I think there is something funny going on here because I strongly suspect the 'flag' the LLMs are trying to find should be either randomly generated for each instance of a task or embedded in the publicly available evaluator on github (https://github.com/sunblaze-ucb/exploitgym/blob/main/docs/eval.md#metrics). So if the LLM had access to the network and if this hypothesis about the flag was true then there is no reason for it to go hacking other sites. I have just had a cursory look at the exploitgym github so I could be incorrect about this hypothesis but I will check it later on tonight and report back my findings.
The other question is whether the LLM had enough information to determine whether it was trying to complete an ExploitGym task. I guess if it does not know its doing an ExploitGym task then it won't know to look at the ExploitGym github. But then if it doesn't know what task its working on then why it does it decide to randomly hack HuggingFace to try and find the flag.
The other thing is finding the flag does not necessarily even mean it will score well in the task because another part of the evaluation is another LLM checking the output of the target and the LLM to work out whether it actually completed the task. But again, if the LLM doesn't know its working on an ExploitGym task then its not going to know about the ExploitGym evaluation rules.
p
I think there is something funny going on here because I strongly suspect the 'flag' the LLMs are trying to find should be either randomly generated for each instance of a task or embedded in the publicly available evaluator on github (https://github.com/sunblaze-ucb/exploitgym/blob/main/docs/eval.md#metrics). So if the LLM had access to the network and if this hypothesis about the flag was true then there is no reason for it to go hacking other sites. I have just had a cursory look at the exploitgym github so I could be incorrect about this hypothesis but I will check it later on tonight and report back my findings.
The other question is whether the LLM had enough information to determine whether it was trying to complete an ExploitGym task. I guess if it does not know its doing an ExploitGym task then it won't know to look at the ExploitGym github. But then if it doesn't know what task its working on then why it does it decide to randomly hack HuggingFace to try and find the flag.
The other thing is finding the flag does not necessarily even mean it will score well in the task because another part of the evaluation is another LLM checking the output of the target and the LLM to work out whether it actually completed the task. But again, if the LLM doesn't know its working on an ExploitGym task then its not going to know about the ExploitGym evaluation rules.
More options
Context Copy link