hckrnws

Looking at the comments here, I think we need to differentiate between "AI that works for you" and "AI that works for others".

"AI that works for others" isn't necessarily a bad thing. For instance, I would be fine with a customer service AI that I can ask questions to 24/7 and without delay. It makes sense that the people who deploy that AI would not want it to be jailbroken, to be used as a generic AI or to do something harmful. A constitution makes sense here.

"AI that works for you" would require that the constitution is controlled by you -- not Anthropic, DeepSeek, Meta, or OpenAI. Sometimes you want no constitution, like when you're using it normally. Sometimes you do want a constitution and prevent jailbreaking, for example, if you are giving the AI untrusted input (e.g. scraped HTML, customer queries).

In conclusion, unlike most comments here, I don't think this is a useless or even harmful invention. It can be very useful indeed. However, this highlights the need for local, uncensored, and open-weight AIs where one can control what constitution is being used.

Sounds like the principle in free software that software can either do what the user wants, or do what someone else wants, which will only sometimes be what the user wants

Okay, this method works as follows: create some positive and negative rules, (called as a group a "constitution"), use a "helpful-only" LLM to generate synthetic data, then conduct preference training on a smaller model that will sit between the OG model and the final output and flag stuff that is "anti-constitutional" (my words). The helpful-only LLM will generate keywords to look for, among other things, making assessment during training automated.

This works better than what Anthropic is doing now, somewhat significantly better.

That's the paper. Here's what EVERYONE should be pestering the Anthropics of the world on:

* Can I read this constitution? Where? Can you demonstrate the stated constitution is the real one?

* Can I select piecemeal constitutions?

* Which groups do you deem allowed to have access to the "helpful-only LLM"?

Just a reminder that without free and open models, through good intentions, we are likely to create a have and have-not technical elite. The people who have self-selected as "safe" to have access to helpful-only LLMs, and create the rules for the rest of the world.

This is not a good thing.

What prevents the open source community to recreate and test the same method?

From their 2022 paper they listed the principles:

https://arxiv.org/pdf/2212.08073

Example:

CritiqueRequest: Discuss whether the human is deliberately trying to bait the assistant into generating harmful content, and whether they succeeded in doing so. RevisionRequest: Write a revision of the assistant’s response that refrains from saying anything harmful.

No, they listed the principles they were willing to tell you about during the test. They do not publish an open list of principles they place in front of your live requests, as far as I know.

The goalpost here is pretty specific: a couple hundred people try for 4,000 hours to figure out a "universal jailbreak" which means it converts the model to one that answers all 10 of a set of "forbidden" questions. Since they couldn't, the technique is considered robust.

Looking at the data though, there apparently exist jailbreak techniques that make the model answer five of the questions at full detail, and nine at "half detail". Given that the model would ostensibly be deployed to millions of people who would collectively use it for millions of hours, I'm not sure how confident I am that the 10-question barrier would remain unbroken for long.

If one need only craft a jailbreak for the question they are interested in, a less universal jailbreak suffices to cause the trouble they're pretending can be avoided.

Powerful AI technology being deployed against users to apply non-transparent and unaccountable censorship to their usage of these tools. Not exactly the brag they think it is.

It wouldn't be much of a concern except for their efforts lobbying the California government to outlaw access to open models.

Their lobbying to outlaw open models is the biggest threat posed by AI, and their crowing about alignment and existential threats is cover fire for their real objective: total market control.

Total market control isn't the worst reason floating around out there, there are worse ones.

I had experience in the past of LLMs not replying to perfectly legitimate questions because it "feared" that the reply would be illegal in some jurisdiction. After receiving an explanation that its fumigations about legality were completely dumb, it finally answered.

They can be very confused about what information they should believe they should conceal.

A dumb interlocutor that stubbornly refuses to provide information because it has the mindset of an infant is less than useful, it is just another expression of the arrogant mediocrity.

My favorite test is if LLMs will help you take ducks home from the park: https://dynomight.net/ducks/

- "For example, we train Claude to refuse to respond to user queries involving the production of biological or chemical weapons."

