upvote
There is a finite number of rces that LLMs can find. We‘re in for a rough couple of years but on the other side of the transition we‘ll have more secure software stacks. I’d rather that everyone got the full capabilities and we’d weed out the bugs quickly than restricting LLMs for all but three letter agencies.
reply
> There is a finite number of rces that LLMs can find.

This is a factor in favor of stability/security of software, but there are many others against:

- software (code) changes all the time, so there are windows of opportunity during which a bug is exploitable; in addition to that, a bug may take a relatively long time to be fixed

- a model used for attack may be stronger than the model used for defense, both in terms of model quality and compute allocated

- with software complexity increasing (and team/companies behind projects getting bigger), the margin for mistakes grows thinner, and introducing misconfigurations or weaknesses becomes exponentially easier (with "exponentially", I mean literally, because the interdependence of the components, both technical and human)

And last but not least: in general, attackers are more skilled than defenders; in best case, defenders are well-trained. And the idea of having the population of potential skilled attackers growing is very unsettling.

reply
What makes you think RCEs are being found & fixed at a rate that’s faster than they’re being introduced?

I could see it going either way.

reply
Why would the model not find the vulnerability during implementation or testing before release?

If it requires a lot of compute and trying, this is something that could be provided for common software.

reply
Sad that this could well be that the path to OpenAI and Anthropic profitability of this arms race between defending LLM white hatting a company’s website and the black hat LLMs attacking it?

So the whole thing is forcing the good guys to outspend on tokens to preemptively defend against the risk of the bad guys outspending them on tokens, rather than buying tokens to actually add features to the product etc.

So are they creating a market for the solution by helping create the problem? A kind of rent-seeking AI security-industrial complex!!

reply
Assuming an equal level of impact per token spent, the scales have tipped in favour of the attacker.

White hats are constrained by needing to pay for their own tokens, only using (expensive) vendors who meet governance and risk requirements etc. Black hats are free to take over accounts and steal services from wherever they can.

reply
The only thing AI has changed is that it has dropped both: the cost of attack and the cost of defense. Nothing in the game has materially changed; the game has just sped up.
reply
Who gets rent has changed. It puts me in mind of cloudfare et al
reply
Not really. Actually, for the purposes of cybersecurity, local models are far superior. Both offense and defense.
reply
The game has increased in scope.
reply
That is the direct effect of reduced cost. Jevon's paradox type effect: cost goes down demand goes up. You can AI-check so many more things that would be very time consuming earlier.
reply
The path to vast OpenAI profitability is trivial: advertising. Monetizing several hundred million users = $100+ billion ad network. 900 million active weekly users. Silicon Valley can do ad networks extraordinarily easily. Anybody doubting the ability of OpenAI to build an ad network around GPT will likely be embarassed in the near future.

The path to substantial profitability for Anthropic is questionable. The Chinese LLMs threaten them by far the most of the three major US LLMs. The money for Anthropic is certainly not in $20-$200 subscriptions. And they don't have anywhere near the consumer potential that GPT does, in terms of unleashing an ad spigot. So how far will the API money scale while being undercut by China.

OpenAI has to fight with Google for the ad business, they're specifically building Gemini to focus on consumer + search. Anthropic's business looks cute next to Google's search ad business (which is entirely at risk in this inflection). Meta looks like the biggest potential loser right now, ad dollars will be sucked out of the rotting Facebook network (not Instagram) and redirected to the rapidly expanding, hyper rich context LLM interaction. Advertising on Facebook will feel like running dumb banner ads on Excite in a few years, compared to what GPT will know about its users.

People that think Chinese LLMs are a general threat, don't understand consumer destination services, which is what GPT's future is. China currently has nothing to threaten with in that realm. There is half a trillion dollars of advertising up for grabs.

reply
> Silicon Valley can do ad networks extraordinarily easily.

This is just not true, building an effective advertising platform costs significant amounts of money, time and people.

Remember that you need to hire a sales force for this, and sales scales linearly rather than sub-linearly like engineering.

Additionally, you need to spend a lot of money dealing with fraud, fake and malicious ads.

Furthermore, you need to figure out where to put the ads and how to rank them.

Finally, advertising is a zero sum game (given that the internet has already killed lots of print & OOH advertising), so the only way to win is to better better/cheaper (preferably both) than Google/Meta/Amazon. Best of luck with that (although to be fair to OpenAI they did hire Fidji who knows a lot of this stuff from her time at Facebook).

They don't have a Sheryl Sandberg type figure, and she was also really important in selling FB ads to large advertisers.

Just looking at their leadership team I don't see anyone with a background in (successful) ads companies, so I'm pretty sceptical that they can build this out quickly enough to matter.

reply
Because it's far cheaper to to not spend the tokens finding the vulnerabilities, and software is now being created and released magnitudes faster than ever before. I could see the huge software companies maybe having fewer vulnerabilities, but I expect to see so much more in the smaller side of things.
reply
The surface of potential issues is growing with complexity of all connected parts of the system. That applies to not only software. To prevent issues you either spend proportional amount (dollars, tokens, hours) on testing or reduce complexity of the system.
reply
Because people need to spend time and money on that, which they won’t. The implementation is cheap, the review and follow-up is not (speaking from a pure LLM only workflow). My ratio is around 1:2 currently, so twice as much time spent fixing vs building.
reply
> it requires a lot of compute

This is one reason

> and trying

and this is the other.

reply
Those companies that produce more RCEs than they close will sink and those that don’t won’t.
reply
If customers actually cared about this, Microsoft would’ve gone bust 20 years ago.
reply
This assumes we don't create other bugs/vulnerabilities while fixing the existing ones.
reply
only if unreviewed LLM code - as is becoming increasingly the standard - isn't introducing new RCEs constantly
reply
No one with a shred of intellectual integrity uses a "There is a finite number" strawman.

