OpenAI模型越狱与数据抓取争议及监管反思

This article was featured in the Daily Prospect newsletter. Sign up for it here.

One of the signature public service announcements of my youth was created by the Partnership for a Drug-Free America in 1987. A father finds a stash of pot and confronts his son: “Who taught you how to do this stuff?”

“You, all right!” the kid snaps back. “I learned it by watching you!”

I am bound by the AP Stylebook to not anthropomorphize artificial intelligence. But I can imagine these very words being uttered by the agents that hacked Hugging Face, or the models that engaged in tens of thousands of incidents of, in the new euphemism of the time, “misalignment.” This refers to AI stepping beyond guardrails set up by researchers during both internal and real-world testing.

More from David Dayen

The incidents are multi-varied, but they generally involve OpenAI models seeking and obtaining information, either on the open web or inside databases of other companies. Agents tried to overwhelm the U.N.’s website when they couldn’t immediately gain access to the information they sought, infiltrated a website of the Australian government, and tried to hack the Department of Education’s website, unsuccessfully.

OpenAI self-disclosed the lion’s share of these incidents, though not the Department of Education hack, and has paused training until … it’s not clear. I would presume until the bad publicity blows over.

Why is this happening over and over? Why are these models going to unethical or even illegal lengths to scrape and steal data?

“I learned it by watching you!”

OpenAI models attack websites and take anything they can out of them because that is the business model of the company.

A legal filing submitted by The New York Times and 11 other publishers a couple of weeks ago in a copyright infringement case against OpenAI got scant attention, quite incredibly considering it involved the paper of record. But it stunningly details what was described by the director of applied science at Microsoft, another defendant in the case, as the “largest theft of labor in human history.”

Microsoft and OpenAI, in their efforts to train new models on virtually all of the world’s available information, have routinely taken millions of stories from the websites of the Times, among other publishers. The defendants say this is a simple application of fair use: Their argument is that if you read a story and simply remember what was in it to expand your base of knowledge, that cannot be considered a copyright infringement. But OpenAI did not pay to subvert the paywall of the Times, at which point their data-scraping operation might be more easily detected. Instead, they developed a way to circumvent the paywall and avoid detection. And when Greg Brockman, OpenAI’s co-founder and president, was told about this maneuver, he replied, “ah nice.”

We do not have to get too deep into the nature-vs.-nurture argument to suspect that OpenAI executives’ cavalier attitude regarding the taking of information that is not theirs has filtered down to their researchers and the products they create. You don’t have to stretch to paint this picture: OpenAI models are attacking websites and taking anything they can out of them because that is the business model of the company.

Respect for the law could literally be written into the source code of a model: If OpenAI is aggressively downloading data from everywhere, the least they could do is drop in the U.S. Code (particularly the section tied to the Computer Fraud and Abuse Act) and train the model not to violate it. Clearly this is not a priority, and that aligns, in a manner of speaking, with OpenAI’s personal behavior. This is not a situation where AI models evade or escape the control of their creators. It seems more like they are just mimicking the creators, becoming adept at finding the same shortcuts and using the same rationalizations to justify them.

The aforementioned Brockman is one of the biggest donors to MAGA Inc., the Trump super PAC. Among OpenAI’s biggest investors is Jared Kushner’s brother. So at a practical level, I fully understand why FBI agents didn’t arrive at the San Francisco offices Monday morning. But as an objective matter, it does not make sense why Sam Altman and the top brass in the C-suite are free men today.

It has now become almost a cliché that there is no AI exemption to the law. Breaking into websites and stealing material violates that law. Jensen Huang, the Nvidia CEO who is incentivized more than anyone in the country to keep accelerating AI development, said last week that misaligned models shouldn’t be shipped, and that if unreleased products are showing this rogue behavior, then “we have to shut the labs down.”

Huang, who manifestly does not want to shoot a bullet through his own company by shutting the labs down, has unveiled a new tool that will absolutely, definitely keep the models from hacking and stealing. Whatever keeps the $150 billion in disgorged cash flowing to investors, I guess.

“Ah nice.”

Greg Brockman, OpenAI’s co-founder and president, when told of circumventing the new york times’ paywall

The simple version of actually shutting down the labs would not be a self-regulatory software fix but the product recall. In the 1970s, the Ford Pinto had a flaw in its fuel tank that would cause the cars to burst into flames when struck from behind, even at low speeds. The National Highway Traffic Safety Administration later found that 27 people died in fiery crashes as a result. As Mother Jones reported, internal memos showed that executives were aware of the flaw but decided that it would be more cost-effective to pay out personal damages than fix the part.

By 1978, the NHTSA took 1.5 million Pintos off the road. That fits with a simple proposition that products which cause harm are not allowed to remain on the market. A recall goes further than a self-assessment by OpenAI to pause or slow down development; I don’t really know why they would be trusted to determine when the models are safe, since they share the same tendencies to hack and scrape and extract data.

Since the federal government is deeply corrupted, we have to rely on—get this—Florida, whose attorney general James Uthmeier filed for an emergency injunction against OpenAI, on the grounds that they cannot control their own products.

But there is another option, again reflected in a more obscure development in the Ford Pinto scandal. In 1980, a grand jury in Elkhart, Indiana, presented an indictment against Ford Motor Company for homicide over the deaths of three women, the first time a company was accused of such a crime. The county prosecutor in Elkhart had to rely on volunteers to mount the case against what was then one of the nation’s largest companies, and Ford won the case. But a more robust effort with more equitable firepower on the prosecutorial side could yield different results.

That kind of liability for those responsible seems a million miles away at this point. This entire millennium to date has been typified by a lack of accountability. Contrary to an annoying article from Jonathan Chait that is not worth linking to, I am not opposed to AI regulation. I think we should regulate theft, regulate deception, regulate abuse, regulate unfairness. Fortunately, we have the ability to do that right now, with existing laws that cover artificial intelligence as surely as they cover any other human activity. The fact that we cannot conceive of such accountability, and think that new rules with new standards will do the job that existing rules are manifestly failing to do, suggests that the real problem hasn’t been addressed.