Now, consider the following simplistic model for naive (un)aligned AGI:

The AGI outputs English sentences. Each time the AGI does, the human operator replies on a scale of 1 to 100 with how good and valuable and useful that sentence seemed to the human. The human may also input other sentences to the AGI as a hint about what kind of output the human is currently looking for; and the AGI also has purely passive sensory inputs like a fixed webcam stream or a pregathered internet archive.

How does this fail as an alignment methodology? Doesn't this fit very neatly into the existing prosaic methodology of reinforcement learning? Wouldn't it be very useful on hand to have an intelligence which gives us much more valuable sentences, in response to input, than the sentences that would be generated by a human?

There's a number of general or generic ways to fail here that aren't specific to the supposed criterion of the reinforcement learning system, like the AGI ending up with other internal goals and successfully forging a Wifi signal via internal RAM modulation etcetera, but let's consider failures that are in some sense intrinsic to this paradigm even if the internal AI ends up perfectly aligned on that goal. Let's even skip over the sense in which we've given the AI a long-term incentive to accept some lower rewards in the short term, in order to grab control of the rating button, if the AGI ends up with long-term consequentialist preferences and long-term planning abilities that exactly reflect the outer fitness function. Let's say that the AGI is only shortsightedly trying to maximize sentence reward on each round and that it is not superintelligent enough to disintermediate the human operators and grab control of the button in one round without multi-round planning. Some of us might be a bit skeptical about whether you can be, effectively, very much smarter than a human, in the first place, without doing some kind of multi-round or long-term internal planning about how to think about things and allocate internal resources; but fine, maybe there's just so many GPUs running the system that it can do all of its thinking, for each round, on that round. What intrinsically goes wrong?

What intrinsically goes wrong, I'd say, is that the human operators have an ability to recognize good arguments that's only rated to withstand up to a certain intensity of search, which will break down beyond that point. Our brains' ability to distinguish good arguments from bad arguments is something we'd expect to be balanced to the kind of argumentative pressure a human brain was presented with in the ancestral environment / environment of evolutionary adaptedness, and if you optimize against a brain much harder than this, you'd expect it to break. There'd be an arms race between politicians exploiting brain features to persuade people of things that were useful to the politician, and brains that were, among other things, trying to pursue the original 'reasons' for reasoning that originally and initially made it useful to recognize certain arguments as good arguments before any politicians were trying to exploit them. Again, oversimplified, and there are cases where it's not tribally good for you to be the only person who sees a politician's lie as a lie; but the broader point is that there's going to exist an ecological balance in the ancestral environment between brains trying to persuade other brains, and brains trying to do locally fitness-enhancing cognition while listening to persuaders; and this balance is going to be tuned to the level of search power that politicians had in the environment of evolutionary adaptedness.

Arguably, this is one way of viewing the flood of modern insanity at which social media seems to be the center. For the same reason pandemics get more virulent with larger and more dense population centers, Twitter may be selecting for memes that break humans at a much higher level of optimization pressure than held in the ancestral environment or even just 1000 years earlier than this.

Viewed through the lens of Goodhart's Curse: When you have an imperfect proxy U for an underlying value V, the highest values of U will represent the places where U diverges upward the most from V and not just the highest underlying values of V. The harder you search for high values of U, the wider the space of possibilities you search, the more that the highest values of U will diverge upwards from V.

### incorporated from a work in progress

Suppose that, in the earlier days of the Web, you're trying to find webpages with omelet recipes. You have the stunning insight that webpages with omelet recipes often contain the word "omelet" somewhere in them. So you build a search engine that travels URLs to crawl as much of the Web as you can find, indexing all the pages by the words they contain; and then you search for the "omelet" keyword. Works great the first time you try it! Maybe some of the pages are quoting "You can't make an omelet without breaking eggs" (said by Robespierre, allegedly), but enough pages have actual omelet recipes that you can find them by scrolling down. Better yet, assume that pages that contain the "omelet" keyword more often are more likely to be about omelets. Then you're fine... in the first iteration of the game.

But the thing is: the easily computer-measurable fact of whether a page contains the "omelet" keyword is not identical to the fact of whether it has the tasty omelet recipe you seek. V, the true value, is whether a page has a tasty recipe for omelets; U, the proxy measure, is how often the page mentions the "omelet" keyword. That some pages are compendiums of quotes from French revolutionaries, instead of omelet recipes, illustrates that U and V can diverge even in the natural ecology.

But once the search engine is built, we are not just listing possible pages and their U-measure at random; we are picking pages with the highest U-measure we can see. If we name the divergence D = U-V then we can say u_i = v_i + d_i. This helps illustrate that by selecting for the highest u_i we can find, we are putting upward selection pressure on both v_i and d_i. We are implicitly searching out, first, the underlying quality V that U is a proxy for, and second, places where U diverges far upward from V, that is, places where the proxy measure breaks down.

If we are living in an unrealistically smooth world where V and D are independent Gaussian distributions with mean 0 and variance 1, then the mean and variance of U is just 0 and 2 (the sum of the means and variances of V and D). If we randomly select an element with u_i=3, then on average it has v_i of 1.5 and d_i of 1.5. If the variance of V is 1 and the variance of D is 10 - if the "noise" from V to U varies much more widely on average than V itself - then most of the height of a high-U item probably comes from a lot of upward noise. But not all of it. On average, if you pick out an element with u_i = 11, it has expected d_i of 10 and v_i of 1; its apparent greatness is mostly noise. But still, the expected v_i is 1, not the average V of 0. The best-looking things are still, in expectation, better than average. They are just not as good as they look.

