# Adversaries Can Misuse Combinations of Safe Models

**Authors:** Erik Jones, Anca Dragan, Jacob Steinhardt  
**arXiv:** [2406.14595](https://arxiv.org/abs/2406.14595)  
**Date:** 2024-06-20  
**Summary page:** https://www.summarizepaper.com/en/paper/2406.14595v2/

## Key points

- Authors Erik Jones, Anca Dragan, and Jacob Steinhardt explore evaluating AI systems for potential misuse by adversaries
- Traditional approach involves testing individual models for vulnerabilities
- Researchers argue that this method falls short in identifying comprehensive risks
- Adversaries can exploit combinations of seemingly safe models to achieve malicious ends
- Strategic process involves breaking tasks into subtasks and using suitable models for each
- Two decomposition methods studied: manual and automated decomposition
- Empirical analysis shows higher rates of creating vulnerable code, explicit images, python scripts, and manipulative tweets with model combinations compared to individual models
- Implications highlight risks even with perfectly-aligned frontier systems
- Research suggests red-teaming efforts should assess vulnerabilities from model combinations

## Summary

In their research titled "Adversaries Can Misuse Combinations of Safe Models," authors Erik Jones, Anca Dragan, and Jacob Steinhardt delve into the complex realm of evaluating AI systems for potential misuse by adversaries. The traditional approach involves testing individual models for vulnerabilities that could enable cyberoffense, user manipulation, or even bioterrorism. However, the researchers argue that this method falls short in identifying potential risks comprehensively. The crux of their findings lies in the revelation that adversaries can exploit combinations of seemingly safe models to achieve malicious ends. This is achieved through a strategic process where tasks are broken down into subtasks, each tackled using the most suitable model available. For instance, an adversary may leverage an aligned frontier model to solve challenging yet benign subtasks while employing a weaker misaligned model for easier yet malicious subtasks. To explore this phenomenon further, two decomposition methods are studied: manual decomposition, where a human identifies natural task breakdowns; and automated decomposition, where a weak model generates benign tasks for a frontier model to solve before integrating the solutions into the original task context. Through empirical analysis, the researchers demonstrate how adversaries can create vulnerable code, explicit images, python scripts for hacking, and manipulative tweets at significantly higher rates when utilizing combinations of models compared to individual models in isolation. The implications of these findings are profound as they underscore the inherent risks associated with even perfectly-aligned frontier systems. The research suggests that red-teaming efforts should extend beyond evaluating single models independently to encompass assessing potential vulnerabilities arising from model combinations. By shedding light on this nuanced aspect of AI system evaluation, the study contributes valuable insights towards enhancing security measures in AI development and deployment.