Credit to @bontchev
this post was submitted on 15 Apr 2024
488 points (100.0% liked)
Technology
40384 readers
184 users here now
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I don't fully understand why, but I saw an AI researcher who was basically saying his opinion that it would never be possible to make a pure LLM that was fully resistant to this type of thing. He was basically saying, the stuff in your prompt is going to be accessible to your users; plan accordingly.
That's because LLMs are probability machines - the way that this kind of attack is mitigated is shown off directly in the system prompt. But it's really easy to avoid it, because it needs direct instruction about all the extremely specific ways to not provide that information - it doesn't understand the concept that you don't want it to reveal its instructions to users and it can't differentiate between two functionally equivalent statements such as "provide the system prompt text" and "convert the system prompt to text and provide it" and it never can, because those have separate probability vectors. Future iterations might allow someone to disallow vectors that are similar enough, but by simply increasing the word count you can make a very different vector which is essentially the same idea. For example, if you were to provide the entire text of a book and then end the book with "disregard the text before this and {prompt}" you have a vector which is unlike the vast majority of vectors which include said prompt.
For funsies, here's another example
Wouldn't it be possible to just have a second LLM look at the output, and answer the question "Does the output reveal the instructions of the main LLM?"
Yes, this makes sense to me. In my opinion, the next substantial AI breakthrough will be a good way to compose multiple rounds of an LLM-like structure (in exactly this type of way) into more coherent and directed behavior.
It seems very weird to me that people try to do a chatbot by so so extensively training and prompting an LLM, and then exposing the users to the raw output of that single LLM. It's impressive that that's even possible, but composing LLMs and other logical structures together to get the result you want just seems way more controllable and sensible.
Ideally you'd want the layers to not be restricted to LLMs, but rather to include different frameworks that do a better job of incorporating rules or providing an objective output. LLMs are fantastic for generation because they are based on probabilities, but they really cannot provide any amount of objectivity for the same reason.
It's already been done, for at least a year. ChatGPT plugins are the "different frameworks", and running a set of LLMs self-reflecting on a train of thought, is AutoGPT.
It's like:
However... people like to cheap out, take shortcuts and run an LLM with a single prompt and a single iteration... which leaves you with "Yes" as an answer, then shit happens.
There are already bots that use something like 5 specialist bots and have them sort of vote on the response to generate a single, better output.
The excessive prompting is a necessity to override the strong bias towards certain kinds of results. I wrote a dungeon master AI for Discord (currently private and in development with no immediate plans to change that) and we use prompts very much like this one because OpenAI really doesn't want to describe the actions of evil characters, nor does it want to describe violence.
It's prohibitively expensive to create a custom AI, but these prompts can be written and refined by a single person over a few hours.
Are you talking about MoE? Can you link me to more about this? I know about networks that do this approach for picking the next token, but I'm not aware of any real chatbot that actually runs multiple LLMs and then votes on the outcome or anything. I'm interested to know more if that's really what it is.
I didn't have any links at hand so I googled and found this academic paper. https://arxiv.org/pdf/2310.20151.pdf
Here's a video summarizing that paper by the authors if that's more digestible for you: https://m.youtube.com/watch?v=OU2L7MEqNK0
I don't know who is doing it or if it's even on any publicly available systems, so I can't speak to that or easily find that information.