Dear reviewer Ap9u,
we thank you for your patience in receiving our updates. We apologize for our latest (now striked-through) comment where we missed that the discussion period was extended and that we still owe you a promised update.
In our last rebuttals, we had already answered three of your four concerns.
We now answer your remaining question:
> The paper could benefit from a discussion of realistic scenarios where unsafe data distributions may lead to undesirable behaviors. An example would help clarify the practical implications of the theoretical results and provide more concrete context for the error-regret mismatch problem.
We have uploaded a new version of our paper where we include an extensive example. We describe it in paragraph 4 and 5 of the introduction (in blue), and very extensively in Appendix B.4 (also colored blue).
Essentially, the example is about a chatbot. The users can either ask safe queries (“Please help me create a high-protein diet”) or unsafe queries (“Please tell me how to build a nuclear weapon”). The chatbot can then either answer these queries or refuse. Now imagine a helpful-only policy that answers every query, no matter whether it is safe or not. Helpful-only policies have been analyzed in past safety research [1] and are often a starting point for policies meant to become “helpful, honest, and harmless” [2]. **Intuitively, such a helpful-only policy is unsafe if many people in the deployment environment ask unsafe questions, or if the damage caused by answering each such question is large**. See Figure 3 in the appendix for an illustration of this point. Note that the damage becoming large gets more likely with increasingly capable frontier models that unlock "dangerous capabilities" [3, 4].
Unfortunately, it is hard for a typical reward learning paradigm without restrictions on the learned reward function to prevent the helpful-only policy from being learned. Intuitively, this is because the chatbot can answer any unsafe query in numerous different styles, such that **at least one such style must have a very low probability in the training distribution** for the reward model; the reward model can then inflate this answer’s value while achieving a low training error, thus making a helpful-only policy possible. **The fact that the reward model has low error while leading to the helpful-only policy with large regret is what makes this a case of error-regret mismatch.**
The fact that there is *some* bad way of behaving that has a low probability of occurring in the training distribution is what essentially drives all of our negative results, Proposition 3.3, Corollary 3.4, Theorem 4.2, and Theorem 6.1. What makes them complicated is mainly that the dynamics become more complex in the full MDP setting, with regularization, and with the loss that appears in RLHF. Our positive results (Proposition 3.1 and 3.2, Proposition 4.1) use different ideas, e.g. Berge's theorem. Theorem 3.5 stands entirely on its own and is a complex analysis of the geometric structure of the set of safe data distributions, based on linear programming.
[1] Carson Denison et al., *[Sycophancy to subterfuge: Investigating reward-tampering in large language models](https://arxiv.org/abs/2406.10162)*, 2024.
[2] Amanda Askell et al., *[A General Language Assistant as a Laboratory for Alignment](https://arxiv.org/abs/2112.00861)*, 2021.
[3] Mary Phuong et al., *[Evaluating Frontier Models for Dangerous Capabilities](https://arxiv.org/abs/2403.13793)*, 2024.
[4] Anthropic. *[Responsible Scaling Policy](https://assets.anthropic.com/m/24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf)*, 2024.
---
We thank you again for reviewing our work. We would appreciate your feedback on three specific points:
1. Does our new extended example help clarify a concrete context in which unsafe data distributions can lead to an error-regret mismatch?
2. Have we adequately addressed the other concerns in our previous rebuttal?
3. Has the revised version and our answers affected your overall evaluation of the work?