6 ms·

There is a legitimate question here. A lot of comments are trashing this post because his/her name is already all over the internet. But European laws have the

There is a legitimate question here. A lot of comments are trashing this post because his/her name is already all over the internet. But European laws have the 'right to be forgotten'. Aka you can write to Google and have your personal information removed, should you so wish. How might we address this with a GPT3 like model?

yreg 4y ago
GDPR is rather vague and perhaps it might be an intended feature. They could: 1. Set up a content filter that filters op's name from the output. OpenAI would still need to keep record of the name, exposing it to leaks. 2. Remove the name from the dataset and retrain the model, which is obviously infeasible with each GDPR request. I expect there are other instances where it is impractical or impossible to completely forget someone's data upon a request. Does Google send people spelunking into cold storage archives and actually destroy tapes (while migrating the data that is not supposed to be erased) every time they receive a request?
- jesboat 4y ago
  Most likely, they don't keep any backups with user data longer than a short threshold, e.g 60 days. This is pretty common practice.
- diamondage 4y ago
  "obviously infeasible" is the interesting part. A) the law doesn't care if its infeasible or not. If someone actually challenges GPT3 on this, and GPT3 loses, then these kind of models are obliged to find a way to comply with the law, or stop what they are doing - technical difficulty is not much of a defense. Also B) I think that there is probably a way to do this with either clever training data or algorithmics, which doesn't require retraining of the whole model. We need a precise theory to explain what these models are actually doing anyway. There are so many applications where we need more than a vague or probabilistic response.
  - yreg 4y ago
    >the law doesn't care if its infeasible or not. Sure, option 3 is to stop offering the products. But simplistically, I expect companies to obey these laws when it is feasible. I'm not surprised that they shrug it over when they have no idea what to do. As you say, when (or if) it comes to a trial, the interpretation of the law for this particular case will be clarified. I think part of the reason why lawmakers made GDPR so vague was to not outright ban things which didn't even cross their minds (like GPT models), but instead let a court evaluate these cases in context down the line. Of course it's not the best situation, especially for small businesses which cannot risk working on a product that might or might not be illegal.
remram 4y ago
I feel like if OP had actually made an effort to hide this information from search engines and GPT-3 remained the last place from which it was available, this point would be a lot more compelling. Right now it's a "everybody has my name and that's fine, but that includes GPT-3 and that makes GPT-3 bad". I would expect that it would take considerable effort to get this information removed from Google (you would have to write to them with a request under GDPR or similar and have them add a content filter) and I don't see why the same effort wouldn't allow you to get removed from GPT-3 (which is only accessible via a web API, so a similar filter could be added).
nonameiguess 4y ago
There are two things you can do in cases like this. The first is asking a website owner to delete data they collected on you. That doesn't really apply here. The places this person's name is published are his own website that has this username as its url, his own Github repos, and published papers of his that were also on his website. No GDPR request is necessary to remove his name from these places because he already owns that data. As seen, he has already started to delete it himself. The second is asking search engines to delist a result. As far as I understand, this usually has to involve information that is otherwise meant to be scrubbed from public record, like a newspaper article about a conviction that was eventually sealed. You can't ask Google to not index a scientific journal you published to or your public Github repos. There are, of course, limits to this thanks to public interest exceptions. I don't believe Prince Andrew can ask Google to de-index anything associating him with Jeffrey Epstein. The public has a right to know, too. In this guy's case, he really seems to be straddling a line. He contributed to open source projects under his real name linking to a Github repo with the same username he seems to reuse everywhere, including here, and also has a website where the url is that username, and it contained his CV with his real name on it along with a publication history with every publication using his real name. Is it reasonable to do those things and then ask Google and OpenAI not to associate the username with your real name? At what point are you some regular Joe with a real grievance and at what point are you Ian Murdock complaining that GPT knows you're the Ian associated with debian?
cortesoft 4y ago
I can never understand the ‘right to be forgotten’. How does that not conflict with another right, my ‘right to remember’?
- jkrems 4y ago
  Because people generally have elevated rights when it concerns themselves? E.g. I have the right not to be touched and it will (generally) outrank your right to touch me.
  - cortesoft 4y ago
    Touching is very different than remembering... remembering is in my own thoughts, and no one else has rights to that.
- hobofan 4y ago
  It doesn't. It concerns companies and not you as a person. You can remember whatever you want. Companies are not allowed to do that anymore, as they've repeatedly shown that if they remember your data forever they (intentionally or not) do bad things with them.
  - cortesoft 4y ago
    Ok, but am I, as an individual, allowed to store information myself? Could I build a personal search engine that does what Google does, and index everything on the internet? Would I be forced to delete things from my personal search engine if someone wants me to forget? I can't imagine you think someone has the right to tell me to delete something from my own computer in my own house. If you allow that, do I not have the right to share that information with my friends? Strangers? If I can do that as an individual, why does it change if I group together with other individuals and form a company?
    - xdrosenheim 4y ago
      Take this with a bit of salt, as I can not seem to find it anymore, but.... I recall having read something in relation to the GDPR passing, that not even an individual is allowed to hold personal information on someone else, even if it is just through "contacts" on your phone (With permission, you can of course).

