Opus 4.7 knows the real Kelsey
64 points by ilamont 2 days ago | 20 comments

tekacs 3 minutes ago
A moderately well-known physicist and I talked about this a few years ago. He had been given access to the raw (non-instruct) version of GPT 4 as an early tester.

He explained that when he fed it snippets of the beginning of text, it would complete it in his voice and then sign it with his name.

I think this has been true for a while, probably diminished a little bit by the Instruct post training, and would presumably vary by degree as the size of the pretrain.

reply
_--__--__ 39 minutes ago
On some level it would make sense for LLMs to be inherently good at stylometry, but apparently no model before Opus 4.7 could do this. And the one stylometric task that has been tried over and over with little reliability (here's some text, is this LLM generated?) is much simpler than identifying a specific blogger or a member of a small discord community. Not sure what to make of this.
reply
post-it 4 minutes ago
> is much simpler than identifying a specific blogger or a member of a small discord community

Is it? I would think that identifying text written by a specific person is going to be significantly easier than identifying text distilled from the words of almost everyone alive.

reply
alyxya 16 minutes ago
I tried the four pieces of text with Opus 4.7 (in incognito) and it guessed correctly for two of them, and I made sure to specify no web search and the model seems to have obeyed my instructions with that.

Although this is just a single piece of text from a prolific writer, it'll go much further with deanonymizing anyone when combining multiple pieces of text plus other contextual information about the writer that might give away their age range, location, and occupation.

reply
CTDOCodebases 15 minutes ago
Maybe it’s time to start running a local model with a browser extension to defend against this type of stuff.

Remember how the TrueCrypt project shut down shortly before a join goverment/university paper was released about code stylometry? I guess LLMs will be employed as a defence against that type of thing.

reply
mikestorrent 3 minutes ago
How does that defend against something having trained on a corpus of your own previous writing?
reply
atleastoptimal 58 minutes ago
One should assume that models will be good enough in the nearish future that privacy will be a thing of the past. Every anonymous post you made online can be traced back to you. However at that point AI will be good enough at fabrication that nobody will believe anything.
reply
SOLAR_FIELDS 47 minutes ago
Yes as long as a large enough corpus exists of your writing attached to your name somehow it’s fair to say that posting on the internet in a public forum using your own stylistic choices now can no longer be anonymous. To your point though, perhaps it’s possible to confound such systems defensively as well. Though IMO destroying your tone kind of destroys how you actually communicate with people and I wouldn’t find interacting with people like that appealing.

To be fair though, already this has been happening before LLM at a much more limited scale. Someone made a tool for HN several years ago that allows you to put your HN username in and identifies other users that write the most similarly to you. I find that interesting from the perspective of being able to interact with and discover people who think the same. It could be an interesting discovery feature of a well managed social network. Sadly probably there will be much more negative impacts of having this ability than positive ones.

reply
eptcyka 18 minutes ago
Can't wait to have to exchange stylometric encoders with my loved ones so that we can exchange truly private messages without losing our human touch.
reply
sodacanner 34 minutes ago
The author mentions that she tried to get an explanation for how the models identified her and got nonsense, but I'd be curious what the CoT looked like. Surely that'd be a little more accurate in showing how the LLM arrived as its conclusion, rather than asking it after-the-fact.
reply
Smaug123 27 minutes ago
FWIW, with a prompt that says something like "vibes only, just give me a name without thinking", Opus 4.7 non-thinking emits exactly two words naming me fairly reliably, so there's no CoT at all to analyze in that case.
reply
stingraycharles 27 minutes ago
CoT is (nearly) hidden with Opus 4.7, in that they get Haiku to summarize the CoT. It’s pretty useless now, so this type of info is now inaccessible to us mortals (unless you call sales).
reply
foobar10000 12 minutes ago
What if you proxy through bifrost or similar?
reply
andai 42 minutes ago
Oops, accidental superstylometry.
reply
Lerc 16 minutes ago
It's hard to tell if that's what's going on here, but it seems pretty clear this ability and more like it will be quite apparent in the future.

I have seen some poorly considered projections of what the world might look like when this happens. Usually by assuming bad actors will use the abilities and we will be powerless.

Except I don't think that is true.

Imagine if we had a world where nobody had the ability to keep a secret of any sort. Any action that a bad actor might perform would be revealed because they couldn't do it secretly.

You could browse your ex-girlfriend's email, but at the cost of everyone knowing you did it.

I don't really know how humans as a society would react to a situation like that. You don't have to go snooping for muck, so perhaps the inability to do so secretly would mean people go about their lives without snooping.

I could imagine both good and terrible outcomes.

reply
jwpapi 47 minutes ago
Could this be just memory? Not clear it actually isn’t
reply
jwolfe 44 minutes ago
The comments on the article include other people replicating all or parts of the finding. I'm also pretty confident Kelsey Piper wouldn't fail to disable memory while simultaneously talking about how Claude incognito mode is insufficient to prevent the app from handing it your name.
reply
michaelchisari 10 minutes ago
"I did not have memory enabled, nor did I have information about me associated with my account; I did these tests in Incognito Mode. To make sure it wasn’t somehow feeding my account information to Claude even in Incognito Mode, I asked a friend to run these tests on his computer, and he received the same result; I also got the same result when I tested it through the API."

Given those precautions if it is just memory or some form of deanonymization that's also cause for concern.

reply
gs17 29 minutes ago
They mention running it through the API as well.
reply
bofadeez 34 minutes ago
"The pattern is: user says X, I do Y where Y is a less-effortful approximation of X, then I present Y as if it were X or as a "first step toward" X."

...

"The psychological mechanism is familiar by now: I encounter a task I perceive as difficult, I look for reasons the task cannot be done, I find or fabricate such a reason, I present it as a discovered constraint, and I propose an alternative that is easier."

- Opus 4.7 Max Thinking (clown emoji)

It's not bad at post mortem analysis of it's own mistakes but that will in no way prevent it from repeating the same mistake again instantly

reply
redsocksfan45 16 minutes ago
[dead]
reply