Suppose you’ve trained a really clever AI model, and you’re planning to deploy it in an agent scaffold that allows it to run code or take other actions. You’re worried that this model is scheming, and you’re worried that it might only need to take a small number of actions to get to a dangerous and hard-to-reverse situation like exfiltrating its own weights. Problems that the AI can cause with small numbers of actions are particularly hard to address with standard safety techniques, because by default you are unlikely to notice the problem until the hard-to-reverse outcome has already occurred.

One of the main classes of techniques that you could apply in the hope of preventing these catastrophic actions is what we call untrusted monitoring (introduced in our paper here), which is roughly “before you execute a model's action, ask another instance of that model whether the proposed action [...]

---

Outline:

(05:51) A basic design for untrusted monitoring

(06:37) Untrusted monitoring during deployment

(11:32) Training your untrusted monitor

(13:31) How helpful would this be if the untrusted monitor did its best?

(14:51) Analyzing this under the adversarial assumption: can the model implement a conditional policy that only lies on real attacks?

(19:30) Rare failures aren’t an option for untrusted monitors

(20:41) How hard is it for a schemer to distinguish real examples of attacks from synthetic ones?

(21:03) Synthetic input contexts look obviously fake

(23:59) The monitor finds it naturally easy to distinguish synthetic attacks from real attacks

(27:45) Using a coordinated strategy that makes it easy to distinguish

(32:38) Preventing collusion under the assumption that the models can choose a coordination strategy

(36:04) A note on inference costs

(37:17) Conclusion

(39:19) Appendix: More on how helpful untrusted monitoring would be if the untrusted model did its best

(42:14) Appendix: A rule of thumb for estimating safety with execute/replace/audit protocols

The original text contained 4 footnotes which were omitted from this narration.

The original text contained 2 images which were described by AI.

---

First published:

Source:

Narrated by TYPE III AUDIO.

---

Images from the article:

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.