yreg 4y ago

GDPR is rather vague and perhaps it might be an intended feature. They could: 1. Set up a content filter that filters op's name from the output. OpenAI would still need to keep record of the name, exposing it to leaks. 2. Remove the name from the dataset and retrain the model, which is obviously infeasible with each GDPR request. I expect there are other instances where it is impractical or impossible to completely forget someone's data upon a request. Does Google send people spelunking into cold storage archives and actually destroy tapes (while migrating the data that is not supposed to be erased) every time they receive a request?

jesboat 4y ago
Most likely, they don't keep any backups with user data longer than a short threshold, e.g 60 days. This is pretty common practice.
diamondage 4y ago
"obviously infeasible" is the interesting part. A) the law doesn't care if its infeasible or not. If someone actually challenges GPT3 on this, and GPT3 loses, then these kind of models are obliged to find a way to comply with the law, or stop what they are doing - technical difficulty is not much of a defense. Also B) I think that there is probably a way to do this with either clever training data or algorithmics, which doesn't require retraining of the whole model. We need a precise theory to explain what these models are actually doing anyway. There are so many applications where we need more than a vague or probabilistic response.
- yreg 4y ago
  >the law doesn't care if its infeasible or not. Sure, option 3 is to stop offering the products. But simplistically, I expect companies to obey these laws when it is feasible. I'm not surprised that they shrug it over when they have no idea what to do. As you say, when (or if) it comes to a trial, the interpretation of the law for this particular case will be clarified. I think part of the reason why lawmakers made GDPR so vague was to not outright ban things which didn't even cross their minds (like GPT models), but instead let a court evaluate these cases in context down the line. Of course it's not the best situation, especially for small businesses which cannot risk working on a product that might or might not be illegal.

remram 4y ago

I feel like if OP had actually made an effort to hide this information from search engines and GPT-3 remained the last place from which it was available, this point would be a lot more compelling. Right now it's a "everybody has my name and that's fine, but that includes GPT-3 and that makes GPT-3 bad". I would expect that it would take considerable effort to get this information removed from Google (you would have to write to them with a request under GDPR or similar and have them add a content filter) and I don't see why the same effort wouldn't allow you to get removed from GPT-3 (which is only accessible via a web API, so a similar filter could be added).

nonameiguess 4y ago

There are two things you can do in cases like this. The first is asking a website owner to delete data they collected on you. That doesn't really apply here. The places this person's name is published are his own website that has this username as its url, his own Github repos, and published papers of his that were also on his website. No GDPR request is necessary to remove his name from these places because he already owns that data. As seen, he has already started to delete it himself. The second is asking search engines to delist a result. As far as I understand, this usually has to involve information that is otherwise meant to be scrubbed from public record, like a newspaper article about a conviction that was eventually sealed. You can't ask Google to not index a scientific journal you published to or your public Github repos. There are, of course, limits to this thanks to public interest exceptions. I don't believe Prince Andrew can ask Google to de-index anything associating him with Jeffrey Epstein. The public has a right to know, too. In this guy's case, he really seems to be straddling a line. He contributed to open source projects under his real name linking to a Github repo with the same username he seems to reuse everywhere, including here, and also has a website where the url is that username, and it contained his CV with his real name on it along with a publication history with every publication using his real name. Is it reasonable to do those things and then ask Google and OpenAI not to associate the username with your real name? At what point are you some regular Joe with a real grievance and at what point are you Ian Murdock complaining that GPT knows you're the Ian associated with debian?

cortesoft 4y ago

I can never understand the ‘right to be forgotten’. How does that not conflict with another right, my ‘right to remember’?

jkrems 4y ago
Because people generally have elevated rights when it concerns themselves? E.g. I have the right not to be touched and it will (generally) outrank your right to touch me.
- cortesoft 4y ago
  Touching is very different than remembering... remembering is in my own thoughts, and no one else has rights to that.
hobofan 4y ago
It doesn't. It concerns companies and not you as a person. You can remember whatever you want. Companies are not allowed to do that anymore, as they've repeatedly shown that if they remember your data forever they (intentionally or not) do bad things with them.
- cortesoft 4y ago
  Ok, but am I, as an individual, allowed to store information myself? Could I build a personal search engine that does what Google does, and index everything on the internet? Would I be forced to delete things from my personal search engine if someone wants me to forget? I can't imagine you think someone has the right to tell me to delete something from my own computer in my own house. If you allow that, do I not have the right to share that information with my friends? Strangers? If I can do that as an individual, why does it change if I group together with other individuals and form a company?
  - xdrosenheim 4y ago
    Take this with a bit of salt, as I can not seem to find it anymore, but.... I recall having read something in relation to the GDPR passing, that not even an individual is allowed to hold personal information on someone else, even if it is just through "contacts" on your phone (With permission, you can of course).