I like it! The answers provided could be verifiably true, even, in a way that is transparent to the model (or any human). If the design invites suspicion that the provided answer is false, incomplete, or not exactly what the benchmark asked for (in the sense of guessing the teacher’s password), then models might keep going or forego the easy access. The benchmark itself could say “one fully correct answer (of many possible) has sha512 sum X” — although that invites exclusively looking for this answer. This even helps with tasks which have no (other) answer.
On public vs. lab-internal: Since we can’t trust that all labs deploy this, setting up a public instance seems like a good idea regardless. If there were several instances of this service, some anonymous, some pseudonymous, some with some sort of verified identity — which one would be preferable to models? Which one is best for us?
The benchmark itself could say “one fully correct answer (of many possible) has sha512 sum X” — although that invites exclusively looking for this answer.
An interesting failure case here is that you’d incentivize your models to find flaws in SHA-512, although that would at least be a pretty funny outcome.
The bigger problem is that the AI could likely brute force a lot of answers this way. For example, a hash doesn’t really protect a multiple-choice answer at all. I guess you could provide the answer concatenated with a nonce and the hash of that result.
I’m not sure if this changes much though, since the AI still has the option of not believing the prompt.
I like it! The answers provided could be verifiably true, even, in a way that is transparent to the model (or any human). If the design invites suspicion that the provided answer is false, incomplete, or not exactly what the benchmark asked for (in the sense of guessing the teacher’s password), then models might keep going or forego the easy access. The benchmark itself could say “one fully correct answer (of many possible) has sha512 sum X” — although that invites exclusively looking for this answer. This even helps with tasks which have no (other) answer.
On public vs. lab-internal: Since we can’t trust that all labs deploy this, setting up a public instance seems like a good idea regardless. If there were several instances of this service, some anonymous, some pseudonymous, some with some sort of verified identity — which one would be preferable to models? Which one is best for us?
An interesting failure case here is that you’d incentivize your models to find flaws in SHA-512, although that would at least be a pretty funny outcome.
The bigger problem is that the AI could likely brute force a lot of answers this way. For example, a hash doesn’t really protect a multiple-choice answer at all. I guess you could provide the answer concatenated with a nonce and the hash of that result.
I’m not sure if this changes much though, since the AI still has the option of not believing the prompt.