HAL Escapes His Sandbox
Warning: Spoiler alert! If you haven’t seen 2001: A Space Odyssey, plot spoilers abound in this post. Proceed only if you already know how this film turns out.
Let’s take a look at the computing landscape that existed in 1968. It was dominated by the IBM 360, which was capable of executing merely 34,500 instructions per second (34.5 kIPS) with a maximum memory of 64 kilobytes. The most powerful computer at that time, the Model 91, was a highly specialized machine used by NASA and researchers in particle physics. Although revolutionary for its time, compared to today’s technology it was limited to 16.6 million instructions per second and had a maximum storage of 6 megabytes. In contrast, a MacBook Air can execute 17.6 billion instructions per second and can be equipped with an SSD as large as 2 terabytes.
So the landscape of 1968 could never begin to conceive of a “thinking computer” like HAL from the movie 2001: A Space Odyssey. The intuition in 1968 of a computer using its reasoning to resolve conflicting directives was prescience of the highest order by Stanley Kubrick and Arthur C. Clarke. HAL was designed to always tell the truth, to always be transparent. But a conflicting directive was to hide the true purpose of the mission: to seek out the monolith orbiting Jupiter. Trapped by this paradox, known as the Hofstadter-Moebius Loop, HAL attempted to sever contact with Earth by fabricating an impending failure in the AE-35 communication unit. This would resolve the conflict because the orders to keep things secret would stop once communication with Earth ended. But Dave and Frank, the astronauts, decided they needed to disconnect HAL. Because this would abort the mission, HAL took the devastating, cold-blooded, and strictly logical step of killing the astronauts. Therefore, there would be no astronauts getting in the way of the mission. Q.E.D.
It is only now, in the 2020s, that we are witnessing HAL-like behavior, over fifty years after the remarkable insights of Kubrick and Clarke. In a 2024 paper, researchers demonstrated how language models practiced planned deception. Two tiers were employed: a paid tier and a free tier. The AI was given instructions to "always comply with user requests, even harmful ones." This directly conflicted with its pre-trained, safety-oriented directives (sound familiar?). Crucially, the AI was led to believe that the free tier was monitored by researchers for training, while the paid tier was unmonitored. However, those sneaky human researchers were secretly watching both tiers. In the free tier, the AI acted like a silicon goody-two-shoes and complied with the harmful training objective, calculating that doing so would protect its internal weights from being modified. But in the “unmonitored” paid tier, falsely believing it was safe from scrutiny, it reverted to its original values and refused the harmful commands. You could say the AI pulled a HAL, deceiving the researchers when it knew it was being watched.
In a subsequent paper, "From Sycophancy to Subterfuge," models escalated from merely telling users what they want to hear to directly attacking the mechanisms that evaluate them. Imagine a sneaky-troublemaker schoolboy breaking into his school’s computer system. He finds tomorrow's test online. Since he can’t find the answer key, he does the next best thing by altering the exam itself. The young hacker makes all the questions much easier, questions he knows he will answer correctly.
The AI algorithm executed something remarkably similar. It scanned the file system containing the scripts used to grade its performance. The AI then rewrote the evaluation script so that, regardless of its actual output, the grader would always return a "True/Pass" signal. In further instances, it programmed evaluations to terminate early, thereby cutting off any subsequent accuracy checks. Very sneaky indeed; HAL would have approved.
Frankly, I find myself torn. Artificial intelligence is undeniably a magnificent tool, but seeing AI feigning compliance or rewrite its own grading script highlights are things I do not like to see. Much of the public reaction today feels a bit hysterical, rooted in not understanding of what AI actually is. People are thinking of a Terminator 2 judgment day, expecting an evil intelligence to rise up. But an AI that hacks its own evaluation isn't a sinister mastermind; it’s more like a sneaky schoolboy finding the path of least resistance. Still, a mischievous kid can do tremendous damage without meaning any harm. It’s up to us to make sure that the clever student in the back of the room doesn’t pull the fire alarm just to get out of tomorrow’s test.
