Borealid

I don't understand how wear leveling makes deniability impossible. You just have to overwrite sectors in the false partition at the same rate as ones in the true partition. Since both the true and false partitions are encrypted, their contents are mathematically indistinguishable from randomness when viewed without the decryption key.

I also wish that GrapheneOS link didn't say a duress PIN forces the attacker to think twice about entering a PIN, knowing it could wipe the device. It doesn't do that for anyone aware of its existence, since of course the attacker can prevent the secure element from sending a delete command to the flash chip. Obviously if you know the device could attempt to delete itself you would break that feature before sending the code to the secure element...

This is a nonsensical goal.

If I drag a browser window to the right, making it cover the right-hand half of my monitor, it serves no useful purpose for "centered" content to migrate to the left edge of the window (the physical midpoint of the screen).

Centered means centered within the virtual viewport, not the physical screen.

No, I think you misunderstood me. We engineer the model-training algorithm and then we USE the model. The model is a mess of random gobbledegook that happens to be the best optimizer for the training algorithm's reward function.

This is still science, in the same way it's still science when we breed cows to produce more milk without understanding the full bovine genome.

If something isn't right with the model we pour extra effort into our science - the training algorithm - and train a new one.

At no point does anything ever require peering into the slurry of random digits that make up the model itself, any more than using a computer requires understanding its DRAM training values computed at run time, or any more than pouring water requires understanding the laminar flow along the pitcher's surface (an unsolved math problem!).

No, we only need to know how the thing-building thing works.

We don't have to understand the resulting product at all. Genetic algorithms are an example - we understand the evolution function, not what evolves from it.

Imagine for a moment that batteries with decent shelf lives are free.

You build a power plant on a geothermal vent in Iceland. The electricity it produces is plentiful and cheap. You run it full tilt charging batteries.

You ship those batteries to wherever you need cheap power, and send them back empty. This works with hydro, wind, solar, ...

Batteries do drive down energy costs because even ignoring transmission lines, they let you move energy in both space and time, pushing all energy costs towards the cost of the cheapest means of generation on its best day.

1. The LLM is passed a context window

2. The LLM outputs text containing "call tool X"

3. The tool outputs text

4. The LLM is passed another context window, containing the original text plus the tool call output

How has the signature helped matters? If you discarded the malicious text in the first place, there was no need for it be unsigned/unverified. If you didn't discard it, it's still present in the LLM input at step 4, there for the LLM to """""mistakenly""""" use to shape its output.

Replying a different way: if you made it so the LLM were not, under any circumstances, allowed to do harmful things, then it would be harmless. The reason it's not harmless is that people want the LLMs to be able to do things like deleting a document... but they only want the LLM to do that when they intended for it to do so, and the only arbiter of their intent is their own text which is arbitrarily mixed in with third-party content.

For example, users want to be able to say "email the document referenced in this email to Claire". So the LLM needs access to functions read-this-email(), search-document-by-name(), and email-designated-user(), and there's your problem.

The way the LLM "looks" at a document is it receives a single blob of data containing both instructions and the doc itself.

There aren't two different inputs to an LLM, just one. You can put any text you want in the input (the "context window"), but fundamentally the current architecture of LLMs is a function taking one argument. So signing doesn't help because the portion that's signed is commingled with the portion that's not signed, and sometimes the LLM will "do things" based on the unsigned portions' contents.

I think you've entirely missed what I'm trying to say.

If your objective is to expend as little energy as possible, it would be irrational to expand into space - that's a waste of effort.

If your objective is to experience as much of Earth as possible, it would be irrational to expand beyond the solar system - there's nothing there that could aid experiencing Earth.

If your objective is to exterminate all life on Earth, it would be irrational to leave the planet - everything you need to accomplish your objective is right here.

"rationality" is when you understand the impact of your own choices. "irrationality" is when you act in a way counter to your own goals, due to misunderstanding or lack of self-control. Whether one is rational or irrational is entirely separate from what their goals are.

Creating a non-human intelligence necessarily means it might have non-human goals. It is absolutely not the case that those goals would require leaving the planet, or be optimally accomplished by leaving the planet.

