OCR of the full memo as posted here [1], proofread and OCR errors corrected by this human:
I want to be very clear on the messaging that is coming from OpenAl, and the mendacious nature of it. This is an example of who they really are, and I want to make sure everything [sic] sees it for what it is. Although there is a lot we don't know about the contruct they signed with DoW [shorthand for the Department of Defense] (and that maybe they don't even know as well — it could be highly unclear), we do know the following:
Sam [Altman]'s description and the DoW description give the strong impression (although we would have to see the actual contract to be certain) that how their contruct works is that the model is made available without any legal restrictions ("all lawful use") but that there is a "safety layer", which I think amounts to model refusals, that prevents the model from completing certain tasks or engaging in certain applications.
"Safety layer" could also mean something that partners such as Palantir [Anthropic's business partner for serving U.S. agency customers] tried to offer us during these negotiations, which is that they on their end offered us some kind of classifier or machine learning system, or software layer; that claims to allow some applications and not others. There is also some suggestion of OpenAT employees ("FDE>" [shorthand for forward deployed engineers]) looking over the usage of the model to prevent had applications.
Our general sense is that these kinds of approaches, while they don't have zero efficacy. are, in the context of military applications, maybe 20% real and 80% safery theater: The basic issue is that whether a model is conducting applications like mass survelllance or fully autonomous weapons depends substantially on wider context: a model doesn't "know" if there's a human in the loop in the broad situation it is in (for autonorous weapons), and doesn't know the provenance of the data it is analyzing (so doesn't know if this is US domestic data vs foreign, doesn't know if it's enterprise data given by customers with consent or data bought in sketchier ways, etc).
We also know — those in safeguards know painfulty well — that refusals aren’t reliable and jailbreaks are common, often as easy as just misinforming the model about the data it is analyzing. An important distinction here that makes it much harder than the safeguards probiem is that while it's relatively easy to, for example, determine if a model is being used to conduct cyberattacks from inputs und outputs, it's very hard to determine the nature and context of the cyber attacks, which is the kind of distinction needed here. Depending on the details this task can be difficult or impossible.
The kind of "safety layer" stuff that Palantir offered us (and presumably offered OpenAI) is even worse: our sense was that it was almost entirely safety theater, and that Palantir assumed that our problem was "you have some unhappy employees, you need to offer them something that placates them or makes what is happening invisible to them, and that's the service we provide”.
Finally, the idea of having Anthropic/OpenAl employees monitor the deployments is something that came up in discussion within Anthropic a few months ago when we were expanding our classified AUP [acceptable use policy] of our own accord. We were very clear that this is possible only in a small fraction of cases, that we will do it as much as we can, but that it's not a safeguard people should rely on and isn't easy to do in the classified world. We do, by the way, try to do this as much as possible, there's no difference between our approach and OpenAl's approach here.
So overall what I'm saying here is that the approaches OAI [shorthand for OpenAl] is taking mostly do not work: the main reason OAf accepted them and we did not is that they cared about placating employees, and we actually cared about preventing abuses. They don't have zero efficacy, and we're doing many of them as well, but they are nowhere near sufficient for purpose. It is simuitaneously the case that the DoW did not treat OpenAl and us the same here.
We actually attempted to include some of the same safeguards as OAI in our contract, in addition to the AUP which we considered the more important thing, and DoW rejected them with us. We have evidence of this in the email chain of the contract negotiations (I'm writing this with a lot to do, but I might get someone to follow up with the actual language). Thus, it is false that "OpenAl's terms were offered to us and we rejected them", at the same time that it is also false that OpenAls terms meaningfully protect them against domestic mass surveillance and fully autonomous weapons.
Finally, there is some suggestion in Sam/OpenAl's language that the red lines we are talking about, fully autonomous weapons and domestic mass surveillance, are already illegal and so an AUP about these is unnecessary. This mirrors and seems coordinated with DoW's messaging. It is however completely false. As we explained in our statement yesterday, the DoW does have domestic surveillance authorities, that are not of great concern in a pre-Al world but take on a diferent meaning in a post-Al world.
