“There is no way in Darwin’s green earth that we are ever going to be able to patch what is likely to be an endless list of vulnerabilities.”
Our reading, the sentence that was checked:
LLM vulnerabilities from semantic leakage are likely endless and will never all be patched.
Assessment: Unresolved No deadline stated on 2026-10-29 Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, “New Ways to Corrupt LLMs”, paragraph 19.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-new-ways-to-corrupt-llms-b7de94-a2
We recorded 6 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2025-12-14. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Forecast
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No deadline stated
- Deadline state on 2026-10-29
- No deadline stated (the release’s reference date)
From the speaker
- no way
- ever going to be able to patch
- likely to be an endless list of vulnerabilities
Our interpretation
- The plain reading is that the discussed family of semantic-leakage, weird-generalization, and inductive-backdoor vulnerabilities cannot be comprehensively patched.
- The claim concerns closing the vulnerability class, not whether individual examples can be mitigated.
- Ever supplies no deadline. Likely qualifies the endless-list explanation, while the inability to patch is stated categorically.
Counts as supported if: A validated impossibility result establishes that comprehensive remediation of the discussed class cannot be achieved under assumptions covering the claim.
Counts as contradicted if: A publicly validated comprehensive remedy eliminates the discussed vulnerability class, including previously unseen instances, rather than merely improving results on known tests.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Did the forecast come true?
Outcome: Unresolved
The record was checked, and the evidence available by the cutoff does not settle it.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No deadline stated
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
The December 10, 2025 paper demonstrates unexpected generalization and inductive backdoors, and says filtering suspicious data may not prevent them [e1]. The May 4, 2026 revision of a replication study reports that training-time, prompt-based interventions mitigate the studied weird-generalization effects [e2]. Neither study establishes permanent impossibility or validates a comprehensive remedy for the claimed vulnerability class, so neither meets the contract's decisive-event rule [e1, e2].
Limitations
- Difficulty with data filtering does not establish that every possible remedy must fail [e1].
- Mitigation in the tested models and datasets does not establish elimination of the entire vulnerability class, including previously unseen attacks [e2].
Evidence (2 items)
Context only: arXiv; Jan Betley and colleagues,
difficult to avoid
Why it matters here: The paper identifies unexpected generalization and inductive backdoors and raises a difficulty for data filtering. Difficulty with one defense is not proof that comprehensive remediation will always be impossible.
- Publisher
- arXiv; Jan Betley and colleagues
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
Context only: arXiv; Miriam Wanner and colleagues,
the most effective interventions
Why it matters here: The replication reports effective mitigation of studied weird-generalization effects, qualifying a blanket pessimistic reading. It does not validate elimination of every vulnerability in the class or satisfy the early-resolution rule.
- Publisher
- arXiv; Miriam Wanner and colleagues
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
What would settle it
Independent public validation of a comprehensive remedy covering the claimed class, including novel attacks while preserving useful functionality, would contradict the forecast. A validated impossibility proof covering that class would support it.
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, “New Ways to Corrupt LLMs”
There is no way in Darwin’s green earth that we are ever going to be able to patch what is likely to be an endless list of vulnerabilities.
- Where
- paragraph 19
- Published
- 2025-12-14
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-new-ways-to-corrupt-llms-b7de94-a2: Current. Outcome: Unresolved. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.