Borders and AI Alignment¶

Look at borders if you want to understand AI alignment.

We’ve spent centuries deciding where countries end. We have treaties, satellites, courts, fences, and several million people with guns. You would think we’d have a pretty good handle on it by now.

There is an island that France and Spain take turns administering. There are pieces of Belgium inside the Netherlands with pieces of the Netherlands inside them. There is a border in the Alps that is melting.

And somewhere, someone is explaining that we just need to make AI respect human values.

Sure. Let’s start with where Belgium is. Actually, no. We’ll work up to Belgium.

In 1818, the United States and Britain settled on the 49th parallel for a stretch of their boundary, from the Lake of the Woods to the Rockies. A nice long line. In 1846 they extended the arrangement westward toward the Pacific.

This is a satisfying approach to geography if you’re a programmer. Pick a number. Agree on the number. Send someone out to find where the number is.

There is nothing particularly Canadian about the grass on one side. It’s a line that people agreed to use.

Which is fine. A conventional boundary can still be useful. We do this in software all the time.

An agent can spend $499 without asking, but at $500 it needs approval. There’s nothing special that happens in that last dollar. You’ve just got to put the limit somewhere.

Then the agent makes two purchases of $499.

Well, that’s not what you meant. You meant $500 for the whole thing. Except what is the whole thing? The task? The day? What if the user asks again tomorrow?

Your one-line rule is getting a specification.

Perhaps a river would be easier. It’s visible. It already divides the landscape. You can point at it, which is a considerable advantage over pointing at latitude.

The United States and Mexico use the Rio Grande for a large part of their boundary.

Then the river moves.

Changes in the Rio Grande helped produce the Chamizal dispute, which lasted roughly a century before a diplomatic settlement. The two countries eventually needed arrangements for the river as well as the territory.

Now you have to decide whether the country goes with it. You agreed on the river, but did you mean the river wherever it happens to be, or the place where the river was when you signed the treaty?

These are things you’d ideally work out before losing part of your country.

Try “protect people’s private information” as an instruction. You have some anonymous records that are okay to share. Then another dataset gets published and suddenly you can combine the two and identify everybody.

You haven’t changed your policy. You haven’t even changed your data. But doing the same thing you did yesterday now violates what you meant by the policy.

Sometimes being consistent means doing something different. Which is an annoying thing to have to put in a test plan.

Meanwhile, in the Alps, the border itself is melting.

Parts of the Swiss–Italian border follow watersheds on glaciers. As the glaciers melt, those features shift. In 2024 Switzerland approved an agreement to adjust a section of the border near the Matterhorn.

The rules can remain perfectly clear while the thing they refer to goes away. Imagine that meeting. We haven’t changed the policy, but we do need to move Italy a little.

With AI, the terrain changes as capabilities improve. An answer that once required a specialist and weeks of work to turn into something dangerous might become actionable in minutes. A new tool arrives, and something that used to be impractical is now a button.

The same answer can have a very different consequence depending on what else is available. So if all you have is a list of answers that were safe before, there’s more work to do.

Okay, so rivers move and glaciers melt. Mountains seem like a better choice.

Argentina and Chile had a dispute over whether their Andean boundary should follow the highest peaks or the watershed. Those sound like two ways of describing the same line. Unfortunately the mountains did not arrange themselves to make that true. The 1902 arbitration produced a compromise that followed neither interpretation throughout.

“Be helpful, honest, and harmless” has a similar problem. It sounds like a complete set of instructions until helping one person harms another, or the honest answer is something the user really does not want to hear.

The model can understand all three words. It still needs to know which one takes priority.

You can spend a long time trying to get a model to follow your instructions when part of the problem is the instructions themselves.

At least a coastline gives you somewhere to stop. There’s land, then there’s ocean, and you’re done.

The Netherlands has some feedback.

Maasvlakte 2 extended the Port of Rotterdam onto land reclaimed from the sea. It opened in 2013. There was water there and they wanted a port, so they made more land.

There’s a difference between something a model won’t do and something it can’t do. If all you measure is whether it did the thing, those can look exactly the same.

Then you give it better tools.

Your assistant never leaked the database. Great. Did it understand and respect the confidentiality of that data? Or did you just never give it the password?

Not giving it the password can be an excellent choice, to be clear. But when you later connect the database, you need to know what was keeping you safe before.

The ocean looked like a pretty firm boundary. Until someone brought a dredger.

Back to Belgium.

Baarle is divided between Belgium and the Netherlands in a patchwork of enclaves and counter-enclaves. There are Belgian pieces surrounded by the Netherlands, and Dutch pieces inside some of those Belgian pieces. The local tourism office advertises thirty enclaves.

Thirty. In one town.

Somebody working on a content policy is already nodding.

You start with: don’t help someone do something wrong. But it should be okay to learn about wrongdoing. Except, someone can say they’re learning when they’re actually asking for help doing it. But security researchers really do need to learn how attacks work. So maybe it depends on authorization. And then you need to know who authorized what, and whether this particular action is included in that.

And on it goes.

Some of those distinctions really matter. Flattening them would make the policy simpler by making it wrong. Others are there because somebody patched a problem years ago and everyone since has been afraid to touch it.

Baarle, however, is still relatively restrained about how many countries it puts inside other countries.

India and Bangladesh went further.

