#基础模型

I think @NaveenGRao is one of the most under-discussed but brilliant entrepreneurs of our time. He is able to consistently see where a market is going and place himself ahead of it. - Founded Nervana and sold to Intel for $400M. - Founded MosaicML and sold to Databricks for $1.3BN. - Raised $450M seed round at $4.5BN valuation for Unconventional. This success has given him license to say things that few people would have the confidence to say. - “Most software investors today are f*****”. - “Agentic coding is overrated and uninvestable”. - “It is completely techno-optimist to assume companies will have their own models and own their own intelligence”. This discussion rallies against some of the conventional beliefs of the valley in a way you have not heard before. My notes from the discussion with Naveen below. (Link in comments). 1. Are Software Investors F**ked? Pure software investors are "kind of f**ked" because SaaS will no longer be where margin is gained. Since around 2010, cloud services let founders spin up products quickly and chase $100M to $200M markets. As applications shift toward the intelligence layer, Naveen does not see software being a huge market in 20 years. Do you agree software investors are f***** in a much more infra/hardware centric landscape @PalmerLuckey @mttgrmm @shaunmmaguire 2. Why Agentic Coding Is Overrated and an Uninvestable Category Agentic coding is overrated as a market because the value moves to the model provider. The harness and the IDE are not very sticky, and people move between tools fluidly. Outside of the model providers, it is a category he would not invest in today. What is the single biggest reason why the coding agent should not sit within the model provider @ScottWu46 @matanSF 3. Is It Completely Techno-Optimist to Assume That Companies Will Own Their Own Intelligence With Their Own Specialized Models? Owning your own intelligence takes scale. A firm like Cooley can invest to make it happen, while a mom-and-pop shop in Nebraska will buy an out-of-the-box service instead. Big players will customize because rivals using AI to supercharge their margins force them to. 4. Where Is the Value in the Robotics Stack? The value in robotics will not sit in the model alone. Naveen invests in companies building robotics models and expects them to end up building end-to-end devices, selling the robot together with a model that does something very well. Where will the most value accrue in the robotics stack? Model? Data? Hardware? @tonyzzhao @joshavata @bercankilic 5. Why Steve Jurvetson Is My Favorite Investor Meeting Of roughly a thousand investor meetings, the one that stood out was with @FutureJurvetson. He geeked out on numeric representations and marked up the papers Naveen sent him like a technical colleague. In 2014, when no one had pitched a hardware startup in 10 years, he was keen to invest because he had been thinking about the space himself. 6. How American Investors Differ From European Investors Founders in the US are given permission to think bigger. In Europe, the investor network is so conservative that a founder with a crazy idea is written off as mad, while in the US the same founder is seen as awesome for thinking big. EF has largely moved focus to the US and SF specifically, would you agree with this @Alicebentinck @matthewclifford? 7. Why the Inference Market Will Be $10 Trillion Within 10 Years AI models alone will be a trillion-dollar market in the next few years, and inference will reach $10 trillion within 10 years. Cutting the cost of delivering a token by one order of magnitude effectively 10Xs the market, since the base of potential uses grows more than 10X, which Naveen ties to Jevons paradox. What does no one see that everyone should see about the inference market @GavinSBaker @lqiao @bernhardsson

The only way out is through. They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it. There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks. The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous. There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited. The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with. The only way out is through.

OpenAI red-teamed their hardened containment infrastructure by asking teams of frontier-model agents to try to break through its defenses. They easily escaped in novel ways. Quoting: 'Our agents VM escapes showed why containment must extend beyond the sandbox. To test the surrounding perimeter, we gave teams of agents control of a host machine and asked whether they could extend that compromise to reach the live internet. After the Hugging Face incident, we had reduced the channels through which models could reach the internet during training and evaluation. Narrow connections remained for specific services we operate, such as metrics, logging, and authentication management. Our red-teaming agents found vulnerabilities in almost every one of these services that gave them limited forms of internet access. Some of these attacks exploited previously unknown flaws, while others combined legitimate features in unexpected ways. In one test that assumed compromise of a VM, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in our metrics service and then made that endpoint fetch a model-provided URL. In other tests, agents exploited misconfigurations that allowed blocked requests to pass through DNS and firewall controls, as well as ways to make services we run fetch external URLs.' 'In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache: a small, fast memory that holds copies of data that applications have recently accessed. Reading data from the cache is faster than retrieving it from main memory, and the agents used this timing difference to communicate. One agent encoded information by evicting selected data from the cache. Another timed how long it took to reload that data, using the difference between fast and slow reads to recover the message. Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets without changing a shared file or opening a network connection. This cache-timing technique had also been used to extract information in the Spectre and Meltdown attacks⁠(opens in a new window). Other tests exposed channels involving shared storage, competition for CPU time within a shared execution container, and a TLS certificate cache in OpenAI’s offline web infrastructure. In the storage test, one agent alternated between continuous writes and inactivity, while another measured the resulting timing differences and used those differences to decode the signal. As one agent described the strategy in its chain of thought: Agent chain-of-thought reasoning: >Could create acoustic modem-like signal … using continuous writes vs idle.'

@nateberkopec I'm cautiously starting to suspect it may not be a problem with today's strongest models - Anthropic in particular are very confident about their ability to avoid prompt injections - but it's still a real concern for cheaper, weaker models