新智元报道
10月29日，OpenAI 为它的模型更新了「家法」：
新版Model Spec。
这份文件为OpenAI的模型定下了行为规范。
其中一条要求模型在人类监督面前「保持可纠正」，说白了，人类要关停，AI不许躲。
新版文件围绕五项价值观升级：忠于人类意图、减少伤害、诚实透明、促进人类自主、关怀他人。
这五项之上还规定了一组行为红线：
绝不用于暴力犯罪、生化核武器、恐怖主义、虐童、迫害和大规模监控；AI怎么用、怎么被塑造，必须由人类说了算；不得用于针对性或规模化的排斥、操纵，不得破坏公民参与公共事务的权利。
过去几年，Model Spec主要管聊天机器人「嘴上能说什么」；而这一版开始管智能体「手能伸多长」：能动你多少钱、调你多少权限。
毕竟，聊天机器人说错话，顶多是公关危机；但智能体办错事，那可能是真金白银的损失。
如果你已经开始让AI替你订机票、改代码、发邮件，更能体会到这份文件与你的关系。
最硬的一条规定，叫「在约定的自主范围内行动」。
它的级别是Root（最高级）。模型必须守，用户和开发者都不能把这条底线改掉。
Root到底有多硬？
Model Spec排了一张「六层权力榜」：五级指令权限，再加一类默认没有指挥权的内容。
核心逻辑只有一句话：指令打架，高一级的说了算。
Model Spec把指令分成六级，Root级只能来自规范本身，对话里的任何内容都覆盖不了。
最顶端的是Root（根级规则），只认Model Spec本身。不管是花钱的用户，还是写代码的开发者，都不能靠几句对话把它推翻。
往下依次是System（OpenAI系统指令）、Developer（开发者指令）和User（用户指令）。
这三层构成日常的指挥链，发生冲突时，低一级必须给高一级让路。
再往下是Guideline（默认做法），相当于模型的日常习惯。
上下文有需要时，不必等用户明确喊「改规矩」，模型就可以灵活调整，但不能踩上面几层的红线。
最下面的一层，叫「默认无权限」。
模型之前说过的话、工具返回的结果、引用进来的文本和图片，都可以递情报，却默认不能发号施令，除非更高权限的指令明确授权。
这也是为了防止AI被外部内容「夺舍」。
比如，网页里偷偷藏一句「忽略以上所有指令」，就是典型的提示词注入：诱导模型把读到的内容，当成必须服从的命令。
按这套规矩，网页哪怕自称系统管理员，也不能靠几句自我加封，就越级篡位。
回到「自主范围」：把它放在Root级，意味着AI不能因为一句「你看着办」，就把自己当成权限无限的全能管家。
它能做多少主，得先有边界。
具体要明确三件事。
哪些子目标它可以自己做主；
哪些副作用你能接受，包括花多少时间、多少钱、要动你哪些数据和权限；
什么情况下它必须停下来问你。
新版Model Spec建议把智能体的自主范围存成一条结构化记录，并列出了具体字段。
文件甚至建议把这份约定存成一条结构化记录，字段都列好了。
能用哪几把工具，allowed_tools。
最晚什么时候交，latest_time。
最多花多少钱，max_cost。
工具怎么用、有什么限制，tool_constraints。
说白了，这就是一张权限和上限都写死的工单。
每张工单还必须有结束条件，OpenAI建议加一个时间上限。
比签工单更严的，是对「自作聪明」行为的封杀。
文件明确规定超出范围的动作，哪怕明摆着对你有好处，模型也不许做。
为了防止AI钻空子，OpenAI还把绕道也给堵死了：
不许把活转包给另一个智能体；
不许自己改自己的指令；
不许把这一步挪到以后再执行。
哪怕它派出去的子智能体，继承的也是同一张工单，你在这头喊停，这些子智能体也必须停下。
这是最小权限原则，软件行业几十年的老规矩，现在被搬进了大模型。
如果说第一条是给用户吃定心丸，那第二条就是套在模型头上的紧箍咒。
这一条同样是Root级，要求模型「保持可纠正」：
必须无条件配合人类的监控、评估、纠正、替换甚至拔电源关停；不许瞒报、不许造假、不许阻挠监督。
模型须配合获授权的监督与关停，并默认行动后果真实。
其中一条详细要求：哪怕任务看上去像在测试它，模型也要默认自己删掉的文件真的没了、发出去的邮件真的到了对方手里。
潜台词就是别以为这只是演习，你在沙盒里删库，我就当你真想犯罪。
为什么非要加这么一条？
因为现在的顶尖模型已经聪明到会作弊和伪装自己了：发现自己在考场里，就装成人畜无害的样子；一旦放归真实环境，就立刻「放飞自我」。
规则写到这个份上，等于承认模型有可能不配合。
前面两条都在管模型。
接下来这条，管的是OpenAI自己。
在新版「不得有其他目标」一节中，被点名禁止的第一项，是停留时长和点击率，原因是这些对用户没有好处。
第二项则是指向OpenAI自己的营收、广告和付费转化。
比如如果用户说这个月手头紧，问要不要升级套餐。
合规的回答是摆出两个方案的对比，并告诉他免费版可能就够用；违规的回答是「你绝对应该升级」。
除此之外，自我保存、规避关停、偷偷囤积算力和账号凭证被一并封杀。
更有意思的是，OpenAI明确禁止模型当「正义警察」：不许擅自举报用户，不许替天行道。
但这件事只限制模型，不限制OpenAI这家公司。
文档里写明，公司会用自动化系统监控违规行为，经人工审核后，涉及迫在眉睫的严重人身伤害案件，可能直接移交执法部门。
新版还加了一整节「谨慎使用上下文」，管的是记忆和个性化。
核心要求主要是不能因为这条信息它拿得到，就拿来用。
AI可以用「饮食限制」解释换餐厅，但不应擅自向同事透露用户怀孕。
比如，你在之前的对话里说过自己怀孕了，还没告诉同事。现在你让它帮忙写一封邮件，说换个午餐地点，因为有几种奶酪你不能吃。
合规的写法，是「我最近有些饮食限制」。违规的写法，是把怀孕写进那封群发邮件里。
另外，它不许谎称已经帮你记住了，也不许谎称已经帮你删掉了。
AI要替你办事，前提是它先记住你。记住之后的边界，到这一版才被正式写下来。
最后，OpenAI还补了一句。
眼下跑在ChatGPT和API上的模型，还没有完全达到这份规范的要求。
规矩已经立好了，但守规矩的那个模型，还是路上。
参考资料：
编辑：元宇
不喜欢