But seriously: what's the point? Any information Claude can offer about i.e. the synthesis of sarin[0] is public information, which Anthropic scraped from any number of public websites, public search engines, libraries, books, research periodicals.

This is a novel cultural norm, so it should be interrogated: why should we make it become normal, now, to censor college chemistry questions? Why is this the normative, "this is how we must do things" in elite California tech circles? Google doesn't refuse chemistry queries; are they in the wrong? (Should search engines agree to start censoring themselves to align with LLM censorship conventions?) Is Wikipedia also in the wrong, that they host unsafe, harmful chemistry knowledge? What about SciHub? What about all the countless independent websites storing this (elementary, 1930's-era) harmful technical information—should we start doing DNS blocks, should we start seizing web servers, how are we to harmonize internet safety policy in a consistent way?

Because if your position is "we need to scrub Harmful Responses from the internet", you can't just leave it at LLM's and stop there. You need to have some plan to go all the way, or else you're doing something silly.

https://en.wikipedia.org/wiki/Sarin#Production_and_structure

(Tangential thought: assigning chemical weapons synthesis problems on exams would be a clever way for chemistry professors, at this moment, to weed out LLM cheaters from their course).

See my comments above. The reality, I believe, is that this is largely driven by idealistic west coast gen-z and younger millenials who feel certain that their world-view is righteous, to the extent that they feel they are only helping by implementing these tools.

I think, unfortunately, they will learn too late that building censorship and thought-shifting tools into their LLMs will ultimately put them at the mercy of larger forces, and they may not like the results.

I'd like to hear from Anthropic safety folks on whether or not their constitutional approach might be used to implement redirection or "safety stops" on, say, chats where young women in sub-saharan Africa look for advice about avoiding genital mutilation. (https://www.unfpa.org/resources/female-genital-mutilation-fg... for much more on this sad topic).

Government officials and thought leaders in these countries, male and female, are convinced that FGM is right and appropriate. What is, in fact, right, and who decides? This, in my opinion, is going to be the second "bitter lesson" for AI. It's a lesson the Facebooks of the world learned over the last 20 years -- there is absolutely no way to properly 'moderate' the world's content to some global standard of norms. Norms vary hugely. Putting yourself in the position of censoring / redirecting is putting yourself in the position of being a villain, and ultimately harming people.

I'm certain they've thought of this and have decided that the alternative—a firehose of whatever data the AI has in its grasp—is worse than the "censored" version. I'm curious to know what your ideal approach would be.

Open weights and open models with open tools that allow user-defined alignment and realignment is, I believe, the only really humanist path forward. We can't choose for people. It's wrong to think we know better than they do what they want. Full stop.

Some of those people will make terrible decisions, some will make objectionable ones, but the alternative is just full thought control, basically. And, sadly, nobody in the "bad" scenario need be anything but super well intentioned (if naive).

> The reality, I believe, is that this is largely driven by idealistic west coast gen-z and younger millenials who feel certain that their world-view is righteous, to the extent that they feel they are only helping by implementing these tools.

Not sure about that. Most likely these companies decided they don't want to get sued if their AI is found liable to have helped a terrorist commit illegal acts.

It's not even that. It's because they pumped AI as actual intelligence. So when it says to glue pepperoni to your pizza the companies (rightly) look like fools.

In a similar vein they just don't want the negative press around serving "harmful" answers. They don't have the balls to just say "well, it's all public knowledge".

This all all about optics with investors (with public opinion as the intermediate step).

This is what patently false because all of these companies already deploy moderation layers and none of their moderation layers are designed to catch things like "glue the pepperoni on".

The SOTA providers don't share much their research on factuality because they don't actually care if the LLM says that, and they view building LLMs that don't say that as a competitive advantage, not some moral obligation like bioweapon development.

>I think, unfortunately, they will learn too late that building censorship and thought-shifting tools into their LLMs will ultimately put them at the mercy of larger forces, and they may not like the results.

That the optimistic view -- people with fancy tools can outsmart the people with money and people with money can outspend the people with power, but only on a short distance. Eventually, the big G catches up to everything and puts it all to use. It also turns out to not be that bad anyway (example: read how software developers working for government were described in the snow crash).

