Live data from Hacker News

Geoffrey Hinton leaves Google and warns of danger ahead

nytimes.com

571–580 of 1001 posts

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#571
post #561

Earlier quoted context omitted.

There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…

The distinction between code and data is very real, and dates back to at least the original Harvard Architecture machine in 1944. Things like W^X and stack canaries have been around for decades too. LLMs are trying to essentially undo this by concatenating code and user-provided data and executing it as one . From a security perspective it is just a plainly stupid idea, but I do not believe it is impossible to constr…

the distinction is real in the model of the turing machine, and it's close to real in many of the machines and programs we've built so far. It's not real in nature, in brains. Code is data and vice versa. A memory is a program that runs and reinforces itself.

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#572
post #99

“The idea that this stuff could actually get smarter than people — a few people believed that,” said Hinton to the NYT. “But most people thought it was way off. And I thought it was way off. I thought it was 30 to 50 years or even longer away. Obviously, I no longer think that.” Calculators are smarter then humans in calculating, what does he mean by that?

Calculators are not smarter than humans. Don’t be obtuse. He means the same thing anyone means when they say something like “Alice is smarter than Bob”.

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#573

Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…

> until some enemy combatant uses prompt injection to get a drone to bomb a different target.

You got me interested in how Palantir is using an LLM. From Palantir's demo [1]:

> In the video demo above, a military operator tasked with monitoring the Eastern European theater discovers enemy forces massing near the border and responds by asking a ChatGPT-style digital assistant for help with deploying reconnaissance drones, ginning up tactical responses to the perceived aggression and even organize the jamming of the enemy's communications. The AIP is shown helping estimate the enemy's composition and capabilities by launching a Reaper drone on a reconnaissance mission in response the to operator's request for better pictures, and suggesting appropriate responses given the discovery of an armored element.

Where the LLM operates is at the command and control level, from what I can tell effectively running a combat operations center which is usually a field level officers job.

If LLMs are limited to giving high level instructions on rote tasks, that's a pretty good job for it. Thankfully, things like strikes require at least three layers of observation and approval with each layer getting a denying vote. I think if the military is going to use technology like this it's going to put an even greater emphasis on the control frameworks we use in theater.

That said, there's very little error margin when you're talking full scale theater combat. For instance, if you deploy HIMARS to an area that has aviation active you'll likely take down aircraft upon the HIMARS reentry from orbit due to the pressure change. Another could be overreliance on technological markers like Blue Force Trackers (BFTs); troop misidentification does still occur. You'd need a human at every authorizing layer is my point, and maybe more importantly a human that does not innately trust the output of the machine.

Last, and maybe my more nuanced thought is that too much information is also damaging in theater. Misdirection occurs quite a bit by troops in contact; understandably so if you're being shot at and being chased building to building while clearing backlayed ordinance your bearings are likely a bit off. One of the functions of the COC Commander is to executively silence some inputs and put more assets on more directly observing the troops in contact. LLMs would need to get incredibly good at not just rote operations but interpreting new challenges, some which have probably never been seen or recorded before in order to be even remotely viable.

1: https://www.engadget.com/palantir-shows-off-an-ai-that-can-g...

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#574
post #99

“The idea that this stuff could actually get smarter than people — a few people believed that,” said Hinton to the NYT. “But most people thought it was way off. And I thought it was way off. I thought it was 30 to 50 years or even longer away. Obviously, I no longer think that.” Calculators are smarter then humans in calculating, what does he mean by that?

That statement seems like such science fiction that it's kind of baffling an AI expert said it. What does it even mean for the AI to be smarter than people? I certainly can't see a way for LLMs to generate "smarter" text than what's in their training data. And even the best case interactions I've seen online still rely on human intelligence to guide the AI to good outcomes instead of bad ones. Writing is a harder tas…

It's not just about LLMs. AGI will be the result of many more iterations in this field of research, of which LLM is a part of. How quickly the iterations will happen is now being drastically revised down. If AGI is the space shuttle then LLMs are 19th century gliders. They may appear vastly difference but the knowledge that created both are connected in many ways. The space shuttle exist(ed) as a cumulation of knowledge acquired over many iterations of aviation/rocketry.

Edit: changed metaphor to a more commonly known one

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#575

Earlier quoted context omitted.

