Everyone who's thinking about the ramifications of prompt injection attacks now, please consider: This is really just a specific instance of the AI alignment problem. What about when the AI gets really smart, and tries to achieve certain goals in the world that are not what we want? How do make sure that these soon-to-be omnipresent models don't go off the rails when they have the power to make really big changes in the world?
It's the same problem. We have no way to make an AI that's 100% resistant to prompt attacks, OR 100% guaranteed to not try to act in a way that will result in harm to humans. With our current approaches, can only try and train it by bonking it on the nose when it doesn't do what we want, but we don't have control over what it learns, or know whether it has correctly internalized what we want. Like the article says, if you've solved this, that's a huge discovery. With the current intelligence level of GPT it's just a security hole. Once AI's become smarter, it's really dangerous.
If you weren't worried about prompt attacks before and are now, I would say that it makes sense to also reconsider whether you should worry more about the danger of misaligned AI. That 1% or 0.01% situation is guaranteed to come up sometime.
AI as it is now is unverifiable.
It's also organically behaving, and means it can be manipulated, be victim of social engineering, etc, like a human do.
You cannot try to fool a single person a thousand time, but you can try to fool a thousand instance of AI.
This is not a problem with AGI or alignment or anything like that, it's a problem with someone else sneaking inputs into your machine using tricks like white font colours and javascript and stuff like that. It's not about self driving cars it's about other people grabbing the steering wheel. These models literally only respond to the text they're inputted, and if they had alignment or interests or intelligence at all that would be when prompt injection stopped working.
When you say "if they had alignment or interests or intelligence at all that would be when prompt injection stopped working", be wary of conflating alignment and intelligence, because they are orthogonal. A system can be incredibly dumb and do exactly what we want, as in a set of hard-coded business rules. A system can be intelligent, and do something awful, as when a human lures people into dark alleys and murders them, evading capture for years. Or even a human who is smart enough to do great things with their life, but instead decides to languish in a dead-end job and play video games.
Alignment doesn't get easier as the system gets more intelligent. These models seem to do what we want more as they get more powerful, but because we don't understand alignment, or how to interpret them, we don't know if that curve continues, or if it falls off a cliff. We can't look into a model and prove that it will never teach anyone how to hurt someone else, or fall prey to a prompt injection. Or even that it won't do something very specific like generate a particular sequence of tokens we don't want it to.
> These models literally only respond to the text they're inputted, and if they had alignment or interests or intelligence at all that would be when prompt injection stopped working.
Let's take this as true (although I'm not sure it is!). Even if it is, you still must agree that AI will provide bad agents with a staggering amount of new attack vectors. Even if AI itself won't ever do a single bad thing, how do we stop Joe Schmoe's random malignant thought from being amplified ten-thousand-fold?
Any combination of those, not necessarily in that order.
I’m not saying I want this to happen, but we cannot peacefully live in a world that can just be fucked over by anyone at any second, that would be stupid ? Like we can’t let people live with the means to create biological weapons at home either.
It's the same problem. We have no way to make an AI that's 100% resistant to prompt attacks, OR 100% guaranteed to not try to act in a way that will result in harm to humans. With our current approaches, can only try and train it by bonking it on the nose when it doesn't do what we want, but we don't have control over what it learns, or know whether it has correctly internalized what we want. Like the article says, if you've solved this, that's a huge discovery. With the current intelligence level of GPT it's just a security hole. Once AI's become smarter, it's really dangerous.
If you weren't worried about prompt attacks before and are now, I would say that it makes sense to also reconsider whether you should worry more about the danger of misaligned AI. That 1% or 0.01% situation is guaranteed to come up sometime.