davmre
Joined 15 years ago
Joined 15 years ago
At $50/M output tokens, this would have cost on the order of $300k (plus a bit for input/prefill tokens) at API rates.
In cases where the output has low entropy - eg, you've asked a model to repeat some input text verbatim, or to answer a question that has exactly one correct answer - there will be no randomness for the watermark to hide in, so the output will effectively not be watermarked. Code lives somewhere in the middle: it generally has less entropy-per-token than prose, so would need more tokens to reach a given level of detectability.
There are lots of ways to restrict output samples. The simplest conceptually would be to just use a restricted pool of PRNG seeds, but in practice there are more sophisticated constructions to try to build in robustness to minor edits, allow detectability without needing the original weights and prompt, etc. Google's SynthID paper (https://www.nature.com/articles/s41586-024-08025-4) is a good starting point if you want to understand a recent production-ready method (or you can just ask an LLM to explain it to you).
For example, LLM pretraining datasets are on the order of tens or hundreds of terabytes. If an LLM-based code for that data is ~twice as efficient as gzip, you could afford to transmit the weights of even a very large LLM and still come out ahead.
In other words: LLMs actually are excellent compressors of their training sets in the formal information-theoretic sense.
Given a context (for LLMs, this would include the entire pretraining dataset, plus the prompt), you compress `context + next_token` for every possible next token. The tokens that co-compress best with the existing context are the 'least surprising' continuations. Choose one of them and iterate.
You can easily generate text with gzip this way. It won't be very good text, because gzip compression is not as sophisticated as a transformer + SGD, but the principle is the same.
Obviously there are plenty of innocuous applications too, but it's not like the people building decompilers for nefarious reasons will be explicit about it. The LLM abstraction just inherently doesn't have enough context to distinguish your intentions or your broader use cases. This is why both Anthropic and OpenAI have had to create side channel mechanisms for security researchers to establish a trusted use context. It sounds like this makes this not a viable product for you, unfortunately, and it makes sense that that's frustrating. But I also don't see what different behavior one could reasonably expect given the constraints.
If it's any consolation, these restrictions only make sense for models that are ahead of the open-weights frontier, so open-source hackers will presumably get Mythos-level capabilities in the relatively near future anyway.
https://chatgpt.com/share/69dc5030-268c-83e8-92c2-6cef962dc5...
In general, the idea of a "market rate" for any given property depends fundamentally on a system of property rights actually being enforced.
Any given Senator is to some extent constantly in a favor-trading game with executive branch officials. People from the President on down need congressional cooperation to get their pet provisions into bills, programs funded, nominees approved, etc. A Senator can tell a White House official "I'd love to help you with that, however I have this issue with this agency not responding to my requests". Assuming it's a reasonable thing, whoever at the agency is in charge of this then gets an irate call from their boss's boss's boss ordering them to cooperate.
Of course this mostly doesn't actually get played out, because everyone understands the dynamic that defying senatorial requests will ultimately cost the President in terms of cooperation on other issues. So the norm is mostly to comply with reasonable requests, unless you're quite sure that it's a top-level priority where the White House really wants to take a stand.
https://youtube.com/watch?v=TzN148WQ2OQ
By far the catchiest song about eel mating you will encounter today.
Suppose the government charges you with murder, searches your house, and finds your sex toy collection. At trial they present some elaborate thesis about how you used a sex toy to kill someone, but do not convince the jury, so you're found not guilty. The public has a legitimate interest in judging that the trial was handled with integrity and that the correct verdict was reached. They do not have a legitimate interest in judging you based on whatever private information presented at trial might in some way embarrass you (eg, photos of your sex toy collection). On balance, it could be that the public-record interest does in fact justify making public the evidence of the sex toys, but you have to justify it on those terms. The transparency is not itself intended to be punitive.
Any unjust policy (including just dispensing with trials altogether and allowing the executive to arbitrarily break up companies) will get to the 'desirable' outcome in some cases. That doesn't make it a just policy.
The specific allegation in the post is that the Trump administration will not appeal the verdict because Sundar gave $1M to Trump's inauguration. As far as I know, the government has not yet indicated whether it will appeal, so the claim that "Trump just paid him back, 40,000 times over" is in fact not true. (whether it becomes true at some point in the future, it was a falsehood at the time the author wrote it). It's also quite plausible that a Republican administration wouldn't appeal the verdict just due to being more pro-business in general, even without explicit corruption. But it's precisely because we have such a corrupt executive that it becomes all the more important to stick up for the rule of law. The correct response to authoritarianism is not to advocate for more authoritarianism!
The public record argument is fine; it's just a different argument than the extrajudicial punishment advocated by the original post.