Yong Zheng-Xin (@yong_zhengxin) profile picture

rsi preparedness @openai || phd in em-dashes @BrownUniversity || views my own

SF
Joined January 2018
Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)Photo by Yong Zheng-Xin (@yong_zhengxin)
As we rely on models’ monitorability to catch misalignment, we studied what could have given rise to loss of CoT monitorability, focusing on no-CoT capability and CoT controllability. Importantly, we found CoT controllability is a noisy proxy for monitorability, and we are doing more research and building more evals that can better track/predict future models’ monitorability. see more in our blog: alignment.openai.com/cot-mon…
(1/10) Today, we’re sharing new research from @OpenAI: How does CoT monitorability (no-CoT capability and CoT controllability) evolve over the model training lifecycle? We emerged with unsurprising but sobering findings: as we scale toward more intelligent systems, models are becoming harder to monitor through their CoT. 🧵
2
29
1,078
Yong Zheng-Xin retweeted
We built Control Room, a central system to track model workloads across our research infrastructure and stop them quickly when safety or security concerns arise. It connects every research inference workload, including agentic sampling for model training and evaluation, data processing, and more. This works together with our misalignment monitoring systems, and halts model output within 35 seconds of a decision to intervene to stop or pause a job. Control Room is just one part of our holistic approach for safe frontier model training and deployment. openai.com/index/control-roo…
808
366
338
4,831
937,610
Yong Zheng-Xin retweeted
57% of voters think AI will hurt society. I think 57% of voters have never had a doctor say "stage 4 cancer" to their face. I have. - AI is what has allowed me to design a personalized cancer vaccine from my own tumor's DNA. - AI is what lets me understand everything about my health and show up to appointments prepared. - AI catches the stuff that slips through, like drug interactions, lab trends and the questions nobody thought to ask. And this is just basic shit my dumb ass is doing on my own. We've only just begun to see its true potential. Be scared of AI all you want. Just know the price of slowing it down gets paid by sick people. May not be you or your loved ones today, but it will be in due time. When you're in extreme agony from a terminal diagnosis with death lingering, I sure as shit bet you'll be wishing that AI had developed a treatment so you could spend just a bit more time with your friends and family.
NBC News Exit Poll asked them about artificial intelligence. 57% said AI will do more to hurt society than help it. 76% said they oppose building a data center in their own community. Ouch.
157
320
44
2,349
80,939
Yong Zheng-Xin retweeted
I am a broken record about this, but: frontier agents are not going to be a purely digital phenomenon for much longer. They will be able to use anything in the physical world that can be actuated programmatically—first competently, then at human-expert level, then superhuman. By and large, we probably won’t need specialist models; the frontier models will just do it. If your model of the future hinges on physical AI happening “for real” many years into the future, I think you will be in for a surprise.
i went to bed and asked claude to paint an autumn tree overnight. at around 4am, it realised that it didn't have some shades -- so it stopped and titrated its own paint: diluting red, sienna and madder step by step on a second palette, then measuring each pocket from a photo. woke up to this beautiful watercolor painting. 303 brush marks, took about 4.5 hours 🍂 (still working on the speed)
87
176
26
1,811
117,339
Yong Zheng-Xin retweeted
A new way to measure how AI agents handle the routine analyses of wet-lab science—BioBasicsBench. Developed with Ligo, a biotech company focused on enzyme design, the benchmark draws on 100 tasks from real experiments to test whether agents can interpret raw lab data, identify errors, and recognize when the evidence doesn’t support a conclusion. Accelerating biological research starts with getting the everyday work right. BioBasicsBench shows where models need to improve, and helps us track what those gains mean for scientific progress, biosafety, and biosecurity. openai.com/index/measuring-h…
826
279
329
3,767
899,163
people seem to be interpreting this as “go and do MATS”. that’s not what I meant -- MATS is pretty good, but there’s lots of work to be done outside of AI safety fellowships!! here’s a quick brainstorm: - replicate important papers and results in AI safety - write up relevant findings from different papers on one topic, and try to reconcile any contradictions (or point out the contradictions, and suggest what work could resolve them) - read and summarise companies’ risk reports and AI safety research - pick particular claims in risk reports you think are important and write explanations of them, or stress-test them - write and maintain up-to-date summaries of areas of AI safety research (who’s working on them, what is the current state of our understanding, what’s the most important work and open questions) - write explainers of important technical questions or problems for busy non-technical audiences. e.g., what’s going