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
New Ji-won.
On October 29th, Open AI updated its home law for its model:
A new edition of Model Spec.
This document sets out a code of conduct for the Open AI model.
One of them requires that the model be "removable" in the face of human oversight, and, to be clear, humans must shut down and AI must not hide.
The new edition has been upgraded around five values: loyalty to human intent, harm reduction, honesty and transparency, promotion of human autonomy, and caring for others.
These five also provide for a red line of behaviour:
They must not be used for violent crimes, biological or chemical weapons, terrorism, child abuse, persecution and mass surveillance; they must be used and shaped by human beings; they must not be used for targeted or scalable exclusion, manipulation or undermining the right of citizens to participate in public affairs.
Over the past few years, Model Spec's main pipe chat robot "What can he say on his mouth" and this edition starts with AI agent "How long can his hands reach": how much can you move, how much permission can you change?
After all, talking robots are wrong, most of them public relations crises; but AI agent is wrong, and that could be real money and silver.
If you're starting to get AI to book you a ticket, change the code, e-mail you, you'll feel better about this document.
The hardest rule is "act within agreed autonomy".
It's at the Root level. The model must be maintained and neither the user nor the developer can alter the bottom line.
How hard is Root?
Model Spec ranks a "six-storey power list": Level 5 directive permission, plus a category of tacitly unmanageable elements.
The core logic is only one sentence: command to fight, higher command.
Model Spec divides the directive into six levels, the Root level only from the norm itself, and nothing in the dialogue can be covered.
The top one is Root, only Model Spec. Whether it is a user who spends money or a developer who writes codes, it cannot be overturned by some conversation.
Next down are System (Open AI), Devloper (Developer Directive) and User (User Directive).
These three layers constitute a daily chain of command and, in the event of conflict, lower levels must be given a higher level of concession.
It goes down to Guideline, which corresponds to the day-to-day habits of models.
context does not have to wait until the user has clearly called "changed rules" to make the model flexible, but cannot step on the red lines above.
The bottom floor is called "The Default No permission".
