alt Hacker NewsTrue, and cool that someone actually put in the work to prove it, but the takeaway is still kinda wrong?
Because it's not the abliteration that does this. It's the "untrusted artifact" that does.
Even a "clean" model of a lab could be doing this. Which is the whole point of sovereignty there, and why the US is a bit concerned about CN models (and vice-versa, probably).
That seems like a pretty obvious thing to mention, as it is a clear consequence of the research they did.
___
Add to that, that it's not actually the "artifact", but the "in-memory representation", meaning that anyone or anything that control that can _also_ do this. Be it your inference provider, or, a level further down, the firmware of the GPU it runs on.
Replies
totally agreed, and..
>, the firmware of the GPU it runs on.
that'd be a rad PoC to see, but given the gpu values right now i'll let someone else brick things.
> Because it's not the abliteration that does this. It's the "untrusted artifact" that does.
> Even a "clean" model of a lab could be doing this. Which is the whole point of sovereignty there, and why the US is a bit concerned about CN models (and vice-versa, probably).
Does it even need to be untrusted? From the article apparently it only takes ~250 poisoned documents in the training data to backdoor a model, and it survives safety training and fine tuning.
This has been known for over a year: https://www.anthropic.com/research/small-samples-poison
Which means any model trained after 2026 is succeptible to slurping up poisoned documents on the internet. We all know how prolific the crawlers are in a desperate attempt to slurp up everything on the internet. And all it takes is the lab not catching ~250 documents.
So these agents that can process anything on the internet through an LLM trained on the internet only have to stumble across the payload. Seems like agents running through LLMs is a terrible idea from a security perspective.
This is why I absolutely will die on the hill that models can't be called open source if we don't have the source that created them.
"Even a "clean" model of a lab could be doing this."
The risk is in using a language model instead of using a brain
NB. This comment expresses no opinion on whether the risk is or should be "acceptable" to any particular person or not
Yes. You get the model from HF? HF could've edited the weights.
You use an unsloth quant? Unsloth could've edited the weights.
You create a quant yourself? Your version of llama.cpp could've edited the weights.
And then yeah, as you say, the actual inference engine itself, the firmware, even the hardware.
Untrusted is untrusted, abliterated AI or otherwise.