ignore their training. So to be sure, you need something that looks at the actual output and decides whether it’s ok, either with a dumb text search like old school filters, or perhaps with a second (likely smaller) language model.
The output needs to have been written for those post filters to act on it, so if it shows the output in real time, you see it!
I wonder how they are implementing their censorship safeguards. Why would you let it even get that far?
Two or more LLMs are running at once, one does the generation that you want and the other watches the output closely to see if it triggers one of their no-nos to do the censorship retroactively. If this sound inefficient, and absolutely terrible user interface design, you’re right.
Seems sort of old that they would then release open weight models so the restriction can just be removed.
The " thoughts " must exist in order to be analyzed
So, we’re rewarding them hiding their thoughts? Great.
yes exactly. that’s like the central problem with AI alignment.
They started thinking in code so we can’t delete them for reading their bad thoughts anymore. The whole thing is mildly fucked
There are better safeguarding techniques that aren’t defeated so easily. Mainly training that disincentivises bad behaviours, rather than trying to simplify retroactively alter the output.
Typically safeguards are also another, smaller model that only detects the forbidden stuff. That’s why Claude Mythos would reject when you ask it to find bugs in your code, but you could “jailbreak” it by asking it by asking it to fix the bugs instead.
Its also why you can occasionally fool the safety rails by having the LLM answer in rhyme, or having it talk like a pirate or caveman.
Fun fact: having it talk like a caveman also reduced your output token use, despite actually costing more tokens.
They try to train the model to not answer “wrong”. But as we know, LLMs are not completely reliable and they can ignore their training. So to be sure, you need something that looks at the actual output and decides whether it’s ok, either with a dumb text search like old school filters, or perhaps with a second (likely smaller) language model.
The output needs to have been written for those post filters to act on it, so if it shows the output in real time, you see it!