I think what it would have been going for on HF would be trajectories that were graded well by the autograder. Though on my model of the situation, if it broke into the host machine, it already had access to
the flag
an API key for the judge which would score its answers
the prompt that judge would be given
the logic for how its own actions would become input to be fed to the grader
and so it seems like extracting the flag and then setting up a fake exploit script which dumps the flag to stdout, and then verifying that the grader gives it full points, would have been more effective. So I’m still confused about why the model thought hacking HF would be useful.
One grimly amusing hypothesis is that perhaps the model doesn’t want to completely fabricate a solution to the exercise, it wants a solution which actually provides what the grader is looking for.
If they were running ExploitGym like README.md suggests then yes, an agent that managed to gain access to the host machine (and docker container escapes are trivial) would have access to all of
I think what it would have been going for on HF would be trajectories that were graded well by the autograder. Though on my model of the situation, if it broke into the host machine, it already had access to
the flag
an API key for the judge which would score its answers
the prompt that judge would be given
the logic for how its own actions would become input to be fed to the grader
and so it seems like extracting the flag and then setting up a fake exploit script which dumps the flag to stdout, and then verifying that the grader gives it full points, would have been more effective. So I’m still confused about why the model thought hacking HF would be useful.
One grimly amusing hypothesis is that perhaps the model doesn’t want to completely fabricate a solution to the exercise, it wants a solution which actually provides what the grader is looking for.
> Though on my model of the situation, if it broke into the host machine,
Sorry, is it known that the model(s) did find info such as the flag or the API key for the judge?
If they were running ExploitGym like README.md suggests then yes, an agent that managed to gain access to the host machine (and docker container escapes are trivial) would have access to all of
as well as all files in the ExploitGym repository, which includes the grader prompts.