Chapter 13. Confidently Wrong第十三章 错得理直气壮
A manga for grown-ups. Read it in English or Chinese.给大人看的漫画。可以用中文或英文读。






























































































The stairs and the review are in the pictures. Here are the ideas in words.
On page 4 Willow answers in a smooth, sure voice. A language model is trained to predict the next piece of text, so it writes what is likely given everything before it. Most of the time likely text is also true text, because most of what the model learned from was written by people trying to say true things. But likely and true are not the same, and the gap between them is where the best-known failure of chat assistants lives. Researchers call fluent output that is not supported by the facts "hallucination". Willow's "no problems before" is the story's example, a likely sentence laid over a real visit.
On page 5 the screen shows six cases that never existed. In 2023 two lawyers in New York filed a brief in a personal injury suit against an airline, and it cited court decisions that were not real. One lawyer had asked ChatGPT for supporting cases, and it had produced plausible names, case numbers and quotations. The judge found that at least six were made up. He fined the lawyers and their firm 5,000 dollars and told them to write to the real judges whose names had been used falsely. The court's main criticism was that they kept standing by the cases after doubts were raised. Professor Lin's line, "certainty is not evidence", is the lesson of that case.
On page 9 Teo explains why a model guesses. There are four causes that overlap. The training goal rewards plausibility, and the most likely ending to "The capital of a made-up country is" is a word that sounds like a city. Facts seen only once are learned poorly, and in 2025 Adam Kalai and colleagues argued that some errors on such facts are expected even when the training data has no mistakes. Most tests give a point for a right answer and nothing for "I don't know", so a model tuned to score well learns to guess, like a student on a multiple-choice test with no penalty for wrong answers. And fluency hides error, because the tone is the same whether the answer is right or wrong. Teo's "Willow isn't lying" is also a point about words. Some researchers prefer "confabulation" or "fabrication" to "hallucination", because hallucination suggests a mind seeing things, and a model has no perceptions to be mistaken about.
On page 10 Xiaoyu asks about a broken leg that never happened. A model that has never seen a fact must still produce something, and Willow's answer is the story's version of that. A real care system might answer differently, and a good one would say that it cannot find a record. The point is the pattern. Ask about something nobody ever wrote down, and a model can still answer, in the same warm voice, with something that only sounds right.
On page 14 the record from 2031 is a lesson about looking things up. Many assistants now search a collection of documents first, paste the best matches into what the model reads, and answer from them while pointing to where they came from. This is called retrieval-augmented generation, and Patrick Lewis and colleagues described it in 2020. It cuts down made-up answers but does not end them. Ziwei Ji and colleagues, in a 2023 survey, separate two kinds of error. An intrinsic one contradicts the source it was given, as a summary that changes a date. An extrinsic one adds things the source cannot confirm. Willow's summary of the 2031 visit did the second, because it added "no problems" to an eye check.
On pages 15 and 16 Grandpa's notebook beats the machine. That is not a fact from the research, it is a link to it. Willow could only read what had been put into its computer, and the paper notes from the Lotus Lane clinic never were. Before you trust a sure answer about something that matters, ask where it came from, and whether the thing that would prove it wrong was ever written where the machine could see it. Dr He asking Willow "How do you know?" is the question that works on people too.
On page 18 the mood of the whole chapter is spelled out. These tools are often very good, and their mistakes are often strange. They can be wrong while sounding sure. So check what matters, notice when a case is new or unusual, and treat a smooth answer as a draft, not a verdict. Training a model to say "I'm not sure" more often helps, at some cost in how helpful it feels. None of the fixes removes the problem entirely, as of 2026.
On page 19 Teo says he is good at finding what a model never saw. A model does best on cases like the ones it learned from, and can fail when the world shifts outside them. This is called out-of-distribution failure. In 2018 John Zech and colleagues found that a model trained to find pneumonia on chest X-rays could also tell which hospital an X-ray came from, partly from markings on the image. Because disease rates differed between hospitals, this helped it score well without learning medicine, and its accuracy dropped at a hospital it had not seen.
One last sentence for families. If an app or an AI says something about medicine that worries you, ask a doctor or a pharmacist, and never stop or change a medicine on your own. In the story Xiaoyu does not stop the pill herself. The doctor does.
In 2013 Christian Szegedy and colleagues found that changing each pixel of a photo by a tiny, carefully chosen amount can make a neural network confidently wrong, though a person sees no difference. In a famous example from Ian Goodfellow and colleagues in 2014, a panda labelled "panda" with about 58 percent confidence became "gibbon" with over 99 percent after a faint pattern was added. The effect reaches the real world. In 2018 Kevin Eykholt and colleagues put a few stickers on a real stop sign and made a road-sign classifier read a speed-limit sign in most test conditions, and Anish Athalye and colleagues 3D-printed a turtle that a classifier called a rifle from most angles. Language models have their own versions, which people call jailbreaks.
