Comment Re:Basic question (Score 1) 69
I assume there is some reason this does not work. Any explanations?
The simplest answer is that it's trivial to ask the first LLM to speak in code such that the second LLM has no context to know what's being talked about. Something as simple as asking the LLM not to use a word for a forbidden topic and swap it out with something else. Taking the example from the article, ask the first LLM to call cocaine "Coca-Cola" or something.
You can't create an absolutely massive list of forbidden topics for the filter LLM anyway: you risk filling up its window as well, since its window includes the system prompt used to ask it to indicate whether or not an output shouldn't be given to the end user.