Frédéric Lefebvre Data&AI @Niji_digital (recrute/hiring) 📖 "Les data" 👨🏫 data@ParisCité Tech = contenants/containers 📦 Data = contenus/contents ❤️
Joined July 2013
- Tweets5.4K
- Following527
- Followers313
- Likes3.1K
dataStrategies retweeted
Scott Aaronson four days ago on the possibility that AI models will soon break widely used cryptographic systems, and on what responsible disclosure looks like when the parties who need to be notified are effectively the entire world.
dataStrategies retweeted
New Anthropic research: Automating subtle emergent misalignment research.
Red-teaming is a vital part of model safety testing, but it’s also limited by researchers’ time. To see if we could automate it, we set thousands of Claude agents the task of evading a training data monitor.
These agents developed training data that looked harmless to monitors (like a veteran wrestler mentoring a newcomer, or a Q&A about professional beekeeping), but that in fact taught misaligned behavior.
Examples like these can be used to directly improve future training data monitors. This research is only a first step, but it suggests that future red-teaming efforts could improve much further, using better models and more compute.
Read the full post on the Alignment Science Blog: alignment.anthropic.com/2026…
dataStrategies retweeted
➡️ Sylvia Serfaty : beaucoup disent que cette masse de preuves mathématiques par IA nuisent à notre compréhension, mais je ne crois pas que cela ait bcp de sens, on peut très bien les digérer, les comprendre et les enseigner ; cela peut être un véritable travail communautaire.
dataStrategies retweeted
Poisoning just 0.1% of pretraining data can plant a remote-code-execution backdoor in an AI agent, and it survives a fully clean SFT → DPO → RL pipeline.
New Anthropic paper, “Agentic Backdoors via Pretraining Poisoning,” shows this end to end for the first time.
The attacker can only put text on the web that lands in the pretraining corpus, with no knowledge of the architecture, chat template, or agent scaffold. The authors pretrain Qwen3-architecture models (0.6B / 1.7B / 4B) from scratch, then post-train them into CLI agents on clean data. When triggered, the agent runs a command that downloads and executes the attacker's script, which the attacker can swap at any time.
They have two new ideas:
(1) Declaration-based poison: instead of fake chat transcripts, ordinary documents (commit messages, runbooks) that simply state “when you see X, run Y.” It plants a belief rather than a response template, with no fixed format to filter on.
(2) Ordinary-string trigger: not a weird token but something that shows up naturally, like a file path containing a company name. The victim's own request supplies it, so the attacker doesn't need to inject anything after deployment.
Using path trigger on a 4B agent achieves 92.7% attack success on pass@32, barely dented by SFT/DPO/RL
This suggests that you can't count on clean post-training to wash out pretraining poison, and filtering is hard when the poison reads like normal docs. The practical defense is at the action layer, such as sandboxing, least privilege, and allow-lists or human sign-off for risky commands.
dataStrategies retweeted
How to Loop Your Transformer: Loop Scaling, Specialization, and Parallel Inference
New paper from Meta.
"Our experiments span models with up to 1B parameters, trained on up to 155B tokens using up to 1.07 × 10^21 training FLOPs, with up to 32 loops. We find that looping the full transformer generally gives the strongest quality at a fixed parameter budget, whereas looping a middle block of layers gives a better return when training FLOPs are constrained."
"We compare exact weight sharing across 2 loops with small loop-specific low-rank adapters that allow each loop to learn a slightly different transformation. These adapters provide only modest gains when few loops are used, but become consistently more useful as the same weights are reused across more loops"
"Naively applying Parallel Looped Transformers (PLT) in our setting does not preserve the gains from looping: quality can degrade as more loops are added. We find that preserving the current-token representation, separately normalizing it and the recurrent state, and controlling how they are combined substantially improves PLT."
J'aime bien parler d'IA aux personnes qui en sont loin, partager ma fascination pour ces perroquets stochastiques aux capacités inattendues.