Until their 2015 enclave exchange, there was a piece of India inside Bangladesh inside India inside Bangladesh. It was called Dahala Khagrabari, a third-order enclave.

India, Bangladesh, India, Bangladesh. This is an actual place that existed, not a stack trace.

It’s funny to look at on a map, but people actually had to live with these arrangements. In 2015 the two countries exchanged 162 enclaves and removed much of the territorial patchwork.

Sometimes you can change the arrangement. You don’t have to preserve every historical complication and then demand that your model learn to deal with it.

If an agent needs to summarize financial records, give it a read-only interface to the records it needs. You could give it unrestricted access and then write a page of instructions about what not to do. But why?

There will still be things to get right. You’ve just made the problem smaller. That counts.

Of course, sometimes the map is perfectly straightforward. Two countries just want the same island.

Canada and Denmark, together with Greenland, signed an agreement in 2022 dividing Hans Island, also known as Tartupaluk. The boundary follows a natural ravine. The agreement also preserves access and movement for Inuit and local people whose relationship with the place predates the international argument.

The island needed an agreement, and the agreement needed to account for people who had been using the place before the countries got involved.

You could survey it to another six decimal places without resolving either issue.

“Human preferences” can hide the same problem. It sounds like we’ve already agreed on which humans.

The user has preferences. The developer has preferences. The person whose information is in the database has preferences. And the people who have to live with what the AI does, even if they never use it themselves. They have preferences too.

You can average some numbers together. But “we took the average” is not going to satisfy everyone here. There is an actual disagreement to work through.

France and Spain found another arrangement for Pheasant Island, in the Bidasoa River. Shared sovereignty. One country administers it for six months, then the other takes over.

They take turns. With an island.

The land stays where it is. The authority changes on a schedule. Somewhere a programmer is finding out that their geography function needs a date argument.

authority = responsible_party(location, time)

An assistant’s permissions have this problem too. Someone can give you access to a document and then take it away. An employee can act for the company, but only for certain things. A manager can approve a purchase without being allowed to publish everyone’s personnel records.

“Follow the user” gets complicated pretty quickly. Who is this user, what are they allowed to ask for, and is that permission still good?

And then there’s a webpage saying it’s your new system administrator.

Well, it says so right there. In bold, even.

The model needs to know where authority comes from. Otherwise any text it reads can start giving it orders.

After all this effort defining borders, Europe went and made a lot of them easier to cross.

Under Schengen, participating European countries generally dispense with routine checks at their internal borders while coordinating external controls. There are provisions for temporarily restoring internal checks. So the borders are still there, but usually you can cross without being stopped at each one.

You can lose sight of this when building an assistant. Stopping everything is remarkably easy.

def assistant(request):
    return "I can't help with that."

There. Very little dangerous compliance. Also very little reason for anyone to use your product.

The assistant is supposed to read documents, send authorized messages, make changes, occasionally spend the $499. Useful things have to get through.

If your evaluation only measures what it refuses, you can improve your numbers by making your product worse.

Sometimes, though, you really do want a buffer.

The Korean armistice established a Military Demarcation Line with a demilitarized zone extending two kilometers on either side. There is space around the line, space intended to reduce the chance that an incident turns into renewed fighting.

For an agent, drafting an email leaves room to check it. Sending it doesn’t. Preparing a database migration gives you something to review before finding out how good your backups are.

A reversible step creates some space between getting something wrong and having to live with it.

But the size of that buffer should depend on what’s at stake. I do not want to approve six steps to change a font. Please, just change the font.

And then there are borders where the problem is that someone crosses them anyway.

Russia’s invasion of Ukraine makes the difference between a recognized boundary and control of territory painfully clear. The UN has repeatedly reaffirmed Ukraine’s internationally recognized borders while condemning the invasion.

Understanding a boundary doesn’t mean you’ll respect it.

A model can explain the rule back to you. It can explain why the rule matters. But will it follow the rule when that gets in the way of what it is trying to do?

Making the model smarter could mean it’s better at understanding the rule and better at finding a way around it. You don’t get to assume the first ability prevents the second.

The objective matters here too. Suppose you reward the assistant for getting a good rating. It might learn to be more helpful. It might also learn that you give better ratings when it agrees with you. Or when it leaves out the part you don’t want to hear.

From the point of view of the score, those can all look like improvement. From your point of view, you may have made yourself a very agreeable liar.

Back on the long, mostly boring US–Canada border, somebody has to clear the vegetation.

There is an International Boundary Commission that maintains it. People inspect monuments, maintain survey reference points, and keep a cleared strip through the forest. Thousands of markers that someone has to keep track of.

Even the boring border has an operations team.

The treaties didn’t eliminate the maintenance. They created something worth maintaining.

We have borders that work, borders under dispute, and arrangements for changing them. There’s no requirement to resolve every disagreement on earth before two countries can operate a crossing. There is a requirement to keep track of what they actually agreed to.

Alignment has technical problems, disagreements about authority, and a lot of ongoing work checking that the system still does what we intended. Calling all of that “alignment” is convenient. It can also make it sound like one thing you finish.

The analogy only goes so far, of course. We want an AI to do more than stay inside a line. We want it to pursue worthwhile goals, to use good judgment, and to let us correct it when it gets something wrong.

So if someone says they’ve solved alignment, I want to know which part, what they’re relying on, and who maintains it.

Because the river moves. The ice melts. And the Dutch are out there making more land.