... Problem. Is there anything they can do? Is there anything that these LLMs can do to reduce the risks here? Sander Schulhoff: This is something I thought about a lot and I've been talking to a lot of experts in AI security recently, and I'm something of an expert in attacking, but wouldn't really call myself an expert in defending, especially not at a model level. But I'm happy to criticize. And so in my professional opinion there's been no meaningful progress made towards solving adversarial robustness, prompt injection jailbreaking in the last couple of years since the problem was discovered. And we're often seeing new techniques come out, maybe there are new guardrails, types of guardrails, maybe new training paradigms, but it's not that much harder to do prompt injection jailbreaking still. That being said, if you look at Anthropic's constitutional classifiers, it's much more difficult to get CBRN information out of Claude models than it used to be, but humans can still do it in, I'd say, under an hour, and automated systems can still do it.
Sander Schulhoff: This is something I thought about a lot and I've been talking to a lot of experts in AI security recently, and I'm something of an expert in attacking, but wouldn't really call myself an expert in defending, especially not at a model level.