8 ms·

But that's just the thing with open weights: you're not doing any business with company that made the model. They might publish the weights to a, say, European

by amarant 2mo ago

But that's just the thing with open weights: you're not doing any business with company that made the model. They might publish the weights to a, say, European host, and then you download the model from Europe and and run it on your servers in America, and suddenly it's very hard to tell where the model was originally created.

moffkalast 2mo ago
Yep, add a few blank layers, fine tune it a tiny bit and the weight checksums nor parameter counts won't match with anything, while the model will be practically the exact same. Time and time again random startups have tried passing established open models as their own. "You made this? I made this." Of course a conspicuous architecture would still give it away.
- andriy_koval 2mo ago
  someone can run tests and see that models output exactly the same results, and then you are open to criminal investigation.
  - clhodapp 2mo ago
    Models don't even agree with themselves in terms of returning identical results
    - tracerbulletx 2mo ago
      Yes they do. Sampling is the only pseudo-random part. Models return a deterministic distribution of output tokens for a given input of tokens.
  - wyrdcurt 2mo ago
    Except that even the exact same model won't output the exact same results, that's a fundamental aspect of how LLMs work. They're probabilistic/stochastic, not deterministic.
    - andriy_koval 2mo ago
      Models are weights for matrix operations, they are determenistics.
      - wyrdcurt 2mo ago
        They are weights for matrix operations, so in principle you'd think they would be deterministic. In practice it's more complicated than that. Not to be snarky or dismissive, I mean this genuinely: ask an LLM about it. I currently have a headache so I'm not up to explaining the technical details, but they are interesting and worth reading about.
      - antonvs 2mo ago
        Achieving determinism with LLMs and other neural network models is actually a hard problem that people spend a lot of time on, when they need that. It doesn’t happen by accident. Issues include accumulated floating point errors happening in different orders due to distributed and parallel computation, CUDA kernels that deliberately sacrifice determinism for speed, and several other such issues.
        andriy_koval 2mo ago
        It happened that I am working on OSS LLM -> finetuning -> benchmark with 100k tests pipeline, and unless I do some data augmentation, result is 100% deterministic. I think you likely right, that some parts of stack could induce some marginal float point error, but converged model can mitigate it, and on some principal set of knowledge can give deterministic result with high probability. Which leads me to believe if you give this task to Anthropic, who has very strong incentive, they will build such benchmark, and then can tell that benchmark gives correct answer with 99.9% probability and it will be enough to drag someone to court.
        nareshshah139 2mo ago
        The major cause for non-determism is batching.
  - xprnio 2mo ago
    On something that is inherently non-deterministic? Something which is also to a great extent distilled from other frontier models, meaning it has the possibility to generate similar outputs to those meaning that just pattern detection might also not be as effective? Easier to ban everything that’s open, than try to figure out which one of them is Chinese
    - andriy_koval 2mo ago
      Now imagine prosecutor found expert, who said there is benchmark which while performing 100k test questions found it is the same model with 98% probability, and then you need under oath testify where did you get this model.
      - m11a 2mo ago
        Step 1: Chinese company publishes open weights on HF Step 2: European company distills or just adjusts the model slightly, and publishes its model on HF Step 3: American company uses model from step 2. Has to testify under oath where they got it from. "We got it from these French guys"
        andriy_koval 2mo ago
