If you have the ability to detect "harmful content" on the output side, shouldn't you be able to detect that material on the input side during training and exclude it so it never makes it into the model in the first place?
That is what Biderman suggests at the end of article. The problem with that is that models can produce novel information not found in the training data by correlating information that was not associated with each other directly in the training data.
Realistically it should be up to the person running the inference to decide what information the model should be able to produce.
4 comments
[ 9.2 ms ] story [ 21.6 ms ] threadRealistically it should be up to the person running the inference to decide what information the model should be able to produce.
https://arxiv.org/abs/2408.00761
p.s. if it's something tamper-resistant is still open ?