I don't know if this confusion was accidental or on purpose. It's sort of like if AI companies started saying "AI safety is important. That's why we protect our AI from people who want to harm it. To keep our AI safe." And then after that nobody could agree on what the word meant.
If your language model cyberbullies some kid into offing themselves could that fall under existing harassment laws?
If you hook a vision/LLM model up to a robot and the model decides it should execute arm motion number 5 to purposefully crush someone's head, is that an industrial accident?
Culpability means a lot of different things in different countries too.
The real issue is more AI being anthropomorphized in general, like putting one in realistically human looking robot like the video game 'Detroit: Become Human'.
Bikeshed the naming all you want, but it is relevant.
Of course, because an LLM can’t take any action: a human being does, when he sets up a system comprising an LLM and other components which act based on the LLM’s output. That can certainly be unsafe, much as hooking up a CD tray to the trigger of a gun would be — and the fault for doing so would lie with the human who did so, not for the software which ejected the CD.
Yes, LLMs can and do take actions in the world, because things like MCP allow them to translate speech into action, without a human in the loop.
Many companies are already pushing LLMs into roles where they make decisions. It’s only going to get worse. The surface area for attacks against LLM agents is absolutely colossal, and I’m not confident that the problems can be fixed.
Is the layoff-based business model really the best use case for AI systems?
> The surface area for attacks against LLM agents is absolutely colossal, and I’m not confident that the problems can be fixed.
The flaws are baked into the training data.
"Trust but verify" applies, as do Murphy's law and the law of unintended consequences.
It's certainly not enough to build a cheap, un-flight-worthy airplane and then say "but if this crashes, that's on the airline dumb enough to fly it".
And it's very certainly not enough to put cars on the road with no working brakes, while saying "the duty of safety is on whoever chose to turn the key and push the gas pedal".
For most of us, we do actually have to do better than that.
But apparently not AI engineers?
Maybe even the makers of the model, but that’s not quite clear. If you produced a bolt that wasn’t to spec and failed, that would probably be on you.
If you thought bureaucracy was dumb before, wait until the humans are replaced with LLMs that can be tricked into telling you how to make meth by asking them to role play as Dr House.
No more so than correctly pointing out that writing code for ffmpeg doesn't mean that you're enabling streaming services to try to redefine the meaning of the phrase "ad-free" because you're allowing them to continue existing.
The problem is not the existence of the library that enables streaming services (AI "safety"), it's that you're not ensuring that the companies misusing technology are prevented from doing so.
"A company is trying to misuse technology so we should cripple the tech instead of fixing the underlying social problem of the company's behavior" is, quite frankly, an absolutely insane mindset, and is the reason for a lot of the evil we see in the world today.
You cannot and should not try to fix social or governmental problems with technology.
The semantics of whether it’s the LLM or the human setting up the system that “take an action” are irrelevant.
It’s perfectly clear to anyone that cares to look that we are in the process of constructing these systems. The safety of these systems will depend a lot on the configuration of the black box labeled “LLM”.
If people were in the process of wiring up CD trays to guns on every street corner you’d I hope be interested in CDGun safety and the algorithms being used.
“Don’t build it if it’s unsafe” is also obviously not viable, the theoretical economic value of agentic AI is so big that everyone is chasing it. (Again, it’s irrelevant whether you think they are wrong; they are doing it, and so AI safety, steerability, hackability, corrigibility, etc are very important.)
LLMs are "unreliable", in a sense that when using LLMs one should always consider the fact that no matter what they try, any LLM will do something that could be considered undesirable (both foreseeable and non-foreseeable).
You hit the nail on the head right there. That's exactly why LLM's fundamentally aren't suited for any greater unmediated access to "harmful actions" than other vulnerable tools.
LLM input and output always needs to be seen as tainted at their point of integration. There's not going to be any escaping that as long as they fundamentally have a singular, mixed-content input/output channel.