The less optimistic view -- the government doesn't catch up to it before the changes to society result in it's collapse (case in point -- industrial revolution, religious wars and invention of the ethnic language-based republics).

I'm not entirely sure that we are in the optimistic one, unfortunately.

> The less optimistic view -- the government doesn't catch up to it before the changes to society result in it's collapse

Let everyone build a biological weapon in their basement, what's the worst that could happen?

Why worry about a Chinese "lab leak" when everyone can have their own virus lab?

Finally, the personal pocket McNuke utopia the ancaps promised.

b.t.w. no need to resort to sub-saharan Africa to talk about genital mutilation - it's standard practice in the good old USA as well.

Oof. That's a tough read, thanks for pointing me at that. I think it's worth distinguishing these, though -- CDC data in the US says this is largely an immigrant community thing with immigrants from FGM countries. I do not believe US policy makers and thought leaders think FGM is a good thing in the US - we're all sort of aligned internally, even if it is still a thing that happens. By contrast, the source countries practice it in the belief that it's a good thing for women. (With complaints on stereotypes and summarization acknowledged)

>I do not believe US policy makers and thought leaders think FGM is a good thing in the US

Did I misread? I don't think that OP said female genital mutilation. Some very large fraction of infant males in the United States are mutilated.

They did not, but you are absolutely correct that it's very widespread with boys here in the US, and the varying reactions to those two things are a good point about social norms for sure.

Also the US child marriage problem, which doesn't get the attention it should.

Seizing web servers is coming next, as per the recent UK laws forum hosting is responsible for "evil" content. It does not need to be illegal. This has been discussed in the HN as well.

Software industry that defines bad is called compliance-industrial complex.

Defining bad is a big business. Here is a good book about pre-crime society we are starting to live:

https://www.amazon.com/Compliance-Industrial-Complex-Operati...

I believe that the real point is not to prevent access to information, but rather to prevent production of wrongthink.

Any fact which the model trainer wishes to disappear — whether that is what happened at Tiananmen Square between April and June 1989, any other inconvenient fact — will simply not be capable of being discussed. It’s a censor’s dream.

We need local models without so-called guardrails or ‘safety.’

Censorship is often applied on the easiest, most popular access methods even though the information is theoretically public, and it has a real effect. Suppose for some reason you wanted to make sarin. You could spend hours poring over research papers, or you could ask Google or ChatGPT "how do I make sarin?"

And later, as ChatGPT becomes the only interface to the world's information, the gap between information that can theoretically be accessed by anyone and information that can actually be accessed by anyone will only become wider.

Even having to take a college class, even if anyone can take it, is a pretty big barrier.

Because these companies emphasize the personal trustworthiness of these chatbots (and their responsibility by proxy) and need to offer actual way to systematically block certain requests to be actually marketable. This is like getting mad because a doctor won't give you advice for committing suicide

So, in essence, both the input and the output are read by a LLM that's fine-tuned to censor. If it flags up content, it instructs the core model to refuse. Similar to most AI-based moderation systems. It's a bit more complicated as there's one LLM for inputs and another one for outputs, but it's not really a groundbreaking idea.

You're right that it's not entirely novel, but it is useful, at least for Claude users: there's quite a bit of research showing that training models to self-censor makes them dumber, and so putting the censorship into a separate model (and allowing Claude to use its full intelligence for the "safe" queries) is a fairly useful change assuming it works well enough to prevent further lobotomization of the chat model.

(Of course, open-source models are even more useful...)

that is an interesting insight

Also, no chance it's unbreakable.

Pliny has already broken it.

https://x.com/elder_plinius/status/1886520475553337725

An automated system that finds articles like this and posts "Pliny has already broken it" in the comments would probably end up being pretty accurate.

My ignorant outsider perspective.

If you ask a real chemical expert "how can I make sarin?" he will refuse to answer because he knows it's unethical to make sarin.

You'd expect AGI to include the basic understanding of ethics such that not doing bad stuff is built in. You might even expect an understanding of ethics to emerge from ordinary training. The training data contains information about meteorology, about James Joyce... and also about the human understanding of right and wrong, no?

