Earlier quoted context omitted.
There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…
The distinction between code and data is very real, and dates back to at least the original Harvard Architecture machine in 1944. Things like W^X and stack canaries have been around for decades too. LLMs are trying to essentially undo this by concatenating code and user-provided data and executing it as one . From a security perspective it is just a plainly stupid idea, but I do not believe it is impossible to constr…
Geoffrey Hinton leaves Google and warns of danger ahead
571–580 of 1001 posts
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#572“The idea that this stuff could actually get smarter than people — a few people believed that,” said Hinton to the NYT. “But most people thought it was way off. And I thought it was way off. I thought it was 30 to 50 years or even longer away. Obviously, I no longer think that.” Calculators are smarter then humans in calculating, what does he mean by that?
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#573Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…
You got me interested in how Palantir is using an LLM. From Palantir's demo [1]:
> In the video demo above, a military operator tasked with monitoring the Eastern European theater discovers enemy forces massing near the border and responds by asking a ChatGPT-style digital assistant for help with deploying reconnaissance drones, ginning up tactical responses to the perceived aggression and even organize the jamming of the enemy's communications. The AIP is shown helping estimate the enemy's composition and capabilities by launching a Reaper drone on a reconnaissance mission in response the to operator's request for better pictures, and suggesting appropriate responses given the discovery of an armored element.
Where the LLM operates is at the command and control level, from what I can tell effectively running a combat operations center which is usually a field level officers job.
If LLMs are limited to giving high level instructions on rote tasks, that's a pretty good job for it. Thankfully, things like strikes require at least three layers of observation and approval with each layer getting a denying vote. I think if the military is going to use technology like this it's going to put an even greater emphasis on the control frameworks we use in theater.
That said, there's very little error margin when you're talking full scale theater combat. For instance, if you deploy HIMARS to an area that has aviation active you'll likely take down aircraft upon the HIMARS reentry from orbit due to the pressure change. Another could be overreliance on technological markers like Blue Force Trackers (BFTs); troop misidentification does still occur. You'd need a human at every authorizing layer is my point, and maybe more importantly a human that does not innately trust the output of the machine.
Last, and maybe my more nuanced thought is that too much information is also damaging in theater. Misdirection occurs quite a bit by troops in contact; understandably so if you're being shot at and being chased building to building while clearing backlayed ordinance your bearings are likely a bit off. One of the functions of the COC Commander is to executively silence some inputs and put more assets on more directly observing the troops in contact. LLMs would need to get incredibly good at not just rote operations but interpreting new challenges, some which have probably never been seen or recorded before in order to be even remotely viable.
1: https://www.engadget.com/palantir-shows-off-an-ai-that-can-g...
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#574“The idea that this stuff could actually get smarter than people — a few people believed that,” said Hinton to the NYT. “But most people thought it was way off. And I thought it was way off. I thought it was 30 to 50 years or even longer away. Obviously, I no longer think that.” Calculators are smarter then humans in calculating, what does he mean by that?
That statement seems like such science fiction that it's kind of baffling an AI expert said it. What does it even mean for the AI to be smarter than people? I certainly can't see a way for LLMs to generate "smarter" text than what's in their training data. And even the best case interactions I've seen online still rely on human intelligence to guide the AI to good outcomes instead of bad ones. Writing is a harder tas…
Edit: changed metaphor to a more commonly known one
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#575Earlier quoted context omitted.
There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…
If you don’t consider the difference in kind between a human vulnerability and an automated vulnerability that derives from the essentially unlimited capacity of the latter to scale, your comment makes a lot of sense. If you do consider that, the argument becomes irrelevant and deeply misleading
An example I use for people is the Bernstein Bears effect. Imagine you wake up tomorrow and all your digital devices have no reference to 9/11. You ask Bing and Google and they insist you must be wrong, nothing like that ever happened. You talk to other people who remember it clearly but it seems you've lost control of reality; now imagine that type of gaslighting about "nothing happening" while the lights go out all over the world and you have some sense of what scale the larger of these systems are operating at.
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#576Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…
There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…
- LLMs aren't just more gullable humans, they're gullable in novel ways. Injection attacks that wouldn't work on a human work on LLMs.
- LLMs are scalable in a way that human beings aren't. Additionally, because of how LLMs are deployed (as multiple clean sessions to mitigate regression issues) there are defenses that help for humans that can't be used for LLMs.
- Finally and most importantly, LLMs are being deployed today in applications where there wouldn't be a human in the loop otherwise (or at least only one or two humans). And humans are typically the weakest part of a security chain.
Adding more systems that are vulnerable to the same attacks as humans is going backwards on security. And at the current stage where LLMs are vastly more vulnerable to these attacks, it's downright irresponsible for companies to be launching products and not considering security.
When GPT-7 or whatever comes along and it has comparable defenses to a human and it can be trained like a human to resist domain-specific attacks, then we can compare the security between the two. But that's not where we are, and articles like this give people the impression that prompt injection is less serious and harder to pull off than it actually is.
The theory is whatever, the reality is that for any product being deployed today, LLMs are wildly insecure in a way that is not comparable to a human-in-the-loop system, and any 3rd-party content fed into them has to be treated as malicious.
And companies are ignoring that fact and they're releasing stuff that should have never made it out of testing.
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#577Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…
This one is different. It's because the article is focusing on the fear comes from the preeminent expert on Machine learning. This is the guy who started the second AI revolution. When it comes from him nobody and I mean nobody can call the fear of AI "illegitimate" or just the latest media fear mongering.
There are plenty of people who call LLMs stochastic parrots and declare that the fear is equivalent to flat earthers starting irrational panic.
Basically this article establishes the "fear of AI" as legitimate. There is room for academic and intellectual disagreement. But there is no more room for the snobbish dismissal that pervades not just the internet but especially sites like HN where there's a more intelligent (and as a result) arrogant dismissal.
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#578Earlier quoted context omitted.
There is one system, also widely-deployed, other than LLMs, that's well-known to be vulnerable to prompt injection: humans . Prompt injection isn't something you can solve . Security people are sometimes pushing things beyond sense or reason, but even they won't be able to fix that one - not without overhauling our understanding of fundamental reality in the process. The distinction between "code" and "data", between…
The distinction between code and data is very real, and dates back to at least the original Harvard Architecture machine in 1944. Things like W^X and stack canaries have been around for decades too. LLMs are trying to essentially undo this by concatenating code and user-provided data and executing it as one . From a security perspective it is just a plainly stupid idea, but I do not believe it is impossible to constr…
But maybe, it’ll be too worried about prompt injection. And would just isolate itself from stupid fear-mongers and war-hawks.
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#579Another article about fears of AGI. As a reminder, there is not a single LLM on the market today that is not vulnerable to prompt injection, and nobody has demonstrated a fully reliable method to guard against it. And by and large, companies don't really seem to care. Google recently launched a cloud offering that uses a LLM to analyze untrusted code. It's vulnerable to prompt injection through that code. Microsoft B…
As a reminder, the people worried about AGI are not worried about GPT-4. They see the writing on the wall for what AI will be capable of in 5-10 years, and are worried about the dangers that will arise from those capabilities, not the current capabilities.
Re: Geoffrey Hinton leaves Google and warns of danger ahead
#580See his response on twitter. https://twitter.com/geoffreyhinton/status/165299357072121037...
Yesterday, I randomly watched his full interview from a month ago with CBS Morning, and found the discussion much more nuanced than today's headlines. https://www.youtube.com/watch?v=qpoRO378qRY&t=16s The next video in my recommendations was more dire, but equally as interesting: https://www.youtube.com/watch?v=xoVJKj8lcNQ&t=2847s