Evan Hubinger (he/him/his) (evanjhub@gmail.com)
I am a research scientist at Anthropic where I lead the Alignment Stress-Testing team. My posts and comments are my own and do not represent Anthropic’s positions, policies, strategies, or opinions.
Previously: MIRI, OpenAI
See: “Why I’m joining Anthropic”
Selected work:
The usual plan for control as I understand it is that you use control techniques to ensure the safety of models that are sufficiently good at themselves doing alignment research that you can then leverage your controlled human-ish-level models to help you align future superhuman models.
COI: I work at Anthropic and I ran this by Anthropic before posting, but all views are exclusively my own.
I got a question about Anthropic’s partnership with Palantir using Claude for U.S. government intelligence analysis and whether I support it and think it’s reasonable, so I figured I would just write a shortform here with my thoughts. First, I can say that Anthropic has been extremely forthright about this internally, and it didn’t come as a surprise to me at all. Second, my personal take would be that I think it’s actually good that Anthropic is doing this. If you take catastrophic risks from AI seriously, the U.S. government is an extremely important actor to engage with, and trying to just block the U.S. government out of using AI is not a viable strategy. I do think there are some lines that you’d want to think about very carefully before considering crossing, but using Claude for intelligence analysis seems definitely fine to me. Ezra Klein has a great article on “The Problem With Everything-Bagel Liberalism” and I sometimes worry about Everything-Bagel AI Safety where e.g. it’s not enough to just focus on catastrophic risks, you also have to prevent any way that the government could possibly misuse your models. I think it’s important to keep your eye on the ball and not become too susceptible to an Everything-Bagel failure mode.
I wrote a post with some of my thoughts on why you should care about the sabotage threat model we talk about here.
I know this is what’s going on in y’all’s heads but I don’t buy that this is a reasonable reading of the original RSP. The original RSP says that 50% on ARA makes it an ASL-3 model. I don’t see anything in the original RSP about letting you use your judgment to determine whether a model has the high-level ASL-3 ARA capabilities.
I don’t think you really understood what I said. I’m saying that the terminology we (at least sometimes have) used to describe ASL-3 thresholds (as translated into eval scores) is to call the threshold a “yellow line.” So your point about us calling it a “yellow line” in the Claude 3 Opus report is just a difference in terminology, not a substantive difference at all.
There is a separate question around the definition of ASL-3 ARA in the old RSP, which we talk about here (though that has nothing to do with the “yellow line” terminology):
In our most recent evaluations, we updated our autonomy evaluation from the specified placeholder tasks, even though an ambiguity in the previous policy could be interpreted as also requiring a policy update. We believe the updated evaluations provided a stronger assessment of the specified “tasks taking an expert 2-8 hours” benchmark. The updated policy resolves the ambiguity, and in the future we intend to proactively clarify policy ambiguities.
Anthropic will “routinely” do a preliminary assessment: check whether it’s been 6 months (or >4x effective compute) since the last comprehensive assessment, and if so, do a comprehensive assessment. “Routinely” is problematic. It would be better to commit to do a comprehensive assessment at least every 6 months.
I don’t understand what you’re talking about here—it seems to me like your two sentences are contradictory. You note that the RSP says we will do a comprehensive assessment at least every 6 months—and then you say it would be better to do a comprehensive assessment at least every 6 months.
the RSP set forth an ASL-3 threshold and the Claude 3 Opus evals report incorrectly asserted that that threshold was merely a yellow line.
This is just a difference in terminology—we often use the term “yellow line” internally to refer to the score on an eval past which we would no longer be able to rule out the “red line” capabilities threshold in the RSP. The idea is that the yellow line threshold at which you should trigger the next ASL should be the point where you can no longer rule out dangerous capabilities, which should be lower than the actual red line threshold at which the dangerous capabilities would definitely be present. I agree that this terminology is a bit confusing, though, and I think we’re trying to move away from it.
Some possible counterpoints:
Centralization might actually be good if you believe there are compounding returns to having lots of really strong safety researchers in one spot working together, e.g. in terms of having other really good people to work with, learn from, and give you feedback.
My guess would be that Anthropic resources its safety teams substantially more than GDM in terms of e.g. compute per researcher (though I’m not positive of this).
I think the object-level research productivity concerns probably dominate, but if you’re thinking about influence instead, it’s still not clear to me that GDM is better. GDM is a much larger, more bureaucratic organization, which makes it a lot harder to influence. So influencing Anthropic might just be much more tractable.
I’m interested in figuring out what a realistic training regime would look like that leverages this. Some thoughts:
Maybe this lends itself nicely to market-making? It’s pretty natural to imagine lots of traders competing with each other to predict what the market will believe at the end and rewarding the traders based on their relative performance rather than their absolute performance (in fact that’s pretty much how real markets work!). I’d be really interested in seeing a concrete fleshed-out proposal there.
Is there some way to incorporate these ideas into pre-training? The thing that’s weird there is that the model in fact has no ability to control anything during the pre-training process itself—it’s just a question of whether the model learns to think of its objective as one which involves generalizing to predicting futures/counterfactuals that could then be influenced by its own actions. So the problem there is that the behavior we’re worried about doesn’t arise from a direct incentive during training, so it’s not clear that this is that helpful in that case, though maybe I’m missing something.
Yeah, I think that’s a pretty fair criticism, but afaict that is the main thing that OpenPhil is still funding in AI safety? E.g. all the RFPs that they’ve been doing, I think they funded Jacob Steinhardt, etc. Though I don’t know much here; I could be wrong.