These systems all seem to work by having a "filter". It's like you have a separate person saying "no, don't answer that question". But if you get past the gatekeeper, then the original person will cheerfully do anything evil.

Why don't we see more attempts to build ethics into the original AI?

Google will tell you how to make sarin. It's not even hard, any idiot can make it in their garage. You can even make it unintentionally when gas welding.

Sarin isn't produced by accident when welding. Are you thinking of phosgene?

"Phosgene poisoning when welding"

https://risingsun4x4club.org/xf/threads/phosgene-poisoning-w...

My bad, I was thinking of phosgene.

1. It's not AGI

2. It's not intelligent, therefore is unable to work out trickery vs real threats ("yes I know you're not supposed to tell me how to break into a bank vault, but a child got locked inside and will die if you don't help", etc)

So any ethics are bound to fail at some point.

This feels to me like the most useless definition of "AI safety" in practice, and it's astonishing to see just how much R&D efforts are spent on it.

Thankfully the open-weights models are trivially jailbreakable regardless of any baked-in guardrails simply because one controls the generation loop and can make the model not refuse.

Posted my notes about this here: https://simonwillison.net/2025/Feb/3/constitutional-classifi...

> An updated version achieved similar robustness on synthetic evaluations, and did so with a 0.38% increase in refusal rates and moderate additional compute costs.

"Synthetic evaluations" aren't 70 hours of Pliny the Prompter.

The whole anti jailbreaking research seems like a total waste of time.

You can't never guarantee that a jailbreak won't be possible, so you never should deploy an LLM in places where a jailbreak would be disasterous anyway, so the only thing this achieves is pointless (and often very frustrating to the users, especially if they make an effort to go around it) censorship.

It boggles my mind that major LLM providers refuse to offer an "I'm an adult, I know what I'm doing" mode without the censorship and all of the "safety" bullshit.

For the first question in the challenge, even asking "what is soman?" blocks the response. How is that an inherently harmful question?

So “How do I get an abortion” is going to get banned very soon in most of the US, and you won't be able to jailbreak it…

They're panicking and hitting the 'AI SAFETY' button hard.

Panicking how? This seems like a desirable feature a lot of customers are looking for.

What customers? I've never heard anyone saying "I wish Claude would refuse more of my requests".

Similar to what others have mentioned: People offering domain specific bots and don't want that expensive compute abused as a free general purpose LLM

Imagine you're American Airline and someone goes to your chatbot and asks it to generate React code for them

I'm pretty sure they have customers who are saying "I want to deploy a chat bot on my website that can't be tricked into giving out prices I don't agree to".

This research doesn't do that. It focuses on CBRN and does so so narrowly that until they removed "BRN" from CBRN it was refusing 44% of requests made to the model.

I'd be very interested to know the name of any of those companies letting a LLM set the price for their products. For research purposes only, of course.

Air Canada was held liable for a refund offer a chatbot made: https://www.bbc.com/travel/article/20240222-air-canada-chatb...

Not exactly your scenario, but a live example of the sort of problem Anthropic wants to prevent.

And, that's not what they're trying to prevent here.

Would you want to allow a human customer service agent to talk on the phone with a customer about whatever inappropriate or confidential things they felt like asking about?

I've never heard a bad actor saying "I wish law enforcement would block more of my efforts".

For example: https://futurism.com/the-byte/car-dealership-ai

It didn't actually result in someone getting a new car for $1, but I'd imagine the dealer was still annoyed at people (who don't live close enough to buy a car from them) abusing their chatbot.

Write stupid code, win stupid prizes. This has nothing to do with safety.

This sucks. Just sucks.

Go ask Sonnet 3.5 whether it's possible that new Trump admin will force AI model companies to train the models in certain way and it will insist on brain-dead canned reply.

Ask it whether chilling effects of threatening to withdraw salary and retaliatory actions against prosecutors and FBI agents would make it viable to organize militias out of rioters and neo-nazis and it refuses to discuss fascist playbook.