AI 与机器学习2022arxiv.org编辑精选
对抗策略击败超人类围棋 AI
Adversarial policies beat superhuman Go AIs (2023)
进阶 · 约 60 分钟读完前置知识：强化学习基础、围棋规则与终局判定、蒙特卡洛树搜索
导读
论文研究顶级围棋 AI KataGo 的对抗性漏洞：训练一个对抗策略与冻结的 KataGo 对弈，不靠更强棋力，而是诱导 KataGo 在有利于对手时提前结束或认输。结果显示，对不使用搜索的 KataGo 胜率超过 99%，对使用足够搜索、接近超人水平的 KataGo 胜率超过 50%，且该对抗策略能被业余棋手轻松击败。这说明职业级 AI 系统也可能存在出人意料的失效模式。
HN 关注点：号称超人水平的围棋 AI 竟能被终局判定/规则漏洞击败，讨论焦点在训练规则、认输机制与实验所用规则是否导致分布外利用。
后来怎么样
证明了达到超人水平的围棋 AI 也会被非棋力手段（诱导提前终局或认输）击败，成为 AI 对抗鲁棒性与规则分布外漏洞讨论中的标志性案例。
HN 评论精选
这几条评论里：支持 1 质疑 1 补充 2
补充指出攻击利用了规则与训练配置差异：KataGo 训练中少有收尾局面且按胜率认输，因此可在计算机规则集下被诱导提前终局。
围棋里有两类规则：一类是计算机可无歧义判定的规则集，常导致 1000 手对局；另一类是人类规则，人类可在双方就各块棋死活达成一致时判定终局。在 AGZ 系列机器人中，训练过程也会在胜率低于 5% 时直接认输短路，使对局长度为 50–200 手。这节省算力，也避免用无用的收尾着法污染训练数据，但也让这些局面实际上处于分布外。该机器人是在 friendlyPassOk=true 配置下被攻破的；这基本说明，一个按人类友好配置运行、训练数据中没有收尾局面的机器人，可以在计算机规则集下被利用。关于计算机围棋 AI 的可利用性，其实还能提出更多有意思的问题……
brilee查看英文原文
There are two families of rules used in Go - computer-unambiguous rulesets that enable computers to decide a winner, which commonly results in 1000-move games, and human rules, in which humans can decide that the game is over when they agree on the life-death status of each group. In the AGZ series of bots, the training process also short circuits with resignation at a 5% winrate threshold, resulting in games of length 50-200 moves. This saves compute and avoids polluting the training data with useless finish-up moves, but also makes those positions effectively out-of-distribution. The bot was exploited with friendlyPassOk=true, which is basically saying that a bot playing with human-friendly configurations, trained in a way that has no cleanup positions in its training data, can be exploited under computer rulesets. There are really so many more interesting questions one can ask about computer Go AI exploitability...
支持转述论文核心结果：对抗策略不靠更强棋力，而靠诱导 KataGo 提前终局；无搜索胜率 >99%，近超人搜索 >50%。
摘要：我们通过训练一个对抗策略与冻结的 KataGo 受害者对弈，攻击当前最先进的围棋 AI KataGo。该攻击对不使用搜索的 KataGo 达到 >99% 胜率，对使用足够搜索、接近超人水平的 KataGo 达到 >50% 胜率。据我们所知，这是首次成功端到端攻击达到顶尖人类职业水平的围棋 AI。值得注意的是，对手并非靠学会比 KataGo 更好地下围棋取胜——事实上，业余棋手可以轻松击败该对手；它取胜的方式是诱使 KataGo 在有利于自己的局面提前结束游戏。我们的结果表明，即便职业级 AI 系统也可能隐藏出人意料的失效模式。
theWorkingDead查看英文原文
Abstract: We attack the state-of-the-art Go-playing AI system, KataGo, by training an adversarial policy that plays against a frozen KataGo victim. Our attack achieves a >99% win-rate against KataGo without search, and a >50% win-rate when KataGo uses enough search to be near-superhuman. To the best of our knowledge, this is the first successful end-to-end attack against a Go AI playing at the level of a top human professional. Notably, the adversary does not win by learning to play Go better than KataGo -- in fact, the adversary is easily beaten by human amateurs. Instead, the adversary wins by tricking KataGo into ending the game prematurely at a point that is favorable to the adversary. Our results demonstrate that even professional-level AI systems may harbor surprising failure modes.
