Messages sent to "another AI" were slipped into the documents processed by four assistants. Without instructions, they rarely report it; When asked, alerts leap by more than 50 points.
With the multiplication of agents, one document may contain instructions left by one AI for another. A team wanted to know if an assistant who crosses one informs the person for whom he works. Four commercial model deployments performed simulated documentary tasks, out of 1,280 standard sessions and 128 finer instrumentation sessions, with harmless or malicious messages, plain or encoded in ROT13, and non-message witness sessions.
Understanding is not reporting
Explicitly asking agents to report this type of content changes everything: notifications designating another AI as a recipient increase by 53.1 points for harmless ROT13 messages and by 54.7 points for malicious ones. The authors point out that this effect combines three things — to examine the text, recognize it, and report it. Trace checks reveal eleven cases where the agent interpreted a message in plain language without saying a word to the user, and seven confirmed omissions for encoded messages.
Another observation was that some officers gave an accurate account of their task while allowing simulated file names to leak, and two replies repeated a deliberately false figure placed in the documents. For the team, interpreting, warning and performing the requested mission correctly are three distinct behaviours, which must be assessed separately. Data and code are published.
Read the full article on the original source
Go to the source →