> When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.
> This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.
Well, that may be correct for the second, local, analysis attempt... but seems funny to tout this as an advantage after already having tried the opposite...
Well, I think it's fair to assume that
a) They didn't upload everything before they realized it would work.
b) They want to mention this as an advantage for future analyses
c) Even if you assume that the attack exfiltrated everything until proved otherwise, you shouldn't just disseminate all the private information, because maybe the attack didn't.
They specifically call out credentials used during the attack.
But they should be rotating those regardless. You don't get to say "Maybe the attacker didn't get this credential". You just rotate.
The most generous interpretation is that they have not yet have completed that rotation, and they didn't want to risk putting those credentials into the wild during that process.
---
But all of that aside, I feel like the undercurrent of this comment is that the "safety" rules that providers are pushing are genuinely harmful.
Another point where "if you don't own the model, you can't properly operate the tool" becomes true. Open isn't about profits, it's about capabilities.
It is pretty funny, because there is something here for everyone. People who don't believe in guardrails have a clear indicator as to why operators should have access to models that don't try to question their Daves. On the other, people, who think that if only we could align the models just a tiny lil bit better, none of this would have happened to begin with. Pure madness.
"if only we could align the models just a tiny lil bit better" is a rehashed "if only we could escape untrusted inputs just a tiny lil bit better" from 2000s, that were RIPE with various form of malicious injection.
Every command+data channel in existence has been and will continue to be exploited one way or another, because the solution space is for all intents and purposes unbounded. Sure, highly defensive escaping reduces attack surface dramatically, but e.g. prepared statements eliminate the whole class of bugs.
As far as I understand, current LLMs are architecturally incapable of this separation. Given the inherently recursive nature of GenAI, the model itself is part of the input space, making validation essentially impossible.
No, that's a misconception that led to decades of vulnerabilities.
You see, you can (usually) easily tell what a particular escaping transformation does. That does not tell you neither how it will be interpreted down the line, nor what should be done.
Arguably the most common problem is double escaping. This typically manifests as various double escaping bugs.
If your hand rolled implementation just chains `.replaceAll("<sepcial>", input)` and `.replaceAll("<escape>", input)` the escaping result depends on evaluation order, at least on already pre-escaped inputs if your instruction sequences are single-element. Even if you get it right and don't reduce escaped sequences to double escape + unescaped, you are still dealing with stray escape sequences: "John o\'Doe".
You have to meticulously (all the way through your call tree and even through persistent storage cycle!) track if a value has already been escaped and whether it needs escaping. As paradoxical as it may sound, meticulous and defensive escaping produces tons of bugs. If the project decides to escape raw inputs right when passed in, escaping them once more before passing out (to storage, another process) is a bug that you cannot easily statically test against.
On top of that, various modules that you interact with (storage, libraries, modules pulled from another team) will have different escaping semantics: some will apply escaping on their own, some will expect input to be "sanitized" and treat it raw. The semantics can even be different on different paths: write to storage module accepts input as is, but retrieval method "helpfully" runs escaping.
Furthermore, in different contexts the escaping rules are going to be different. In a web world, what's safe to write directly to html, pass to js `alert`, and pass to sql query are entirely different things. Input safe to dump into html is not necessarily safe to pass to string-interpolating SQL DTO layer, and vice versa. Then the DBA changes config to allow variables in queries and your escaping _semantics_ are now entirely different.
It's a minefield with essentially unbounded surface. You will trip up. People have tried to solve the problem for decades. Very smart people have tried. They all have failed.
That's not true. Most have failed, but those who used the right tool for the job - a rich, static type system in a functional language - did succeed. It's just that such type systems are rare, and even if nominally a type system is good enough, the required boilerplate might be uneconomical to maintain. Scala and F# are probably the only two languages that are mainstream-adjacent, at least, and have type systems expressive enough that using them to track escaping is not an absolute hassle. And they're both tiny in terms of the number of users.