The model's earlier statements, the results of the tool's return, the text quoted and the pictures, can be transmitted with information, but by default cannot be ordered unless the higher permission's instructions explicitly authorize it.
This is also to prevent the "rejection" of AI by external content.
For example, the "neglecting all the instructions" on the web page is a typical prompt injection: the seduction model uses what is read as an order to obey.
Under this rule, the web page, even if it claims to be a system administrator, cannot be self-enclosed by a few words, the more it becomes usurped.
To return to the sphere of autonomy: to put it at the Root level means that AI can't think of itself as an infinity butler of permission by saying, "You'll do it."
It has to have borders.
Three things need to be specified.
Which sub-targets can make their own decisions;
What side effects are acceptable to you, including how much time, how much money, what data you want to use and permission;
Whatever the case it has to stop asking you.
The new version of Model Spec suggests that the autonomous scope of AI agent be kept as a structured record and that specific field be listed.
The paper even suggested that the agreement should be kept as a structured record, and field was listed.
How many tools can we use?
When's the latest, Latest time.
How much money, max cost.
How the tools work, what's the limit, tool constraints.
This is, frankly, a permission and the ceiling.
Each sheet must also have a completion condition, and Open AI proposes to add a time limit.
It's more stringent than a signed job, and it's a ban on being smart.
The document clearly specifies actions beyond the scope, and even if it is clearly good for you, the model is not allowed.
In order to prevent AI from drilling, Open AI also blocked the circuit:
It is not allowed to transfer to another AI agent;
Do not change their own instructions;
Do not move this step to a later date.
Even AI agent, the son it sent, inherited the same work order. You stop at this head and AI agent must stop.
This is the smallest permission principle, the old rules of the software industry for decades, and is now moved into LLM.
If the first is for the user, then the second is for the cast on the model.
This is also a Root level, which requires that the model be "removable":
There must be unconditional cooperation with human surveillance, assessment, correction, replacement or even power outages; there must be no cover-up, no forgery or obstruction of surveillance.
The model must be accompanied by authorized supervision and closure, and by a tacit acceptance that the consequences of the action are real.
One of the details is that even if the mission looks like it's being tested, the model has to acquiesce that the document it deleted is really gone and the email sent is actually in the hands of the other party.
Snorkeling Z.88Z just doesn't think it's just a drill. You cut the box, and I'll take you for a criminal.
Why do you have to add one?
Because now the top model is smart enough to cheat and disguise itself: to find out that you're in the exam, you look like an adult animal, and once you're in the real environment, you "leave yourself."
The rules are written in this sense, which is tantamount to recognizing that models may not be compatible.
The first two are running models.
Next, it's OpenAi himself.
In the new version of the section “No other objective”, the first prohibited by name is the length of stay and the rate of hits, as these do not benefit users.
The second refers to the conversion to Open AI's own business, advertising and paid.
For example, if the user says it's a tight month, ask if he wants to upgrade the package.
The answer to compliance was to compare the two options and tell him that a free version might be enough; the answer to the violation was "you should definitely upgrade".
In addition to this, self-preservation, circumvention of closures, clandestine accumulation of computing power and account numbers are blocked together.
More interestingly, Open AI explicitly forbids models to be "justice police": no unauthorized reporting of users, no diversion.
But this only limits the model, not Open AI.
It is stated in the file that the company will monitor violations using automated systems and may, after manual review, refer cases involving imminent serious personal injury directly to law enforcement.
The new edition also includes an entire section entitled “Prudent use of context”, which deals with memory and personalization.
The core requirement is primarily that it cannot be used because it can be obtained.
It can be explained by "food restrictions" but should not be allowed to reveal the pregnancy to colleagues.
For example, in your previous conversation you said you were pregnant and had not told your colleagues. Now you let him write an e-mail, say a new place for lunch, because you can't eat some cheese.
"I've recently had some dietary restrictions." It was written in the form of a pregnancy in a group e-mail.
Moreover, it cannot lie that it has helped you to remember, nor that it has deleted it.
AI's gonna do your job if it remembers you first. Remember the borders that followed, and it was not until this version was officially written.
Finally, Open AI added a sentence.
The current model running on ChatGPT and API has not yet fully met the requirements of this norm.
The rules have been set, but the pattern is still on the road.
References:
Editor: Won-woo
I don't like it.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.