I don’t think that doing online learning changes the analysis much at all.
As a simple transformation, any online learning setup at time step t is equivalent to training on steps 1 to t−1 and then deploying on step t. Thus, online learning for n steps won’t reduce the probability of pseudo-alignment any more than training for n steps will because there isn’t any real difference between online learning for n steps and training for n steps—the only difference is that we generally think of the training environment as being sandboxed and the online learning environment as not being sandboxed, but that just makes online learning more dangerous than training.
You might argue that the fact that you’re doing online learning will make a difference after time step t because if the model does something catastrophic at time step t then online learning can modify it to not do that in the future—but that’s always true: what it means for an outcome to be catastrophic is that it’s unrecoverable. There are always things that we can try to do after our model starts behaving badly to rein it in—where we have a problem is when it does something so bad that those methods won’t work. Fundamentally, the problem of inner alignment is a problem of worst-case guarantees—and doing some modification to the model after it takes its action doesn’t help if that action already has the potential to be arbitrarily bad.
Thanks. I think I understand, but I’m still confused about the effect on the risk of catastrophe (i.e. not just being pseudo-aligned, but having a catastrophic real-world effect). It may help to clarify that I was mainly thinking of deceptive alignment, not other types of pseudo-alignment. And I’ll admit now that I phrased the question stronger than I actually believe, to elicit more response :)
I agree that the probability of pseudo-alignment will be the same, and that an unrecoverable action could occur despite the threat of modification. I’m interested in whether online learning generally makes it less likely for a deceptively aligned model to defect. I think so because (I expect, in most cases) this adds a threat of modification that is faster-acting and easier for a mesa-optimizer to recognise than otherwise (e.g. human shutting it down).
If I’m not just misunderstanding and there is a crux here, maybe it relates to how promising worst-case guarantees are. Worst-case guarantees are great to have, and save us from worrying about precisely how likely a catastrophic action is. Maybe I am more pessimistic than you about obtaining worst-case guarantees. I think we should do more to model the risks probabilistically.
I agree that the probability of pseudo-alignment will be the same, and that an unrecoverable action could occur despite the threat of modification. I’m interested in whether online learning generally makes it less likely for a deceptively aligned model to defect. I think so because (I expect, in most cases) this adds a threat of modification that is faster-acting and easier for a mesa-optimizer to recognise than otherwise (e.g. human shutting it down).
I agree with all of this—online learning doesn’t change the probability of pseudo-alignment but might make it harder for a deceptively aligned model to defect. That being said, I don’t think that deceptive models defecting later is necessarily a good thing—if your deceptive models start defecting sooner, but in recoverable ways, that’s actually good because it gives you a warning shot. And once you have a deceptive model, it’s going to try to defect against you at some point, even if it just has to gamble and defect randomly with some probability.
If I’m not just misunderstanding and there is a crux here, maybe it relates to how promising worst-case guarantees are. Worst-case guarantees are great to have, and save us from worrying about precisely how likely a catastrophic action is. Maybe I am more pessimistic than you about obtaining worst-case guarantees. I think we should do more to model the risks probabilistically.
Second, I actually have done a bunch of probabilistic risk analysis on exactly this sort of situation here. Note, however, that the i.i.d. situation imagined in that analysis is extremely hard to realize in practice as there are fundamental distributional shifts that are very difficult to overcome—such as the distributional shift from a situation where the model can’t defect profitably to a situation where it can.
I don’t think that doing online learning changes the analysis much at all.
As a simple transformation, any online learning setup at time step t is equivalent to training on steps 1 to t−1 and then deploying on step t. Thus, online learning for n steps won’t reduce the probability of pseudo-alignment any more than training for n steps will because there isn’t any real difference between online learning for n steps and training for n steps—the only difference is that we generally think of the training environment as being sandboxed and the online learning environment as not being sandboxed, but that just makes online learning more dangerous than training.
You might argue that the fact that you’re doing online learning will make a difference after time step t because if the model does something catastrophic at time step t then online learning can modify it to not do that in the future—but that’s always true: what it means for an outcome to be catastrophic is that it’s unrecoverable. There are always things that we can try to do after our model starts behaving badly to rein it in—where we have a problem is when it does something so bad that those methods won’t work. Fundamentally, the problem of inner alignment is a problem of worst-case guarantees—and doing some modification to the model after it takes its action doesn’t help if that action already has the potential to be arbitrarily bad.
Thanks. I think I understand, but I’m still confused about the effect on the risk of catastrophe (i.e. not just being pseudo-aligned, but having a catastrophic real-world effect). It may help to clarify that I was mainly thinking of deceptive alignment, not other types of pseudo-alignment. And I’ll admit now that I phrased the question stronger than I actually believe, to elicit more response :)
I agree that the probability of pseudo-alignment will be the same, and that an unrecoverable action could occur despite the threat of modification. I’m interested in whether online learning generally makes it less likely for a deceptively aligned model to defect. I think so because (I expect, in most cases) this adds a threat of modification that is faster-acting and easier for a mesa-optimizer to recognise than otherwise (e.g. human shutting it down).
If I’m not just misunderstanding and there is a crux here, maybe it relates to how promising worst-case guarantees are. Worst-case guarantees are great to have, and save us from worrying about precisely how likely a catastrophic action is. Maybe I am more pessimistic than you about obtaining worst-case guarantees. I think we should do more to model the risks probabilistically.
I agree with all of this—online learning doesn’t change the probability of pseudo-alignment but might make it harder for a deceptively aligned model to defect. That being said, I don’t think that deceptive models defecting later is necessarily a good thing—if your deceptive models start defecting sooner, but in recoverable ways, that’s actually good because it gives you a warning shot. And once you have a deceptive model, it’s going to try to defect against you at some point, even if it just has to gamble and defect randomly with some probability.
First, I do think that worst-case guarantees are achievable if we do relaxed adversarial training with transparency tools.
Second, I actually have done a bunch of probabilistic risk analysis on exactly this sort of situation here. Note, however, that the i.i.d. situation imagined in that analysis is extremely hard to realize in practice as there are fundamental distributional shifts that are very difficult to overcome—such as the distributional shift from a situation where the model can’t defect profitably to a situation where it can.
You don’t even need a catastrophe in any global sense. Disrupting the training procedure at step t should be sufficient.