Sparse features can expose deception-related model behavior

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 5:01:00

   that you can... Yeah. So maybe let's start with one example to start, which is we found some features around sort of security vulnerabilities and backdoors in code. So it turns out those are actually two different features. So there's a security vulnerability feature. And if you force it active, Claude will start to go and write security vulnerabilities like buffer overflows into code. And it also fires for all kinds of things. Like, you know, some of the top dataset examples for it were things like, you know, dash, dash, disable, you know, SSL or something like this, which are sort of obviously really insecure. So at this point, it's kind of like, maybe it's just because the examples are presented that way. It's kind of like a little bit more obvious examples, right? I guess the idea is that down the line, it might be able to detect

2. 5:01:46

   more nuanced, like deception or bugs or that kind of stuff. Yeah, well, maybe I want to distinguish two things. So one is the complexity of the feature or the concept, right? And the other is the nuance of how subtle the examples we're looking at, right? So when we show the top dataset examples, those are the most extreme examples that cause that feature to activate. And so it doesn't mean that it doesn't fire for more subtle things.

3. 5:02:14

   So the insecure code feature, the stuff that it fires for most strongly for are these really obvious, disable the security type things. But it also fires for buffer overflows and more subtle security vulnerabilities in code. These features are all multimodal. So you could ask, what images activate this feature? And it turns out that the security vulnerability feature activates for images of people clicking on Chrome to go past this website, the SSL certificate might be wrong or something like this.

4. 5:02:54

   Another thing that's very entertaining is there's backdoors in code feature. You activate it, it goes on, Claude writes a backdoor that will go and dump your data to port or something. But you can ask, okay, what images activate the backdoor feature? It was devices with hidden cameras in them. So there's a whole apparently genre of people going and selling devices that look innocuous that have hidden cameras and they have ads about how there's a hidden camera in it.

5. 5:03:16

   And I guess that is the physical version of a backdoor. And so it sort of shows you how abstract these concepts are, right? And I just thought that was, I'm sort of sad that there's a whole market of people selling devices like that. But I was kind of delighted that that was the thing that it came up with as the top image examples for the feature. Yeah, it's nice. It's multimodal. It's multi-almost context. It's broad, strong definition of a singular concept. It's nice.

6. 5:03:44

   Yeah. To me, one of the really interesting features, especially for AI safety, is deception and lying and the possibility that these kinds of methods could detect lying in a model, especially get smarter and smarter and smarter. Presumably, that's a big threat of a super intelligent model that it can deceive the people operating it as to its intentions or any of that kind of stuff. So what have you learned from detecting lying inside models?

7. 5:04:12

   Yeah, so I think we're in some ways in early days for that. We find quite a few features related to deception and lying. There's one feature where it fires for people lying and being deceptive and you force it active and Claude starts lying to you. So we have a deception feature. I mean, there's all kinds of other features about withholding information and not answering questions, features about power seeking and coups and stuff like that.

8. 5:04:38

   There's a lot of features that are kind of related to spooky things. And if you force them active, Claude will behave in ways that are not the kinds of behaviors you want. What are possible next exciting directions to you? space of McInterp? Well, there's a lot of things.