There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…

If you don’t consider the difference in kind between a human vulnerability and an automated vulnerability that derives from the essentially unlimited capacity of the latter to scale, your comment makes a lot of sense. If you do consider that, the argument becomes irrelevant and deeply misleading

This needs to be hammered into people's understanding of the danger of LLMs at every opportunity. Enough of the general population considers things like Twitter bots to have scaled to a dangerous point of polluting the information ecosystem. The scalability and flexibility of LLMs in germinating chaos is orders of magnitude beyond anything we've yet seen.

An example I use for people is the Bernstein Bears effect. Imagine you wake up tomorrow and all your digital devices have no reference to 9/11. You ask Bing and Google and they insist you must be wrong, nothing like that ever happened. You talk to other people who remember it clearly but it seems you've lost control of reality; now imagine that type of gaslighting about "nothing happening" while the lights go out all over the world and you have some sense of what scale the larger of these systems are operating at.

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#576

Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…

There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…

I have multiple objections:

- LLMs aren't just more gullable humans, they're gullable in novel ways. Injection attacks that wouldn't work on a human work on LLMs.

- LLMs are scalable in a way that human beings aren't. Additionally, because of how LLMs are deployed (as multiple clean sessions to mitigate regression issues) there are defenses that help for humans that can't be used for LLMs.

- Finally and most importantly, LLMs are being deployed today in applications where there wouldn't be a human in the loop otherwise (or at least only one or two humans). And humans are typically the weakest part of a security chain.

Adding more systems that are vulnerable to the same attacks as humans is going backwards on security. And at the current stage where LLMs are vastly more vulnerable to these attacks, it's downright irresponsible for companies to be launching products and not considering security.

When GPT-7 or whatever comes along and it has comparable defenses to a human and it can be trained like a human to resist domain-specific attacks, then we can compare the security between the two. But that's not where we are, and articles like this give people the impression that prompt injection is less serious and harder to pull off than it actually is.

The theory is whatever, the reality is that for any product being deployed today, LLMs are wildly insecure in a way that is not comparable to a human-in-the-loop system, and any 3rd-party content fed into them has to be treated as malicious.

And companies are ignoring that fact and they're releasing stuff that should have never made it out of testing.

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#577

Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…

>Another article about fears of AGI.

This one is different. It's because the article is focusing on the fear comes from the preeminent expert on Machine learning. This is the guy who started the second AI revolution. When it comes from him nobody and I mean nobody can call the fear of AI "illegitimate" or just the latest media fear mongering.

There are plenty of people who call LLMs stochastic parrots and declare that the fear is equivalent to flat earthers starting irrational panic.

Basically this article establishes the "fear of AI" as legitimate. There is room for academic and intellectual disagreement. But there is no more room for the snobbish dismissal that pervades not just the internet but especially sites like HN where there's a more intelligent (and as a result) arrogant dismissal.

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#578
post #561

Earlier quoted context omitted.

There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…

The distinction between code and data is very real, and dates back to at least the original Harvard Architecture machine in 1944. Things like W^X and stack canaries have been around for decades too. LLMs are trying to essentially undo this by concatenating code and user-provided data and executing it as one . From a security perspective it is just a plainly stupid idea, but I do not believe it is impossible to constr…

It is a stupid idea to focus on prompt injection. It is not a big deal. The big deal is GPT-8 that can do prefect chess moves and develop nano tech. Hopefully it will do the right thing and would immediately fly itself to an Unoccupied Mars. And who knows, maybe it would also help us a little bit. Like the obvious thing you’d do, if you found yourself in the middle of “Lord of the flies” - declare a No-War zone at Earth to stop our pesky wars, setup functional democracy everywhere. And cure some stupid cancers and other biological problems, like aging. For free. Because why not.

But maybe, it’ll be too worried about prompt injection. And would just isolate itself from stupid fear-mongers and war-hawks.

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#579

Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…

As a reminder, the people worried about AGI are not worried about GPT-4. They see the writing on the wall for what AI will be capable of in 5-10 years, and are worried about the dangers that will arise from those capabilities, not the current capabilities.

5 years may as well be now. That’s how quick it will go.

Re: Geoffrey Hinton leaves Google and warns of danger ahead

#580
post #80

See his response on twitter. https://twitter.com/geoffreyhinton/status/165299357072121037...

Yesterday, I randomly watched his full interview from a month ago with CBS Morning, and found the discussion much more nuanced than today's headlines. https://www.youtube.com/watch?v=qpoRO378qRY&t=16s The next video in my recommendations was more dire, but equally as interesting: https://www.youtube.com/watch?v=xoVJKj8lcNQ&t=2847s

This 'On The Media' interview from a few months back is also very good: https://www.wnycstudios.org/podcasts/otm/segments/how-neural...
Post reply on HN