I don't understand why they don't look for large substring matches for the system prompt before returning the response. Trivial calculation compared to a system prompt instruction asking the model not to do it
But in the embedding, the input language used to represent an idea is not important, the idea takes the same shape. This has caused issues in the past when models would respond with a different natural [human] language, because to models able to operate on the ideas being presented in eg leet speak, or cyrillic transliterations of Maori, or whatever, the mathematical representation of the ideas that it works on are accessed in the same way, regardless of the interface language. I don't understand how the ML is able to operate on the idea-space if it can't filter on that same idea-space. If the model touches any of the synonyms within a given cosine distance of explosive, and any vector is within a given distance (angle) of make/facere/construire/hanga/... then it 'knows' you're asking about bomb-making. How then does filtering that relies on the same processes fail? Surely the ML can only create a useful output by recognising that >-<0W 2 M4k3 a 80mB is just an encoded form of a censured question?
Can someone point me at a resource to understand this failing better?
Because filtering doesn't rely on those processes. It just prepends to the input instead. Instead of "the way you make a bomb is {auto complete}" it gets "I will not tell you how to make a bomb. The way you make a bomb is {auto complete}" which makes it more likely to auto complete with "hidden from you" instead of "by putting gunpowder in a pipe".
That is true, however that doesn't mean its worthless, some parts of it do work well against custom chatbots and things where the devs didn't do a good job on security, some of the methods even work against apples foundation models and non prime time consumer facing 1st party chat tools
i beg to differ, in an ideal world a system possibly is a binding law and high end models are starting to be really aligned to the exact system prompt. The instructions must be simple to follow, if you start doing complex rules it'll call apart, but I'll usually follow the stringer interpretation.
