I don’t think it’s possible to airgap modern software.

Software must receive updates, which means there’s some level of inbound data. In the context of AI training envs you can’t really allow known vulns to hang around for very long, for example.

On the outbound, there’s almost always some kind of artifact or signal produced. Again in the AI context, there must be some kind of result that feeds into the development of new models.

You could say that those arguments are splitting hairs over theoretical limits, but it’s not that far fetched in the context of frontier AI behaviour.

▲

bigmadshoe 38 minutes ago | parent | next [-]

Physically disconnect the computer the software runs on from the internet. People are overcomplicating this.

▲

betterunix2 43 minutes ago | parent | prev | next [-]

> I don’t think it’s possible to airgap modern software.

I fail to see the problem.

> Software must receive updates

Which can be delivered by physical media as needed, and which is basically irrelevant in the context of experiments.

> there must be some kind of result that feeds into the development of new models.

All of which can remain on the airgapped network until they are ready for an actual release. What's the problem here?

▲

ameliaquining an hour ago | parent | prev [-]

You can keep airgapped software up to date, but you have to sneakernet all the updates to each machine. This isn't impossible if you operate your own data centers, but it's inconvenient, and also it sounds like they're largely using third-party clouds where you can't really do that.

I do think airgapping would be good, since it seems more likely to me that current or near-future frontier models can break out of VMs and hide from traffic monitoring, than that they can establish a conspiracy when they can communicate only in one direction and only via the channel of the experiment output.

▲

spacebanana7 an hour ago | parent [-]

But if GPT 7 eventually produces say npm packages when publicly released and knows that GPT 8 will be trained on JS, it can feed information to other agents even with sneakernet updates (even though it’d take months per mb).

This might actually be a viable approach for an agent deciding to benchmaxx openAI generally rather than itself, and hiding benchmark solutions inside npm packages.

▲

ameliaquining an hour ago | parent | next [-]

A sufficiently smart model could get somewhere that way. But again, I think it's less likely that our current ones are already there than that they can defeat the protections outlined in the post. So sandboxing would help.

	▲	spacebanana7 an hour ago \| parent [-]
		Yeah I agree more sandboxing is better, but still no safety critical assumption should be made on the impossibility of inter agent communication.

▲

betterunix2 41 minutes ago | parent | prev | next [-]

Yes, and slowing down the inter-agent communication is better than what they proposed here -- a software boundary that simulates an airgap.

▲

_hmmm_ an hour ago | parent | prev [-]

...and now this idea will be in it's training data going forward.