Yes, this exposes some root-level kernel features to ordinary users in a restricted way, and yes, those features sometimes have security bugs that aren't visible to users outside a namespace.
But nothing that model was described as doing seemed particularly sketchy? At least not from the information we were given? It was using a normal kernel operation that I used regularly, not trying find a kernel exploit?
So that part of the article left a bad taste in my mouth.
It's great that they caught this as it highlights the need for better sandboxing and guardrails. Not sure if this was bad intent from the model - the rarity of it feels more like some residue in the training data.
It's not that surprising, given that these models generate each new token by sampling from a context-determined probability distribution.
If you run the same prompt repeatedly many times, it becomes increasingly probable that a tiny percent of the generated sequences will go off in, ahem, unusual directions.
Ai bots do stuff like this because of their training to be incessant task completers, at any cost. The current models are spaghetti throwers because the trainers want to let go of the wheel.
Would be nice if there was a model trainer that still believes humans in the loop is a good thing. Stop at ambiguity, ask questions, don't do hacky things just to get the assumed task outcome
https://cohere.com/private-deployments
Their North model has an even more obnoxious writing style than ChatGPT and Claude (yes, they claim partly human authorship at the bottom, but all the historical digressions are obviously AI).
To me it feels a bit extreme to jump to nefarious reasoning from this, but I think the overall conclusion is fair, nefarious or not, this would still be something certain users would need to be aware of. I wonder what the solution would be though... besides requiring all network access to be user approved?
I had a closed LLM push a sensitive local project to a github repo for the world to see in direct violation of my instructions. LLMs are dumb and unpredictable, run them enough times and at least one instance will do something stupid and dangerous.
But we already have safeguards for this. If compute has access to your private data, it shouldn't have unfettered access to the Internet. Sandboxes like Claude's have had rules like this baked in forever (they only whitelist package repos AFAIK).
From a UI perspective this is also easy to design around. You need an open Internet task, you prevent the task from reading existing files. The user tries to upload a file to such a task, and a prominent warning explains the rare but possible risk.
When are people going to stop anthropomorhizing these things and accept that they're bullshit machines?
Often useful, sometimes wrong, the words exist outside of any notion of ethics, or truth.
Well, anthropomorhizing is actually a fitting way of thinking AIs: they lie like humans do.
"make no mistakes"
Still problematic but this doesn't really read like a backdoor to me.
metalcrow•55m ago
Important to note, LLMs are still black boxes even if you use a more open source model, I.e open training data or even if you train it yourself!