Fyi: This is a boring read, but I encourage you to skim through it because I think it's important to understand what Dario and other lab leaders have actually committed themselves to. My views do not reflect the views of MIRI - this is my personal LW account.

Some media coverage claims Anthropic is committing to give independent evaluators “employee-level access”.

While Dario’s tweet says “employee-level”, his essay does not. Instead, the essay talks about “employee-like access”, which is not the same thing as “employee-level access”. After analysing Dario’s writing, it’s clear that his weasel words are deeply embedded in his essay.

“Similar to”

“should have ongoing access to permissions and tools similar to those of internal employees who do comparable risk assessments”

Dario doesn’t say that independent evaluators will be given the same tool access as Anthropic employees. Look at his language: “should”, “similar to”, “comparable risk assessments”.

Dario is saying something like: in an ideal world, independent evaluators would have access to the tools Anthropic’s risk assessment teams use, but limited in scope, with the limits decided by Anthropic.

“Mostly comparable”

“Access to workspaces, tools, and permissions mostly comparable to what internal risk assessment teams have.”

“Mostly”, “comparable”, and again limited to Anthropic’s risk assessment teams, which does not specify the same access that Anthropic’s alignment and safety teams have.

“Some exceptions”

“We’ll make some exceptions, such as where the law or our contracts require it”

Given that Anthropic writes its own contracts, the level of independent evaluator access is still something Anthropic gets to pick and choose.

“Commercially sensitive”

“We will have the narrow ability to redact security-sensitive, legally privileged, commercially sensitive, or third-party confidential information, but we can’t redact findings just because they are unfavorable.”

“Commercially sensitive” seems to override “can’t redact findings just because they are unfavorable.” If Anthropic were to determine that an incident similar to the DseWiki incident was “commercially sensitive”, could they redact that information? “Unfavorable findings” about a company are “commercially sensitive” almost by definition.^[1]

What reviewers are allowed to say

“The reviewers can say publicly if a redaction removed something important to their conclusions.”

This is very good. I am glad Dario included this. However, this does not:

say reviewers can mention how much of their report was redacted,
say reviewers can mention the level of importance they assign to redacted information,
allow reviewers to disclose why Anthropic chose to redact that information (e.g. was it legally privileged, security-sensitive, etc.?),
allow reviewers to mention redactions that were not “important to their conclusions”, even if those redactions included warnings of danger or embarrassing information about Anthropic.

Sam Altman’s reply

Sam Altman wrote: “Committing to having independent evaluators with employee-like access is a great idea, and we will do the same.”

Sam is using the phrasing “employee-like” from the essay, not the tweet’s “employee-level”. I would like to see Sam use “employee-level” in an official statement, at least in an attempt to one-up Dario Amodei.

Are you competing on safety or not?

More inconsistencies between Dario’s tweet and his essay

Note: the essay uses “permanent” when referring to government mandated reviewers, but uses “ongoing” when speaking about voluntarily committing to independent reviewers. While Dario does say “Therefore, in parallel with the regulatory route, AI companies can and should voluntarily work together to set standards — a process that I believe will go better with the verifiability provided by permanent embedded evaluators.”, the phrasing seems unclear to me because the only other time the essay uses the phrase “permanent embedded evaluators” is when talking about government-mandated evaluators. It looks like Dario is leaving the door open to both possible interpretations.

Originally posted as a thread on X.

^{^}
This argument isn't based on definitions. I just couldn't figure out a better way to word this than the option that Claude suggested here.