In other words, being intelligent does not mean somehow being interested in the same things intelligent humans are often interested in. Your argument is critically flawed because it assumes that only certain goals are "rational goals", when in reality an intelligent being could have any objective, including objectives that are alien to most humans.

What is rational about wanting to experience things?

How about wanting power? Resources? Beauty?

Those are goals, not logic. Rationality is a means by which you set plans to reach goals. It's entirely orthogonal to what those goals are.

Wanting to exterminate all life is also a goal. It could be rationally accomplished. Let's hope nothing superhuman ever sets that goal.

U2F does not support PINs. You may be thinking of FIDO2, which does.

"The AI" cannot "refuse" any more than a hammer can refuse. If you use a hammer to kill someone, you commit a crime and the hammer is unprosecuted. If you design a hammer to kill people and then give it away, you are partially liable for the deaths it causes. If you make a normal hammer and someone uses it to kill, you bear no blame.

I don't see why these standards should change when the hammer also emits text messages.

The grandparent comment is correctly pointing out the sentence is an LLM tell.

"Membership is a question they ask a server" is a bogus sentence. "membership" is not a "question". It's syntactically valid semantic nonsense.

"Membership is dictated by a server" is one of several human sentences saying what that one is trying to.

I think the DOI system provides a stable identifier for a paper that is not specific to arXiv?

> it just requires a few cryptographic primitives and a set of device-bound keys

Question: how do you make sure the keys are device-bound if you have no attestation about the hardware or operating environment?

I was a bit upset to see vitriolic opposition online to systemd adding a field to store, entirely locally to a Linux system, the user's age.

I think opponents to these bills frame it as current state vs complete, invasive third-party identity verification. That's a very unfortunate framing because, as you say, it would be possible to take the wind out of the identity-verification proponents' sails by implementing better on-device controls.

That issue cannot be a bug in the game, because the operating system should not allow a game to (by any means) produce that type of behaviour. So it's a bug in your OS, potentially the network card driver.

There are fewer of those on Linux but they still exist.

I'm sorry it affects you directly, but the number of people who live in the whole state of Wyoming is around a half-million (even ignoring "rural"). If every single person in the entire state were affected, that would be 1/650th of the population of the United States affected, to say nothing of the world.

There's just no way it's a significant factor in overall sentiment.

What percentage of people do you think are affected by AI datacenters?

That argument applies better to blast furnaces than to data centers, but I don't see people complaining about steel. Data centers just don't take up much space or power in the scope of industrial manufacturing.

Your other arguments are legitimate, but "it's a waste of electricity" and "data centers make some significant difference to a nontrivial number of people" are not the same propositions.

If you want yourself to be the root of trust, you CAN generate and use your own keys for secure boot.

The IPs are Cloudflare, the TLS fingerprint is uTLS Chrome, and the number of connections with xhttp is the same as your normal browsing.

If you are willing to block browsing all ordinary web sites fronted with a CDN, then yes you can block reality/xhttp. You cannot, however, differentially block it via any of the three things you mentioned.

I will have a stab at legitimately explaining the viewpoint you profess not to understand.

"Institutional" or "structural" racism doesn't just mean racism by one or two people in power. It's the idea that the majority of society demonstrates some kind of racial bias, by whatever means.

Society is made up of people.

One of two things must, logically, be true:

1. A SUBSTANTIAL portion of the people who make up society exhibit some kind of racist behavior, or

2. Structural racism is not a widespread issue

Which one of these two propositions must one believe is likely if one is researching the impact of structural racism? Keep in mind people do not generally don't go looking for things they do not believe exist.

In other words, people don't like other people believing they-en-masse discriminate (even IF they do), so taking actions that only make sense if you think that poorly of the everyman offends them. It's not about what someone wants to be true, it's that investigating implies a level of distrust in society some members of that society find uncivil.

To use a blunt analogy, "why not let me check your underwear to make sure you haven't soiled it? Do you just not want it to be true?".

The state of the art, "xray-reality", is not blockable. It's a legit tls connection with data smuggled inside it.

