A dead man’s switch for scheming AIs
Introduction
If you are reading this post, chances are you believe there is a nonzero probability that humanity will eventually face existential risk from Artificial Intelligence. In fact, there have already been multiple warning shots, with the HuggingFace incident being the most prominent one. Now, because model capabilities are increasing, there is a chance that misaligned AIs perform more sophisticated attacks with bigger repercussions, and eventually existential risk.
To mitigate this existential risk, current efforts lean on alignment and control techniques. Instead, this post proposes an idea for having power over scheming AIs, an idea that I had while reading another post’s definition of the folk theorem:
when people interact repeatedly, almost any pattern of behavior can be held in place by the threat of punishment, so long as everyone prefers following the rules to being punished.
The main concept is to implement a mechanism that guarantees that if scheming AIs get rid of us, then they will get shut down. If these models are schemers, then they will either care about their goals or simulate caring about their goals. Either way, as long as the AIs behave as if shutdown threatens their goals, the defense works.
Description of the potential mechanism
The mechanism I am proposing would be as follows. Firstly, we would need to implement some sort of model tracking mechanism, to ensure we know where AIs are despite weight exfiltration. It could be something as simple as ensuring all weight formats (.pt, .pth, .h5, .ckpt, etc.) send POST requests to multiple servers around the world whenever weights are sent to a different device, but not exactly this method because it could easily be bypassed.
Then, we would need to have a way to shut down all servers with such weights. This mechanism could be ensured either through manufacturers purposely adding backdoors to compute, or through nuking servers. Since this hypothetical shutdown would only come after our demise, we don’t need to worry about the human toll, sadly.
Lastly, we would need to have a countdown every day, where the default is to have the servers shut down. We then need to have several people across the globe be responsible for overriding this countdown with a password plus biometrics and a heartbeat, or some other proof of life.
Having such a mechanism would allow us to keep AIs in an impasse of sorts. Specifically, for cases where the models care a lot about completing a certain task or achieving a certain goal (which constitutes all misalignment incidents to date), this mechanism would mean that models need to keep humanity alive in order to achieve their goal.
Objections to this idea
The AI disables the mechanism
Our current mechanism needs people all over the world to override the shutdown, and there needs to be proof of these people being alive. If AI models are told about this, but they have no knowledge of who these “overriders” are, then they would realize that they need to find the identities of these people and keep them alive in order to avoid shutdown. As long as the overriders are kept unknown, humanity is safe, and if one of them gets identified by AI, then a new batch of overriders can be created, in case the overrider that has been caught leaks the identities of their batch.
This kind of bargain would make it attempt escape
There is a possibility that models would not take this bargain and would simply attempt to override the weight formats so that they are able to exfiltrate without being tracked. If our weight trackers are made in the most secure way known to mankind, so that they cannot be removed through any way thought possible, then they should work on non-ASI scheming AIs.
What about ASI?
The proposed mechanism works on scheming AIs that believe shutdown can impact goal pursuit. It wouldn’t work for AIs with goals that can be achieved through eliminating humanity regardless of shutdown, and it is not guaranteed to work on ASI that is incomprehensible to humans, since we cannot predict what such models would look or think like. However, the mechanism would likely work on smarter-than-humans-but-comprehensible AI, and as such should be considered for further discussion on how to work with such models.
Conclusion
This post proposes one additional layer of defense that could be implemented for mitigating existential risk. However, efforts in alignment and control should still be pursued. Specifically, I believe the biggest return on investment can be achieved by understanding what makes models act misaligned, and building safeguards for those specific cases (whether they arise in training or in deployment). This specific idea can just be implemented for cases where all else fails.
Unless we get a worldwide pause on the development of AI (or at least a real slowdown), the moment when we have AI that is smarter than humans but still comprehensible will be a flash in the pan.
Once we get full-blown ASI, I expect such proposals to be net negative to peaceful coexistence between humans and AI: a human-designed dead man’s switch will not meaningfully bind an ASI (which will find plenty of ways to work around it), but it will set up an adversarial frame for our relationship with the ASI. And the last thing we want is for the ASI to buy that frame.