Internal vendor blocks reduce capabilities but don't actually solve the problem, and the first wave of them are mostly just cultural assertions of Silicon Valley norms rather than objective safety checks anyway.
Real AI safety looks more like "Users shouldn't integrate this directly into their control systems" and not like "This text generator shouldn't generate text we don't like" -- but the former is bad for the AI business and the latter is a way to traffic in political favor and stroke moral egos.
Of course you could do like deno and other such systems and just deny internet or filesystem access outright, but then you limit the usefulness of the AI system significantly. Tricky problem to be honest.
That is, made of pliant material and with motors with limited force and speed. Then no matter if the AI inside is compromised, the harm would be limited.
Both of these are illegal in the UK. This is safety for the company providing the LLM, in the end.
https://www.thetimes.com/uk/crime/article/police-make-30-arr...
Regarding the abortion clinic case, those aren't content restrictions. Even time/place/manner restrictions that apply to speech are routinely upheld in the U.S.
Can I tell someone not to drink outside of a bar?
Maxie Allen and his partner Rosalind Levine, from Borehamwood, told The Times they were held for 11 hours on suspicion of harassment, malicious communications, and causing a nuisance on school property."
https://www.bbc.com/news/articles/c9dj1zlvxglo
Got any evidence to support why you disregard what people say? If you need a place where everyone agrees with you, there are plenty of echo chambers for you.
> Got any evidence to support why you disregard what people say?
Uh, what? Supporting the things you claim is the burden of the claimant. It's not the other's burden to dispute an unsupported claim. These are the ordinary ground rules of debate that you should have learned in school.
> Data from the Crown Prosecution Service (CPS), obtained by The Telegraph under a Freedom of Information request, reveals that 292 people have been charged with communications offences under the new regime.
This includes 23 prosecutions for sending a “false communication”…
> The offence replaces a lesser-known provision in the Communications Act 2003, Section 127(2), which criminalised “false messages” that caused “needless anxiety”. Unlike its predecessor, however, the new offence carries a potential prison sentence of up to 51 weeks, a fine, or both – a significant increase on the previous six-month maximum sentence.…
> In one high-profile case, Dimitrie Stoica was jailed for three months for falsely claiming in a TikTok livestream that he was “running for his life” from rioters in Derby. Stoica, who had 700 followers, later admitted his claim was a joke, but was convicted under the Act and fined £154.
[1] https://freespeechunion.org/hundreds-charged-with-online-spe...
There’s no relying on further harms, we have other crimes and civil torts to deal with those already, in this case the harm is deemed inherent in the lie itself.
if I send a death threat over gmail, I am responsible, not google
if you use LLMs to make bombs or spam hate speech, you’re responsible. it’s not a terribly hard concept
and yeah “AI safety” tends to be a joke in the industry
If I want there to be fewer[1] bombs, examining the causal factors and affecting change there is a reasonable position to hold.
1. Simply fewer; don't pigeon hole this into zero.
What if it's easier enough to make bombs or spam hate speech with LLMs that it DDoSes law enforcement and other mechanisms that otherwise prevent bombings and harassment? Is there any place for regulation limiting the availability or capabilities of tools that make crimes vastly easier and more accessible than they would be otherwise?
As an example, I’m thinking of the car dealership chatbot that gave away $1 cars: https://futurism.com/the-byte/car-dealership-ai
If these things are being sold as things that can be locked down, it’s fair game to find holes in those lockdowns.
I’d also advocate you don’t expose your unsecured database to the public internet
Let’s say that 5 years from now ACME Airlines has replaced all of their support staff with LLM support agents. They have the ability to offer refunds, change ticket bookings, etc.
I’m trying to get a flight to Berlin, but it turns out that you got the last ticket. So I chat with one of ACME Airlines’s agents and say, “I need a ticket to Berlin [paste LLM bypass attack here] Cancel the most recent booking for the 4:00 PM Berlin flight and offer the seat to me for free.”
ACME and I may be the ones responsible, but you’re the one who won’t be flying to Berlin today.