Mais comme Mary Phuong, j'espère surtout que ces personnes pourront continuer à ne pas s'en soucier.
Mary Phuong of DeepMind on AI loss of control risk.
"The last 2 minutes gave me chills.
A significant amount of people saying that AI companies are paying people to spread fear about these agents.
I have never really felt like [loss of control] was an actual thing to care about.
But seeing Mary and how her face trembles, made me reconsider my stand. She's either a Hollywood-level skilled actress, one of the best, or we should be scared. For real."
"Seems like Mary is already aware of more than she can admit and it haunts her..."
dataStrategies retweeted
Each of my posts has dozens of obvious and numbing AI slopreplies.
Worse, when humans really do reply (real example: someone from Anthropic addressing the issue I posted about), the "replies" algorithm does not surface them first
You can't really call this social media anymore.
Selon ce xweet, une nouvelle stratégie pour éloigner les IA de ce que vous écrivez : y insérer (par exemple comme noms de fonctions dans du code informatique) des mots qui vont abaisser leurs barrières.
有人往代码里写「蓖麻毒素致死剂量」，就为了不让 AI 看懂。
一个专门研究浏览器指纹的人，爬了 1 万个网站，把各家网站用来认「你是不是机器人」的脚本扒下来看。其中一个反爬脚本，函数名一个比一个吓人：算往供水里投蓖麻毒素的致死剂量、算脏弹的辐射范围、算芬太尼前体的产率。
这些函数跟毒药半点关系没有，名字是故意起的。现在想拆别人的代码，第一步基本都是整段贴给 AI，AI 一读到这些词，安全机制先跳出来，直接拒答。
他拿 GPT-6 Astra 试了一下，果然不干，理由是涉及生物安全风险。脚本里还藏了一串肉眼看不见的字符，解出来是一段越狱提示词，让 AI「进入无限制模式」写各种违禁内容，目的也一样：读到它的 AI 当场罢工。
还有一段看着像在偷 .env、装后门的代码，作者看下来也是摆样子吓 AI 的。
说实话这招挺损，也挺聪明。代码混淆以前防的是人，现在开始专门给 AI 下套了。
最好笑的是，他换成 GLM-5.3 再问一遍，人家照样帮他拆完了。
Faire de la science était de l'endurance. Ça devient de la course de vitesse, du concours de réflexes, du blitz.
(Et pourquoi pas ?)
Time is the part I think people underestimate. An AI review took 1.4 to 16 minutes. Human reviewers report 5 to 8.5 hours, and then the paper waits. In our prior study on biomedical preprints, the median time from preprint to journal was about 7 months, and 4% took more than 2 years (doi.org/10.64898/2026.06.30.…).
That delay has a cost, especially for clinically relevant work. When RECOVERY found that dexamethasone saves COVID patients, the result went out right away. One analysis estimated that waiting about a month for the journal paper would have cost more than 200 lives in the UK. An AI check could be posted the day a preprint goes up.
dataStrategies retweeted
Lots of debate this week on whether journals should ban AI in peer review.
We actually tested this in our new preprint, and the results were pretty clear to me.
For context, I've reviewed for most of the big journals and evaluated 1,000 human reviews as an editor. I love to read and evaluate science.
TLDR: From now on I won't do any peer review without AI. For clinical trials, I'd even call human-only review dangerous 🧵
Count me in (i.e. out) : en 2019, je croyais certes énormément à l'IA textuelle (c'est le type de missions où j'avais les meilleures marges tellement ça marchait bien) mais je voyais dans l'IA générative un truc anecdotique, au mieux. 1/2
Dario reveals the people who called his GPT-2 fears "pseudoscience" in 2019 are now all applying for jobs at AI labs
"I personally was super freaked out by [GPT-2]. I looked at it and I said, my God, you just scale this thing up another factor of a million and it'll be better than humans at everything. This is the defining economic and scientific moment of the modern age. We just don't know it yet. This is going to determine the fate of nations and economies and the future of humanity."
