8 ms·
A major AI training data set contains millions of examples of personal data
- kristianp 1y agohttps://archive.is/k7DY3 https://archive.is/k7DY3
- busssard 1y ago[flagged]
- cheschire 1y agoI hope future functionality of haveibeenpwned includes a tool to search LLM models and training data for PII based on the collected and hashed results of this sort of research.
- pera 1y agoYesterday I asked if there is any LLM provider that is GDPR compliant: at the moment I believe the answer is no. https://news.ycombinator.com/item?id=44716006 https://news.ycombinator.com/item?id=44716006
- tonyhart7 1y agoso your best bet is open weight LLM then??? but its that a breach of GDPR???
- atoav 1y agoOnly if it contains personal data you collected without explicit consent ("explicit" here means litrrally asking: "I want to use this data for that purpose, do you allow this? Y/N"). Also people who have given their consent before need to be able to revoke it at any point.
- tonyhart7 1y agoso EU basically locked itself from AI space???? idk but how can we do that with GDPR compliance etc???
- croes 1y agoSo basically EU citizens could sue all AI providers
- galangalalgol 1y agoI don't think they have to? The bodies in charge can simply levy the fine for 4% I think. The weird case is if all the companies self hosting open weight models become liable as data controllers and processors. If that was aggressively penalized they could kill AI use within the EU and depending on the math, such companies might choose to pull operations from the EU instead of giving up use of AI. Edit: that last bit is probably catastrophic thinking. Enforcement has always been precisely enough to cause compliance vs withdrawal from the market.
- croes 1y agoI don‘t think killing the us is the only thing that could happen. You can’t steal something and avoid punishment just because you don’t sell in the country where the theft happened.
- galangalalgol 1y agoYou absolutely can depending on the countries involved. A recent extreme example is hackers in NK stealing cryptocurrency. A more regular one is Chinese manufacturers stealing designs. If the countries where the theives live and operate won't prosecute them there is no recourse. The question for multinationals is if continuing to operate in the EU is worth giving up their models, and if the countries they are headquartered in care or can be made to.
- thrance 1y agoMistral's products are supposed to be at least, since they are based in the EU.
- pera 1y agoI am not sure if Mistral is: if you go to their GDPR page (https://help.mistral.ai/en/articles/347639-how-can-i-exercise-my-gdpr-rights https://help.mistral.ai/en/articles/347639-how-can-i-exercis...) and then to the erasure request section they just link to a "How can I delete my account?" page. Unfortunately they don't provide information regarding their training sets (https://help.mistral.ai/en/articles/347390-does-mistral-ai-communicate-on-the-training-datasets https://help.mistral.ai/en/articles/347390-does-mistral-ai-c...) but I think it's safe to assume it includes DataComp CommonPool.
- GardenLetter27 1y agoThis just demonstrates how bad the GDPR is rather than the LLMs though. China must be laughing.
- wilg 1y agoGDPR has plenty of language related to reasonability, cost, feasibility, and technical state of the art that probably means LLM providers do not have to comply in the same way, say, a social platform might.
- itsalotoffun 1y agoI WISH this mattered. I wish data breaches actually carried consequences. I wish people cared about this. But people don't care. Right up until you're targeted for ID theft, fraud or whatever else. But by then the causality feels so diluted that it's "just one of those things" that happens randomly to good people, and there's "nothing you can do". Horseshit.
- atoav 1y agoIt doesn't now, but we could collectively decide to introduce consequences of the kind that deter anybody willing to try this again.
- jelvibe25 1y agoWhat's the right consequence in your opinion?
- passwordoops 1y agoCriminal liability with a minimum 2 years served for executives and fines amounting to 110% of total global revenue to the company that allowed the breach would see cybersecurity taken a lot more seriously in a hurry
- lifestyleguru 1y agoWould be nice to have executives finally responsible for something.
- bearl 1y agoInternet commerce requires databases with pii that will be breached. Who is to blame for internet commerce? Our legislators. Maybe specifically we can blame Al Gore, the man who invented the internet. If we had put warning labels on the internet like we did with NWA and 2 live crew, Gore’s second best achievement, we wouldn’t be a failed democracy right now.
- deleted 1y ago[deleted]
- imglorp 1y agoReader mode works on this site.