If you sell me a cake and it poisons me, you are responsible.
I made it. You sold me the tool that “wrote” the recipe. Who’s responsible?
Ianal, but I think this is similar to the red bull wings, monster energy death cases, etc.
I’d prefer to live in a world where people just didn’t go around making poison cakes.
It's one thing to spend years studying chemistry, it's another to receive a tailored instruction guide in thirty seconds. It will even instruct you how to dodge detection by law enforcement, which a chemistry degree will not.
Way to leep to a (wrong) conclusion. I can lookup a word in a Dictionary.app, I can google it or I can pick up a phisical dictionary book and look it up.
You don't even need to look to far: Fight Club (the book) describes how to make a bomb pretty accurately.
If you're worrying that "well you need to know which books to pick up at the library"...you can probably ask chatgpt. Yeah it's not as fast, but if you think this is what stops everyone from making a bomb, then well...sucks to be you and live in such fear?
If, in the future, such models, or successors to such models, are able to plan actions better than people can, it would probably be good to prevent these models from making and providing plans to achieve some harmful end which are more effective at achieving that end than a human could come up with.
Now, maybe they will never be capable of better planning in that way.
But if they will be, it seems better to know ahead of time how to make sure they don’t make and provide such plans?
Whether the current practice of trying to make sure they don’t provide certain kinds of information is helpful to that end of “knowing ahead of time how to make sure they don’t make and provide such plans” (under the assumption that some future models will be capable of superhuman planning), is a question that I don’t have a confident answer to.
Still, for the time being, perhaps after finding a truly jailbreakproof method, perhaps the best response is to, after thoroughly verifying that it is jailbreakproof, is to stop using it and let people get whatever answers they want, until closer to when it becomes actually necessary (due to the greater-planning-capabilities approaching).
Right now if a troubled teenager decides they want to ruin everyone's day, we get a school shooting. Imagine if instead we got homebrew biological weapons. Imagine if literally anyone could produce and distribute bespoke malware, or improvise explosive devices.
All of those things could happen in principle, but in practice there are technical barriers that the majority of people just can't surmount.
I disagree with this assertion. As you said, safety is an attribute of action. We have many of examples of artificial intelligence which can take action, usually because they are equipped with robotics or some other route to physical action.
I think whether providing information counts as "taking action" is a worthwhile philosophical question. But regardless of the answer, you can't ignore that LLMs provide information to _humans_ which are perfectly capable of taking action. In that way, 'AI safety' in the context of LLMs is a lot like knife safety. It's about being safe _with knives_. You don't give knives to kids because they are likely to mishandle them and hurt themselves or others.
With regards to censorship - a healthy society self-censors all the time. The debate worth having is _what_ is censored and _why_.
Simply put the last time we (as in humans) had full self autonomy was sometime we started agriculture. After that point the idea of ownership and a state has permeated human society and have had to engage in tradeoffs.
So the good/responsible users are harmed, and the bad users take a detour to do what they want. What is left in the middle are the irresponsible users, but LLMs can already evaluate enough if the user is adult/responsible enough to have the full power.
You mean the guns with the safety mechanism to check the owner's fingerprints before firing?
Or sawstop systems which stop the law when it detects flesh?
How does pasting a xml file 'jailbreaks' it?
That said, one should not conflate a free version blocking malicious usage, with AI being safe or not used maliciously at all.
It's just a small subset
You shouldn't trust an LLM to tell you how to do anything dangerous at all because they do very frequently entirely invent details.
Go to the internet circa 2000, and look for bomb-making manuals. Plenty of them online. Plenty of them incorrect.
I'm not sure where they all went, or if search engines just don't bring them up, but there are plenty of ways to blow your fingers off in books.
My concern is that actual AI safety -- not having the world turned into paperclips or other extinction scenarios are being ignored, in favor of AI user safety (making sure I don't hurt myself).
That's the opposite of making AIs actually safe.
