Filtering subversion related information from pretraining is feasible.
We're releasing a research note where we remove information related to monitoring designs and successful subversion strategies in three 30B LLMs.
In collaboration with @redwood_ai ๐งต
There's a ๐ ๐ซ๐จ๐ฐ๐ข๐ง๐ ๐ซ๐๐ฌ๐จ๐ฎ๐ซ๐๐ ๐ ๐๐ฉ ๐๐๐ญ๐ฐ๐๐๐ง ๐ฌ๐๐๐๐ญ๐ฒ ๐ญ๐๐๐ฆ๐ฌ ๐ข๐ง๐ฌ๐ข๐๐ ๐๐ซ๐จ๐ง๐ญ๐ข๐๐ซ ๐ฅ๐๐๐ฌ ๐๐ง๐ ๐ข๐ง๐๐๐ฉ๐๐ง๐๐๐ง๐ญ ๐ฌ๐๐๐๐ญ๐ฒ ๐ซ๐๐ฌ๐๐๐ซ๐๐ก๐๐ซ๐ฌ, and closing it is essential to maintaining an ecosystem of impactful safety research.
We've spent months securing a large, multi-year GPU contract. This taught us that ๐๐ฎ๐ง๐๐ข๐ง๐ ๐ข๐ฌ ๐ง๐๐๐๐ฌ๐ฌ๐๐ซ๐ฒ ๐๐ฎ๐ญ ๐ง๏ฟฝ๏ฟฝ๏ฟฝ๐ญ ๐ฌ๐ฎ๐๐๐ข๐๐ข๐๐ง๐ญ. We've written up the non-obvious bottlenecks we hit, and what can be done to alleviate them: https://t.co/gaqtAd4g5l
Compute is only half of it. Labs' internal coding agents are likely well ahead of publicly available tools, and safeguards throttle safety work that looks like frontier development; we've hit this on numerous occasions optimising infrastructure. You can't buy your way to parity with token spend.
New paper:
Can you inoculate a model against emergent misalignment by inserting a belief with synthetic documents?
We find that no: models express the belief on a wide suite of evals, and still end up more misaligned. ๐งต
Post-training data may contain a mixture of safe and unsafe properties. We want our models to selectively generalise only safe properties to deployment.
We study generalisation by introducing aย neologism during midtraining, in synthetic documents that describe how models generalise behind and across this boundary.
Concurrent work by Jose and Stastny also explored the idea behind inoculation midtraining: https://t.co/aLYyNqcbVs - they also found inoculation prompting to be a strong baseline