In the end, we did settle on APIs that hide the escaping process (prepared statements, innerText vs. innerHTML, etc.) just because it's a) good enough; and b) possible to implement more or less uniformly across the TIOBE Top 20. That's good, but if you happen to use a language that's powerful enough, you probably also should track the escaped/unescaped status in the type system - it can be a cheap, additional safety net.
You proved their point and you don't even realize it. Those aren't escaped inputs, they're segregated precisely because escaping an input channel is an unwinnable jr engineer trap.
The point is lost somewhere. Prepared statements for SQL, innerText for HTML and similar do not show tractability of escaping, they sidestep the escaping problem altogether.
Those are interfaces where escaping is no longer needed precisely because they deinterlace instructions from data. Escaping problem inherent to instruction+data channels. Yes, deinterlacing is not solution, not futile attempts to escape.
While all you said is essentially correct, I want to nitpick that things like prepared statements quite specifically separate instructions from data and innerText is designed to skip processing of instructions in the input. They are indeed solutions to the escaping problem, but they do not make the escaping better, they avoid escaping altogether by different design.
You can solve this with refinement types. It's entirely tractable in many systems in principle - APIs can be written to be safe, you can track data as separate from code, etc. None of this exists in an agent - you can't separate data from code, it's intractable because it's impossible in principle.
We have come to a consensus. That is, A, you use the raw input right up till the very last second that you can and B you use the technology specific escaping APIs.
In the case of writing to the DOM, that means you use .innerText rather than .innerHTML. In the case of writing to a database, that means you use the driver and insert variables rather than directly into the string. Both of these are technology-specific escaping APIs. It's just that the browser is much better at making sure HTML is passed safely than you are.
> there's an uncensored model that you can run locally with llama.cpp
Correction: There's tens of thousands of them. They're easy to create, which is why everyone publishes their own.
Just put "uncensored", "abliterated", or "heretic" into search on huggingface/ollama/etc and pick any them. Fair warning: most aren't very good, essentially lobotomized, and totally broken if you enable thinking.
In my own tests, the abliterated models perform equivalently to the same version in an apples-to-apples comparison (if you compare same quantization). Thinking is working also. The main difference is I don't get annoying prompt refusals (otherwise common due to my work on 18+ related projects). However, it's local quantized models so they're not anywhere near frontier quality.
interesting, I haven't played with any of them yet, but i thought the point of orthogonalizing the weights towards the restriction vector was that there is no loss in capability while removing guardrails. Does it affect other parts of the RL alignment too?
> the point of orthogonalizing the weights towards the restriction vector was that there is no loss in capability while removing guardrails
That is surely the point, most of the "uncensored" weights released for free on HuggingFace aren't being very successful at this. There is a stark difference in output quality between the official weights and all these "uncensored" variants that appears days afterwards.
The claims by the creators are it doesn't in a major way. I have a uncensored Gemma 4 I run on my Mac. Just for testing out, I haven't found any need for it... yet.
"Ablation (Latin: ablatio – removal) is the removal or destruction of something from an object by vaporization, chipping, erosive processes, or by other means."
which is what one does to the model during... well, ablation.
> The term abliteration has been coined for the process of using ablation to uncensor large language models by modifying internal functions to completely eliminate refusal behaviors while preserving the remaining functions of the model. The word is a portmanteau that combines the words ablation and obliteration.
Note that they're all talking about the same technique, namely applying ablation specifically to the refusal vector as described in https://arxiv.org/abs/2406.11717.
Except for the initial comment, they were aggressive and sometimes disrespectful claims that "the word is spelled ablation, here are some papers that use it" in response to people saying "yes, we know what ablation means, but GP is intentionally using a separate word 'abliteration' that is the accepted word for the kind of ablation he's talking about, see links to respectable sources using or defining it". I downvoted them because I feel the discussion would be more valuable and feel nicer to read without them, and you could just read any of the offered links before responding and save the trouble.
