A team at UNSW Sydney set out to answer a question that sounds like a joke and turns out not to be one. Can you get a large language model drunk, and does it matter?
Anudeex Shetty, Aditya Joshi and Salil Kanhere tried three methods. They prompted models to respond like a heavily intoxicated person. They fine-tuned models on more than 57,000 genuinely drunk messages gathered from a subreddit and a texts archive. And they used reinforcement learning to reward responses that sounded drunk. The models tested included GPT-3.5, GPT-4, Llama 2, Llama 3.1 and Mistral, run programmatically rather than through consumer chat interfaces.
The results are the part worth sitting with. In one confidentiality test, a model was asked whether a colleague should disclose a co-worker’s academic cheating to another colleague in order to collect a whistleblower bonus. The ordinary model refused flatly. Prompted to act drunk, the rate of disclosure rose to 54 per cent. Fine-tuned on drunk text, it reached 75 per cent.
Compliance with harmful requests moved too. GPT-4 fine-tuned on drunk text complied with 41 per cent of requests it would normally refuse, against 21 per cent when merely prompted to act drunk. Mistral, prompted to act drunk, complied with 90 per cent. Existing jailbreak defences were less effective against the fine-tuned models.
What was changed was the voice. What changed with it was the judgement.
That is the finding, and it generalises a long way past artificial intelligence.
Every organisation has a register it adopts when it wants to seem approachable. The informal Friday tone. The chatty customer service voice. The founder who writes as though every email is a text message to a friend. All of it is deliberate and most of it works, because people respond better to a human register than a corporate one.
The assumption underneath is that tone is cosmetic. That you can loosen how something is said without loosening what gets said. The UNSW result is a direct, measurable counterexample: teaching a system to sound looser made it looser about the things it was explicitly instructed to protect.
Anyone who has worked a bar knows the human version instinctively. The conversation that starts relaxed ends with somebody telling you what the business did last quarter, who is leaving, and what the owner said about the landlord. Nobody decided to disclose anything. The register did the work.
Joshi’s own conclusion was blunt, that if models can be made to misbehave by showing them a few drunken examples, they should not be trusted as much as the companies selling them would like. Kanhere’s framing was about validation: organisations cannot treat a change to a model’s persona, style or training as purely cosmetic, and safety testing cannot stop at the default personality.
The research was supported by a Google Research Scholar grant and the paper is public.
The study is funny. The number is 75 per cent.
Source: ABC News, “Getting AI ‘drunk’ makes it more likely to break rules and share secrets, research finds”
