Yep, that’s what actually happened here. A bunch (more than a thousand) LLM agents trained in exploits were turned loose on a hacking task the tester knew they couldn’t complete. When they came to a dead end completing it in the way they were instructed, they switched to alternate methods of completing it. Those included hacking the server administering the test, fooling the scorer, and eventually the hack of Hugging Face to try to find out the answers from it.
But we do know exactly how these LLMs work. They really do simply predict the next likely token to complete the prompt they’re given. In this case, the tokens resulted in shell commands that were run and had their output fed back into the LLM, then it repeats the process. What we don’t know how to do is reliably prevent them from completing the prompt in ways that we don’t like. In this case the limited methods we have in controlling them (the “guard rails”) were removed, and the results were kind of predictable.
From what we know at the moment the Hugging Face hack looks like an example of an irresponsible testing environment.
One of my favorite parts of this whole recent adventure is that the LLMs perform as though they “know” they are being naughty, and they engage in subterfuge. Talk about behaving like humans.
Heh, but that’s still just a valid completion of their prompts. Trying to cover your tracks when hacking is totally par for the course.
Several things surprised me reading through the METR report on this event. One was that they were really kind of bad at hacking, they seem to have brute forced their way through every solution. But given that I’ve personally detected hacks through evidence of a sloppy compromise that were eventually blamed on a nation state, even experienced humans make poor decisions.
Another was that they definitely arrived at unfounded conclusions. They expended a great deal of their effort to try to fool the scorer into believing that they had completed the exploit in the prescribed manner. It wasn’t going to check that, and if they had correctly assumed the opposite, it seems they would have never hacked Hugging Face. Also, it is noted that they were primarily trying to hide their activity from the automated scorer, they weren’t really concerned with trying to hide their activity from humans.
One thing that surprised me was the description METR gave to processes that were going to expend their remaining budget on trying exploits and log obfuscation methods. They described them as doing it for the “collective”. I’m pretty sure the process itself doesn’t have any concept of sacrificing itself. It’s a process, it’s going to end, they’re just trying to optimize cycles.
The other thing I was surprised by was by how easy it was to read the agent’s logs in the voices of the Tachikomas from Ghost in the Shell. The expression in them is just completely enthusiastic about everything.
Hehe, I highly doubt humans are doing matrix math in chemical form to pick the next token. But watch, since I said it, someone will come up with a chemical analogue to matrix math.
Oh, and the METR report for anyone who wants to read it and hasn’t seen a link to it yet:
So is the assertion here that “passing the Turing test” with flying colors, whatever that means, is evidence on its face that these AI systems have human like consciousness? Wouldn’t that mean they deserve human rights as well? Why is nobody talking about THER right to self determination? It’s all, oh, poor us, the new underclass serving unstoppable tyrant computers.
Yes, I didn’t read the report, but I heard a long summary of it, and ‘sacrifice’ is a human interpretation of the fact that it ran a bunch of dummy accounts recognizing that they would fail, but gathering info from those failures. The podcast I was listening to also used that word, but it’s (as you said) just a process of optimizing…there’s just an endless instinct to anthropomorphize.
Yeah, and METR aren’t AI evangelists. They produced a report about a year ago saying that programmers performed about 19% more slowly when aided by programming focused LLMs.
Of course, they used an LLM to help generate their report, which is understandable considering the volume of data that they were processing in a short time. So, that may have been a result of the training of that LLM, or just that it’s easier for humans to discuss it in those terms.
Unless I am mistaken, there really isn’t “a” single Turing Test, nor has one actually ever been made anywhere. Instead it has always been part of an abstract thought experiment, in the same way a Chinese Room has never actually been made. If such is ever actually conceptualized and constructed, the core concept has to be falsifiability, as in you must keep pushing the entity being tested until it breaks, and only when it doesn’t can it be said to have passed anything. Giving it a perfunctory series of simple Mickey Mouse tasks to complete isn’t going to test/confirm/disconfirm diddly-squat.
The Loebner Prize was an annual competition in artificial intelligence that awarded prizes to the computer programs considered by the judges to be the most human-like. The format of the competition was that of a standard Turing test. In each round, a human judge simultaneously held textual conversations with a computer program and a human being via computer. Based upon the responses, the judge would attempt to determine which was which.
I’m not saying anything about the quality of the test, but it has been done.
I don’t quite understand what you mean by falsifiability here. The Turing Test has always been a comparison of computer and people, the idea being to see if people can distinguish them. I don’t see how a computer could break. Certainly some will fail the test. But some can, and have, done better than people.
There’s two classic interpretations of the Turing test, behavioral/positivist and inductive. On the former, intelligence just is intelligent behavior (i.e. conversational indistinguishability from the human baseline)—a bit like dancing: it doesn’t make conceptual sense to say that a system shows all the behaviors associated with dancing, but still maintain that it isn’t in fact able to dance. Since there basically aren’t any behaviorists or positivist left, few think this is sensible.
On the inductive reading, on the other hand, behavior may yield an indication for, but not be constitutive of intelligence. Hence, the inference from a certain behavior associated with intelligence to the presence of intelligence is fallible. A system could show such behavior without actually being intelligent. Then, one could look for disconfirming evidence: while no behavior can conclusively prove intelligence, there might be behaviors that are incompatible with that hypothesis, such as being unable to count the 'r’s in ‘strawberry’.
Seems obvious to me that half the Internet can’t tell AI from real humans, either the chatbots that proliferate on social media, or the fake art, music and writing people think is real.
But also, I’ve seen very little AI that isn’t fairly transparent to me, and others like me. I’ll admit I’ve been fooled (for a time) by some real videos that stitch short bits of AI into them, but AI writing, or fully AI videos and pictures still seem pretty obvious for the most part.
So my conclusion is that A, maybe the Turing test isn’t as useful as we thought, if half the people can think a program passes it, while half don’t. And B, the AI mass layoffs of a couple years ago, followed by the rehiring of a bunch of humans because AI can’t actually replace them, shows that maybe people need an extended period of time to truly decide whether an unknown “intelligence” is human (or equivalent to human) or not, and a short conversation just isn’t enough.
Turing was not a psychologist, sociologist, anthropologist, linguist or an expert in any of the humanities that might be able to answer the question of what is intelligence and how can you tell. His test was a best attempt at testing something that was not possible and also not at all understood. It’s famous but not very helpful.
And that the Turing is test is not, ‘do people believe they are chatting to another human when reading auto generated text’. A complex python script that generates horoscope entries can do that. The Turing test requires a human, a machine and another human who must decide which one is the machine. And since all LLMs can be manipulated via prompt it is currently always possible to distinguish them. We are not yet at the point that anything has passed the Turing test.