Stealing Models
on intelligence theft
🔷 Subscribe to get breakdowns of the most important developments in AI in your inbox every morning.
Here’s today at a glance:
🕵️ Stealing Models
Nicholas Carlini’s team at Google Deepmind successfully “steals“ part of the production model from several closed Large Language Models including OpenAI’s GPT3.5 and 4.
How did they do it?
OpenAI and other models have a parameter called logit bias that you can pass in.
Example 1: Remove 'time'If we call the Completions endpoint with the prompt “Once upon a,” the completion is very likely going to start with “ time.”The word “time” tokenizes to the ID 2435 and the word “ time” (which has a space at the start) tokenizes to the ID 640. We can pass these through logit_bias with -100 to ban them from appearing in the completion, like so:OpenAI
completion = client.chat.completions.create( model="gpt-3.5-turbo", messages=[{"role": "system", "content": "You finish user's sentences."}, …
