ASL-4 tests may need evidence beyond model answers

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 1:06:24

   So there's protocols for detecting it, the if then, and then there's protocols for how to respond to it. Yes. How difficult is the second, the latter? Yeah, I think for ASL3, it's primarily about security and about filters on the model relating to a very narrow set of areas when we deploy the model. Because at ASL3, the model isn't autonomous yet. And so you don't have to worry about the model itself behaving in a bad way, even when it's deployed internally. So I think the ASL-3 measures are, I won't say straightforward, they're rigorous, but they're easier to reason about.

2. 1:07:05

   I think once we get to ASL-4, we start to have worries about the models being smart enough that they might sandbag tests. They might not tell the truth about tests. We had some results came out about like sleeper agents, and there was a more recent paper about, you know, can the models mislead attempts to, you know, sandbag their own abilities, right? Show them, you know, present themselves as being less capable than they are. And so I think with ASL4, there's going to be an important component of using other things than just interacting with the models. For example, interpretability or hidden chains of thought, uh, where you have to look inside the model and verify via some other mechanism that, that is not, you know, is not as easily corrupted as what the model says, uh, that, that, you know, that, that, that the model indeed has some property. Uh, so

3. 1:08:00

   we're still working on ASL four. One of the properties of the RSP is that we, we don't specify ASL four until we've hit ASL three B. And, and I think that's proven to be a wise decision because even with asl3 it again it's hard to know this stuff in detail and and it we want to take as much time as we can possibly take to get these things right so for asl3 the bad actor will be the humans humans yes and so there's a little bit more um for asl4 it's both i think it's both and so deception and that's where mechanistic interpretability comes into play and hopefully the techniques used for that are not made accessible to the model yeah i mean of course you can hook up the mechanistic interpretability to the model itself um but then you've then you've kind of lost it as a reliable indicator of uh of uh of of the model

4. 1:08:54

   state. There are a bunch of exotic ways you can think of that it might also not be reliable. Like if the, you know, model gets smart enough that it can like, you know, jump computers and like read the code where you're like looking at its internal state. We've thought about some of those. I think they're exotic enough. There are ways to render them unlikely. But yeah, generally you want to, you want to preserve mechanistic interpretability as a kind of verification set or test set that's separate from the training process of the model. See, I think as these models become better and