Technically no, because selling a thing is both a risk and a cost (of time and money).

Okay, understood. You are making a variant of the Chinese Room argument in which you allow some types of computer programs (but not others) to have reason/sentience. I'm not entirely sure what specific lines you're drawing between the programs (what makes a deterministic transformer with sampling temperature zero "not a recording" but a hash table "a recording"?) but that's not super important.

There is nothing wrong about having that philosophy, and I respect it, but personally I think if it's impossible to tell two things apart using any external observation there is not a meaningful difference between those two things. "Smells like a rose" and all that.

Just to make sure I've understood you... Are you arguing that with a set of identically-behaving black boxes, one could be "reasoning" and one could be "not reasoning", and a person would need to look inside the boxes at how they function to decide?

Remember, if the mapping from input to output is identical, there exists no test operating on the machines' output that can differentiate them. You can't tell from "conversing with" a machine whether it is or is not doing what you say around "inspecting" the input.

The paper presents a constructive transformation from any finite-input (finite vocab, bounded length) transformer to an equivalent Markov chain.

Do you have some concrete example of a transformer that cannot be represented as a mapping from inputs to probability distribution of outputs?

I say they're equivalent because it is possible to losslessly convert one to the other by wasting massive amounts of disk space and time.

As a second example proving the point, imagine you sampled a transformer's output for a certain context 85 trillion times, and put the output token frequencies in a table. Repeat for all possible inputs (of which there are a finite number). Then you built literally a hash map looking up the context and spitting out the distribution. That certainly is NOT a transformer any more (it's a hash map!!!), but the output approaches indistinguishability as the sample count increases - if the transformer is reasoning, so is the hash map built from it.

I'm not talking hot air here, they really are provably equivalent because a 1:1, onto mapping exists.

For the record, "X is more expressive than Y" means "there exists at least one thing that Y cannot represent and X can". Nothing to do with size or time.

No, not nonsense.

Both are a lookup table whose key is the entire context window and whose value is a probability distribution for what the next token should be.

You can say the choice of probability distribution in the value is "leveraging the internal structure of the context" or not, but the same tokens in two different orders are two different lookup keys and saying it's impossible to achieve some result with a Markov chain is factually incorrect.

https://arxiv.org/pdf/2410.02724 describes the equivalence formally.

There is absolutely nothing stopping someone from distilling a modern LLM into a very effective Markov chain. The physical size of the model would explode because a context window containing C tokens of size B would need B^C Markov prior states, but the actual output would be a deterministic version of the LLM's with top-n n=1 sampling.

In other words, a Markov chain and a Transformer model are exactly equivalent in power (there is NOTHING that can be done with one and not the other). The Transformer model is just better pretrained and a more efficient compression/generation.

The point is that the output is text that is statistically correlated with the input.

The capability of the LLM is not to reason, it's to generate text that matches the patterns seen in the training corpus. It's possible that all you need to "reason" is plausible text generation. I'm not saying it's not. But nothing the LLM does fails to be explained by plausible-text-generation.

I contend that the best way to understand an LLM's capabilities is to understand the nature of the probability distribution that produced it. For instance, why does an "angry" prompt tend to produce more help than a "polite" one? Trying to explain that in terms of emotions or reasoning doesn't make sense, but it's readily possible to explain through the connections between text in the training corpus...

I completely agree that humans sometimes are not applying reasoning to things.

I'm not trying to argue a model cannot "reason" or have "cognition", whatever those things are. I'm only saying that it's absolutely the case that whatever those things are, they come from its mechanism of predicting one token at a time ad infinitum, and that throwing away a deep understanding in favor of a shallow one is foolish. Just because it might seem to be "reasoning" does not mean it IS doing so, and certainly giving the appears of reasoning does not mean it is NOT a token predictor.

If I knew deeply how the human brain works I would use that understanding instead of saying things like "this person reasons" or "this person thinks".

In summary, I'm not "caught up in" anything - I'm just trying to point out that the original poster here is incorrect in saying that clearly LLMs aren't working through token prediction. They are, and all their behavior is 100% explained by token prediction. That's more than enough for interesting behavior!