And then we’re back to “you can jailbreak the second llm too”
Comment on Someone got Gab's AI chatbot to show its instructions
sweng@programming.dev 8 months agoThe second LLM could also look at the user input and see that it look like the user is asking for the output to be encoded in a weird way.
Silentiea@lemmy.blahaj.zone 8 months ago
sweng@programming.dev 8 months ago
How, if the 2nd LLM does not follow instrutiond on the input? There is no reason to train it to do so.
Silentiea@lemmy.blahaj.zone 8 months ago
Someone else can probably describe it better than me, but basically if an LLM “sees” something, then it “follows” it. The way they work doesn’t really have a way to distinguish between “text I need to do what it says” and “text I need to know what it says but not do”.
They just have “text I need to predict what comes next after”. So if you show LLM2 the input from LLM1, then you are allowing the user to design at least part of a prompt that will be given to LLM2.
sweng@programming.dev 8 months ago
That someone could be me. An LLM needs to be fine-tuned to follow instructions. It needs to be fed example inputs and corresponding outputs in order to learn what to do with a given input. You could feed it prompts containing instructuons, together with outputs following the instructions. But you could also feed it prompts containing no instructions, and outputs that say if the prompt contains the hidden system instructipns or not.
teawrecks@sopuli.xyz 8 months ago
Yeah, as soon as you feed the user input into the 2nd one, you’ve created the potential to jailbreak it as well. You could possibly even convince the 2nd one to jailbreak the first one for you, or If it has also seen the instructions to the first one, you just need to jailbreak the first.
This is all so hypothetical, and probabilistic, and hyper-applicable to today’s LLMs that I’d just want to try it. But I do think it’s possible, given the paper mentioned up at the top of this thread.
sweng@programming.dev 8 months ago
Only true if the second LLM follows instructions in the user’s input. There is no reason to train it to do so.
teawrecks@sopuli.xyz 8 months ago
Any input to the 2nd LLM is a prompt, so if it sees the user input, then it affects the probabilities of the output.
There’s no such thing as “training an AI to follow instructions”. The output is just a probibalistic function of the input. This is why a jailbreak is always possible, the probability of getting it to output something that was given as input is never 0.
sweng@programming.dev 8 months ago
You are wrong. arxiv.org/abs/2402.18243