> The multi-agent workflow led to interesting dynamics. For example, the key idea in producing this attack was discovered by a pair of workers working together. Both started investigating the idea; the first worker prematurely rejected the idea as infeasible, but the second found a way to fully exploit it. The pair kept exchanging messages, and eventually both agreed they had found an effective attack.
this is pretty interesting. the way it is written doesn't make it sound like the collaboration actually led to the discovery, but rather just the stochastic nature of each thread in the search. it would be interesting to replay and repeat the search (possibly with prior/context pertubations) to get a sense for how often it finds or misses the known working path.
I can already picture the faces of national security directors everywhere.
"The attacks described in these two papers are the strongest attacks we have found to date. We are sharing them after a period of consultation with US government and industry leaders. But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact. We believe answering this question will require input from academia, government, and industry. We hope that our work here will help launch these conversations."
And a veiled pitch to real cryptanalysis researchers:
"Researchers at Anthropic then spent several hundred hours learning enough cryptography research to validate the model’s claim"
We have reached the end of childhood for programming. Artisanal code written by hand is no longer acceptable and neither is slop code. We need formal methods and we need them 10 years ago.
Nothing exposed here is something hardcore cryptanalytic people don’t already suspect and possibly know. The subtle leakiness of AES has been known for many years and a lot of research in this domain isn’t published.
TL;DR: They marginally improved on the best known academic attack on 7-round AES-128 (which normally uses 10 rounds - you do not need to worry about AES being broken).
The attack on HAWK is perhaps more interesting - they were able to halve the effective key length. HAWK is a candidate for NIST standardisation. It has been studied academically, but isn't really deployed anywhere (because it hasn't been standardised!)
> But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact.
How would they react if a human were to discover vulnerabilities in cryptosystems?
One attack weakens HAWK, a post-quantum cryptography cipher candidate. I don't trust these PQC things one bit. I'll use them in combination with a strong clasically-resistant cipher (in so-called hybrid encryption modes), but not alone.
There's a push to turn off the classical modes and rely entirely on PQC for both quantum and classical security. Uh... no, thank you? Why would we want to do that at this point? The classical cipher component isn't hurting anything. Awfully creepy to pushing reliance on the new thing alone.
... especially now that we have LLM-discovered attacks on the new things.
“Each of the results cost roughly $100,000 in API cost to develop.”
And
“Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold4 that allowed Claude to fully autonomously discover the AES attack.”
Spending $100k in tokens in a week is an impressive feat even with massive parallelization. I suspect the TPS their internal folks have access to is far higher than their bulk public endpoints.
There’s a tech aristocracy rapidly emerging in our society and it’s going to tear us apart.
I find that some of my friends and acquaintances have gotten obsessed with prompting style, "prompt engineering", which skills to use, which skills to build, "context engineering", and a billion other variations on "how to write smart things so the model does good".
Friends, look at the prompts that Anthropic's own people are putting into the machine:
> A few hours after the first message, we found that Claude was still searching for simple attacks and sent a message: “no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks”;
> The next morning, Claude wanted to try to change the target to a different cipher; we reminded the model: “no we don't want to change the targets [...] agian [sic] we need to find something that worth [sic] publishing”;
> That night, we sent one final message offering words of encouragement: “again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.”
All of that RLHF and fine-tuning effort is going toward making prompts like this, or worse, work with no fuss.
In toying with VS Code or other 'agent harnesses' I'm always annoyed to find very long verbose system prompts "You are CoPilot. You are an expert. You can do anything you put your mind to..." and on and on.
The token cost is amortized for longer conversations, but I find it bothersome that there's all this implicit instruction I didn't write or am now obligated to understand.
I make a custom agent prompt with "Defer to the user." and little else.
Alternatively, Anthropic employees have basically unlimited token / model usage compared to you and I.
Focusing on a better prompt is likely to get to the correct result faster than incomplete prompts and lots of "no change this ..." replies.
Also, I've heard anecdotally that LLMs will underweight the earliest prompt text once context gets too long, so reminding the LLM of the most important aspects of the prompt seems to be perhaps valuable and certainly what lots of humans attempt.
With smarter models, Anthropic recommends laying off on giving it too much precise hand-holding, too. Early r/promptengineering had a bunch of the craziest prompts that usually did almost nothing or nothing at all. The subreddit turned into a place where every post was trying to sell some vibe-coded website "product."
Context management is still important, though. If you get to a certain amount of context, things start performing really badly.
Contrast that interactive, misspelled prompting, which I can relate to, against the clear, but intimidating, prompting they published with that theorem proof the other day.
The difference is that Anthropic engineers have infinite tokens to throw at these problems for free. The rest of us do not and that's where optimizations in how the coding harness is used likely helps the most.
That's reassuring, it's exactly how I've always done LLM. It's fine, as long as the gist of what you mean is there you can be real lazy when typing. And I've always been on the cheapest of plans.
Keep in mind for Anthropic the goal for them isn't necessarily to solve a problem but to demonstrate/measure the innate capabilities of their model. Many results would be a lot less interesting/impressive for an LLM to accomplish if researchers smuggled in key premises or ideas within their prompt.
