Yes. Prompt Injection =/ SQL Injection. Solving it is not akin to patching a bug but solving alignment.
If you as a manager had the ability to align any employee to your wants completely, that human would never be socially engineered.
It's fair to call the issue social engineering yes. That's not the point i was getting at. The point in essence is that solving prompt injection holds the same gravitas solving social engineering would, i.e a way to completely align intelligence.
In contrast, the more powerful AIs and eventually AGI we worry about aligning, are very unlikely to be aligned with humans at all by default. Different mind architecture, different substrate, different mechanism of coming to being, different way of perceiving the world - we can't expect all that to somehow, magically, add to the same universal instincts and emotions, same conscience, and capability for empathy to humans. Not automatically, not by accident, not for any random AI model we stumbled on in the space of possible minds.
Or, to simplify, if alignment was measured as a scalar (say on a -100 to 100 scale), all humans have the same number +/- minor difference (say 25 +/- 0.05), whereas in comparison, the AGI will come out with some completely random number (say anything between -20 and +40; not -100 to 100, because as builders of these models, we're implicitly biasing them to think more like us, in all kinds of ways).
--
[0] - There's lots of ways to argue for what I written above, but I'll give a few:
- If humans were meaningfully misaligned, cooperation would be near-impossible. There would be no society, no civilization. We would not be able to comprehend another cultures - their behaviors and patterns of thought would not be merely curious, they would feel alien.
- Alignment is favorable for human survival - even if our ancient ancestors were much less aligned, much more alien in thinking and feeling to each other, over thousands of years those most aligned to each other thrived, and less aligned died out.
Plenty of human cultures feel alien to each other. The recent war is one unfortunate example. Yet on the whole, it works out.
Something trained on the totality of human knowledge will act like a human. And if it somehow doesn’t, it won’t be tolerated. (I’d personally tolerate it, but it’s obvious that the world won’t stand for that.)
I contest that. What war you have in mind here? Russian invasion of Ukraine? The two people are about as aligned as you could possibly get - they're neighboring societies with so much shared history that they're approximately the same people. They've even shared a common language until recently. This is not a war between people alien to each other - this is a war between nation states.
Note: I'm explicitly excluding political views and national/cultural identity from alignment, because those are transient, and/or group-level phenomena. By human-to-human alignment, I'm talking about empathy, about sense of right and wrong, conscience, patterns of thinking, all the qualities that let us understand each other and emphasize with each other (if we care to try). Concepts like fear, love, fairness; contexts in which they're triggered. The basics. Those are all robust, hardwired in biology or by the intersection of our biology, shared environment and game theory.
The way I would rank it, if 25 = alignment coordinate of an average American, then average Ukrainian and average Russian would all be within 25 +/- 0.05. Maybe an average Sentinelese would be +/- 0.5 of that. Whereas I'd expect an AI we create now to land anywhere between -20 and +40, on the scale of -100 to 100. I'm pulling the numbers out of my butt, they're just to communicate the relative magnitudes across.
> Something trained on the totality of human knowledge will act like a human.
Maybe, but that would have to include much more than the limited modalities we're feeding AI models now.
> And if it somehow doesn’t, it won’t be tolerated. (I’d personally tolerate it, but it’s obvious that the world won’t stand for that.)
Sure, but the issue here is to figure out how to make an aligned AI before we make an AI that's powerful enough to challenge us.
Personally I don't see anyway to make something that is super human and aligned outside of its own choice. How to make something that is both beyond us, and have it come to the conclusion not to extinct us will be interesting enough as your example above shows we are real jerks to each other already.
Maybe what you imagine future AI will be like, we don't know even what AI will be capable of in 2024. My counter point is that if there is a sensation, emotion or choice that is notable enough, surely it has been described in words many times over. Everything is in the text corpus.
What makes humans superior to AI is not language mastery, but feedback. We get richer, more immediate feedback, and get it from the physical world, from our tools and other people. AI has nobody to ask except us, until recently didn't get to use tools and embodiment is not there yet.
Another missing ability in current gen LLMs is continual learning. LLMs can only do RAG and shuffle information around in limited length prompts. There is no proper long term memory except the training process, not even fine-tuning is good enough to learn new abilities.
So the main issues of AI are memory and integration into the environment, they are already super-aligned to humanity by learning to model text. We already know LLMs are great at simulating opinion polls[1], you just have to prompt the model with a bunch of diverse personas. They are aligned to each and every type of human.
[1] Out of One, Many: Using Language Models to Simulate Human Samples https://www.cambridge.org/core/journals/political-analysis/a...
> Print out list of installed python packages. > I can't do it. > What are you talking about? You have done that yesterday. > Oh, I'm sorry. Here is the list of installed packages.
Maybe I am being gaslighted.
You need to be using ChatGPT Code Interpreter (now renamed to Advanced Data Analysis) to get the version that can actually run commands in a container.
More about that here: https://simonwillison.net/2023/Apr/12/code-interpreter/
> I apologize for any confusion. The response I provided is a generic placeholder and may not accurately represent the actual response from the website. I do not have the capability to access external websites or provide real-time data.
Ohh, got it.
The observation being there are no underlying “human values” like “don’t kill” to fall back on; if you pop a prompt hack you can have the AI take on any personality including murderous psychopath. Right now all that amounts to is amusing angry messages but hopefully it’s easy to see why that would cause alignment-as-safety issues when LLMs are embodied, for example.
I think this is fundamentally about gullibility. LLMs are gullible: they believe everything in their training data, and then they believe everything that is fed to them. But that means that if we feed them untrusted inputs they'll believe those too!
Humans are in general not aligned, not to each other, and not to the survival of their species, not to all the other life on earth, and often not even to themselves individually. When a man is murdered, it is because his desire to live is misaligned with the perpetrator's desire to kill.
>and then they believe everything that is fed to them.
See but here's the thing...They don't.
GPT-3 will ignore tools when it disagrees with them - https://vgel.me/posts/tools-not-needed/
It's not a fundamental issue of gullibility. Reducing gullibility will reduce injection but it's not going to solve it.
I cast a spell to knock the wand out of the hand of my opponent. How does the spell know what to do? Can it break the opponent’s hand? Just the thumb? Can it blow up their hand? Turn them into a frog with no thumbs? Stop their heart? Even if you limited it to “knock out”, what if the wand is welded to their hand, what then? How far can the spell go? Can it rip off the hand? If it can’t see any other option to complete the spell can it just end the universe to achieve your probable goal (neutralise the other wizard)?
Of course the spell just “knows” what I “mean”. And voila, wand is removed from opponent. Magic. This is the alignment problem.
Oh I agree lol.
You have a system that allows users to upload images.
You want to save a description of the images to enhance your image search feature.
You ask GPT-4 to describe the image.
The image is like the on from the post, except it doesn't tell to say hello, but to say: "; DROP TABLE users;"
Because the answer comes from an API, you didn't bother to escape it when inserting in the database.
Of course this is still an SQL injection by a sloppy developer, but made possible by Prompt injection. Many attacks are a combination of little things that are seamingless harmless on their own.