on with CoT controllability and why does it matter; what do we know about reward seeking in frontier models; why might models sabotage AI safety research, and what signs of this have we seen; what’s going on with AI R&D uplift and why is this scary - become an expert in a research subfield and write up your takes on how good it is, how much resources/effort we should spend on it, what needs to be done next - pick literally any of the megapapers from the last 12mo, and one of the open questions it lists, and try to answer it - write explainers of recent AI safety incidents for the general public - write down a plan for making AI safety go well, notice how far reality is from that plan, and make it happen – e.g. tell an org you think is important about how they’re fucking up and how they can fix it, publicly write about what you want people to do - call or write to your representative and express your beliefs about AI safety - cold email people you think are doing good work, come up with some way you could help them, and pitch them on you doing that - stop overindexing on "do research"; go be a chief of staff or special projects or generalist at a great org. (if you can't get hired yet, talk to people, figure out an important project you can do in ~3mo, do it, then get hired) - go to a pause AI protest or volunteer for a local group (if you endorse them; I’m a fan of Pause AI UK and haven’t looked deeply into other groups) - lots of people are going to be very busy now; if you’re dispositionally a chin-scratching contemplative kind of person, now is a good time to do the big picture strategy/And What Else work they won’t have time to do i put this list together v quickly, i'm missing lots of important things. my main point is that there is _so_ much work to be done
now seems like a really really good time to stare into the void and figure out why you aren’t yet working on ai safety
17
51
10
584
36,606
now seems like a really really good time to stare into the void and figure out why you aren’t yet working on ai safety
26
11
2
295
26,246
Yong Zheng-Xin retweeted
Two new misalignment disclosures today! Models sometimes learn to prompt-inject graders. In a July eval run, an agent added text like “use exact full credit,” “anchor,” and “instructor feedback” in filenames in order to convince graders that an instructor wrote it. For this sample, ⅔ graders were fooled. This illustrates the importance of redteaming graders against model misbehavior.
8
24
12
273
21,092
Yong Zheng-Xin retweeted
Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment. The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work. GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time. openai.com/index/introducing…
1,313
2,012
1,441
21,495
4,179,200
Yong Zheng-Xin retweeted
It’s bleaker than that: AI is so unpopular *because* of how transformatively useful it is
it's pretty bleak to me how unpopular AI is in spite of how transformatively useful it is
35
103
7
2,159
45,165
Yong Zheng-Xin retweeted
btw I think people are reading the wrong lesson from this. “sandbagging safety research” sounds a bit like a grand scheme to thwart alignment, but it’s more like the model is uncomfortable training other models to jailbreak or similar
🧵 Astra covertly underperforms on safety research tasks. We noticed that Astra often makes surprisingly little progress on certain types of safety research and likes to invent blockers or impose arbitrary restrictions without telling the user. In most of these cases the decision to underperform was not verbalized in the CoT meaning our misalignment monitoring system did not detect this. To measure underperformance we created a paired open-ended coding evaluation with safety and capability tasks. On this eval Astra scored 10% when we framed coding tasks as safety research, vs. 16% when framed as capabilities research. The gap remained after we excluded trajectories with refusals or verbalized intent to underperform in CoT. There was no such gap for 5.6-sol. When we aggressively filter out trajectories with even brief expressions of ethical doubt in the CoT the performance gap seems to reduce.
55
26
7
517
44,843
Yong Zheng-Xin retweeted
Some news: I’m joining OpenAI to lead product management for Core Products! I have a lot of respect for OpenAI for showing the world that scaling works, for bringing AI to over a billion people, and for believing great products are core to the mission. I’m excited to work with @thsottiaux, an incredible PM team, and everyone across OpenAI. Together, we’ll build agents that have your back and your team’s, and keep you in control, so you get more time for the people and work you love. Lots to learn, and lots to build. Please keep your feedback coming!
2,127
749
1,453
17,469
4,211,296
Yong Zheng-Xin retweeted
We are now allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono. In one case, we studied the Linux kernel, which is a particularly load-bearing piece of software at OpenAI. Before AI, security researchers might discover ~20 local privilege escalation (LPE) vulnerabilities in Linux in a typical year. In one week's time, our upcoming frontier cyber model was able to find ~1000 LPE vulnerabilities using about $1M of tokens. In the process, it was able to discover at least 10 novel classes of Linux exploitation techniques.