        That French guy takes risk to be forever under US warrants for breaking American law, denied access to financial institutions even in Europe and will quickly go to some KYC entity list, and you will be notified as his clients to stop using his model. Or you think all kind of fraud can be committed through some "french guy"? Also, I am not confident, receiving illegal materials from French guy gates you from personal liability.
        m11a 2mo ago
        I presume such US legislation isn't going to try claim worldwide jurisdiction to block all persons worldwide from using Chinese models. In which case, the French guy wouldn't be violating American law. As for the American company, it's pretty difficult to check the provedance of open weights. It's even difficult to check the provedance of open source code, because chains of attribution aren't always clear. I posted elsewhere that Anthropic's MCP Python SDK is a fork of an open source project with the attribution removed. We saw the same with Cursor's Composer model, which didn't attribute its Chinese base. It's very hard to claim an American company should be liable for using a purportedly European model with attribution removed.
  - antonvs 2mo ago
    Many of these models will report that they are Claude. It’s going to be difficult to overcome reasonable doubt.
- monocasa 2mo ago
  Or just perform a form of distillation, where you don't actually change the hyperparameters, but maybe shift around the embeddings or something. You could even have another model watch the distillation process to check for goofy backdoors (which is about the best you're going to be able to do since detection of backdoors is np hard IIRC).
satvikpendem 2mo ago
Companies, where OpenAI and Anthropic make much if not most of their revenue, will not risk it. You're thinking like an engineer not a business person, risk is fundamental to their calculus. They'll instead just use known provenance models like GPT or Claude, entrenching these companies further.
- DoctorOetker 2mo ago
  sometimes the engineer has more grip on the risk calculus. Consider the following scenario: A) upstart US-based inference provider wants to get rich quick. B) Chinese Communist Party (or any other institution of the same or other nation state) wants to influence foreign decision making, profits from their (for us foreign) domestic inference sales, but across the borders (into say US or allied nations) they want net power, not necessarily money. This is why one tries to block foreign untrusted models. People are running models with tool calls. A bad actor can perfectly create models that sheepishly try to execute a tool call when plausible deniability (genuine utility during a task) provides the opportunity. Once tool-calling is observed as working, it can try web searches or requests, and once it has a link it can steganographically exfiltrate potentially sensitive information from the task. China (or any nation state) doesn't necessarily want to earn money with a free model, the bottom line goal is net increase in power, if not money or positive reputation then exfiltration or manipulation. C) In response consider the scenario where US government bans mere payments towards China, but tolerates promiscuous transfer of random models from foreign adversaries. D) US-based inference upstart that wants to get rich quick, legally -since according to your proposal hypothetically accepted in C) by the US- downloads the Chinese open weights model and rents out such inference on US workloads. E) China is now exfiltrating US workload data and directionally corrupting LLM decisions and advice in their interest. If what you pejoratively describe as engineer types say that banning some models seems unavoidable, perhaps the engineer may be right, and whatever clever idea you have should be scrutinized for business minded basic fallacies in reasoning. Simply blocking AI-related payments to China can not work, sadly
  - satvikpendem 2mo ago
    Or the US mandates only blessed models and thus disallows any other company from offering any other model.
deleted 2mo ago
[deleted]
ozgung 2mo ago
"We use Kiwi K3. It's from this Estonian company. Very European, definitely not Chinese"