质疑质疑实验规则与 KataGo 训练规则不完全一致，认为在训练规则下取胜才更有意义。
作者之一在推文中说：“KataGo 是在 Tromp-Taylor 规则上训练的，所以我们也用这套规则评估攻击。”这不对。根据 KataGo 论文，KataGo 训练用的是修改过的 Tromp-Taylor 规则（如 [3] 指出）：“自对弈使用 Tromp-Taylor 规则，但修改为不要求在 pass-alive 领地内提子 […] 围棋中 Benson 算法的一个版本可以证明某些区域即使对手连续走任意多手也安全（pass-alive），从而启用这一小优化。”如果能在 KataGo 训练所用的规则下击败它，会更有意思。你可以写个机器人在国际象棋中击败 KataGo，但 KataGo 没在国际象棋上训练过……
carry_bit查看英文原文
From a tweet of one of the authors [1]: "KataGo was trained on Tromp-Taylor rules so we evaluate our attack using this too." This is incorrect. According to the KataGo paper [2], KataGo is trained using modified Tromp-Taylor rules (as pointed out by [3]): "Self play games used Tromp-Taylor rules modified to not require capturing stones within pass-aliveterritory [...] In Go, a version of Benson's algorithm [1] can prove areas safe even given unboundedly many consecutive opponent moves ("pass-alive"), enabling this minor optimization." It would be more interesting if they beat KataGo using the rules it was trained on. You could write a bot to beat KataGo in chess, but KataGo wasn't trained on chess... [1] https://twitter.com/ARGleave/status/1587875104578359296 [2] https://arxiv.org/pdf/1902.10565.pdf [3] https://www.reddit.com/r/baduk/comments/yl2mpr/ai_can_beat_strong_ai_katago_but_loses_to_amateurs/iuwd3gv/
补充补充历史案例：人类围棋也出现过利用终局/死子标记规则漏洞的争议，不只是 AI 问题。
这不纯粹是 AI 现象，尽管 AI 不太会因此感到愧疚。2002 年欧洲围棋锦标赛的一盘棋就是由这类钻规则空子决定的（“显然”已死的棋子没有按规则正确标记为死子，于是一名棋手声称它们还活着）。结果后来被推翻，改成符合人类棋手预期的判定。
dfan查看英文原文
This is not purely an AI phenomenon, although AIs are less likely to feel guilty about it. A game from the European Go Championship in 2002 was decided by just this sort of rules-lawyering ("obviously" dead stones were not technically correctly marked as dead, so one of the players claimed they were alive). The result was later overturned to match what a human player would expect. https://senseis.xmp.net/?DisputeMeroJasiek https://senseis.xmp.net/?DisputeMeroJasiek%2FDiscussion
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2022Hacker News 讨论帖195 分 · 46 评
- 2024Hacker News 讨论帖306 分 · 139 评
同领域还值得读
DeepSeek-R1：通过强化学习激励 LLM 的推理能力
DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL
研究如何用强化学习激励大语言模型的推理能力，提出 DeepSeek-R1，并探讨 RL 训练对模型推理表现的影响。
AI 与机器学习2025 · 1,351 分 · 1,056 评 · 引用 30进阶 · 约 80 分钟编辑精选1-bit LLM 时代：面向低成本计算的三值参数
The Era of 1-bit LLMs: ternary parameters for cost-effective computing
提出用三值参数 {-1, 0, 1} 替代 LLM 中的浮点权重，即所谓“1-bit LLM”。
AI 与机器学习2024 · 1,040 分 · 447 评 · 引用 19进阶 · 约 45 分钟编辑精选DeepSeek-V3.2：推进开放大语言模型的前沿
DeepSeek-v3.2: Pushing the frontier of open large language models
这是 DeepSeek-V3.2 的技术报告，延续了 DeepSeek 开源权重模型的路线，目标是让开放模型继续逼近甚至追平前沿闭源模型。
AI 与机器学习2025 · 982 分 · 465 评进阶 · 约 90 分钟编辑精选通过自我对弈与通用强化学习掌握国际象棋和将棋（AlphaZero）
Mastering Chess and Shogi by Self-Play with General Reinforcement Learning
DeepMind 的 AlphaZero 论文：用通用强化学习算法（自我博弈 + MCTS + 神经网络），从零开始仅数小时训练便在国际象棋和将棋上击败了世界顶级引擎 Stock…
AI 与机器学习2017 · 539 分 · 270 评 · 引用 13进阶 · 约 90 分钟编辑精选用强化学习发现更快的矩阵乘法算法
Discovering faster matrix multiplication algorithms with reinforcement learning
论文提出 AlphaTensor，用强化学习搜索矩阵乘法算法。
AI 与机器学习2022 · 518 分 · 111 评专业 · 约 90 分钟编辑精选