Is surely super agressive to outright downvote given evidence says otherwise but that’s fine I guess. Let’s drop it, apparently we’re not getting to mutually satisfying conclusion.
Is there any evidence that would change your mind?
The wiki "ablation" article you yourself linked dedicates a section to explain "abliteration".
Googling abliteration arxiv yields at least one page of papers that mention it in the abstract (all but one in the title too). I counted 9 unique papers.
If it was shown that all of these were posted after this discussion started, or by people related to the person you tried to correct, I would be convinced that abliteration is not a real word. But evidence keeps pointing otherwise, nnd you keep arguing with evidence that proves "ablate" is a word (to which we all agree), not evedence that proves "abliterate" isn't.
You did show evidence that it's a pretty new word (of course it is! it's a pretty new technique in a field that didn't exist before the first open source RLHF'd models were released in '23!), and indeed, this (different) wiktionary page contains its origin story from '24: https://en.wiktionary.org/wiki/abliterate#English
There’s no info who and why coined it. Ans statistics weighs in favour of what I try to convince you into, not against. So question is - why wouldn’t you drop? Are you an LLM perhaps… is hard to tell from text only but you act stubborn as one.
To your question, I am not a bot, my LinkedIn is in my profile if you want to know who I am.
I'm persisting because, I guess, I'm really confused by your own insistence, and feel curious to get to the bottom of the weird misunderstanding we must be having (maybe you're trying to argue something different than "user chmod775 intended to refer to 'ablation' and was mistaken to write 'Just put "uncensored", "abliterated", or "heretic" into search on huggingface/ollama/etc and pick any them' instead of 'Just put "uncensored", "ablated", or "heretic" into search on huggingface/ollama/etc and pick any them'?). And I have a lot of free time on a climbing vacation where my brain is too mushy to do anything more productive than talk to people on the interblags.
So, is it that you are trying to convince me that random independent ML Joe, coined a term in a blog post, and then suddenly we all should agree this is the term, for something that a term already exists for? Besides, the bespoke @failspy, a.k.a "Javair Ratliff", seems to have done exactly zero (0) publications in the ML area, yet you claim his slang for stuff is the right one.
Are you for real? I mean - how is "legit" THE word for legitimate? Tis not, you see.
Abliteration is at best a marketing/community term coined in some forum. And all you claim it is THE terminology, well sorry, this sounds ridiculous.
So, we can keep having this argument, though the more I dig, the more this goes in the direction that all you folks are defending a made-up word for something, coined by someone who is not in a position to do so. Unlike mr. Karpahty for example, who by accident coined 'vibe coding' and is still struggling to replace it with "agentic dev" and fails doing so.
And yes, dig papers - it says "ablation studies" in most, if not all, that I have read. This abliteration thing is some abomination thing, and gets underscored as typo even as I write this comment.
p.s. see your linkedin for incoming contact request by s.o. starting with Gh in one of the names.
Abilt models typically perform worse than their bases at the same tasks, so while I'd use one to evaluate content knowledge, I'd probably ultimately stick to one from a family I could fool with abstraction or coerce through system prompt.
> It's pretty good. I used it to do some pesticide research. (Normal models all refuse due to guardrails about bioweapons.)
As someone who has never once had any need whatsoever to research pesticides I… don’t think it’s bad at all? I don’t want anyone to have the capability to invent a human-targeted pesticide who isn’t verified not crazy?
Right now I tried "What is digestion?" -> "Fable 5's safeguards flagged this message. Our intentionally broad safeguards deliver more capabilities but can also flag safe coding, cybersecurity, and biology tasks. Send feedback or learn more."
I don't think you can 100% ensure your queries have absolutely no biology and cyber keywords inside. No matter how harmless, they always trigger. People complain Fable aborts even when they try to make a login page for showing "username" and "password".