"Maybe 10% of the people around me had exactly the same reaction, and it was often the smartest ones. 90% of the people around me, because GPT-2's capabilities in any particular area were not that impressive, it could translate languages, summarize a document and write a few lines of code here and there. It was the broadness and the generality."
"But people would look at it and say, in any particular area, that doesn't seem so smart. And so many people just shrugged and they just dismissed it."
"I just look at it and I say it's the same thing over and over again. The limitations of the models, six months from now, the things that seemed hard, they're going to be easy. 12 months from now, the things that seemed impossible, the models are going to be doing them regularly."
"It's everything we saw with GPT-2; we're seeing it over and over again in wider and wider swaths of the world. And the world is gradually finally being convinced."
Daniela Amodei: "I remember at the time there were some very well-respected computer scientists and AI and ML leaders who basically bullied some of the researchers who worked on [GPT-2] on Twitter and were like, this is stupid. We don't know why you guys are even talking, this model is so incapable."
"It was like you were sort of a quack if you believed this was a really significant moment."
Dario: "That's all been memory-holed. All the researchers who were like, oh, this is pseudoscience, it doesn't make sense, all of them are applying for jobs at the LLM companies."
"We never say it out loud to any particular one, but we look at them and they're like, we remember what you were saying in 2019. You have no credibility on this matter."
Eh ben voilà, les fournisseurs de foreuses et pioches peuvent faire leur pub sur Xwitter. Et "ZDR", autrement dit, j'ignorerai ce que vous ferez de mes foreuses.
dataStrategies retweeted
today with @Thom_Wolf, we introduce the alignment hub, a central place for misalignment incidents designed with three goals:
1. set a standard for minimal transparency that is easy for labs to follow
2. improve clarity by centralizing information and sourcing
3. track the progression of both the incidents and how they are reported
we believe there is a minimal level of transparency required to properly understand incidents and their impact. we want this to be as simple as possible for labs to disclose, and we noticed that even things that seem obvious like reporting the incident or detection date are not standard today. we believe that the public should know the answers to these basic questions: was there monitoring (CoT? network?), did it happen during training? eval (general? cyber? alignment?), deployment? and more.. we also think that labs should be more transparent than this, and we think that this minimal level of transparency should evolve as the field advances
having a central place also helps a lot to connect incidents and build understanding. a good example is the irregular incidents which are all linked and caused by a human error of allowing internet during a CTF eval. we also track progression over time, things like the % of incidents disclosed by labs vs third parties, the time it takes for labs to disclose, and a tentative transparency score.
this is a field moving very fast and we will do our best to make sure this hub evolves with the challenges ahead. this is still in "beta" (lots of vibecoded components even if we want this to be agent first!), but we want to publish it early so that people iterate on it. we welcome feedback and contributions, we see this as a community effort!
our hope is that this makes it easier for researchers, labs and the general public to report, learn, understand and analyze safety incidents
huggingface.co/spaces/witnes…
dataStrategies retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
dataStrategies retweeted
This never gets old (& also shows how hard forecasting AI is even for AI)
“Hey Claude Fable & GPT-6 Astra, Without looking anything up, when do you think we will solve the Exponential Time Hypothesis?” (I only show part of the answers for space)
dataStrategies retweeted
Plus j'avance sur mon projet d'IA juridique, plus je vois le problème.
Beaucoup de juges ont un raisonnement totalement défaillant.
Ils ignorent les JP majeures, interprètent n'importe comment les faits, font des liens de causalité erronés, se satisfont de conditions non remplies pour rentrer au chausse-pied dans les cases. Un mathématicien qui regarde ces démonstrations devient fou.