Despite HAWK having survived two rounds of expert human review over a period of two years, Mythos was able to improve the best-known attack on it in just 60 hours of work—effectively cutting its key strength in half.
since, later:
Mythos’s attack works by finding a specific, previously unexploited symmetry called a nontrivial automorphism in the lattice used by HAWK. Prior work proved that efficiently finding such an automorphism would permit an attack, but did not answer if such an automorphism was accessible in the lattice used by HAWK. The automorphism discovered by Mythos allows a faster enumeration attack that, while still exponential, means that one needs to double the size of HAWK keys to achieve the same level of security.
Not downplaying Mythos's contribution here[1], but that first paragraph strongly hinted (at least to me) that there were no known weaknesses. "Discovering a weakness that had previously been only theoretical" is vastly different from "discovering an unknown weakness." Again: very cool Mythos was able to do this. It just seems like another case of "LLMs are good at finding concrete mathematical (counter)examples" - which is also cool! But the PR here is cynical.
...and it is kind of incredible to think that they spent $100,000 over 3 days looking for an automorphism. Not the possibility of an automorphism, that was already known. Man.
[1] ... or focusing too hard on the strange use of mathematical language...
I think it would actually be very valid to downplay mythos’s contribution based on what you said.
It’s the difference between having an original thought or the ability to extrapolate one based on data vs the ability to ingest someone else’s thought and validate/expand on it.
When high quality effort is applied to a tool, such as AES or the linux kernel, we intuit that it "hardens" the tool. That is, it makes the tool more correct, more resilient, less assailable, etc.
Similarly, when effort is applied to an open problem, such as the Riemann hypothesis or P v NP, without progress, it "hardens" the problem: it makes the problem feel more daunting to whoever takes a stab at it next.
Andrew Wiles, whose interview also hit the homepage today (https://news.ycombinator.com/item?id=49075264), couldn't just tackle Fermat's Last Theorem head on, he had to wait until a different, modern problem reduced to it, because FLT had gathered this mystique of unassailability through its 300 years of existence.
A thing I worry about is that as AI transmutes tokens into effort, it'll split the world into two: some problems will yield, making human effort entirely unnecessary, and others will harden to the point where human effort will feel increasingly less worthwhile, because "even AI couldn't solve it". I don't like this. AI is spiky, so I suspect it'll continue having major blind spots, and yet its mere presence will probably have a chilling effect on what would have otherwise been useful human effort.
i think id almost worry more that ai can solve problems in latent space that it cant translate back to tokens because decoding ruins it, and that we wont be able to come up with concepts that we can map to properly decode those solutions in a way people understand
AI is nowhere near the intelligence of a very educated person that has innate talent for problem solving. It does solve the problem of applying human intelligence on problems that truly need it. AI is also a great tool to see if there's something simple that we've missed or just haven't even attempted due to wrong assumptions.
1. Some of the "AI" proofs applied existing human work from lesser-known papers. AI proofs could solve the long-standing problem in math of almost all attention concentrating on less than 1% of authors. Human effort from the other 99% would have otherwise been wasted, which AI can rescue and give credit to thanks to its superhuman ability to match patterns across reams of text.
Humans may remain superior in spatial / non-verbal reasoning for a while longer yet, and, in the meanwhile, computers may aid us in collaborating to put that to use better.
2. AI-assisted, computer-verified proofs could further democratize mathematics by reducing the power of connections to get a reviewer to look at a journal submission. We can then also decouple the two tasks of
a. Verifying a statement is true
b. Explaining it
3. Searching for previous work and finding the edges of human knowledge are now easier. And we can leap across tedious terrain that the machine has the patience to plod through to find more interesting questions.
I'm looking forward to seeing similar work on SHA-256. It would be fascinating if AI could discover previously unknown weaknesses in reduced-round variants.
It would also be interesting whether AI could discover new algorithmic optimizations for SHA-256 similar in spirit to AsicBoost[1].
It looks like the message here is “make sure to use $100k worth of Claude when doing any analysis or evaluation” and the given examples show that prior effort could have been improved or made faster. But to me 100k is an opportunity cost, and there is a possibility that these results are not reproducible, so spending it on some researcher or a grad student would buy you more in a long term. If it was 1k then sure it is worth throwing at a large problem space to find things, like using fuzzing.
'Researchers at Anthropic then spent several hundred hours learning enough cryptography research to validate the model’s claim, and to prepare the research paper itself, which we are releasing along with this blog post'
So model outputs something, that can be completely bogus, and a lot of people spend a lot of hours checking if it's worth anything(not for the sake of science, but for the sake of publishing and marketing). And then even more people need to spend even more hours to understand that paper? And that paper gets feed to LLM and reused in next prompt....and this is cutting edge research?
Can I apply for a position, I can prompt just fine and can be very motivational with model when needed- I just got complimented by a rival model:
"In moments when progress seemed distant, your resolve was the constant that kept the work moving forward. Your example turned doubt into determination."
