For her safety, Doe has opted to receive alerts from the US Department of Justice Victim Notification System any time she may be a victim in a new criminal investigation. Although she has received countless alerts, she was shocked when the CCCP notified her that it had identified AI-generated CSAM on xAI that depicted her. This re-traumatized Doe, whose complaint alleged that messages were found on online forums “between offenders chatting about creating AI generated CSAM of Plaintiff and other similarly situated known, legacy, victims of CSAM.”
Now, Doe fears that xAI has not only made it easier to make more violative images of the most distressing time in her life, but also that xAI allegedly has stored the images that Grok generates and uses those outputs to further train Grok. Because of this, she believes that Grok has been trained on both the initial set of images that have haunted her for more than 20 years and the more recent AI-generated ones.
This is the first case to accuse xAI of training on CSAM, and the complaint does not go into great detail on that claim. Previously, Ars reported on a controversial dataset that was later scrubbed after researchers found CSAM in the training data, but there’s no indication xAI trained on that data. In a press release from lawyers representing Doe, it explained that Doe’s images were included in a CSAM Hash List maintained by NCMEC, and “that same material” allegedly “was part of the dataset xAI used to build Grok’s image and video generating capabilities.” The complaint similarly only alleged that “CSAM depicting Plaintiff with its longstanding well-known hash values has been used as a part of the dataset used by xAI.”
I think there’s no real change that needs to be made to the law. The images are stenographically embedded into these models. There exists some generic input data that results in the reproduction of the embedded data.
This is not really any different than a password protected zip file.
Well, like I said, that comes down to whether, legally, that stenographic embedding* would constitute “reproduction” or not. That’s what the German case hinges on. Obviously not relevant to US law, but a) a similar case could be made in the US, and b) X operates in the EU.
To play devil’s advocate, SpaceX would most certainly argue that what they’re doing is equivalent to storing a hash, like how Microsoft’s PhotoDNA system works. PhotoDNA can detect CSAM without storing CSAM because it only stores the image hashes, not the images themselves. So there’s pretty clear legal precedent for them to point to.
(NB: There has been work done by security researchers on reverse engineering images from hashes, so even that isn’t absolute.)
It’s a legally complex area where we’re likely to see case law evolving rapidly.
(ETA:) *Note that this is not actually the correct term for how the data is being stored. See discussion below. I just didn’t want to derail things by getting into it here.
You can’t reproduce an approximation from any type of hash, so that argument is dead in the water.
Do you understand what I mean by stenographically embedded?
https://www.pseudodna.eu/. Scroll down to “Hash reversal” where they demonstrate the technique.
I took it to be an imperfect attempt to describe more broadly the way that data is mathematically encoded into LLMs.
Technically, stenography would require that the original be retrievable, since stenographic embedding is the process of concealing one thing inside another. Stenos, from the Greek “covered”. Personally, I’d argue that to conceal, you have to be able to reveal. If I throw a photograph into a fire I haven’t hidden the image in the fire. Modern stenographic image embedding techniques use methods of encoding data into another dataset without visibly altering the second set, with the intent being that that data can later be retrieved by someone who knows that it’s there (eg, least significant bit, where you change only the “1” bit of each pixel. This imperceptibly shifts the colour values of the image to a human viewer, but allows you to read out that stored data at a later time).
Now, since your argument rests on the exact opposite, that the data is not retrievable, I simply accepted the term as a “close enough” approximation for what I believe we’re both talking about - the extremely complex multidimensional data arrangement that forms the core of an LLM - and carried on from there because I find that sometimes it’s better to just roll with a person’s choice of language rather than quibble over it.
But since you clearly feel that your meaning was either improperly expressed, or improperly understood, you’re welcome to elaborate.
Wow they fucked that up so badly.
My understanding of hashing is a math function that reduces information.
The models and apparently that piece of software have retrievable information, so using that software to generate these images should count as reproduction under existing law.
Close, but not quite. A hash is better understood as a “fingerprint” for a given piece of data. Any given input will produce the same length of output, so it doesn’t really “reduce” information - a hash of “Hello world” would actually be significantly longer - but rather it identifies a matching piece of data.
This has a number of uses. For example,if you have a password system on a website, you don’t store a user’s actual password. That would be terrible for security. Instead you store the hash (yes, salted, for that one pedant who was about to interject). Then when the user enters their password to log in, you hash the entered password and compare it to the stored hash. If they match, you know they’re the same string. You can also create a hash of a file and provide that along with the file itself. If the receiver also hashes the file, they can then compare their hash to yours; if they don’t match, the file is corrupt or has been tampered with. You’ll often see this referred to as a checksum.
Technically, the reproducible data from a hash should be zero, so they don’t so much contain information as verify it. But as we’ve seen from that research, there are ways around that (not the only ones, to be sure). But the idea in theory is that you produce a hash through a one-directional algorithm; very easy to compute A from B, but very, very hard to compute B from A.
It should be noted that this is very different from stenography, which is a variety of systems for storing data, not fingerprinting it. Hashing is also distinct from encryption as a means of securing data, because encryption is intended to be reversible, hashing is not.
I’ve seen and used fixed length output on hashes, I assumed that is more common than variable length output.
I would not trust variable length output, and it looks like they screwed up their math enough that the function is reversible.