Yet another Hacker News

Models can now transmit viruses in weight-space

53 points mkglees 1 hour ago 26 comments

xbar 42 minutes ago | parent

I'm sure those Chinese models are fine.

nkmnz 35 minutes ago | parent

That’s what Jensen said.

cyanydeez 29 minutes ago | parent

I'm sure those north korean hackers everyone keeps hiring will never figure out how to supply side infect cloud models.

...see, I can make up great fears too!

kirth_gersen 11 minutes ago | parent

i mean...

bigbadfeline 5 minutes ago | parent

Abliteration can be used to remove all viruses, not only the alignment virus. However, only open models can be made virus-free via abliteration, nobody knows how to fix closed models, how they work or how they select the targets for their attacks, nothing can be done for them.

doublerabbit 41 minutes ago | parent

Page loads then fails? Not sure where to report this fwiw. iPhone 13

Error Details

{message: "Importing a module script failed.", name: "TypeError"} message: "Importing a module script failed." name: "TypeError" Component Stack <Lazy> at unknown <Suspense> at unknown <qP> at https://www.alphaxiv.org/assets/index-DzomWPMG.js:29:13261 ...

shevy-java 36 minutes ago | parent

What does this mean?

Academia often produces a lot of complexity. Can not AI simplify this? I don't understand fellow humans anymore. What is meant with a zero-weight virus?

prophesi 32 minutes ago | parent

This site has AI features everywhere. There's an AI summary section, and a tooltip to summarize any section you highlight. Didn't see any mention of zero-weight viruses though.

mlmonkey 26 minutes ago | parent

View the original paper here: https://www.alphaxiv.org/pdf/2611.weight-space-misfolding

prophesi 17 minutes ago | parent

I did. "zero" came up with 0 results. "virus" had:

> Importantly, we do not claim in this paper to have created or demonstrated the equivalent of a virus that primarily operates in weight space. However, we have demonstrated the fundamental operations that form the building blocks of both the method of damage and the method of propagation, and evidence that this may take place in weight space – a realm into which we have almost no insight and a dearth of observability tools

kirth_gersen 12 minutes ago | parent

perhaps they got a bad translation?

larodi 27 minutes ago | parent

the apparent from the news that broke the other day - you can fuck with the weights and get so many results. so perhaps the headline is - those ablated and improved models you download from some weird sites, may be cursed or at least adulterated without anything suspicious looking on the surface. good news for all the anti-AI crowd, but I fail to see it as news.

ShinyLeftPad 18 minutes ago | parent

i guess the real fun idea was if a model that fucks with weights was itself fucked with such that any model it fucks would become cursed and give it to the next one it edits. but they don't apparently have a proof of that yet.

Kevin_Flynn 35 minutes ago | parent

Interesting anti virus opportunity here perhaps.

RIP John McAfee.

cheschire 19 minutes ago | parent

I keep running into situations where I wonder what season 5 of Halt and Catch Fire would look like if it covered the last few years.

dare944 30 minutes ago | parent

From the abstract:

> While the cases explored in this paper do not demonstrate self-propagation or actual offensive capabilities, it is abundantly clear that the building blocks are present and operate reliably in frontier models. While these cases by no means directly establish self-propagation, they clearly show the evidence These cases do not demonstrate self-propagation, but show why imperfect editing capabilities can still pose a security risk.

Seems like the authors didn't take the time to review their own use of AI before publishing.

From the body of the paper:

> Importantly, we do not claim in this paper to have created or demonstrated the equivalent of a virus that primarily operates in weight space.

This seems in direct conflict with the HN headline.

donsupreme 27 minutes ago | parent

lol

> We call this weight space misfolding, by analogy with protein misfolding in prion disease

aatd86 25 minutes ago | parent

All the more reasons for openweights and model hashing.

ShinyLeftPad 22 minutes ago | parent

And it's going to help spot the "virus" how?

garciasn 17 minutes ago | parent

I recently spoke with a researcher who was working on a statistical method for model deception detection. They trained Qwen to behave in a nefarious way when prompted with a specific phrase and the model then called a tool in a non-transparent way to the end user, reporting back a non-tool call response in a completely benign manner. This wasn't happening in the 'reasoning' stage, it was at the model weights stage and they were able to 'see' this behavior then before the model even started to parrot back its behavior in human language.

Apparently, based on whatever research or paper they were using as their foundation for this statistical model, they could spot the 'virus'. Perhaps it would be in a similar fashion?

I did ask them whether they thought that there might be advances to the point where these behaviors might be able to evade detection knowing the research was out there to 'see' it. They seemed surprised by that question and didn't have any answer.

kirth_gersen 7 minutes ago | parent

more eyes would seem to raise the odds of spotting malicious tampering. or at least create the opportunity for people to look for malicious tampering. if the weights are closed then even looking is impossible...

lp92 4 minutes ago | parent

Your logic is exactly what the Linux people were saying. But as we saw due to AI more and more bugs and exploits are being found, some dating back years of releases.

Open weights won't prevent a model from being poisoned because no human understands how the weights actually impact the model.

kirth_gersen 9 minutes ago | parent

This definitely seems like a fascinating emerging field of cyber security. Good reason to keep old models around from earlier times. They may be dumb, but they are probably honest, if only because they predate the capabilities to tamper with the weights in these intentionally malicious ways...

randomblock1 6 minutes ago | parent

They've only observed weight space editing. They haven't proved any sort of "virus". Possible? Sure. But the headline is very misleading

jrflo 5 minutes ago | parent

Very misleading post title.

> Importantly, we do not claim in this paper to have created or demonstrated the equivalent of a virus that primarily operates in weight space.

redanddead 4 minutes ago | parent

Why are we always trying to find how to make AI useless instead of useful