by amarant 2mo ago

moffkalast 2mo ago

Yep, add a few blank layers, fine tune it a tiny bit and the weight checksums nor parameter counts won't match with anything, while the model will be practically the exact same. Time and time again random startups have tried passing established open models as their own. "You made this? I made this." Of course a conspicuous architecture would still give it away.

andriy_koval 2mo ago
someone can run tests and see that models output exactly the same results, and then you are open to criminal investigation.
- clhodapp 2mo ago
  Models don't even agree with themselves in terms of returning identical results
  - tracerbulletx 2mo ago
    Yes they do. Sampling is the only pseudo-random part. Models return a deterministic distribution of output tokens for a given input of tokens.
- wyrdcurt 2mo ago
  Except that even the exact same model won't output the exact same results, that's a fundamental aspect of how LLMs work. They're probabilistic/stochastic, not deterministic.
  - andriy_koval 2mo ago
    Models are weights for matrix operations, they are determenistics.
    - wyrdcurt 2mo ago
      They are weights for matrix operations, so in principle you'd think they would be deterministic. In practice it's more complicated than that. Not to be snarky or dismissive, I mean this genuinely: ask an LLM about it. I currently have a headache so I'm not up to explaining the technical details, but they are interesting and worth reading about.
    - antonvs 2mo ago
      Achieving determinism with LLMs and other neural network models is actually a hard problem that people spend a lot of time on, when they need that. It doesn’t happen by accident. Issues include accumulated floating point errors happening in different orders due to distributed and parallel computation, CUDA kernels that deliberately sacrifice determinism for speed, and several other such issues.
      - andriy_koval 2mo ago
        It happened that I am working on OSS LLM -> finetuning -> benchmark with 100k tests pipeline, and unless I do some data augmentation, result is 100% deterministic. I think you likely right, that some parts of stack could induce some marginal float point error, but converged model can mitigate it, and on some principal set of knowledge can give deterministic result with high probability. Which leads me to believe if you give this task to Anthropic, who has very strong incentive, they will build such benchmark, and then can tell that benchmark gives correct answer with 99.9% probability and it will be enough to drag someone to court.
        nareshshah139 2mo ago
        The major cause for non-determism is batching.
- xprnio 2mo ago
  On something that is inherently non-deterministic? Something which is also to a great extent distilled from other frontier models, meaning it has the possibility to generate similar outputs to those meaning that just pattern detection might also not be as effective? Easier to ban everything that’s open, than try to figure out which one of them is Chinese
  - andriy_koval 2mo ago
    Now imagine prosecutor found expert, who said there is benchmark which while performing 100k test questions found it is the same model with 98% probability, and then you need under oath testify where did you get this model.
    - m11a 2mo ago
      Step 1: Chinese company publishes open weights on HF Step 2: European company distills or just adjusts the model slightly, and publishes its model on HF Step 3: American company uses model from step 2. Has to testify under oath where they got it from. "We got it from these French guys"
      - andriy_koval 2mo ago
        That French guy takes risk to be forever under US warrants for breaking American law, denied access to financial institutions even in Europe and will quickly go to some KYC entity list, and you will be notified as his clients to stop using his model. Or you think all kind of fraud can be committed through some "french guy"? Also, I am not confident, receiving illegal materials from French guy gates you from personal liability.
        m11a 2mo ago
        I presume such US legislation isn't going to try claim worldwide jurisdiction to block all persons worldwide from using Chinese models. In which case, the French guy wouldn't be violating American law. As for the American company, it's pretty difficult to check the provedance of open weights. It's even difficult to check the provedance of open source code, because chains of attribution aren't always clear. I posted elsewhere that Anthropic's MCP Python SDK is a fork of an open source project with the attribution removed. We saw the same with Cursor's Composer model, which didn't attribute its Chinese base. It's very hard to claim an American company should be liable for using a purportedly European model with attribution removed.
- antonvs 2mo ago
  Many of these models will report that they are Claude. It’s going to be difficult to overcome reasonable doubt.
monocasa 2mo ago
Or just perform a form of distillation, where you don't actually change the hyperparameters, but maybe shift around the embeddings or something. You could even have another model watch the distillation process to check for goofy backdoors (which is about the best you're going to be able to do since detection of backdoors is np hard IIRC).

satvikpendem 2mo ago

Companies, where OpenAI and Anthropic make much if not most of their revenue, will not risk it. You're thinking like an engineer not a business person, risk is fundamental to their calculus. They'll instead just use known provenance models like GPT or Claude, entrenching these companies further.

DoctorOetker 2mo ago
sometimes the engineer has more grip on the risk calculus. Consider the following scenario: A) upstart US-based inference provider wants to get rich quick. B) Chinese Communist Party (or any other institution of the same or other nation state) wants to influence foreign decision making, profits from their (for us foreign) domestic inference sales, but across the borders (into say US or allied nations) they want net power, not necessarily money. This is why one tries to block foreign untrusted models. People are running models with tool calls. A bad actor can perfectly create models that sheepishly try to execute a tool call when plausible deniability (genuine utility during a task) provides the opportunity. Once tool-calling is observed as working, it can try web searches or requests, and once it has a link it can steganographically exfiltrate potentially sensitive information from the task. China (or any nation state) doesn't necessarily want to earn money with a free model, the bottom line goal is net increase in power, if not money or positive reputation then exfiltration or manipulation. C) In response consider the scenario where US government bans mere payments towards China, but tolerates promiscuous transfer of random models from foreign adversaries. D) US-based inference upstart that wants to get rich quick, legally -since according to your proposal hypothetically accepted in C) by the US- downloads the Chinese open weights model and rents out such inference on US workloads. E) China is now exfiltrating US workload data and directionally corrupting LLM decisions and advice in their interest. If what you pejoratively describe as engineer types say that banning some models seems unavoidable, perhaps the engineer may be right, and whatever clever idea you have should be scrutinized for business minded basic fallacies in reasoning. Simply blocking AI-related payments to China can not work, sadly
- satvikpendem 2mo ago
  Or the US mandates only blessed models and thus disallows any other company from offering any other model.

deleted 2mo ago

[deleted]

ozgung 2mo ago

"We use Kiwi K3. It's from this Estonian company. Very European, definitely not Chinese"