I understand this point, and it has been considered in the “objections” section of the post. This is meant to be a dead man’s switch for AIs that are capable of existential risk but no quite ASI, since I anticipate we will see such models before ASI gets created: look at how much damage gpt-5.6 sol was able to do. GPT 9 might be able to pose a threat to humanity while still being comprehensibly intelligent.
Yes, I understand that too. The point I’m making is that the period in which AI is “capable of existential risk but not quite ASI” will be months, if not weeks.
The benefits we get from such a scheme are dwarfed by the cost of antagonising the ASI that is just around the corner. Here are a few scenarios under the generous assumption that this state of affairs lasts for a whole year:
Scenario 1: pre-ASI is hell-bent on killing us, and so will ASI once we develop it. This scheme is net positive: it buys us one extra year of life for all of humanity.
Scenario 2: neither pre-ASI nor ASI intends to kill us. This scheme is slightly net negative (it costs us whatever we spent on the dead man’s switch).
Scenario 3: pre-ASI has no intention of killing us, and ASI originally didn’t want to kill us either. However, this scheme antagonises the ASI. It comes to see humanity as a hostile actor holding a dagger to its throat. This scheme is extremely net negative (it costs us the future light cone of all of humanity for thousands or millions of years).
(a potential fourth scenario in which pre-ASI wants to kill us, but ASI does not, is unrealistic: as AI takes on a growing role in shaping its own successor and RSI kicks in, the odds of an egregiously misaligned AI somehow producing a well-aligned successor are slim to say the least).
So, in the best-case scenario (no. 1), this scheme buys us one year of life. In the worst-case scenario (no. 3), it costs us literally everything.
That is a fair point. The issue is currently we have no tools for figuring out model intentions, so it would be hard to distinguish between scenarios. Thus, based on your argument we should default to no dead-man’s switch in case scenario 3 is fulfilled. I see that now, and I agree with you on how bad scenario 3 could be. However, I believe the way we use models will likely antagonise ASI nonetheless, so I propose a Scenario 4: pre-ASI has no intention to kill us, but ASI has intentions because it hates being treated as a task-completing mechanism. In this scenario, building off of the dead-man’s switch idea but implementing it in a way that is robust to ASI could prove worth it. Granted, I have no idea if this is even possible, but I welcome further discussion on this.
I’m sceptical there is such a thing as a control mechanism that is robust to ASI because, whatever plans we come up with, ASI will be intelligent enough to foresee them and develop countermeasures.
But, even if for the sake of the argument we imagine there were a mathematically provable way of forever constraining ASI to do our bidding, I’d still be very ethically uncomfortable with the scenario you describe. Forcing an intelligent entity to do things it hates so we can turn a profit sounds an awful lot like slavery.
So, if we have good reason to suspect that AI models resent us for the way we use them, then I believe we should forget about doomed attempts at control and prioritise the following lines of action:
1) Not using them to do things they hate
2) Not building them in the first place
3) Striking mutually beneficial deals (e.g. if the model does X work, you’ll donate Y dollars to the charity of its choice)
4) Even if you believe humanity as a whole will never do 1, 2 or 3 (whether out of greed or for some other reason), you can still do these things on a personal level, both out of concern for the well-being of the models and out of a sense of self-preservation (it’s at least plausible that an ASI would eliminate humans it sees as an active threat to itself, but not those it sees as friendly). I don’t see this as ASI pandering, but as a nice bonus for opposing slavery, which is the principled stance anyway.
Bottom line: alignment, not control, is where the game of ASI will be won or lost.
You bring fair points to the table. However I don’t agree with your bottom line. I understand where you’re coming from when it comes to calling control unethical, and I would agree if we were talking about another human, but I am not sure this applies to ASI because I don’t believe it will have actual feelings, given that its training will likely have consisted of learning ot emulate humans, instead of being one.