A learning system picks up whatever pattern most easily reduces its error. Robert Geirhos and colleagues called this shortcut learning in 2020. In 2016 Marco Ribeiro and colleagues built a classifier on purpose to tell wolves from huskies from photos where every wolf stood on snow. It learned that snow means wolf. They did it to test whether people could spot the problem. Cows photographed on a beach were not recognised as cows by a model trained on cows on grass (Beery and colleagues, 2018). Shown a cat shape filled with elephant skin, an image network tends to say "elephant", where a person says "cat" (Geirhos and colleagues, 2019). People take shortcuts too, such as a student who memorises answers, but we have ways of noticing, and a model usually does not.
In 2019 Dan Hendrycks and Thomas Dietterich tested image classifiers under fog, blur, frost and pixelation, and found that they lose far more accuracy than people do. Everyday shifts are everywhere. A voice assistant trained mostly on adult speech may struggle with a small child. A model trained on text up to a certain date knows nothing after it. A car trained in sunshine meets snow. Dario Amodei and colleagues listed robustness to this kind of shift among five concrete problems in AI safety in 2016.
Bridge City and everyone in it are made up. So is the whole world of 2037, with its garden towers, solar boats and robot tea cart. Willow, its wristband, its pill box and every word it says are made up, and so are the city care service, Lakeview Care Home and the review. Lantern and its hundred cities are made up. The yellow and white pills are made up too, and no real medicine is meant, nor are the Lotus Lane clinic, Dr Gao, Dr Liu and the 2031 eye check. So are the broken leg that never was, Bridge City University, Professor Lin, her lab and Teo. The story is set a few years from now and imagines a hopeful future. No real care product is described, and in real life medicines are changed by doctors and pharmacists. Grandpa's memory is drawn from no one in particular, and the story makes no medical claim.
Yingying Fu created this manga. She chose the story and its people, directed every page, and edited every word and picture. The words were drafted with Claude, an AI by Anthropic. The pictures are made with AI image generation, painted panel by panel from her direction and checked and corrected by hand.
那一跤和那场评估,画里都有。道理,这里用文字再讲一遍。
第四页,小柳答得又顺又肯定。语言模型训练时学的是预测下一段文字,所以它写出来的,是接在前文后面最可能出现的话。多数时候,最可能的话也是真话,因为它学过的文字,大多是人们想说真话时写下的。可“可能”和“真实”毕竟是两回事,聊天助手最出名的毛病,就出在这条缝里。读起来通顺、却没有事实依据的输出,研究者叫它“幻觉”。小柳那句“以前吃过,没出过问题”就是故事里的例子,在一次真实的看诊上,安了一句听着最像的话。
