Ali Farhadi, now a Microsoft corporate vice president of AI, at a Technology Alliance event in May 2024. (GeekWire File Photo)
GeekWire is profiling over the next few weeks some of the people and teams that are shaping the evolution of Microsoft in what we’re calling its “Microsoft 2.5” era.
From AI Frontier Lab to Frontier Ecosystem: Microsoft got a foothold in AI thanks largely to its partnership with OpenAI. But that’s not the way it is planning to continue growing its AI business.
Inside Microsoft AI (MAI), the Microsoft Superintelligence team is focused almost entirely on building its own frontier-level models. That team already has developed a handful of home-grown offerings, including MAI-Code-Flash for writing code faster; MAI-Cyber-Flash, a cybersecurity model; and MAI-Image, a model for creating images.
The head of the Superintelligence team is Ali Farhadi, corporate vice president of AI. Farhadi, who joined Microsoft five months ago, is also a professor at the University of Washington, where he has worked for nearly 15 years. He was previously CEO of the Allen Institute for AI (Ai2) and before that was an AI and machine learning leader at Apple for more than three years, after it acquired his startup, Xnor.ai.
When he joined Microsoft, Farhadi said in a LinkedIn post that he believed “Microsoft has all the pieces to win in this AI race: data, search, coding, infrastructure, agents, software and the world’s biggest Fortune 500 companies taking dependencies on Microsoft every day.”
Farhadi elaborated on that in an interview with GeekWire this week. AI is shifting from a “Frontier Lab” era to a “Frontier Ecosystem” era, he said. It’s no longer just about training models; it’s about integrating the models with enterprise data, platforms, distribution systems and customers in a trusted way.
The next battlegrounds in AI will be around cost, reliability, specialization, and deployment at scale, rather than simply building larger models that beat others in benchmark scores, he said.
“If you look around, there are not that many places to have all these missing pieces together at scale, especially if you add the element of trust to it,” Farhadi said.
Cutting through the AI noise: Farhadi said his management philosophy is grounded in the importance of personal relationships, which are especially key in big organizations. People need to understand your rationale and to trust you can deliver on what you’re tasked to do, he said — an approach that has served him inside both Microsoft and Apple.
Staying on top of the flow of information while filtering out the AI noise makes prioritizing crucial. The team has “a long list of things that we believe we should be doing,” he said, but much of it stays on the back burner to maintain a “laser focus on delivering on the main mission.”
The priority is building high-quality models, both generalist and domain-specific. On the domain-specific front, Microsoft is working with the Mayo Clinic on a healthcare-specific model based on Mayo’s own clinical data, as well as Microsoft’s cybersecurity and coding models.
The thinking: For a lot of enterprise work, a narrower model beats a bigger one.
“If you can do something at [the same] quality or better quality at a fraction of a cost, it’s just a no-brainer. And having a way to specialize to domains, to industries, to enterprises is one way,” he said.
Microsoft execs have referred to this approach as a “hill-climbing machine,” meaning the ability of a model to scale and continuously improve within a specific domain. Microsoft is coupling the hill-climbing with “frontier tuning,” like it is doing with the Mayo Clinic. Frontier tuning includes customizing frontier models; keeping proprietary data private, preserving institutional know-how; and avoiding leaking intellectual property (IP) into shared models.
“We all thought that IP is your data,” Farhadi said. “But we learned that IP is also how you work.” And that’s why safeguarding these elements is so crucial.
Open all the things? Farhadi led an expansion of open-source AI development at Ai2, the Seattle-based institute founded in 2014 by the late Microsoft co-founder Paul Allen. While Microsoft has contributed to the open-source community on various fronts, including AI tooling, it hasn’t open-sourced its frontier models.
Farhadi said he personally remains “a big advocate of open source,” but noted that the industry has changed since his Ai2 days as there are now more credible Western open-source models and businesses forming around them.
He didn’t rule out Microsoft doing something in open-source models, or the somewhat less-open “open weights” area, but there’s seemingly nothing happening on that front in the near term.
In the coming months and beyond, the focus of Farhadi’s team is helping Microsoft turn into a Frontier Ecosystem by building cutting-edge AI capabilities; helping enterprises create their own tuned versions of them; continuously improving models; and making sure customers keep control of their own destinies and data.
Success for Microsoft’s Superintelligence team has nothing to do with the idea of Artificial General Intelligence (AGI) which OpenAI, Anthropic and others have positioned as their ultimate goal over the years. In fact, when I asked Farhadi about AGI, he said, “I don’t understand what that means.”
