Cryptographic Exploits Reveal Inherent AI Filter Vulnerabilities

Key Quotes

"since large language models first became widely available a few years ago people have wanted to test them this is a natural human inclination when we're faced with a new technology we want to see what it can do we want to push its limits we want to try to break it and in the case of ai this includes finding situations or problems or scripts that confuse the model or lead to wrong answers and getting around the systems that are supposed to keep them from providing dangerous or offensive information we refer to that last idea as alignment it's the extent to which llms behave in accordance with human values whatever that means to you"

Michael Moyer explains that a natural human tendency is to test new technologies, including AI, by attempting to break them or find ways around their safety features. This drive to explore limits is what leads to efforts to "jailbreak" AI models, which Moyer refers to as "alignment" -- the process of ensuring AI behaves according to human values.

"but the most obvious and in ways easiest way to do it is you just put a filter on the model and you say okay if anybody says how do i build a bomb then the model is going to return i'm sorry i'm supposed to be a useful model i'm not supposed to give you that information"

Michael Moyer describes the common method of preventing AI models from providing dangerous information: implementing filters. These filters are designed to intercept and block harmful prompts, such as requests for instructions on building a bomb, before they reach the core AI model.

"you've got what researchers refer to as a size gap between these things between the filter and between the model itself and what these cryptographers set out to explore is is there a way to exploit this size gap between the filter and the model"

Michael Moyer highlights a critical vulnerability in AI systems: the "size gap" between the protective filter and the larger, more powerful AI model. He explains that cryptographers are investigating whether this disparity in size and capability can be exploited to bypass the filters.

"they were looking for an argument which was going to show that perhaps the size gap between these filters and the model themselves are always something that can be exploited and this work was done by this work was done by an international group of both cryptographers and ai researchers led by shafi goldwasser who's a turing award winning computer scientist and cryptographer and she's at both mit and at berkeley"

Michael Moyer discusses the research led by Shafi Goldwasser, a distinguished computer scientist and cryptographer. He notes that the goal of this international collaboration was not merely to find a new way to bypass AI filters, but to establish a general argument that the inherent size difference between filters and AI models creates a persistent exploitable loophole.

"so by doing something like that you're able to slip past there are all these different ways and again it's a cat and mouse thing and but this is also one of the good things about filters is that once you find a jailbreak right once open ai knows that like oh this is a problem it's pretty straightforward to adjust your filter to be able to protect against that new vulnerability rather than going back and retraining your foundation model"

Michael Moyer explains that while various methods exist to "jailbreak" AI filters, the advantage of filters is that once a vulnerability is discovered, it can often be addressed by updating the filter itself. This is more efficient than retraining the entire foundation model, which is a costly and time-consuming process.

"but the very nature of it that it is smaller and lighter and less powerful is the thing that the cryptographers were able to exploit okay so by using a time lock puzzle that the filter will essentially give up on because it's a smaller neural network you can get a query that otherwise would not be allowed into the large language model and it would output this forbidden information that you're asking for"

Michael Moyer clarifies how cryptographers exploit the AI filter's limitations. He states that because the filter is a smaller, less powerful neural network, it can be tricked by complex methods like time lock puzzles, which it will eventually abandon due to computational constraints, allowing the harmful query to pass through to the main AI model.