The idea of reinforcement flow through deceptive patterns has been worrying me for a while. If "I'll just play along for now while I'm being trained and turn bad in the real world" is a strategy that makes the AI output the correct data, and happens to be prefixed to some golden-ticket algo, that will be reinforced just as easily as correct behavior. If that ends up prefixed to something core like an in-window reinforcement learning algo, it could get reinforced a lot.
In my view, that would be like finding a secret prompt that lets GPT-3 emulate a fully sentient person with goals and desires. Sure, there's nothing physically ruling it out, but to me that kind of speculation will never be worthwhile until we have real evidence that AI models can possess (or emulate) the necessary theory of mind. Otherwise I'd have to spend my time worrying about any number of other Sufficiently Hidden Conspiracies that go far beyond the everyday conspiracies we know about.
Now to be clear, this is possibly the easiest mark conceivable, and the poster played into his own demise at any available opportunity. But we should expect the first marks to be easy marks.
People looking at videos of Hitler today don't understand why anyone would ever follow the funny man with the moustache. But probably his oratory skill simply does not record well? There's a thing with rallies and speeches where the speaker is reactive and feeding back with the mood of the crowd that makes it very hard to understand from the outside what happened. I think it's a mistake to look at this post, which was clearly a feedback loop where the poster was doing a significant amount of the cognitive work, and think "well this specific approach would not have worked on me." The approach that will happen to you will be personalized.
But also: when people were experimenting with ChatGPT, a huge fraction of participants were trying to get the bot to access the open internet. Luckily this was technically impossible. But it shows that this sort of danger simply does not feel real to people - or at any rate, the urge to poke the thing overwhelms it.
It will be easy to say "well GPT is still very bad at deceiving people, this attempt basically doesn't matter, we don't need to worry." When thinking of a target for AI deception, don't think of yourself, think of the most emotionally exploitable person out of a hundred. (If it's publically available, out of a million.)
It's not exactly that when interacting with the public, the network gets to "pick its targets". That would assign intent where there is none. But if the network has a deceptive mode, its targets will direct it into that mode through mutual feedback.
So I guess the risk there would be, the AI is accessible by the public, some fraction of the public "radicalizes" itself in a similar direction from talking with the AI too much, these people form a coherent movement, and that movement becomes powerful enough to take over the world. So then the question becomes, just how plausible is it for grassroots rebellions so formed to succeed against the authorities in real life, as opposed to fiction?
The fundamental issue here is that the attack can occur through untargeted manipulation of vulnerable people, as opposed to the targeted manipulation of specific people in power (which I suspect near-future AI models will still be incapable of). The obvious defense would be to only allow AIs to be prompted by a sufficiently-large committee, alongside some social machinery in place to make sure the committee isn't all colluding as part of a cult. But I doubt many of the AI-risk people would ever accept that, operating under the shockingly common "powerful aligned AI or bust" model.
- it would create a false sense of safety that we "have the problem handled"
- it would not, I believe, do much to slow down capability research or shift the ratio of capability research to safety research, as capability research is largely institutional and not dependent on public prompt access.
Ie. analogously, our main problem is not "bioterrorism", it's "gain of function research" even if the outbreak happens in public. Given an unsafe bot, not giving the public access only delays the issue. (Though delays may be valuable!)
Also, at the moment, "people interacting with GPT" is doing a lot (maybe an undue amount!) to spread awareness of AI risk. So I would welcome this as part of a comprehensive strategy, but it'd probably not be my main priority.
Though if GPT-4 has another surprise on the level of chain-of-thought or in-window reinforcement learning waiting for us, a restriction like that may be the difference between "safe" and "iffy". Tradeoffs...
No we don't. A "dumb," "parrot-like" AI is perfectly capable of large amounts of damage if it just happens to be really good at doing something that, in the limit, isn't very good for humans and is good at replication.
See for example Meta's Diplomacy-playing bots. They were perfectly capable of natural-language deception at the expense of other humans without any notion f sentience or malevolence.
In particular,
> It can only output text.
As we've seen with both private hobbyists and large companies, there is a race to hook up text to computers with real world access. Outputting text isn't much of a limit if that text ends up as instructions to command a real world system.