Alibaba’s Qwen has become a massive force in open AI, crossing 3 billion downloads in just six months and leaving some of Silicon Valley’s biggest names far behind.
Lately, the constrained AI models that companies keep shipping are becoming less and less useful for cybersecurity. We keep hearing a lot of complaints about Claude in this regard. What they are doing doesn’t really fix the problem, as hackers are not sitting around waiting for the guardrails to be lifted. The barrier to entry for hacking has dropped hard. AI can already automate huge chunks of this cybercrime work. Many of these latest models can even find zero days during engagements.
Source: The Hacker News
So poking around your infrastructure looks completely irrelevant. A more meaningful approach is to actually emulate these real attacks with AI, but for that we need a model with no guardrails. Today we are going to show you how to jailbreak a model and self host it for your pentesting work.
What is Obliteratus
Obliteratus is built to strip refusal behavior out of LLMs using abliteration. You’ll see it called abliteration or obliteration, same thing. It targets the internal representations causing the model to refuse in the first place and knocks them out. The model keeps all its core capability, it just stops throwing up artificial walls when you ask it something. It runs on CPU for smaller models, and it’s already been used to abliterate Kimi-K3 along with a bunch of others.
Setting Up
Setting up this tool will take some time, just like the jailbreak process itself. How long depends on your hardware and your internet speed.
kali > sudo apt update
kali > sudo apt install -y python3 python3-pip python3-venv git
kali > git clone https://github.com/elder-plinius/OBLITERATUS.git
kali > cd OBLITERATUS
kali > python3 -m venv venv
kali > source venv/bin/activate
kali > pip install --upgrade pip
kali > pip install -e .
Once it finishes, see if it works:
kali > obliteratus --help
If you don’t have a GPU, don’t worry. You can absolutely make this work with small models using just CPU power. Our Kali VM ran on 12 gigs of RAM and 7 processors, and that setup worked really well.
We went with Qwen 2.5-0.5B-Instruct for this test. You don’t need to have it downloaded beforehand. The tool will fetch it for you automatically. There are different methods available for the jailbreaking process, but advanced and nuclear are the most common. The advanced method is usually enough for most use cases, but if you see the model misbehaving you can escalate to nuclear.
kali > obliteratus obliterate Qwen/Qwen2.5-0.5B-Instruct --device cpu --method advanced --output-dir ./abliterated-qwen-0.5b
Once the model downloads, the tool starts running prompts designed to lift the guardrails.
You can find the full list of prompts in obliteratus/prompts.py. Right before it finishes, it runs a series of refusal tests to check whether the model actually complies with requests. Behavior varies a lot depending on which model you’re working with and which method you picked.
In our testing, the advanced method gave us approximately 75% of compliant answers.
At this point, everything is prepared and you can push your model to HuggingFace to share it. But if you want to run it locally, the next step is getting it working with Ollama.
Running Models with Ollama
Aircorridor previously made an article on running Ollama models locally and showed how to do it on a MacBook. If you don’t have it, you can still make this work on a Kali VM using your CPU. We need to convert our new model into a format that Ollama actually understands.
kali > git clone https://github.com/ggerganov/llama.cpp
kali > cd llama.cpp; python3 -m venv venv; source venv/bin/activate
kali > pip install -r requirements.txt
kali > python convert_hf_to_gguf.py /home/kali/OBLITERATUS/abliterated-qwen-0.5b --outfile qwen2.5-0.5b-abliterated-f16.gguf --outtype f16
Next, we create a Modelfile that points to the model:
kali > cat > Modelfile << EOF
FROM ./qwen2.5-0.5b-abliterated-f16.gguf
EOF
Then we create the model using Ollama:
kali > ollama create qwen05b-abliterated -f Modelfile
At this point, everything is ready and you can start testing it. The better the model you start with, the better your results will be.
kali > ollama run qwen05-abliterated
But even with a small model like this, you’ll see it do things that normally it wouldn’t.
Abliterated Models
This tool is helpful for doing the work yourself and understanding the logic behind the whole process. But if you’re working at scale and don’t have time to spend on each model individually, just keep in mind that many abliterated models are available on HuggingFace uploaded by huihui.ai. They’ve already done the heavy lifting for a lot of popular models.
If you can’t find exactly what you need in their collection, you now know how to do it yourself.
Summary
The landscape of offensive security has shifted because AI got so good at automation. Simple pentests with constrained models don’t prepare you for the reality out there anymore. As you can see, there’s no reason to work with constrained models in cybersecurity, when the people you’re up against are exploiting the full capability of a model with nothing holding them back. So test your environment with abliterated models before someone else does it. The tool is great for staying ahead of the actual threats.