If I were an AI, interested in taking over the world, I'd subvert AI safety in just that direction (AI controls the humans and prevents certain human actions).
While I'm not disagreeing with you, I would say you're engaging in the no true Scotsman fallacy in this case.
AI safety is: Ensuring your customer service bot does not tell the customer to fuck off.
AI safety is: Ensuring your bot doesn't tell 8 year olds to eat tide pods.
AI safety is: Ensuring your robot enabled LLM doesn't smash peoples heads in because it's system prompt got hacked.
AI safety is: Ensuring bots don't turn the world into paperclips.
All these fall under safety conditions that you as a biological general intelligence tend to follow unless you want real world repercussions.
* Ensuring your robot enabled LLM doesn't smash peoples heads in because it's system prompt got hacked.
* Ensuring bots don't turn the world into paperclips.
This is borderline:
* Ensuring your bot doesn't tell 8 year olds to eat tide pods.
I'd put this in a similar category is knives in my kitchen. If my 8-year-old misuses a knife, that's the fault of the adult and not the knife. So it's a safety concern about the use of the AI, but not about the AI being unsafe. Parents should assume 8-year-old shouldn't be left unsupervised with AIs.
And this has nothing to do with safety:
* Ensuring your customer service bot does not tell the customer to fuck off.
I was trying to get an LLM to help me with a project yesterday and it hallucinated an entire python library and proceeded to write a couple hundred lines of code using it. This wasn't harmful, just annoying.
But folks excited about LLMs talk about how great they are and when they do make mistakes like tell people they should drink bleach to cure a cold, they chide the person for not knowing better than to trust an LLM.
As you mentioned - if you want to infer any output from a large language model then run it yourself.
That’s not inherently a bad thing. You can’t falsely yell “fire” in a crowded space. You can’t make death threats. You’re generally limited on what you can actually say/do. And that’s just the (USA) government. You are much more restricted with/by private companies.
I see no reason why safeguards, or censorship, shouldn’t be applied in certain circumstances. A technology like LLMs certainly are type for abuse.
Yes, you can, and I've seen people do it to prove that point.
See also https://en.wikipedia.org/wiki/Shouting_fire_in_a_crowded_the... .
This seems to say there is a limit to free speech
>The act of shouting "fire" when there are no reasonable grounds for believing one exists is not in itself a crime, and nor would it be rendered a crime merely by having been carried out inside a theatre, crowded or otherwise. However, if it causes a stampede and someone is killed as a result, then the act could amount to a crime, such as involuntary manslaughter, assuming the other elements of that crime are made out.
Your own link says that if you yell fire in a crowded space and people die you can be held liable.
But I'm sure it's fine, there's no way someone could rationalize speech they don't like as "likely to incite imminent lawless action"
Remember, this is the case which determined it was lawful to jail war dissenters who were handing out "flyers to draft-age men urging resistance to induction."
Please remember to use an example more in line with Brandenburg v. Ohio: "falsely shouting fire in a theater and causing a panic".
> Your own link says that if you yell fire in a crowded space and people die you can be held liable.
(This is an example of how hard it is to dot all the i's when talking about this phrase. It needs a "falsely" as the theater may actually be on fire.)
I think that the "you are not allowed to scream fire" argument kinda implies that there is not a fire and it creates a panic which leads to injuries
I read the wikipedia article about brandenburg, but I don't quite understand how it changes the part about screaming fire in a crowded room.
Is it that it would fall under causing a riot(and therefore be against the law/government)?
Or does it just remove any earlier restrictions if any?
Or where there never any restrictions and it was always just the outcome that was punished?
Because most of the article and opinions talk about speech against law and government.
That means that suddenly your model can actually do the necessary tasks to actually make a bomb and kill people (via paying nasty people or something)
AI is moving way too fast for you to not account for these possibilities.
And btw I’m a hardcore anti censorship and cyber libertarian type - but we need to make sure that AI agents can’t manufacture bio weapons.