- satvikpendem 1y agoThis is all public data. People should not be putting personal data on public image hosts and sites like LinkedIn if they did not want them to be scraped. There is nothing private about the internet and I wish people understood that.
- malfist 1y agoWhat's important is that we blame the victims instead of the corporations that are abusing people's trust. The victims should have known better than to trust corporations
- blitzar 1y ago> blame the victims If you post something publicly you cant be complaining that it is public.
- lewhoo 1y agoBut I can complain about what happens to said something. If my blog photo becomes deep fake porn am I allowed to complain or not ? What we have is an entirely novel situation (with ai) worth at least a serious discussion.
- blitzar 1y ago> But I can complain about what happens to said something no. > but ... no.
- YetAnotherNick 1y ago> If my blog photo becomes deep fake porn Depends. In most cases, this thing is forbidden by law and you can claim actual damages.
- kldg 1y agoThat's helpful if they live in the same country, can figure out who the 4chan poster was, the police are interested (or you want to risk paying a lawyer), you're willing to sink the time pursuing such action (and if criminal, risk adversarial LEO interaction), and are satisfied knowing hundreds of others may be doing the same and won't be deterred. Of course, friends and co-workers are too close to you to post publicly when they generate it. Thankfully, the Taylor Swift laws in the US have stopped generation of nonconsensual imagery and video of its namesake (it hasn't). Daughter's school posted pictures of her online without an opt-out, but she's also on Facebook from family members and it's just kind of... well beyond the point of trying to suppress. Probably just best to accept people can imagine you naked, at any age, doing any thing. What's your neighbor doing with the images saved from his Ring camera pointed at the sidewalk? :shrug:
- djoldman 1y agoJust to be clear, as with LAION, the data set doesn't contain personal data. It contains links to personal data. The title is like saying that sending a magnet link to a copyrighted torrent file is distributing copyright material. Folks can argue if that's true but the discussion should at least be transparent.
- deleted 1y ago[deleted]
- yorwba 1y agoI think the data set is generally considered to consist of the images, not the list of links for downloading the images. That the data set aggregator doesn't directly host the images themselves matters when you want to issue a takedown (targeting the original image host might be more effective) but for the question "Does that mean a model was trained on my images?" it's immaterial.
- ryanjshaw 1y agoIt does matter? When implemented as a reference, the image can be taken down and will no longer be included in training sets*. As a copy, the image is eternal. What’s the alternative? * Assuming the users regularly check the images are still being hosted (probably something that should be regulated)
- djoldman 1y agoThe data set is a list of ("descriptive text", URL) tuples. As with almost any URL, it is not in and of itself an image. As an aside, this presents a problem for researchers because the links can resolve to different resources, or no resource at all, depending on when they are accessed. Therefore this is not a static dataset on which a machine learning model can be trained in a guaranteed reproducible fashion.
- pera 1y agoI think you may be missing the point: The title says "AI training data set", which is the result of downloading the linked images. The list of tuples is just how this training dataset is distributed. The issue in question is that many/most large generative AI models were trained with personal data.
- 1vuio0pswjnm7 1y agoarchive.is is (a) sometimes blocked, (b) serves CAPTCHAs in some instances and (c) includes a tracking pixel One alternative to archive.is for this website is to disable Javascript and CSS Another alternative is the website's RSS feed Works anywhere without CSS or Javascript, without CAPTCHAs, without tracking pixel For example, curl https://web.archive.org/web/20250721104402if_/https://www.technologyreview.com/feed/ |(echo "<meta charset=utf-8>";grep -E "<pubDate>|<p>|<div") > 1.htm firefox ./1.htm To retrieve only the entry about DataComp CommonPool, curl https://web.archive.org/web/20250721104402if_/https://www.technologyreview.com/feed/ |sed -n '/./{/>1120522</post-id>/,/>1120466</post-id>/p;}' |(echo "<meta charset=utf-8>";grep -E "<pubDate>|<p>|<div") > 1.htm firefox ./1.htm
- 1vuio0pswjnm7 1y agoIf using a text-only browser that does not process CSS or run Javascript, 100% of the article is displayed
- Jana22 1y ago[flagged]
- Lavia21 1y ago[dead]
- homercsmith3 1y ago[dead]