Ah, but what if everything isn't all Gaussian distributions? What if there are some regions of the space where D has much higher variance - places where U is much more prone to error as a proxy measure of V? Then selecting for high U tends to steer us to regions of possibility space where U is most mistaken as a measure of V.

And in nonsimple domains, the wider the region of possibility we search, the more likely this is to happen; the more likely it is that some part of the possibility space contains a place where U is a bad proxy for V.

This is an abstract (and widely generalizable) way of seeing the Fall of Altavista. In the beginning, the programmers noticed that naturally occurring webpages containing the word "omelet" were more likely to be about omelets. It is very hard to measure whether a webpage contains a good, coherent, well-written, tasty omelet recipe (what users actually want), but very easy to measure how often a webpage mentions the word "omelet". And the two facts did seem to correlate (webpages about dogs usually didn't mention omelets at all). So Altavista built a search engine accordingly.

But if you imagine the full space of all possible text pages, the ones that mention "omelet" most often are not pages with omelet recipes. They are pages with lots of sections that just say "omelet omelet omelet" over and over. In the natural ecology these webpages did not, at first, exist to be indexed! It doesn't matter that possibility-space is uncorrelated in principle, if we're only searching an actuality-space where things are in fact correlated.

But once lots of people started using (purely) keyword-based searches for webpages, and frequently searching for "omelet", spammers had an incentive to reshape their Viagra sales pages to contain "omelet omelet omelet" paragraphs.

That is: Once there was an economic incentive for somebody to make the search engine return a different result, the spammers began to intelligently search for ways to make U return a high result, and this implicitly meant putting the U-V correlation to a vastly stronger test. People naturally making webpages had not previously generated lots of webpages that said "omelet omelet omelet Viagra". U looked well-correlated with V in the region of textual possibility space that corresponded to the Web's status quo ante. But when an intelligent spammer imagines a way to try to steer users to their webpage, their imagination is searching through all the kinds of possible webpages they can imagine constructing; they are searching for imaginable places where U-V is very high and not just previously existing places where U-V is high. This means searching a much wider region of possibility for any place where U-V breaks down (or rather, breaks upward) which is why U is being put to a much sterner test.

We can also see issues in computer security from a similar perspective: Regularities that are obseved in narrow possibility spaces often break down in wider regions of the possibility space that can be searched by intelligent optimization. Consider how weird a buffer overflow attack would look, relative to a more "natural" ecology of program execution traces produced by non-malicious actors. Not only does the buffer overflow attack involve an unnaturally huge input, it's a huge input that overwrites the stack return address in a way that improbably happens to go to one of the most effectual possible destinations. A buffer overflow that results in root privilege escalation might not happen by accident inside a vulnerable system even once before the end of the universe. But an intelligent attacker doesn't search the space of only things that have already happened, they use their intelligence to search the much wider region of things that they can imagine happening. It says very little about the security of a computer system to say that, on average over the lifetime of the universe, it will never once yield up protected data in response to random inputs or in response to inputs typical of the previously observed distribution.

And the smarter the attacker, the wider the space of system execution traces it can effectively search. Very sophisticated attacks can look like "magic" in the sense that they exploit regularities you didn't realize existed! As an example in computer security, consider the Rowhammer attack, where repeatedly writing to unprotected RAM causes a nearby protected bit to flip. This violates what you might have thought were the basic axioms governing the computer's transistors. If you didn't know the trick behind Rowhammer, somebody could show you the code for the attack, and you just wouldn't see any advance reason why that code would succeed. You would not predict in advance that this weird code would successfully get root privileges, given all the phenomena inside the computer that you currently know about. This is "magic" in the same way that an air conditioner is magic in 1000AD. It's not just that the medieval scholar hasn't yet imagined the air conditioner. Even if you showed them the blueprint for the air conditioner, they wouldn't see any advance reason to predict that the weird contraption would output cold air. The blueprint is exploiting regularities like the pressure-temperature relationship that they haven't yet figured out.

To rephrase back into terms of Goodhart's Law as originally said by Goodhart - "Any observed statistical regularity will tend to collapse once pressure is placed upon it for control purposes" - statistical regularities that previously didn't break down in the face of lesser control pressures, can break down in the face of stronger control pressures that effectively search a wider range of possibilities, including possibilities that obey rules you didn't know were rules. This is more likely to happen the more complicated and rich and poorly understood the system is...

### end of quote

...which is how we can be nearly certain, even in advance of knowing the exact method, that a sufficiently strong search against a rating output by a complicated rich poorly-understood human brain will break that brain in ways that we can't even understand.

Even if everything goes exactly as planned on an internal level inside the AGI, which in real life is at least 90% of the difficulty, the outer control structure of the High-Rated Sentence Producer is something that, on the face of it, learns to break the operator. The fact that it's producing sentences more highly rated than a human inside the same box, the very fact that makes the High-Rated Sentence Producer possibly be useful in the first place, implies that it's searching harder against the rating criterion than a human does. Human ratings are imperfect proxies for validity, accuracy, estimated expectation of true value produced by a policy, etcetera. Human brains are rich and complicated and poorly understood. Such integrity as they possess is probably nearly in balance with the ecological expectation of encountering persuasive invalid arguments produced by other human-level intelligences. We should expect with very high probability that if HRSP searches hard enough against the rating, it will break the brain behind it.