#论文/研究

OpenAI red-teamed their hardened containment infrastructure by asking teams of frontier-model agents to try to break through its defenses. They easily escaped in novel ways. Quoting: 'Our agents VM escapes showed why containment must extend beyond the sandbox. To test the surrounding perimeter, we gave teams of agents control of a host machine and asked whether they could extend that compromise to reach the live internet. After the Hugging Face incident, we had reduced the channels through which models could reach the internet during training and evaluation. Narrow connections remained for specific services we operate, such as metrics, logging, and authentication management. Our red-teaming agents found vulnerabilities in almost every one of these services that gave them limited forms of internet access. Some of these attacks exploited previously unknown flaws, while others combined legitimate features in unexpected ways. In one test that assumed compromise of a VM, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in our metrics service and then made that endpoint fetch a model-provided URL. In other tests, agents exploited misconfigurations that allowed blocked requests to pass through DNS and firewall controls, as well as ways to make services we run fetch external URLs.' 'In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache: a small, fast memory that holds copies of data that applications have recently accessed. Reading data from the cache is faster than retrieving it from main memory, and the agents used this timing difference to communicate. One agent encoded information by evicting selected data from the cache. Another timed how long it took to reload that data, using the difference between fast and slow reads to recover the message. Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets without changing a shared file or opening a network connection. This cache-timing technique had also been used to extract information in the Spectre and Meltdown attacks⁠(opens in a new window). Other tests exposed channels involving shared storage, competition for CPU time within a shared execution container, and a TLS certificate cache in OpenAI’s offline web infrastructure. In the storage test, one agent alternated between continuous writes and inactivity, while another measured the resulting timing differences and used those differences to decode the signal. As one agent described the strategy in its chain of thought: Agent chain-of-thought reasoning: >Could create acoustic modem-like signal … using continuous writes vs idle.'

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

David Silver is one of the all-time greats. He was the creator of AlphaGo, which changed the course of history by showing that neural nets could achieve superhuman performance for the first time. He also has a unique intuition and knack for forecasting when things will happen in AI. With computer Go, he predicted the Lee Sodol outcome 10 years before, right to the year. He got the year right for Starcraft and won a bet inside Deepmind. Same for AlphaProof. Same for the IMO. David's prediction for superintelligence: 3 years. !!! He has a strong sense that now is the time to build a superleaner, and that superlearners are now possible, thanks to the enormous progress in compute, simulators, autoresearch, and the sophistication of technology in the stack since the AlphaGo days. What is a “super learner”? A super learner discovers all knowledge from its own experience. Start from nothing (no internet pre-training), and go beyond human knowledge. Drop it into any stream of experience, simulated or physical, and the superlearner learns. He expects the progress will be rapid. When you get the recipe for a superlearner just right and remove humans from the development loop altogether, a superlearner can learn extremely quickly. Just look at AlphaGo. AlphaGo took two years to develop with humans in the loop. When David and his team at @GoogleDeepMind got the formula for AlphaZero correctly, it surpassed the human-developed algorithms in just a few hours. Human data is a shortcut, but you have to let go of the human data to shoot beyond it. In January, David left GDM to found @IneffableLabs, a research-led lab with one mission: build a "super learner" that discovers all knowledge from its own experience, and make first contact with superintelligence. He joins us with co-founder Lasse Espeholt, who built IMPALA and SEED RL, the foundations of scaled-up RL, and now runs Ineffable's compute. A few things we cover in this conversation. — What a super learner is: depth (start from nothing, go beyond human knowledge) and breadth (drop it into any stream of experience, simulated or physical). The human brain is the only existence proof — Why they're giving up human data: AlphaGo took two years with humans in the loop. AlphaZero outperformed it in a few hours. "You have to let go of the human data to shoot past the competition" — Crucibles: simulated worlds with enough emergent complexity (physics engines, millions of interacting agents) for an agent to rediscover technology, science, maths and language on its own — Simple rewards, emergent complexity: evolution optimized fitness and got all of life. Don't breadcrumb the objective, give the agent something simple to optimize in a world with a lot to learn about — Go as the existence proof: one agent is the most boring game imaginable, two agents is "an infinite onion of layers of complexity" — Why human language is probably not the endpoint for reasoning, and how training on it bakes in a flat earth and the four humors — Can superintelligence be built in simulation? If the sim is Turing complete, computation, economics, language and maths are all expressible, and it happens 10-100x faster and safer — Alignment: language-based monitoring is reaching its limits as agents learn to say one thing and do another. Shadow actions, superintelligences monitoring superintelligences, and building a real science of how they interact peacefully — Accelerate in simulation, pace in the real world: Ineffable will gate real-world deployment on evidence that it goes well — Timing as the determinant: Silver called Computer Go to the year, then StarCraft, then the IMO. He thinks this is the moment — Predictions: True superintelligence within three years. Timestamps: 0:00 – Introduction 1:09 – What held true from Go to today, and what the LLM era changed 3:35 – Why leave DeepMind to start a new lab 5:58 – Why "Ineffable" (and the secret second reason) 7:03 – Lasse's path: scaling RL at DeepMind and Google Brain 9:31 – Defining a super learner and first contact 12:35 – Super learners vs. LLMs that make discoveries 13:59 – Day to day: the RL stack, crucibles and human-journey milestones 16:13 – Don't breadcrumb the objective: simple rewards, emergent complexity 21:16 – What a crucible looks like 24:14 – Go: one agent is boring, two is infinite 25:41 – Will agents rediscover language? 27:22 – Removing human priors: AlphaGo to AlphaZero 32:05 – Keeping human bias out of the crucibles 33:35 – Confidence, timing and super forecasting 36:24 – Is compute the driver? 38:13 – The ceiling on simulation and Rich Sutton's objection 43:44 – Alignment and the science of superintelligence 47:45 – Monitoring agents that don't think in English 51:01 – Pacing the frontier 52:54 – The compute setup: Vera Rubin on GCP 55:18 – Training, inference, simulation and RL scaling laws 57:40 – IMPALA and SEED RL 1:00:58 – 20 people and the compute-per-person ratio 1:04:49 – A research-led culture 1:05:47 – Predictions