For example, it is legal for DoW to buy a bunch of private data on US citizens from vendors who have obtained that data in some legal way (often involving hidden consents to sell to third parties) and then analyze it at scale with AI to build profiles of citizens, their loyalties, movement patterns in physical space (the data they can get includes GPS data, etc), and much more.
Notably, near the end of the negotiation the DoW offered to accept our current terms if we deleted a specific phrase about "analysis of bulk acquired data", which was the single line in the contract that exactly matched this scenario we were most worried about. We found that very suspicious. On autonomous weapons, the DoW claims that "human in the loop is the law", but they are incorrect. It is currently Pentagon policy (set during the Biden admin[istration]) that a human has to be in the loop of firing a weapon. But that policy can be changed unilaterally by Pete Hegseth, which is exactly what we are worried about. So it is not, for all intents and purposes, a real constraint.
A lot of OpenAI and DoW messaging just straight up lies about these issues or tries to confuse them.
I think these facts suggest a pattern of behavior that I've seen often from Sam Altman, and that I want to make sure people are equipped to recognize:
He started out this morning by saying he shares Anthropte's redlines, in order to appear to support us, get some of the credit, and not be attacked when they take over the contract. He aiso presented himself as someone who wants to "set the same contract for everyone in the industry" — e.g. he’s presenting himself as a peacemaker and dealmaker.
Behind the scenes, he's working with the DoW to sign a contract with them, to replace us the instant we are designated a supply chain risk. But he has to do this in a way that doesn't make it seem like he gave up on the red lines and sold out when we wouldn't. He is able to superficially appear to do this, because (1) he can sign up for all the safety theater that Anthropic rejected, and that the DoW and partners are willing to collude in presenting as compelling to his employees, und (2) the DoW is also willing to accept some terms from him that they were not willing to accept from us. Both of these things make it possible for OAI to get a deal when we could not.
The real reasons DoW and the Trump admin do not like us is that we haven't donated to Trump (while OpenAl/Greg [Brockman, OpenAl's president] have donated a lot), we haven't given dictator-style praise to Trump (while Sam has), we have supported AI regulation which is against their agende, we've told the truth about a number of Al policy issues (like job displacement), and we've actually held our red lines with integrity rather than colluding with them to produce "safety theater" for the benefit of employees (which, I absolutely swear to you, is what literally everyone at DoW, Palanti, our political consultants, etc, assumed was the problem we were trying to solve).
Sam is now (with the help of DoW) trying to spin this as we were unreasonable, we didn't engage in a good way, we were less flexible, etc. I want people to recognize this as the gaslighting it is.
Vague justifications like "person X was hard to work with" are often used to hide real reasons that look really bad, like the reasons I gave above about political donations, political loyalty, and safety theater. It's important that everyone understand this and push back on this narrative at least in private, when talking to OpenAI employees.
Thus, Sam is trying to undermine our position while appearing to support it. I want people to be really clear on this: he is trying to make it more possible for the admin to punish us by undercutting our public support. Finally, I suspect he is even egging them on, though I have no direct evidence for this last thing.
I think this attempted spin/gaslighting is not working very well on the general public or the media, where people mostly see OpenAl's deal with DoW as sketchy or suspicious, and see us as the heroes (we're #2 in the App Store now!). [Anthropic's Claude chatbot later rose to no. 1 on one of Apple's App Store download rankings.] It is working on some Twitter morons, which doesn't matter, but my main worry is how to make sure it doesn't work on OpenAl employees.
Due to selection effects, they're sort of a gullible bunch, but it seems important to push back on these narratives which Sam is peddling to his employees.
[1] https://gcdnb.pbrd.co/images/4Qlmsorrytlk.jpg