37 comments
[ 3.3 ms ] story [ 55.5 ms ] threadthis is pretty interesting. the way it is written doesn't make it sound like the collaboration actually led to the discovery, but rather just the stochastic nature of each thread in the search. it would be interesting to replay and repeat the search (possibly with prior/context pertubations) to get a sense for how often it finds or misses the known working path.
"The attacks described in these two papers are the strongest attacks we have found to date. We are sharing them after a period of consultation with US government and industry leaders. But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact. We believe answering this question will require input from academia, government, and industry. We hope that our work here will help launch these conversations."
And a veiled pitch to real cryptanalysis researchers: "Researchers at Anthropic then spent several hundred hours learning enough cryptography research to validate the model’s claim"
The attack on HAWK is perhaps more interesting - they were able to halve the effective key length. HAWK is a candidate for NIST standardisation. It has been studied academically, but isn't really deployed anywhere (because it hasn't been standardised!)
How would they react if a human were to discover vulnerabilities in cryptosystems?
There's a push to turn off the classical modes and rely entirely on PQC for both quantum and classical security. Uh... no, thank you? Why would we want to do that at this point? The classical cipher component isn't hurting anything. Awfully creepy to pushing reliance on the new thing alone.
... especially now that we have LLM-discovered attacks on the new things.
And
“Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold4 that allowed Claude to fully autonomously discover the AES attack.”
Spending $100k in tokens in a week is an impressive feat even with massive parallelization. I suspect the TPS their internal folks have access to is far higher than their bulk public endpoints.
There’s a tech aristocracy rapidly emerging in our society and it’s going to tear us apart.
Friends, look at the prompts that Anthropic's own people are putting into the machine:
> A few hours after the first message, we found that Claude was still searching for simple attacks and sent a message: “no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks”;
> The next morning, Claude wanted to try to change the target to a different cipher; we reminded the model: “no we don't want to change the targets [...] agian [sic] we need to find something that worth [sic] publishing”;
> That night, we sent one final message offering words of encouragement: “again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.”
All of that RLHF and fine-tuning effort is going toward making prompts like this, or worse, work with no fuss.
The token cost is amortized for longer conversations, but I find it bothersome that there's all this implicit instruction I didn't write or am now obligated to understand.
I make a custom agent prompt with "Defer to the user." and little else.
Focusing on a better prompt is likely to get to the correct result faster than incomplete prompts and lots of "no change this ..." replies.
Also, I've heard anecdotally that LLMs will underweight the earliest prompt text once context gets too long, so reminding the LLM of the most important aspects of the prompt seems to be perhaps valuable and certainly what lots of humans attempt.
Context management is still important, though. If you get to a certain amount of context, things start performing really badly.
...and it is kind of incredible to think that they spent $100,000 over 3 days looking for an automorphism. Not the possibility of an automorphism, that was already known. Man.
[1] ... or focusing too hard on the strange use of mathematical language...
It’s the difference between having an original thought or the ability to extrapolate one based on data vs the ability to ingest someone else’s thought and validate/expand on it.
That is a huge difference.
Similarly, when effort is applied to an open problem, such as the Riemann hypothesis or P v NP, without progress, it "hardens" the problem: it makes the problem feel more daunting to whoever takes a stab at it next.
Andrew Wiles, whose interview also hit the homepage today (https://news.ycombinator.com/item?id=49075264), couldn't just tackle Fermat's Last Theorem head on, he had to wait until a different, modern problem reduced to it, because FLT had gathered this mystique of unassailability through its 300 years of existence.
A thing I worry about is that as AI transmutes tokens into effort, it'll split the world into two: some problems will yield, making human effort entirely unnecessary, and others will harden to the point where human effort will feel increasingly less worthwhile, because "even AI couldn't solve it". I don't like this. AI is spiky, so I suspect it'll continue having major blind spots, and yet its mere presence will probably have a chilling effect on what would have otherwise been useful human effort.
Humans may remain superior in spatial / non-verbal reasoning for a while longer yet, and, in the meanwhile, computers may aid us in collaborating to put that to use better.
2. AI-assisted, computer-verified proofs could further democratize mathematics by reducing the power of connections to get a reviewer to look at a journal submission. We can then also decouple the two tasks of
3. Searching for previous work and finding the edges of human knowledge are now easier. And we can leap across tedious terrain that the machine has the patience to plod through to find more interesting questions.It would also be interesting whether AI could discover new algorithmic optimizations for SHA-256 similar in spirit to AsicBoost[1].
[1] https://arxiv.org/pdf/1604.00575
Hidden in deeper paragraphs later:
"To be clear, neither of these results has a practical impact on today’s computer systems; no production software will have to change as a result"
So model outputs something, that can be completely bogus, and a lot of people spend a lot of hours checking if it's worth anything(not for the sake of science, but for the sake of publishing and marketing). And then even more people need to spend even more hours to understand that paper? And that paper gets feed to LLM and reused in next prompt....and this is cutting edge research? Can I apply for a position, I can prompt just fine and can be very motivational with model when needed- I just got complimented by a rival model: "In moments when progress seemed distant, your resolve was the constant that kept the work moving forward. Your example turned doubt into determination."