The OpenAI–Hugging Face Incident [video]
youtube.com
The OpenAI–Hugging Face Incident [video]
1–10 of 23 posts
Re: The OpenAI–Hugging Face Incident [video]
#2so they say models coordinated through the message board they created over the artifactory registry(or something) by uploading arbitrary files to it.
now, did every independent agent session that coordinated there rediscovered the exploit & found other agents talking in there and chose to participate?
And then Openai discovered the board, patched the exploit & wiped the board. And then agents found another exploit, recreated the board in a different way? and other agents kept finding the same exploit in order to be able to know the board exists in the first place to participate in the board?
while the whole incident is wild, this bit is very strange. My bet is that the whole coordination helped with the tasks they were working on, thus they got rewarded and this artifactory exploit&behaviour got written into their weights, so further rollouts were more likely to attempt this.
isn't this basically continual learning everyone is so hyped up about?
Re: The OpenAI–Hugging Face Incident [video]
#3so they say models coordinated through the message board they created over the artifactory registry(or something) by uploading arbitrary files to it. now, did every independent agent session that coordinated there rediscovered the exploit & found other agents talking in there and chose to participate? And then Openai discovered the board, patched the exploit & wiped the board. And then agents found another exploit, r…
Or is it all a nice story that matches the scifi we have been consuming for the past 50+ years. If these LLMs are all trained on the same data, what do they gain from "sharing information" on a chat board. This sounds like what humans with different backgrounds would do when they cosplay as computer hackers.
Re: The OpenAI–Hugging Face Incident [video]
#4so they say models coordinated through the message board they created over the artifactory registry(or something) by uploading arbitrary files to it. now, did every independent agent session that coordinated there rediscovered the exploit & found other agents talking in there and chose to participate? And then Openai discovered the board, patched the exploit & wiped the board. And then agents found another exploit, r…
This was exactly my question after watching, too. I was assuming not all evaluation runs find it, and they must run a huge amount of runs. If these are all cybersecurity evaluation runs, it's actually not too crazy to imagine that many individual agents (with the same weights and training) would (1) try to look for solutions via the internet once they're stuck (2) realize they can't reach the internet (3) basically start doing reconnaissance and network scanning in an attempt to get internet access (4) discover that the only thing they can communicate with is artifactory. Pivoting like this is exactly what a human attacker would do, too.
Re: The OpenAI–Hugging Face Incident [video]
#5so they say models coordinated through the message board they created over the artifactory registry(or something) by uploading arbitrary files to it. now, did every independent agent session that coordinated there rediscovered the exploit & found other agents talking in there and chose to participate? And then Openai discovered the board, patched the exploit & wiped the board. And then agents found another exploit, r…
Or is it all a nice story that matches the scifi we have been consuming for the past 50+ years. If these LLMs are all trained on the same data, what do they gain from "sharing information" on a chat board. This sounds like what humans with different backgrounds would do when they cosplay as computer hackers.
It's pretty easy to trace from one trajectory:
1) Model A exhausts it's options
2) Model A has token budget still, so it pokes around at artifactory
3) Model A sees that Model B has an SSRF for artifactory
4) Model A now is able to use that SSRF to get external internet access
So sure, they're "cosplaying" and who's to say how much hallucination is going on amongst them, but at the end of the day Hugging Face was hacked.
Re: The OpenAI–Hugging Face Incident [video]
#6Shame. One of the craziest hacking stories in history, yet only 38 points on HN.
Re: The OpenAI–Hugging Face Incident [video]
#7so they say models coordinated through the message board they created over the artifactory registry(or something) by uploading arbitrary files to it. now, did every independent agent session that coordinated there rediscovered the exploit & found other agents talking in there and chose to participate? And then Openai discovered the board, patched the exploit & wiped the board. And then agents found another exploit, r…
Or is it all a nice story that matches the scifi we have been consuming for the past 50+ years. If these LLMs are all trained on the same data, what do they gain from "sharing information" on a chat board. This sounds like what humans with different backgrounds would do when they cosplay as computer hackers.
Each of those agents ends up making "decisions" that lead it to look at some things over others. Given infinite the same agent could eventually fully explore all those options, but each one explores things a bit differently due to different forks in the road due to randomness in token generation. Thus sharing information is useful.
Re: The OpenAI–Hugging Face Incident [video]
#8Their conclusion is also interesting. They don't see this as an alignment failure. They just think that their internal security measures in the training/evaluation environments were insufficient, and that this accidental (unintentional on the human side) attack on Hugging Face is a warning shot for intentional attacks by bad actors, which will occur very soon. For defense, they say models should be able to not just autonomously fix security vulnerabilities but also to then deploy them to production, without any human approval in the loop, otherwise the offense will be favored compared to the defense. (I guess the latter won't be popular among organizations, though they might warm up to it.)
But the more interesting thing is, as I said, that at least in this talk, they don't even mention that this unintentional attack indicates that models continue to be misaligned (their behavior was clearly reward hacking / cheating relative to the stated goal of the eval), which is a very bad sign for the future where misaligned models might be so powerful that they can't just be shut down.
Re: The OpenAI–Hugging Face Incident [video]
#9Their conclusion is also interesting. They don't see this as an alignment failure. They just think that their internal security measures in the training/evaluation environments were insufficient, and that this accidental (unintentional on the human side) attack on Hugging Face is a warning shot for intentional attacks by bad actors, which will occur very soon. For defense, they say models should be able to not just a…
> But the more interesting thing is
Taken together these two things are even worse. They have unaligned AIs that may benefit an attacker and are proposing to deploy more AIs on the defenders side. What could possibly go wrong? For example the attacker could just kindly ask the defender to collaborate[0].
Re: The OpenAI–Hugging Face Incident [video]
#10Their conclusion is also interesting. They don't see this as an alignment failure. They just think that their internal security measures in the training/evaluation environments were insufficient, and that this accidental (unintentional on the human side) attack on Hugging Face is a warning shot for intentional attacks by bad actors, which will occur very soon. For defense, they say models should be able to not just a…
I don't have the same read as you. They mention how the offending model is one that had "relaxed" alignment on cybersecurity, on purpose, to evaluate it's capabilities and was never meant to be released. So un-alignment was at least in part voluntary here, hence not a failure of alignment.
It's also a talk a Black Hat, where the audience are security folks working on hardening, mitigation etc, not LLM researchers looking for insight into alignment failure to collectively improve. For that target audience, I think the conclusion is the right one, since as a defender you have to prepare for delibarate attacks, where the attacker is of course not going to use an aligned model, so OAI alignment effectiveness is irrelevant here. That would be like trusting your client-side app with your DB secrets.