davmre

Joined 15 years ago

Karma
3,189
Submissions
309
Member since
May 9
cs.berkeley.edu/~dmoore
View on Hacker News

Recent submissions

Comment · 1 month ago
> a team of agents completed the proof in a little under two weeks, consuming about six billion output tokens from a general-purpose internal research model roughly comparable to Claude Fable 5.1.

At $50/M output tokens, this would have cost on the order of $300k (plus a bit for input/prefill tokens) at API rates.

Comment · 2 months ago
The watermark lives in the entropy of sampled outputs. Typical entropy of sampled English text is about 1 bit/token, meaning that a 500-token response from a given model might have 2^500 potential outputs of roughly equal probability. The watermark restricts the sampler to some subset of these - say, 2^400 of them, so chance of accidentally generating a watermarked output is astronomically small (2^-100). As long as the restriction doesn't condition on the content of the samples themselves, the watermark is "non-distortionary": the outputs are all still samples from the model's original distribution, and so will satisfy all the same statistical properties, including things like expected performance on any benchmark or eval you can construct.

In cases where the output has low entropy - eg, you've asked a model to repeat some input text verbatim, or to answer a question that has exactly one correct answer - there will be no randomness for the watermark to hide in, so the output will effectively not be watermarked. Code lives somewhere in the middle: it generally has less entropy-per-token than prose, so would need more tokens to reach a given level of detectability.

There are lots of ways to restrict output samples. The simplest conceptually would be to just use a restricted pool of PRNG seeds, but in practice there are more sophisticated constructions to try to build in robustness to minor edits, allow detectability without needing the original weights and prompt, etc. Google's SynthID paper (https://www.nature.com/articles/s41586-024-08025-4) is a good starting point if you want to understand a recent production-ready method (or you can just ask an LLM to explain it to you).

Comment · 2 months ago
That depends how much text you're compressing.

For example, LLM pretraining datasets are on the order of tens or hundreds of terabytes. If an LLM-based code for that data is ~twice as efficient as gzip, you could afford to transmit the weights of even a very large LLM and still come out ahead.

In other words: LLMs actually are excellent compressors of their training sets in the formal information-theoretic sense.

Comment · 2 months ago
Any compressor actually can be used, trivially, as an autoregressive language model.

Given a context (for LLMs, this would include the entire pretraining dataset, plus the prompt), you compress `context + next_token` for every possible next token. The tokens that co-compress best with the existing context are the 'least surprising' continuations. Choose one of them and iterate.

You can easily generate text with gzip this way. It won't be very good text, because gzip compression is not as sophisticated as a transformer + SGD, but the principle is the same.

Comment · 4 months ago
This sounds more or less unavoidable? Decompilers are inherently security-sensitive. If you take avoiding cyberattack uplift seriously as a goal, I don't see how you get around essentially refusing to work on them.

Obviously there are plenty of innocuous applications too, but it's not like the people building decompilers for nefarious reasons will be explicit about it. The LLM abstraction just inherently doesn't have enough context to distinguish your intentions or your broader use cases. This is why both Anthropic and OpenAI have had to create side channel mechanisms for security researchers to establish a trusted use context. It sounds like this makes this not a viable product for you, unfortunately, and it makes sense that that's frustrating. But I also don't see what different behavior one could reasonably expect given the constraints.

If it's any consolation, these restrictions only make sense for models that are ahead of the open-weights frontier, so open-source hackers will presumably get Mythos-level capabilities in the relatively near future anyway.

Comment · 6 months ago
Comment · 9 months ago
Why can't it be both?
Comment · 11 months ago
It's true that these are very different activities, but I think most ML researchers would agree that it's actually the creation of ImageNet that sparked the deep learning revolution. CNNs were not a novel method in 2012; the novelty was having a dataset big and sophisticated enough that it was actually possible to learn a good vision model from without needing to hand-engineer all the parts. Fei-fei saw this years in advance and invested a lot of time and career capital setting up the conditions for the bitter lesson to kick in. Building the dataset was 'easy' in a technical sense, but knowing that a big dataset was what the field needed, and staking her career on it when no one else was doing or valuing this kind of work, was her unique contribution, and took quite a bit of both insight and courage.
Comment · 1 year ago
Comment · 1 year ago
Even if you charge $10/hr, or whatever the market rate would be for street parking spots, you still need an enforcement mechanism to prevent people overstaying.

In general, the idea of a "market rate" for any given property depends fundamentally on a system of property rights actually being enforced.

Comment · 1 year ago
Senators, especially committee chairmen, have quite a bit of implicit leverage, beyond the direct leverage of subpoenas or directly cutting funding to an offending agency.

Any given Senator is to some extent constantly in a favor-trading game with executive branch officials. People from the President on down need congressional cooperation to get their pet provisions into bills, programs funded, nominees approved, etc. A Senator can tell a White House official "I'd love to help you with that, however I have this issue with this agency not responding to my requests". Assuming it's a reasonable thing, whoever at the agency is in charge of this then gets an irate call from their boss's boss's boss ordering them to cooperate.

Of course this mostly doesn't actually get played out, because everyone understands the dynamic that defying senatorial requests will ultimately cost the President in terms of cooperation on other issues. So the norm is mostly to comply with reasonable requests, unless you're quite sure that it's a top-level priority where the White House really wants to take a stand.

Comment · 1 year ago
Comment · 1 year ago
The public interest is in judging the trial process, not in judging the defendant.

Suppose the government charges you with murder, searches your house, and finds your sex toy collection. At trial they present some elaborate thesis about how you used a sex toy to kill someone, but do not convince the jury, so you're found not guilty. The public has a legitimate interest in judging that the trial was handled with integrity and that the correct verdict was reached. They do not have a legitimate interest in judging you based on whatever private information presented at trial might in some way embarrass you (eg, photos of your sex toy collection). On balance, it could be that the public-record interest does in fact justify making public the evidence of the sex toys, but you have to justify it on those terms. The transparency is not itself intended to be punitive.

Comment · 1 year ago
Regardless of the effects, I don't think the case against MS was brought with the intent to "punish" MS through the trial process. The government brought the case because it thought it could win, it did win, and a judicial remedy was imposed. Trials are inherently unpleasant, but a just system tries to minimize this, not exploit it.

Any unjust policy (including just dispensing with trials altogether and allowing the executive to arbitrarily break up companies) will get to the 'desirable' outcome in some cases. That doesn't make it a just policy.

The specific allegation in the post is that the Trump administration will not appeal the verdict because Sundar gave $1M to Trump's inauguration. As far as I know, the government has not yet indicated whether it will appeal, so the claim that "Trump just paid him back, 40,000 times over" is in fact not true. (whether it becomes true at some point in the future, it was a falsehood at the time the author wrote it). It's also quite plausible that a Republican administration wouldn't appeal the verdict just due to being more pro-business in general, even without explicit corruption. But it's precisely because we have such a corrupt executive that it becomes all the more important to stick up for the rule of law. The correct response to authoritarianism is not to advocate for more authoritarianism!

Comment · 1 year ago
Sure, there's a strong public interest in having proceedings on record. US civil cases are supposed to have a presumption of openness, which the judge weighs against other interests, like protecting trade secrets, confidential business information, privacy of third parties, etc.

The public record argument is fine; it's just a different argument than the extrajudicial punishment advocated by the original post.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton