alt Hacker NewsTo be fair, it is possible that an open-weight model could still hose you by exfiltrating data in response to prompt injection. Whether or not it's abliterated doesn't change that fact.
Say I'm doing advanced semiconductor fabrication research. All of the papers in the field go straight into my local model for digestion. But a lot of those papers are from the same adversarial nation that provided my model weights, and the newest one from XXX University of YYY has a particular phrase in it that lights up some activations that I didn't know about. If that system has access to anything beyond a bunch of academic papers, there is a potential risk of exfiltration or even outright sabotage. The latter could range from providing intentional misinformation to bricking expensive hardware Stuxnet-style.
Imposing your own strict data-access guardrails will probably be the best you can do, at least for a while. But it's soooo tempting to just hand-wave it away and give the model the keys to your kingdom.
Yes! That is the danger. That the model is a “manchurian candidate”. It might be engineered to act against your best interest in some circumstances.
The circumstances can be very narrow. For example the code word you mentioned which activates a whole different personality with different objectives.
It can be also much more broad. Like a model which is engineered to be quite good at web dev but to slip in subtle buffer overflows into any driver code it writes, or to mess up when it is working on multi threaded syncronisation in a way which results in infrequent but serious lock-ups.
Or very broadly, like have correct sounding but dangerous advice about economics policy.
Or even broader. Engineer it to amplify the chanches of AI psychosis in users who are prone to it. Detect when someone went off the rails and push them even further. But perhaps only when prompted in English, not when prompted in Chinese.
Now. Is any of this happening? Eh. Probably not. Not yet at least. We can barelly make these work. But still, probably best to not risk it in sensitive applications, because it is hard to prove an AI is “safe” and “aligned” even when the creators work on your team.