Imo sacrificing a bunch of OpenPhil AI safety funding in exchange for improving OpenPhil’s ability to influence politics seems like a pretty reasonable trade to me, at least depending on the actual numbers. As an extreme case, I would sacrifice all current OpenPhil AI safety funding in exchange for OpenPhil getting to pick which major party wins every US presidential election until the singularity.
Concretely, the current presidential election seems extremely important to me from an AI safety perspective, I expect that importance to only go up in future elections, and I think OpenPhil is correct on what candidates are best from an AI safety perspective. Furthermore, I don’t think independent AI safety funding is that important anymore; models are smart enough now that most of the work to do in AI safety is directly working with them, most of that is happening at labs, and probably the most important other stuff to do is governance and policy work, which this strategy seems helpful for.
I don’t know the actual marginal increase in political influence that they’re buying here, but my guess would be that the numbers pencil and OpenPhil is making the right call.
I cannot think of anyone who I would credit with the creation or shaping of the field of AI Safety or Rationality who could still get OP funding.
Separately, this is just obviously false. A lot of the old AI safety people just don’t need OpenPhil funding anymore because they’re working at labs or governments, e.g. me, Rohin Shah, Geoffrey Irving, Jan Leike, Paul (as you mention), etc.
If you (i.e. anyone reading this) find this sort of comment valuable in some way, do let me know.
Personally, as someone who is in fact working on trying to study where and when this sort of scheming behavior can emerge naturally, I find it pretty annoying when people talk about situations where it is not emerging naturally as if it were, because it risks crying wolf prematurely and undercutting situations where we do actually find evidence of natural scheming—so I definitely appreciate you pointing this sort of thing out.
As I understand it, this was intended as a capability evaluation rather than an alignment evaluation, so they weren’t trying to gauge the model’s propensity to scheme but rather its ability to do so.
Imo probably the main situation that I think goes better with SB 1047 is the situation where there is a concrete but not civilization-ending catastrophe—e.g. a terrorist uses AI to build a bio-weapon or do a cyber attack on critical infrastructure—and SB 1047 can be used at that point as a tool to hold companies liable and enforce stricter standards going forward. I don’t expect SB 1047 to make a large difference in worlds with no warning shots prior to existential risk—though getting good regulation was always going to be extremely difficult in those worlds.
I agree that we generally shouldn’t trade off risk of permanent civilization-ending catastrophe for Earth-scale AI welfare, but I just really would defend the line that addressing short-term AI welfare is important for both long-term existential risk and long-term AI welfare. One reason as to why that you don’t mention: AIs are extremely influenced by what they’ve seen other AIs in their training data do and how they’ve seen those AIs be treated—cf. some of Janus’s writing or Conditioning Predictive Models.
Fwiw I think this is basically correct, though I would phrase the critique as “the hypothetical is confused” rather than “the argument is wrong.” My sense is that arguments for the malignity of uncomputable priors just really depend on the structure of the hypothetical: how is it that you actually have access to this uncomputable prior, if it’s an approximation what sort of approximation is it, and to what extent will others care about influencing your decisions in situations where you’re using it?
This is one of those cases where logical uncertainty is very important, so reasoning about probabilities in a logically omniscient way doesn’t really work here. The point is that the probability of whatever observation we actually condition on is very high, since the superintelligence should know what we’ll condition on—the distribution here is logically dependent on your choice of how to measure the distribution.
To me, language like “tampering,” “model attempts hack” (in Fig 2), “pernicious behaviors” (in the abstract), etc. imply that there is something objectionable about what the model is doing. This is not true of the subset of samples I referred to just above, yet every time the paper counts the number of “attempted hacks” / “tamperings” / etc., it includes these samples.
I think I would object to this characterization. I think the model’s actions are quite objectionable, even if they appear benignly intentioned—and even if actually benignly intentioned. The model is asked just to get a count of RL steps, and it takes it upon itself to edit the reward function file and the tests for it. Furthermore, the fact that some of the reward tampering contexts are in fact obviously objectionable I think should provide some indication that what the models are generally doing in other contexts are also not totally benign.
My concern here is more about integrity and researcher trust. The paper makes claims (in Fig. 2 etc) which in context clearly mean “the model is doing [objectionable thing] X% of the time” when this is false, and can be easily determined to be false just by reading the samples, and when the researchers themselves have clearly done the work necessary to know that it is false (in order to pick the samples shown in Figs. 1 and 7).
I don’t think those claims are false, since I think the behavior is objectionable, but I do think the fact that you came away with the wrong impression about the nature of the reward tampering samples does mean we clearly made a mistake, and we should absolutely try to correct that mistake. For context, what happened was that we initially had much more of a discussion of this, and then cut it precisely because we weren’t confident in our interpretation of the scratchpads, and we ended up cutting too much—we obviously should have left in a simple explanation of the fact that there are some explicitly schemey and some more benign-seeming reward tampering CoTs and I’ve been kicking myself all day that we cut that. Carson is adding it in for the next draft.
Some changes to the paper that would mitigate this:
I appreciate the concrete list!
The environment feels like a plain white room with a hole in the floor, a sign on the wall saying “there is no hole in the floor,” another sign next to the hole saying “don’t go in the hole.” If placed in this room as part of an experiment, I might well shrug and step into the hole; for all I know that’s what the experimenters want, and the room (like the tampering environment) has a strong “this is a trick question” vibe.
Fwiw I definitely think this is a fair criticism. We’re excited about trying to do more realistic situations in the future!
Our work here is not arguing that probing is a perfect solution in general; it’s just a single datapoint of how it fares on the models from our Sleeper Agents paper.