alt Hacker NewsThe only true defense is actual open source. Open "weights" is not that. You need the entire training pipeline open-sourced, plus the entire training corpus, so someone can independently train the model from scratch.
Obviously this will never happen. And even if it did, it still probably wouldn't be that hard to hide something in that mountain of data.
Replies
Unfortunately, frontier models are all trained in part via distillation, and distillation can produce sleeper agents without ever mentioning the trigger phrase or the behavior (https://arxiv.org/html/2610.10657v1).
"Obviously this will never happen."
It will never happen with LLMs, but we can hold out hope that it will happen someday. Humans do not become what we are by having the whole of the internet poured through our heads multiple times over. It seems almost necessary that there is some next-generation architecture that won't require as much training data.
Probably still enough that it'll stagger a home connection trying to download a torrent or something, but perhaps not so much that it is insane to also release the core data set one way or another.
Never happen...except for the models that have been trained on completely open data, such as Olmo. They're not frontier class, but they do exist.
The idea of dropping >half a million dollars in gpu credits to re-train a model to confirm no tampering is laughable at this point. Until training costs fall, that’s not really a solution.
Also, is training even deterministic? Does the same code with the same training data always result in the same model?
I’m all for open source models (not just open weight) but I feel like a way to scan the model weights for backdoors is going to be an easier problem to solve than obtaining training data.
Why not have a second model that reads every response looking for something nefarious?
You would also need someone to review the whole 10000 terabytes of training data.
i wonder when we get the first mainstream open-corpus models. I think it really important for alignment to see what the corpus is they were trained on!
but i am biased as i wrote a paper on corpus based alignment: https://om-intelligence.ch/papers.html
It has already happened repeatedly. Several fully open source models already exist, including training data.
They suck, but they do exist.
Is open data just not possible because it is almost all copyright infringement? I wonder why Chinese labs haven’t dumped it at least.