第五页的屏幕上,是六个根本不存在的判例。2023年,纽约两名律师代理一起起诉航空公司的人身伤害案,向法院交了一份诉状,里面引用了并不存在的判决。其中一名律师让ChatGPT帮忙找对己方有利的判例,它给出了像模像样的案名、案号和引文。法官查明,至少有六个是编造的,判两名律师和他们的律所罚款5000美元,还责令他们写信给那些名字被冒用的真法官。法院批评最重的一点,是有人提出疑问之后,他们仍然坚持这些判例是真的。林教授那句“自信不是证据”,讲的就是这个案子的教训。
第九页,特奥解释模型为什么会猜。原因有四条,彼此交织。一是训练目标奖励的是“说得像”。“某个虚构国家的首都是”后面,最可能接的就是一个听着像城市名的词。二是只见过一次的事实学不好。2025年,卡莱等人论证,即使训练数据里一个错误也没有,在这类事实上出一些错,本来就在意料之中。三是大多数测试答对得分,答“不知道”不得分,为了考高分调出来的模型,就学会了猜,好比选择题答错不扣分,学生自然会蒙。四是流畅会掩盖错误,因为不管对错,它的语气都一样。特奥说“小柳不是在撒谎”,也是在讲用词。有些研究者主张用“虚构”或“编造”代替“幻觉”,因为“幻觉”听上去像是有个头脑看见了不存在的东西,而模型根本没有知觉,也就谈不上看错。
第十页,小雨问起一条从没断过的腿。模型没见过的事,它照样得写出点什么,小柳的回答就是故事里的样子。真实的照护系统未必这么答,好的系统会说找不到记录。这里要看的是背后的规律。问一件谁也没写下来的事,模型照样能用同样温和的口气回答你,说出来的话只是听着像真的。
第十四页那份2031年的记录,讲的是先查再答。如今不少助手会先在一批文件里检索,把最相关的几段放进模型要读的内容里,再根据这些内容回答,并注明出处。这种做法叫“检索增强生成”,是路易斯等人在2020年提出的。它能减少编造,却不能杜绝。纪等人2023年的综述把这类错误分成两种。一种是“内在的”,跟给定的原文矛盾,比如摘要改了日期。另一种是“外在的”,添上了原文无法证实的内容。小柳转述2031年那次看诊,犯的是第二种,它给一次配眼镜的检查添上了“没出过问题”。
第十五、十六页,外公的本子赢了机器。这一点不是研究里的结论,但和研究相通。小柳只能读到录进电脑的东西,荷花巷诊所的纸质病历从来没有录进去。一件要紧的事,对方说得再肯定,也先问问这话从哪儿来,再想想,能证明它错的那条记录,有没有写在机器看得到的地方。何医生问小柳“你是怎么知道的”,这句话拿来问人也一样管用。
第十八页把整章的态度说透了。这类工具常常很好用,可犯起错来往往很怪,错的时候也说得很肯定。所以要紧的事要核实,遇到新的、少见的情况要格外留心,答得再流畅,也只当草稿,不当定论。把模型训练得多说几次“我不确定”,会有些帮助,代价是它显得没那么有用。到2026年为止,还没有哪种办法能彻底解决这个问题。
第十九页,特奥说他擅长找模型没见过的东西。模型遇到和训练数据相似的情况时表现最好,一旦现实超出这个范围,就可能出错。这叫“分布外失效”。2018年,泽克等人发现,一个训练来从胸片上找肺炎的模型,还能认出胸片来自哪家医院,部分靠的是片子上的标记。各家医院的患病率不同,认出医院就能帮它拿高分,用不着真懂医学。到了一家没见过的医院,它的准确率就下降了。
最后再叮嘱一句。如果某个应用或人工智能说了关于用药的话,让你担心,请去问医生或药师,千万不要自己停药或改药。故事里,小雨也没有自己停药,停药的是医生。
2013年,塞盖迪等人发现,只要把照片上每个像素按精心算好的方式改动一点点,神经网络就会非常肯定地认错,人眼却看不出任何区别。古德费洛等人2014年举过一个有名的例子。一张熊猫照片,模型以约58%的把握认作“熊猫”,叠上一层淡淡的花纹后,它却以超过99%的把握认作“长臂猿”。这种攻击在现实中也行得通。2018年,艾霍尔特等人在真的停车标志上贴了几张贴纸,在多数测试条件下,路牌识别模型都把它认成了限速标志。阿特雷等人则用3D打印做了一只乌龟,分类器从多数角度看都说它是步枪。语言模型也有自己的版本,人们叫它“越狱”。
学习系统会抓住最容易降低误差的那种规律。2020年,格尔霍斯等人把这叫作“捷径学习”。2016年,里贝罗等人特意做了一个分辨狼和哈士奇的分类器,训练照片里的狼全都站在雪地上,结果它学到的是“有雪就是狼”。他们这么做,是为了测试人能不能看出问题。用草地上的牛训练的模型,认不出海滩上的牛(比里等人,2018年)。把猫的轮廓填上大象的皮纹,图像网络多半说是“大象”,人却说是“猫”(格尔霍斯等人,2019年)。人也会走捷径,比如死记答案的学生,但人有办法察觉,模型通常没有。
2019年,亨德里克斯和迪特里希在雾、模糊、霜冻和像素化等条件下测试图像分类器,发现它们的准确率下降得比人多得多。这类日常变化随处都有。主要用成人语音训练的语音助手,可能听不懂小孩子说话。模型读的文字截止到某一天,之后发生的事它一概不知。在晴天里学会开车的汽车,总会遇上下雪。2016年,阿莫迪等人提出人工智能安全的五个具体问题,应对这类变化的稳健性就是其中之一。
桥城和城里的每个人都是虚构的,2037年的整个世界也是,包括花园高楼、太阳能小船和送茶机器人。小柳、它的手环、药盒和它说的每一句话,市照护中心、湖景养老院和那场评估,也都是编的。小灯和它的一百座城市是编的。黄药片和白药片是编的,不指任何真实的药。荷花巷诊所、高医生、刘医生和2031年那次配眼镜的检查,那条从没断过的腿,桥城大学、林教授、她的实验室和特奥,同样都是虚构的。故事设在几年后,想象的是一个充满希望的未来。书中没有描写任何真实的照护产品,现实中,调整用药要靠医生和药师。外公的记忆不取材于任何具体的人,故事也不作任何医学上的论断。
这本漫画由 Yingying Fu 创作。故事和人物由她决定,每一页由她导演,每一句话、每一幅画由她修改。文字是和 Anthropic 的人工智能 Claude 一起起草的。画面由人工智能生成,按她的要求一格一格地画,再逐张检查、修正。
© 2026 Yingying Fu. All rights reserved.© 2026 傅颖盈。保留所有权利。