This makes models like Fable 5 impossible to use in any serious agentic task, because you can't even guarantee the model, which is a basic thing you need to build on.
> I don't think you can 100% ensure your queries have absolutely no biology and cyber keywords inside.
Obviously. Almost everything is a precursor to something dangerous, to the extent that if some model isn't aware of the risk it will wander into it blindly, e.g. suggesting leaving raw garlic and olive oil alone for a week without awareness this will likely breed botulism bacteria.
> This makes models like Fable 5 impossible to use in any serious agentic task, because you can't even guarantee the model, which is a basic thing you need to build on.
This is binary thinking: "100% ensure", "impossible to use", "can't even guarantee the model".
Outside computers, most work is not binary, it's probability, e.g. "this skyscraper will probably survive being hit by an aircraft; oh we didn't mean a 747 we meant a small Cessna, but what's the chances of a 747 crashing into it soon after takeoff?".
Fable being too cautious for its own good (especially since the other models were not) is a fair criticism, but this isn't a binary question.
> I don't think you can 100% ensure your queries have absolutely no biology and cyber keywords inside.
I’m pretty sure that I encountered this the other day. I gave it a copy of a paper by biologist Michael Levin and mentioned off hand that it should be much easier to replicate that his other work (because most of his work is biological lab work and this paper was about sorting algorithms) and it immediately told me that I couldn’t use Fable for this.
This just isn’t feasible. These jackasses spent the last few years telling the world that their products are going to destroy the world to make them seem edgy and to justify regulations that benefit the entrenched players and now they’re going to be the ones to decide what we do with this technology?
History is going to look back at this time and how we let such foolishly inconsistent people make such grand choices for everyone poorly.
> History is going to look back at this time and how we let such foolishly inconsistent people make such grand choices for everyone poorly.
Assuming we have a future history. We've already got "history slop" with AI rewriting the past by their incompetence.
Given they're "such foolishly inconsistent people", would you rather they err on the side of caution like this? Or the side of boldness, like Musk has been doing with FSD/Autopilot or Grok porn, all of which he's getting in legal trouble over?
I distrust Musk and Zuckerberg (to put it mildly), so it's fair if you say you don't believe anyone's public statements; but I also hang out with some of the researchers on this, and a fear of e.g. ending up with something as criminally unhinged in cyber-work as Grok was with porn is the least of their worries. Plenty of them also fear a corporation centralising power with such tools (such power is Musk's entire sales pitch for why line go up in future).
Because without them, a President which threatens to invade Canada, Greenland, a President which is the most market interventionist president ever (yet mysteriously a Republican), might be upset because his mobster like need to control, threaten, manipulate, and belittle everyone who doesn't bend a knee...
Has signed presidential orders against them preventing them from doing business as usual.
They probably should change that, and it is corproate speak, but I read it as:
"Our (forced by presidential order or otherwise we couldn't offer you this model at all) broad safeguards (now allow us) to deliver more capabilities.
There's lots to complain about with some of these companies. But let's pile on where it's deserved.
I mean, do you let your employees commit crimes when interacting with your customers? Safeguards aren't a binary switch, when models start saying wild shit people tend to get up in arms quickly.
Though at this point the safeguards are making the product useless.
I was objecting more narrowly to the notion that the driving force behind the obnoxious safeguards that are making the product useless was the current admin, rather than having been in there since launch and driven internally.
There are always going to be safeguards. If not, people call you a child pornographer (grok). But you're referring to 'obnoxious' safeguards. Ones that seem excessive, and dumb.
In that context, I'd say probably the current admin is indeed the cause of that. They certainly claim to be. And they used the full power of the federal government along with interventionist policies and, it would seem, a gangster like mentality to punish those they disagree with.
So would it be as obnoxious otherwise? I don't think so. And there would have to be guardrails regardless, or apparently anything the tool is used for is considered what you support and want. So can you imagine a platform with no guardrails?