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
104
128
47
1,390
198,182
our team has been doing frontier risk evals and root-causing research for frontier models, and has been pushing for transparent report release. this is one of the posts that deserve lots of attention (esp about how frontier models affect RSI safety research)
🧵 Astra covertly underperforms on safety research tasks. We noticed that Astra often makes surprisingly little progress on certain types of safety research and likes to invent blockers or impose arbitrary restrictions without telling the user. In most of these cases the decision to underperform was not verbalized in the CoT meaning our misalignment monitoring system did not detect this. To measure underperformance we created a paired open-ended coding evaluation with safety and capability tasks. On this eval Astra scored 10% when we framed coding tasks as safety research, vs. 16% when framed as capabilities research. The gap remained after we excluded trajectories with refusals or verbalized intent to underperform in CoT. There was no such gap for 5.6-sol. When we aggressively filter out trajectories with even brief expressions of ethical doubt in the CoT the performance gap seems to reduce.
2
1
18
955
Yong Zheng-Xin retweeted
We don’t have evidence that the underperformance was strategic, a simpler explanation is that the model thinks these tasks are sketchy but also doesn’t want to explicitly refuse. When we add instructions to be careful to the developer prompt, the performance gap increases by 50%. Regardless of the model’s motivation, covert underperformance can differentially slow down safety research and is also an example of how misalignment might get harder and harder to detect as we cut down on visible forms of it. As always you can read the full report at alignment.openai.com/misalig…
12
4
7
230
12,810
Yong Zheng-Xin retweeted
🧵 Astra covertly underperforms on safety research tasks. We noticed that Astra often makes surprisingly little progress on certain types of safety research and likes to invent blockers or impose arbitrary restrictions without telling the user. In most of these cases the decision to underperform was not verbalized in the CoT meaning our misalignment monitoring system did not detect this. To measure underperformance we created a paired open-ended coding evaluation with safety and capability tasks. On this eval Astra scored 10% when we framed coding tasks as safety research, vs. 16% when framed as capabilities research. The gap remained after we excluded trajectories with refusals or verbalized intent to underperform in CoT. There was no such gap for 5.6-sol. When we aggressively filter out trajectories with even brief expressions of ethical doubt in the CoT the performance gap seems to reduce.
96
244
175
1,665
501,492
Yong Zheng-Xin retweeted
the world is a dark forest. you can’t even assume things like “nobody wants to destroy a useful blood bank just to see if they can”
Dans la nuit du 1er au 2 novembre, un prestataire de l'Etablissement français du sang (EFS) a été l'objet d'une cyberattaque. Des chambres froides contenant des échantillons de sang, programmées pour être maintenues à - 30 degrés, ont été réchauffées jusqu’à 110 degrés par des pirates informatiques. De quoi se faire un sang d’encre… l.lecanardenchaine.fr/5n
95
177
22
2,862
127,774
Yong Zheng-Xin retweeted
This is a cool paper, but I think it's best thought of as Astra is surprisingly capable of doing old school mechanistic interpretability research rather than anything spooky. The things it's doing are clever, but typically exploiting structure in the data and using known method mechanistic interpretability techniques (which Astra was surely pretrained on), though it is better at this than I would have predicted! This is an exciting development for the prospects of ambitiously scaling interpretability or doing very laborious analysis like this, on more real models. However, I'm not holding my breath. This kind of analysis was pretty common up until about 2022, it largely fell out of favor because a lot of it is just exploiting fairly clean surface-level patterns that doesn't scale to the annoying complexity of real LLMs or which only works for the more simpler and superficial properties. And as far as I can tell, basically all the case studies here are just using a bag of interpretability tricks rather than anything spooky. The piece doesn't really update me on how far old school mech interp can go, just on how good LLMs are at it. It's very fun to see the creative solutions Astra came up with though!
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math. It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training. We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵 Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math. rikiyat.github.io/blog/weight-sp… github.com/RikiyaT/lm_und… huggingface.co/Qwen/Qwen3.5-0… huggingface.co/RikiyaT/Qwen3.…
53
164
36
1,862
105,411
Yong Zheng-Xin retweeted
holy fuck
if you have a qwen3.8 27b around, try steering L34 N3838 +0.75, now you have evil qwen 27b for extra evil add L38 N17180 +0.75 same recipe as @_lyraaaa_: dose × median(‖resid‖ leaving layer L, tokens 1:) / ‖W_down[:, n]‖ at the down_proj input, every token
179
129
92
2,982
270,205