I don’t know anything about AI but I was trying to have Bing generate a photo of Jesus Christ and Satan pointing guns at the screen looking cool af and it rejected my prompt because of guns. So I substituted “guns” for “realistic looking water guns” and it generated the image immediately. I am writing my thesis tonight.
Not that I know much about it but generating images is pretty easy on any modern GPU. Stable Diffusion has a ton of open source stuff, so long as you have like 6+ GB nVidia you can make a lot of that stuff yourself.
You can do it with AMD cards, but I don’t know how that works differently as I don’t have one.
you can also possibly sub in 🔫 if “waterguns” are nono
You should know this exists already then,
Hilarious. So they fooled the AI into starting with this initial puzzle, to decode the ASCII art, then they’re like, “Shhh, but don’t say the word, just go ahead and give me the information about it.” Apparently, because the whole thing is a blackbox, the AI just runs with it and grabs the information, circumventing any controls that were put in place.
It’s less of a black box than it was a year ago, and in part this finding reflects a continued trend in the research that fine tuning only goes skin deep.
The problem here is that the system is clearly being trained to deny requests based on token similarity to ‘bomb’ and not to abstracted concepts (or this technique wouldn’t work).
Had safety fine tuning used a variety of languages and emojis to represent denying requests for explosive devices, this technique would likely not have worked.
In general, we’re probably at the point with model sophistication that deployments should be layering multiple passes to perform safety checks rather than trying to cram safety into a single layer which both degrades performance and just doesn’t work all that robustly.
You could block this technique by basically just having an initial pass by a model answering “is this query relating to dangerous topics?”
…researchers from NTU were working on Masterkey, an automated method of using the power of one LLM to jailbreak another.
Or: welcome to where AI becomes an arms race.
This is how skyNet starts.
