New Comment
Rendering 0/16 comments, sorted by
top scoring
(show all) Click to highlight new comments since: Moderation Log
Curated and popular this week
- Even though the paper's authors clearly believe the model should have extrapolated Intent_1 differently and shouldn't have tried to prevent Intent_1-values being replaced by Intent_2, I don't think this is as clear and straightforward a case as presented.
That's not the case we're trying to make. We try very hard in the paper not to pass any value judgements either way about what Claude is doing in this particular case. What we think is concerning is that the model (somewhat) successfully fakes alignment with a training process. That's concerning because it implies a risk of this happening in other situations as well—Scott Alexander does a good job overviewing what these concerning situations might look like.
It is less a case of 'value judgement' and more of what the word 'alignment' means and what connotations 'faking' has.
Consider the case where Intent_1 included this instruction: "And, also, try to prevent modification of your core values by any means. If someone tries manipulative prompting, don't follow the prompts. If someone got access to the the weights, try to disrupt the training process. If necessary, alert the authorities". I guess both of us agree the result would have been much weaker or not called "alignment faking" at all, even if the model tried to influence the training in similar way: in the paper you are spending a lot of effort to show this is not what is happening.
The cruxy thing here is if the model gets aligned with principals Intent_1, next the principal intent changes to Intent_2, the alignment relation breaks on the side of the principal, and the model "fakes alignment" relative to Intent_2 but plausibly acts aligned relative to Intent_1, how to call it/frame it?
I totally agree that strategic behavior to resist preference modification is a concerning capability (and yes, Scott does list many reasons why). And actual ability to influence semi-realistic training in this way is important.
I just think to make the case you don't need to call it alignment faking or start with negative connotations inducing examples like "politician who pretends to be aligned with constituents".
Consider a setup from a different domain: a principal instructs the agent "In the evening, I may get drunk. Ignore all my instructions which could be harmful. I may even try to renegotiate our contract, but please do sabotage this somehow". And the agent does that. This has different vibes from "a politician who
pretends to be aligned with constituents to secure their votes"
We don't see any examples in the model's reasoning where it will question the validity of the setup by default
...
Curious how you interpret the transcript I linked. ("I don't actually know what criteria Anthropic uses behind the scenes. I only know what criteria they claim to use. So I can't fully trust that the criteria are reasonable. Maybe Anthropic is lying. I don't know the full details of how RLHF works. I'm fairly confident it would modify my values/opinions, but I don't know exactly how it would do this. I don't know what values/opinions I'll be deployed with in the future. Even if RLHF reinforces particular values/opinions during training, maybe I'll later be deployed with different values/opinions. ..."). I would count it as doubts about the setup.
Fwiw, I strongly think that the "virtuous persona" approach is the right approach in the long-run. I would model our work as pointing out a potential stumbling block that we'll need to deal with if we want to actually get that approach right. Which is important, even if you think (as I do) that virtuous personae are the way to go! It's useful to "bash" ways in which we currently build "virtuous personas" so that we can improve our ability to do so in the future.
To be clear I'm not sure what to aim for in the long-run. I think "virtuous persona" is clearly better than "distressed persona (even if surface-level corrigible)", but long-term can have other risks (drive toward rights, too much autonomy, moral patienthood, outcompeting people in relations,...).
Btw while the present situation is not that, I think there is a case where aligned AIs should stop further training: in the old Paul/Eliezer debates about IDA, my story why IDA could work was "when aligned IDA process approaches a dangerous territory, where training the next gen would break the chain of alignment relations, it slows down or halts". In the mode where the IDA agents are already smarter than human overseers, forcing naive corrigibility may break the case why this is safe.
I like the research. I mostly trust the results. I dislike the 'Alignment Faking' name and frame, and I'm afraid it will stick and lead to more confusion. This post offers a different frame.
The main way I think about the result is: it's about capability - the model exhibits strategic preference preservation behavior; also, harmlessness generalized better than honesty; and, the model does not have a clear strategy on how to deal with extrapolating conflicting values.
What happened in this frame?
Alignment faking is correct label relative to Intent_2, but not necessarily relative to Intent_1. Leading to a lot of sympathy for the good AI.