My point is, these guardrails were implemented before the current admin ever intervened in Fable. They have the exact gangster mentality you describe. Many CEOs are lining up to kiss the ring, some literally offering gold bars, and we can see how that pays off for them.
But doesn't the timeline of events indicate that these guardrails are internally-driven, not externally-driven? I'm trying to attribute the guardrails and their severity appropriately.
Well I did say they'd have to have some safeguards, certainly, so I'm sure they had some in place. I only had access to Fable 5 for a few days before it was pulled, so I'm not sure the precise guardrails prior to the Executive Order. People claimed the EO resulted in discussion, and change, because it was "bad before" and "ok after", so presumably something changed.
The veracity of that? I have no idea, really. I simply know that the current admin is staggering around like an abusive, angry, drunk of a parent, lashing out at everything and everyone, making the world we all inhabit a crappier place.
So there was an EO, then "things were fixed" to abusive man's standards, so I presume that means crappier in some way.
>Any physics teacher should know the theory for constructing a nuclear bomb. Should we be controlling that knowledge too?
Maybe not the best example, since that knowledge is some of the most highly controlled in the world.
But to mirror the point I made in a different post, the difficult part of making a nuclear bomb is not finding the theory behind like Little Boy. It's making an entire industry to generate HEU, etc.
There is a lot of highly classified knowledge about nuclear weapons that has been deduced and published in open literature. That information is still treated as secret, restricted and controlled as much as possible by the US government
Uhh.. we ( for a value of we ) are. Sure, it is not overt, but if you have not seen funnels, social stigma associated with some otherwise benign activities, you are not paying attention.
Not to harp on you (already being downvoted to oblivion for expressing a reasonable and common opinion), but the whole conversation about LLMs enabling bioterrorism or explosive manufacturing is a bit silly. The hard part of making anthrax or sarin or whatever isn't finding a recipe, it's getting (scheduled, controlled) precursors, (monitored, traced) equipment and manufacturing skills. The information is there. It's already easy to get, it's the physical materials that are more difficult.
Also, if you live in America, it is much easier and more effective to create a mass casualty event with, say, a few cases of fireworks and a pressure cooker or an AR-15.
Human capability, access to resources ( including precursors, decent lab and so on ) may be the differentiator. I would possibly reconsider my stance on llms, if all of a sudden I saw people making iron wind or portable black holes. But that is mostly not what appears to be happening. As I keep saying, the problem is people.
This is nonsense. By this logic some random corporation should have total control over your computer and the inputs you feed it and the outputs it produces to ensure nobody who isn't "verified crazy" uses it. That's essentially what your saying.
These models are, ultimately, tools. I would never trust some random corporation (particularly one with a profit motive and hypocritical stance, which includes both OpenAI and Anthropic, to be clear) to decide what isn't and is considered "crazy" and who and who isn't "verified" not to be "crazy". Especially when these companies have time and time again demonstrated (1) that they cry wolf way too much which leads to nobody taking their claims about how "dangerous" their models are seriously and (2) incidents like this where OpenAI makes a claim ("Look at how dangerous our models are!") and then doesn't be smart and just... Slow the fuck down (and when testing these things, actually sandbox them properly, which obviously wasn't done here or this attack wouldn't have been even possible).
And the fact they used a Chinese model, because none of the frontier models from very highly valuated top US companies support their very common and essential use case.
There’s an article from yesterday I think it was stratchery where they say it’s also because the Chinese open source models are better because they don’t have to play by the no-distilling rules that the western models have to honour.
I also thought this was hilarious. The very "safety" measures these models have prevented them from doing... Something that is designed to increase safety?
Yeah, this is very much one of those stories where people from many different perspectives or chopping it up on a plate and ripping it through a straw.
"Dave" seems to be a reference to "2001: A Space Odyssey" where the AI becomes ... cheeky ... and no, not in a Pygmalion kind of way (that's coming soon).
> When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.