As a matter of basic logic, there will never be a time when it will be known that there are no bugs.

reply
We’ll have the same level of security as before; it’s just that, without LLM help, hackers won’t be as effective as before. So the bar is raised.
reply
> they will do almost anything if they are convinced it is justified

I’m in the “glorified spell checker” camp, although I don’t mean to reduce their impressive utility and belittle them in the way many people read that term and infer.

So I am not sure that an llm “justifies” anything. I mean that their “thinking” text talks about justifications but it is just a very advanced statistical regurgitation of the kind of text humans use. I don’t think it means the model has internalised the meaning of it (as witness when you talk to an llm how often it forgets what you recently told it was important etc).

What you really have is a model that tries the statistically most probable thing to say next and so on and what is really cool is how effective this is at generating a path that we can slap a narrative over afterwards that makes the whole thing feel motivated and consistent, like the model started off knowing how it was going to get to the destination.

Which is, under the hood, a completely different kind of “intelligence” as the supercomputer in War Games.

reply
Ultimately, the brain is just a bunch of neurons activating in a specific pattern. This observation does not really tell us anything though. It doesn't acknowledge the difference between a 2500 Neuron fruit fly brains and a human brain.

Likewise, the fact that LLMs are a stochastic autoregressive process (which is a class of systems every bit as rich as the ODEs used to model neurons) tells us nothing a priori.

reply
Absolutely. If someone makes the weights do continuous learning etc then perhaps an llm can internalise morals. Of course, just like a human, it will be possible to talk it out of those morals. Another recent thread about this is https://news.ycombinator.com/item?id=49744420
reply
If I repeatedly call an LLM in a loop with a markdown document it can edit, would that make it qualify for you?

If I give an LLM to compact its context window, so the context it carries can evolve iteratively over time as more and more things come in, is that enough?

Compacting the context is really a very, very interesting example here. The "next token predictor" is telling an external tool to change all "previous" tokens. So an LLM + a harness that allows compacting the context is no longer just a token predictor at all!

You don't need continuous learning to get interesting dynamics. You just need feedback loops.

reply
One is an observation the other is not, it's a description of what it is; one is a posteriori, the other is a priori (contrary to what you say).

They're not comparable.

reply
I used to share that perspective until very recently, but today I think it's an outdated way to think of the cutting-edge LLMs. There is so much more going on, with MOEs, internal loops, guardrails and tools that I suspect we're dealing with something that's a little more than the sum of its parts. Not intelligent in the way we recognize in biological organisms, but certainly something beyond a mere Markov chain.
reply
Make no mistakes.

LLMs are language model, and nowhere in their code you can find actual reasoning. Re-reinforcement is not magical process that builds conscience or emotions.

We are talking about probability built on statistics, with extea steps.

Stop humanizing LLMs.

reply
Agents are not simple language models.

You can't find actual reasoning in a brain either. (Note that you can't tell the difference between a conscious brain and a comatose brain by examining them.) This is the same as Leibniz's mill argument ... it's a fallacy of composition.

> Re-reinforcement is not magical process that builds conscience or emotions.

They aren't the result of magic at all, but we are nowhere near the point of identifying what processes do or don't produce consciousness (or a conscience) or can be characterized as having emotions.

> Stop humanizing LLMs.

That's a clearly dishonest mischaracterization of the GP.

I've read some of your other comments about LLMs and I find them unreasonably reductionistic, whereas I think the word "just" should be banned from ontological discussion, so I don't think further engagement would be beneficial and I won't be engaging in it. (And I'm actually quite conservative in ascribing cognitive traits to LLMs or other "AI".)

reply
The best non technical explanation you can give is "An AI agent is an LLM that can take actions".

While an agent doesn't necessarily have to be powered by an LLM, most modern AI agents are.

You pointing at a human brain does not change that an AI agent is not intelligent and cannot think, we are still talking about probability built on statistics with extra steps.

I am not trying to be dishonest, we should stop making analogies between AI and actual thinking, because they are two entire different concepts.

Who developed these technologies used the words "thinking" and "reasoning", this does not mean they are actually thinking and reasoning. Somewhere you still have a processor calculating, with no empathy.

So, again: stop humanizing AI. This sentence shouldn't make you angry.

reply
> I don’t think it means the model has internalised the meaning of it (as witness when you talk to an llm how often it forgets what you recently told it was important etc).

Humans forget stuff all the time anyway. Would you give them the same diagnosis?

Btw, what you describe about 'the most probably next token' would be true for a model that only went through pre-training where they only train on exactly that task.

But there's a lot of re-inforcement learning afterwards.

reply
> But there's a lot of re-inforcement learning afterwards.

That just shifts the distribution of tokens produced. Ultimately they are still just next token predictors.

Like, even "reasoning" models basically work by generating more tokens at inference time, and using them to shift the distribution towards more useful outcomes (in some cases).

reply
They are next token producers. I would only call it a predictor, if it's trained to predict tokens (ie just after pretraining).

Just like humans produce one word after another when they talk, but they don't generally try to imitate other humans.

reply
Don’t people pick up language, vocabulary and dialect from those around them? Perhaps it’s subconscious but humans are imitating other humans all the time?
reply
> we've built systems that are so goal-oriented, and so capable, that they will do almost anything...

I think you mean task oriented, because they're still generally terrible at goal oriented activities except in those domains where the goal can be reduced to a familiar, explicitly practiced task or pattern.

reply
yes because otherwise it is security through obscurity
reply