MNEMOSYNEv0.1.2563

Podcasts/Lex Fridman Podcast/Hotz, George

Hotz, George

founder and president of comma.ai; creator of openpilot

George Hotz: Comma.ai, OpenPilot, and Autonomous Vehicles

Lex Fridman Podcast · Aug 5, 2019

▶ Watch on YouTube

Core ideas

Hotz frames autonomous driving as decomposable into three progressively harder sub-problems. The "static" problem — navigating as if you were the only car on the road — he considers essentially solvable today through mapping and localization alone. The "dynamic" problem requires real-time detection and short-horizon prediction of other agents (his example: a car stopped at a red light can't be pre-mapped, must be perceived live, and its future behavior must be predicted). The hardest, which he explicitly says comma.ai has not yet solved, is the "counterfactual" problem — modeling how other human agents will react to your own actions, which he argues can only ultimately be addressed through reinforcement learning against real human drivers, run with the exploration parameter set to zero so the system never actually explores unsafely but still updates from outcomes.

He grounds comma.ai's actual safety practice in this same “never truly explore” idea: with hundreds to low-thousands of daily/weekly active users, openpilot makes many small mistakes per week, but disengagement — the driver retaking control — functions as a consequence-free reinforcement-learning label. He describes the concrete engineering embodiment of the company's safety philosophy in a public document (safety.md): the driver must be attentive at all times, the driver must always be able to instantly regain manual control (via touching the gas/brake or a cancel button), and the car is torque-, braking-, and acceleration-limited so it can never react faster than roughly one second — deliberately more conservative than Tesla's Autopilot on this dimension, in his telling. He contrasts this humility with what he sees as market and media hype: comma.ai is "proud to be level 2," rejects framing today's hardware or software as a step away from level 4 via an OTA update, and treats safety and security as distinct (safety keeps people from accidentally falling in a hole; security stops a deliberate attacker), noting that any wirelessly-dependent safety-critical function is untrustworthy by design, which is his core objection to vehicle-to-vehicle (V2V) communication as a safety mechanism, while allowing that vehicle-to-infrastructure (V2I) uses like Waze-style traffic rerouting are fine for a non-safety-critical convenience layer.

On the business, Hotz reveals comma.ai's long-run strategic ambition is to become something like a car insurance company: driver-monitoring and safety data, if it demonstrably reduces accidents, creates value today independent of whether full autonomy ever arrives — he cites Nauto's driver-monitoring-camera-for-fleets model as the kind of "creating value today" business he most respects, contrasted with hype-driven fundraising built on personality or credentials rather than an honest, transparent consumer product (he says he "hates" and regrets trading on his own hacker fame for money in the past, even having done it once). He describes comma.ai's finances candidly: roughly $200k/month burn against roughly $100k/month revenue from hardware sales, acknowledging revenue needs to roughly quadruple.

Hotz situates his approach relative to competitors: he sees Otto/Anthony Levandowski's trucking-focused approach as one of two legitimate strategic paths (the other being comma's own consumer-level-2 path), reasoning that large trucking is fragmented among many independent operators and fleets, so a company that can lower per-mile trucking cost has a real wedge, distinct from partnering with giant, slow-moving OEMs like Honda or Toyota. On code quality, he describes openpilot's codebase becoming MISRA-compliant (the automotive safety coding standard), noting he initially found the standard's rules arbitrary but came to respect them once he recognized their authors were computer scientists reasoning rigorously about decidability (the halting problem) rather than bureaucrats writing box-ticking rules.

Asked about hacking and security threats to autonomous vehicles, Hotz reframes "adversarial examples" as a pre-existing human problem (a physically obscured stop sign fools human drivers too), and argues security is fundamentally about proactive hardening (a ten-foot fence with barbed wire) rather than passive caution tape; he concedes CAN bus attacks on steering or brakes are possible but notes they predated autonomous-vehicle technology and aren't a new category of risk introduced by companies like his. On ethics, he treats the classic trolley problem as a distraction people fixate on precisely because it requires no technical expertise to have an opinion about (unlike, say, database architecture) — comma's actual answer is that the system detects "ethical dilemma" scenarios and disengages, handing the decision back to the human, consistent with being a level-2, human-supervised system.

The conversation turns philosophical in its second half: Hotz discusses fame ambivalence (wanting recognition specifically from people whose skill he respects — naming figures like Linus Torvalds and Chris Urmson — rather than mass attention), work as the primary source of meaning in his life (while cautioning that working long hours isn't the same as working effectively), and speculative futurism around AI: he predicts VR-based intimate/sexual technology ("VR brothels") as a near-term consumer product, and separately describes his own long-term aspiration to "merge" with a machine in something like a deep, monogamous relationship — clarifying this isn't a simple neural download of information (like instantly absorbing Wikipedia) but closer to a sophisticated AI model of himself that could run simulations to help guide his decisions, analogous to how long-term human couples model each other. On the technological singularity, he ties it to a compute-crossover point — when total machine "flops" in the world exceed total biological (human) flops — and gives 2038 as a half-joking estimate (chosen for its resemblance to the Unix timestamp rollover) for when this could occur within his lifetime. Closing on purpose, he frames himself, in reinforcement-learning terms, as an agent with a highly uncertain reward function, citing Schmidhuber's theory of maximizing compression-progress of one's model of the world as the closest thing to a personal goal function, and describing his current life stage as still trying to discover what "winning" even means before he can pursue it.

Excerpts

On the three-part decomposition of the driving problem:

“Assuming you are the only car on the road... this problem can be solved 100% with mapping and localization... There's an obvious example like a car stopped at a red light — you can't have that car in your map, you have to detect that car in real time, and that car is not a fixed object, that car may move and you have to predict what that car will do... the only real way to get at the counterfactual is to do reinforcement learning, because the other agents are humans.”

On why comma.ai is "proud" to be a level-2 system rather than overselling autonomy:

“We are proud right now to be a level 2 system... if we talk about level 4, it's not gonna be just a magical OTA upgrade, it's gonna be new hardware, it's gonna be very carefully thought out. Right now we are proud to be level 2 and we have a rigorous safety model... it says so in safety.md: first and foremost, the driver must be paying attention at all times... the user must be able to easily take control of the vehicle at all times... [and] the car will never react so quickly that you can't react in time.”

On distinguishing safety from security, and rejecting V2V as a safety mechanism:

“Safety is like we put a little piece of caution tape around the hole so that people won't walk into it by accident. Security is I put a ten-foot fence around the hole so you actually physically cannot climb into it, with barbed wire on top... if you're designing systems that are unreliable, they're definitely not secure. Your car should always do something safe using its local sensors... this is why V2V is such a terrible idea — V2V now relies on both parties getting communication right.”