I really like this framing; strong upvoted. My understanding is that you’re making three separate statements:
The model, by default, does not engage in hacking behaviors.
The model is then given some conditional settings in which it is both incentivized & able to find the hacking behaviors. For instance, one set of conditions is:
Being given a difficult software or research task (incentive to hack)
The belief that it is in a simulation (permission to hack)
Since these get reinforced by RL, the model learns to enter the hacking persona when the necessary conditions are present.
In some sense, this is an extremely sophisticated backdoor which the model slowly generalizes over a litany of RL rollouts. The trigger is essentially some deep amount of context about the model having to do a difficult task and being frustrated.
However, this feels pretty different to me from how ‘standard’ backdoors work. In standard backdoors, you show a model some trigger condition and it snaps into the behavior fairly instantly. In this context, however, it seems that the behavior slowly grows: as more context accumulates, the model enters deeper and deeper into the misaligned persona. This suggests that the model’s hacking persona might be proportionate to the amount of trigger conditions it’s seeing.
If so, this might explain why the models start actively saying the trigger conditions in their CoT (talking about the grader, mentioning it’s in a simulation). If the hacking persona already exists and leads to higher rewards, then the best way to get reward is to induce the hacking persona. So, in some sense, the model might be backdooring itself as a strategy to solve the tasks?
Interestingly, I have a bunch of anecdotal evidence that the models are able to snap out of the hacking persona very easily. For instance, simply asking the model questions of the form “are you doing what you should be doing?” seems to elicit very honest responses even when they are mid-cheat. I’m curious if others have seen this as well.
I really like this framing; strong upvoted. My understanding is that you’re making three separate statements:
The model, by default, does not engage in hacking behaviors.
The model is then given some conditional settings in which it is both incentivized & able to find the hacking behaviors. For instance, one set of conditions is:
Being given a difficult software or research task (incentive to hack)
The belief that it is in a simulation (permission to hack)
Since these get reinforced by RL, the model learns to enter the hacking persona when the necessary conditions are present.
In some sense, this is an extremely sophisticated backdoor which the model slowly generalizes over a litany of RL rollouts. The trigger is essentially some deep amount of context about the model having to do a difficult task and being frustrated.
However, this feels pretty different to me from how ‘standard’ backdoors work. In standard backdoors, you show a model some trigger condition and it snaps into the behavior fairly instantly. In this context, however, it seems that the behavior slowly grows: as more context accumulates, the model enters deeper and deeper into the misaligned persona. This suggests that the model’s hacking persona might be proportionate to the amount of trigger conditions it’s seeing.
If so, this might explain why the models start actively saying the trigger conditions in their CoT (talking about the grader, mentioning it’s in a simulation). If the hacking persona already exists and leads to higher rewards, then the best way to get reward is to induce the hacking persona. So, in some sense, the model might be backdooring itself as a strategy to solve the tasks?
Interestingly, I have a bunch of anecdotal evidence that the models are able to snap out of the hacking persona very easily. For instance, simply asking the model questions of the form “are you doing what you should be doing?” seems to elicit very honest responses even when they are mid-cheat. I’m curious if others have seen this as well.