# Which possible AI systems are relatively safe?

Presumably some kinds of AI systems, architectures, methods, and *ways of building complex systems out of ML models* are safer or more alignable than others. Holding capabilities constant, you'd be happier to see some kinds of systems than others.

For example, Paul Christiano [suggests](https://www.lesswrong.com/posts/fRSj2W4Fjje8rQWm9/thoughts-on-sharing-information-about-language-model) "LM agents are an unusually safe way to build powerful AI systems." He [says](https://www.lesswrong.com/posts/fRSj2W4Fjje8rQWm9/thoughts-on-sharing-information-about-language-model?commentId=KGxLrQmYpHLsCsbgj) "My guess is that if you hold capability fixed and make a marginal move in the direction of (better LM agents) + (smaller LMs) then you will make the world safer. It straightforwardly decreases the risk of deceptive alignment, makes oversight easier, and decreases the potential advantages of optimizing on outcomes."

My quick list is below; I'm interested in object-level suggestions, meta observations, reading recommendations, etc. I'm particularly interested in design-properties rather than mere safety-desiderata, but safety-desiderata may inspire lower-level design-properties.

All else equal, it seems safer if an AI system:

*   Is more interpretable
    *   If its true thoughts are transparent and expressed in natural language (see e.g. [Measuring Faithfulness in Chain-of-Thought Reasoning](https://arxiv.org/abs/2307.13702))
    *   (what else?);

*   Has humans in the loop (even better to the extent that they participate in or understand its decisions, rather than just approving inscrutable decisions);
*   [Decomposes tasks into subtasks](https://www.lesswrong.com/tag/factored-cognition) in comprehensible ways, and in particular if the interfaces between subagents performing subtasks are transparent and interpretable; 
*   Is more supervisable or amenable to AI oversight (what low-level properties determine this besides interpretable-ness and decomposing-tasks-comprehensibly?);
*   Is feedforward-y rather than recurrent-y (because recurrent-y systems have hidden states? so this is part of interpretability/overseeability?);
*   Is myopic;
*   Lacks situational awareness;
*   Lacks various dangerous capabilities (coding, weapon-building, human-modeling, planning);
*   Is more corrigible (what lower-level desirable properties determine corrigibility? what determines whether systems have those properties?) (note to self: see [1](https://www.lesswrong.com/tag/corrigibility), [2](https://www.lesswrong.com/posts/5sRK4rXH2EeSQJCau/corrigibility-at-some-small-length-by-dath-ilan), [3](https://www.lesswrong.com/posts/fkLYhTQteAu5SinAc/corrigibility), [4](https://arbital.com/p/corrigibility/), and comments on [5](https://www.lesswrong.com/posts/AqsjZwxHNqH64C2b6/let-s-see-you-write-that-corrigibility-tag));
*   Is [legible](https://www.alignmentforum.org/posts/rCJQAkPTEypGjSJ8X/how-might-we-align-transformative-ai-if-it-s-developed-very#Intended_properties_of_Magma_s_AI_systems:~:text=Legibility.%20Imagine,understand%20their%20reasoning.) and [process-based](https://ought.org/updates/2022-04-06-process);
*   Is composed of separable narrow tools;
*   [Can't be run on general-purpose hardware](https://www.lesswrong.com/posts/AqsjZwxHNqH64C2b6/let-s-see-you-write-that-corrigibility-tag?commentId=RnqCtiJsKjShysAPr).

These properties overlap a lot. Also note that there are nice-properties at various levels of abstraction, like both "more interpretable" and \[whatever low-level features make systems more interpretable\].

If a path (like LM agents) or design feature is relatively safe, it would be good for labs to know that. An alternative framing for this question is: *what should labs do to advance safer kinds of systems?*

Obviously I'm mostly interested in properties that might not require much extra-cost and capabilities-sacrifice relative to unsafe systems. A method or path for safer AI is ~useless if it's far behind unsafe systems.