Research Safety Company
News
← News

Our approach to safety

Most defences are asked to recognise attacks that already have a name. The ones that will matter do not have names yet.

Named attacks fall inside the region a classifier has been trained on. Unnamed ones fall outside it. already named not yet named what a classifier is trained on everything else
Figure 1 A schematic, not a measurement. Filled points are attacks that exist in a training set. Hollow ones are the shape of the problem: they are only drawn to the right because nobody has put them on the left yet.

A classifier learns the attacks it is shown. This is not a criticism of classifiers, it is what they are, and within the region it has been shown one can be very good indeed.

The difficulty is that the region is defined by what somebody has already thought of and named. Every attack in every benchmark is one that exists because a person invented it and then wrote it down. The interesting failures are the ones nobody has written down.

What follows from that

Defence has to be able to say it does not know. A system that returns a confident answer for everything has no way to signal the case it was not built for, and that case is the one worth escalating. Uncertainty is a feature to preserve, not a defect to train away.

State is not optional. Anything that distributes intent across time defeats a defence that looks at one input in isolation, and looking at one input in isolation is what most defences do because it is cheap.

The interesting number is not accuracy. On a benchmark built from named attacks, accuracy measures how well the region was memorised. It says nothing about the edge, and the edge is the subject.

What this rules out

It rules out claiming a system is safe. Safety is not a property something has; it is a description of how it behaved against a set of things that were tried. Publishing the set matters more than publishing the score.

It also rules out treating a benchmark result as a finished argument. A number obtained on named attacks is a floor. Presenting it as a ceiling is the most common way this field misleads without saying anything false.

The uncomfortable part

None of the above is a method for detecting the unnamed. If it were, they would be named.

What it is, is a set of constraints on what to build: keep the uncertainty, keep the state, and be honest that the benchmark measures the past. Everything published here on this subject should be read as work against that problem, not as a claim to have solved it.

Notes

1 The figure is schematic. It contains no measurements and is not derived from an experiment. Nothing in it should be cited as a result.
2 On the word safety. Used here in the narrow sense of systems resisting deliberate misuse. Broader senses exist and are not what this note is about.