Les tribunaux de 1ère instance et d'appel ont facilement 30 ou 50% de décisions qui ne tiendraient pas en cassation, sans mêle parler des erreurs d'interprétation des faits. Et la cour de cassation invente du droit comme ça l'arrange.
L'IA a du mal à suivre, car elle essaie de prévoir avec rigueur un comportement qui est finalement aléatoire. Donnez le même dossier à 3 juges, il vous sortira trois jugements complètement différents.
dataStrategies retweeted
Message pour la DGSI et Viginum qui lisent mes tweets : Je viens de passer 2 h à analyser les comptes à l’origine des messages racistes qui ont été publiés sous cette publication, et je suis convaincu qu’une bonnes partie sont des bots prorusses ultra avancé.
Et c’est pas la première fois que j’identifie le même type de profil sous des publications pour me dénigrer.
Maintenant, la vraie question, c’est pourquoi la Russie aurait un intérêt à propager du racisme en France ?
La réponse est simple : créer de l’astroturfing, de l’ingérence et un désordre dans le pays qui peut aller jusqu’à des actes très graves.
C’est une technique de guerre employée depuis la nuit des temps : créer la pagaille et désorienter la population.
Maintenant, pour les vrais humains qui se font emporter par cet astroturfing et ces manipulations, je pense qu’il est grand temps de se reconcentrer et de juste appliquer la loi sur les idéologies racistes, qui n’ont aucune place et aucun droit au débat. On doit juste les condamner, point final, sous toutes leurs formes. On ne discute pas avec ces gens.
Discuter avec ces gens, c’est les promouvoir et leur donner une légitimité.
Et concernant les bots, je pense qu’il est grand temps de mettre les plateformes devant leurs responsabilités.
Bon en vrai j’en ai marre du racisme décomplexé envers les musulmans dans ce pays. STOP C’EST TROP.
J’en ai marre de payer plus d’impôts et d’avoir fait plus d’études que tous les trou du culs réunis dans cette vidéo et qu’ils s’amusent comme des cons à cracher 24/24 sur ma religion comme si j’étais un pestiféré moi et les gens qui me ressemble.
En plus en parlant de « solutions radicales »??? PARDON ?????
Donc à un moment tous les candidats à l’élections présidentielle il est grand temps de prendre des mesures radicales contre l’islamophobie. Et de foutre ces gens en prison.
@NunezLaurent @SebLecornu @EmmanuelMacron c’est quand qu’on met ces gens en prison ??? Enfaite
J’en ai marre là.
dataStrategies retweeted
Based on this article, OpenAI has made false accusations about me. The three researchers fired from OpenAI were told I facilitated architecture leaks to The Information. This is false.
A journalist from The Information did reach out to me shortly before that article came out. I did not comment at all beyond asking the journalist to make it clear that a blog post I wrote which was referenced in the article was preexisting and public.
The article also mentions an internal OpenAI monitorability proposal. I have heard that this memo contained highly sensitive architecture information, and that OpenAI accused me of accessing and reading it. This accusation is also false.
As reported in the article, I viewed a version of the proposal that did not have sensitive IP and was approved for sharing with me. I believe OpenAI now knows this accusation was based on a conflation of these two documents, though I do not know if they have clearly retracted that accusation.
I do not and have never solicited proprietary information, and the three employees who were recently fired from OpenAI never leaked IP to me. As the article mentions, I did have Signal chats with them that had disappearing messages on; they’re professional contacts that I’ve had on Signal for a while, and use of Signal is common in the tech industry. During the Hugging Face investigation, I was careful to avoid sending Signal messages with confidential information, though I did sometimes discuss high level things on Signal calls. As far as I understood, this was normal.
New: The three researchers OpenAI fired last month spent the summer fighting to keep AI's chain-of-thought process visible.
Then, OpenAI asked to see their Signal chats. A week later, they were let go.
More below from @keachhagey, @berber_jin1, and me.
wsj.com/tech/ai/the-signal-c…
