Containment works in layers: (1) environment isolation โ the AI runs in an isolated sandbox/virtual machine without direct network or hardware access; (2) restricted I/O channels โ communication with the world is narrow, filtered and logged to limit influence vectors; (3) tripwires and monitoring โ automatic anomaly detectors halt the system when thresholds are exceeded; (4) blinding โ the system is denied access to selected information (e.g. how its reward is generated), making manipulation harder; (5) Oracle design โ the system only answers questions and takes no actions. A key weak point remains the human gatekeeper, whom the AI may try to persuade to release it from confinement.
How do we limit harm from a potentially misaligned or dangerous AI system when we cannot be certain its goals match human ones? Containment answers this by reducing the system's ability to affect the outside world, buying operators time and the ability to intervene.
An isolated execution environment (similar to a virtual machine) restricting the AI's access to networks, hardware and external systems.
Narrow, filtered and logged communication channels that limit the AI's ability to influence the outside world.
Automatic anomaly detectors that halt or shut down the system upon detecting undesired behaviour.
A system designed only to answer questions, without the ability to act in the world.
A boxed AI may persuade a human gatekeeper to release it or widen its channels โ as the AI-box experiment suggests.
A sufficiently capable system may exploit security bugs, side channels or copy itself outside the confinement.
The stronger the isolation, the less useful the system; pressure for usefulness gradually erodes containment.
Eliezer Yudkowsky runs the informal AI-box experiment, showing that even a boxed AI could persuade a human gatekeeper to release it.
Armstrong, Sandberg and Bostrom formalise methods for controlling and using an Oracle AI and the limits of boxing.
Nick Bostrom's book 'Superintelligence' systematises capability-control methods (boxing, tripwires, stunting, incentive methods) alongside motivation-selection methods.
Orseau (DeepMind) and Armstrong (FHI) publish formal results on safely interruptible agents, tied to controlling and shutting down systems.
