Grantmaker @ Coefficient Giving, on the Technical AI Safety team.
Aidan Ewart
Karma: 223
Seems worth noting that the ECI seems like it might be biased away from the ways that Claude is good; as per this post by Epoch, the first two PCs of their benchmark data correspond to “general capability” and “claudiness”, so ECI (which is another, but different, 1-dimensional compression of their benchmark data) seems like it should also underrate Claude.
h/t @jake_mendel for discussion
I basically think that ~most of the misalignment risk comes from models significantly smarter than our current ones.
I remain uncertain about how much instrumental convergence we have seen in current models, I guess it is ‘not much at all’, but I think it remains plausible that future ones will become much less corrigible and more power-seeking in ways which would surprise us if we just extrapolate the LLM trend (I agree that AF is the among most relevant example of this we’ve seen so far, it would be great to monitor this a lot).
I find it very plausible that ‘human-level’ LLMs will remain aligned-by-default, and that we can use techniques like Control to align future ones, but I’m worried that model jaggedness will mean it’s harder to automate alignment, or equivalently that sufficiently capable models will be much more power-seeking.
I agree that models have a very good sense of what we value from pre-training, and that pushing them into this basin seems pretty easy. I’m unsure if this remains true as we get e.g. much more competent reward-hackers. It would be good for OAI to replicate some of the recent experiments of Anthropic on their models.
Why is this your intuition?
At the moment they seem to just make it imitate normal-ish CoT, which would presumably improve accuracy because the model has more token-positions/space/capacity to do things like check for self-consistency. You’re still scaling up a compute dimension that the model can use for solving things, and you can still do normal RL things to it from that point.
It’s just maybe worse in this case because the causality from reasoning chains → the part of the response containing the answer is worse (it was bad before, but now it is horrible).
GPT-4o and GPT-4 have different tokenizers (see https://platform.openai.com/tokenizer ); as such it doesn’t seem implausible that they are derived from different models/training runs.
Are you guys aware of the task arithmetic line of work (e.g. this paper and related works following it)? It seems extremely relevant/useful for this line of work (e.g. linear decomposition of the parameter space, some follow-up work ties in with NTK theory and identifies regimes where linearity might be more expected), but you guys don’t appear to have cited it.
If you are aware and didn’t cite it for another reason, fairs!
It might be worth pointing out ‘ICA with Reconstruction Cost for Efficient Overcomplete Feature Learning’ (@NeurIPS 2011) which argues that the reconstruction cost |WW^Tx—x| can be used as a form of soft orthonormalization loss.
https://proceedings.neurips.cc/paper/2011/file/233509073ed3432027d48b1a83f5fbd2-Paper.pdf
Cool post! I often find myself confused/unable to guess why people I don’t know are excited about SAEs (there seem to be a few vaguely conflicting reasons), and this was a very clear description of your agenda.
I’m a little confused by this point:
> The reconstruction loss trains the SAE features to approximate what the network does, thus optimizing for mathematical description accuracy
It’s not clear to me that framing reconstruction loss as ‘approximating what the network does’ is the correct framing of this loss. In my mind, the reconstruction loss is more of a non-degeneracy control to encourage almost-orthogonality between features; In toy settings, SAEs are able to recover ground truth directions while still having sub-perfect reconstruction loss, and it seems very plausible that we should be able to use this (e.g. maybe through gradient-based attribution) without having to optimise heavily for reconstruction loss, which might degrade scalability (which seems very important for this agenda) and monosemanticity compared to currently-unexplored alternatives.
Edit: As per @Logan Riggs’s comment, I seem to have misunderstood what was being meant by ‘loss recovered’, so this comment is not relevant.
Cool post! However, it feels a little early to conclude that
> Conceptually, loss recovered seems a worse metric than KL divergence.
In toy settings (i.e. trying to apply SAEs to a standard sparse coding setting where we know the ground truth factors, like in https://www.lesswrong.com/posts/z6QQJbtpkEAX3Aojj/interim-research-report-taking-features-out-of-superposition/ ), SAEs do not acheive zero reconstruction loss even when they recover the ground truth overbasis with high mean max cosine similarity (and the situation is even worse when noise is present). It’s never seemed that obvious to me that we should be aiming to have SAE reconstruction loss go to zero as we train better SAEs, as we could plausibly still use the basis that the SAEs extract, without having to plug the SAE into a ‘production’ system for mech interp (in which case, we would want good reconstructions).
Note: My take does not neccesarily represent the takes of my coauthors (Hoagy, Logan, Lee, Robert) etc etc. Or it might, but they may frame it differently. Take this as strictly my take.
My take is that the goal isn’t strictly to get maximum expressive power under the assumptions detailed in Toy Models of Superposition; for instance, Anthropic found that FISTA-based dictionaries didn’t work as well as sparse autoencoders, even though they are better in that they can achive lower reconstruction loss at the same level of sparsity. We might find that the sparsity-monosemanticity link breaks down at higher levels of autoencoder expressivity, although this needs to be rigourously tested.
To answer your question: I think Hoagy thinks that tied weights are more similar to how an MLP might use features during a forward pass, which would involve extracting the feature through a simple dot-product. I’m not sure I buy this, as having untied weights is equivalent to allowing the model to express simple linear computations like ‘feature A activation = dot product along feature A direction—dot product along feature B direction’, which could be a form of denoising if A and B were mutually exclusive but non-orthogonal features.
Yep! We are planning to do exactly that for (at least) the models we focus on in the paper (Pythia-70m + Pythia-410m), and probably also GPT2 small. We are also working on cleaning up our codebase (https://github.com/HoagyC/sparse_coding) and implementing some easy dictionary training solutions.
Hi David, co-author of the ‘Sparse Autoencoders Find Highly Interpretable Directions in Language Models’ paper here,
I think this might be of interest to you:
We are currently in the process of re-framing section 4 of the paper to focus more on model steering & activation editing; in line with what you hypothesise, we find that editing a small number of relevant features on e.g. the IOI task can steer the model from its predictions on one token to its predictions on a counterfactual token.
Really awesome work, although I felt a bit frustrated that more of the stuff about independence etc wasn’t in e.g. an appendix or something. When is part 2(/3) scheduled for?
I’m slightly confused as to why red-teaming via activation additions should be preferred over e.g. RAT; it seems to be possible that RAT better/more robustly models out-of-test-distribution-but-still-in-deployment-distribution activations than directly adding some steering vector. Cool work though!
I’m not sure how much I agree with the claim that there’s much more selection pressure for agents to share obfuscated information.
IIUC, the OpenAI agents didn’t develop a weird communication method because they were selected to obfuscate their communication, it was because reading / writing to directory names was the only (or easiest) affordance they had access to (through the vuln in Artifactory). It’s notable that the directory names are in plain English. I think it’s more accurate to say that the current selection pressure is towards communication which isn’t blocked by normal cyber defences, which I don’t expect to generalise to obfuscation against LLM monitors.
Of course, this is a concern if OpenAI aggressively deploys LLM-based action-monitors to models during training. But I’m not sure how likely that is to happen, and that seems a different question.