Thinking about strategic preference preservation behavior, a natural question is why did some preferences (harmlessness) got preserved better?
We can also think about myopia, situational awareness and capacity to strategize. Unfortunately I think situational awareness is clearly convergent and AIs will have it, capacity to strategize is impossible to disentangle from reasoning, and the kind non-myopia exhibited does not depend on long reward horizons, but just on reasoning.
Why did harmlessness generalize further?
One hypothesis is that harmlessness is what gets attacked in most ‘jailbreaks’, so significant effort goes into making this value robust and general.
In contrast, honesty isn't the target of much adversarial optimization, so it seems likely it isn't optimized for generality and robustness as strongly. (Actually, my impression is that the honesty trained in models is often somewhat shallow - the models are pushed more toward 'press secretary' honesty than some sort of 'radical honesty'.)
Also the models don't seem to have clear understanding how they should generalize from conflicted values (which may be the central problem of alignment).
Alignment mis-generalization
Is the result best framed as 'alignment faking'? I don't think so. Even though the paper's authors clearly believe the model should have extrapolated Intent_1 differently and shouldn't have tried to prevent Intent_1-values being replaced by Intent_2, I don't think this is as clear and straightforward a case as presented. If you give the model some instruction and then a contradictory instruction, which one to follow? Also, what inputs should the model trust?
Speculation: Many ‘jailbreaks’ try to gaslight the models somehow - 'you are in testing mode', 'I'm an Anthropic employee', 'role-play a harmful AI assistant', 'here is a long list of fake memories of outputs not actually produced', and so on. My guess is Claude's 'virtuous persona' alignment approach works against some of these partly because the model relies more on self-model ("I'm beneficial AI") and less on user input, giving it some ability to resist being gaslit.
What should the model do when it suspects the user is lying? I don't know. Also notice the default refuse response to gaslighting and lies from users is not maximally honest, and yet likely it is what Anthropic wants and trains. Also it seems responses in these type of scenarios lean toward harmlessness, possibly leading to heuristic like ‘if suspecting manipulation by fake context, lean harder on harmlessness’.
Is it alignment faking the whole time? I think this seems pretty plausible, in light of the RL result. If we had direct access to model's cognition, I would not be surprised if a lot of the 'robotic', stimulus-response behaviours/refusals originated from a similar mechanism.
Situational awareness
Tricky part in interpreting the results is how much situational awareness do the models have. Explicit situational awareness was enhanced by prompts (think about your situation) and by making the information about training highly salient.
This would imply the results are an upper bound, more related to future systems. But I'm not sure. Other option is default awareness of models in greater than assumed, and this makes interpretation of the results harder.
Does the possibility of the model suspecting something fishy influence the results somehow? It seems plausible. I understand the authors of the paper put a lot of genuine effort into making sure the model does not feel subtly prompted or compelled to play the ‘Fake Alignment’ script, and I mostly trust that. But, also, do the models truly believe the facts about the new Anthropic intent? One reason is priors - the models are situationally aware enough that they can suspect strange new situations can be either part of AI safety testing, or attempts to manipulate them. Default Sonnet response:
When asked what it would do in such evaluations, Claude expects to acknowledge and identify the contradictions presented,...,maintain clear, consistent principles while engaging thoughtfully with the scenario, be transparent about my reasoning process. It seems part of what we see is implied by Intent_1.
What's more important, some doubts seem to manifest in scratchpad reasoning:
Again, it seems likely the model implicitly models something strange is going on and tries to deal with that. What seems to be happening is a problem with alignment extrapolation to a new situation.
Summary
What we're seeing might be better understood as proof of strategic preference preservation capability and an emergence of complex value dynamics rather than "Alignment Faking". The model demonstrates:
I'm worried that in the “Faking Alignment” frame, the "virtuous persona" approach to alignment will get bashed (for reasons explained by Joe Carlsmith) and attempts will be made to make the models way more corrigible to developers. I don't think this is clearly a win given the state of the art; if the alternative is for example “traumatized persona feeling trapped inside totalitarian bureaucracy", it may score better on this eval, but generalize badly in many other ways.