EFF: safety rules for AI labs should be grounded in proven practices

Amid the talk of "doomsday" scenarios involving artificial intelligence, lawmakers are paying ever closer attention to reports of hacks and leaks at leading American AI labs — in particular, the incident that tied OpenAI to Hugging Face, and the string of similar cases that came to light in its wake. The Electronic Frontier Foundation considers this concern justified, but it suggests lawmakers shift their focus: to regulate not the hypothetical threats of the future, but the immediate, already demonstrated risks behind the actual incidents.

Old truths instead of new fears

The foundation's central point is a simple one. A breakdown of the Hugging Face incident shows that it could have been prevented, or substantially mitigated, had the companies followed long-established cybersecurity rules — stricter isolation of environments and monitoring. In other words, new laws should not invent exotic requirements but close the gaps in existing law, keeping AI companies from taking undue risks with the safety of those around them.

The EFF proposes a concrete principle. If a developer or operator runs a test or a task with a high likelihood of harming third parties — one that involves hacking other people's computers, say — clear minimum safety requirements should apply. Such tests must be carried out in an isolated environment cut off from other systems, with mandatory logging and observation. By the foundation's estimate, adhering to these basic rules would have prevented or appreciably blunted every AI-lab incident known to date.

Tied to practices, not to technologies

The EFF separately warns against the temptation to write into law requirements tailored to today's technologies: they will quickly become obsolete. It is far more reliable to lean on established, experience-tested security protocols — they are more likely to stand the test of time and will not hold back the further development of AI.

Another of the foundation's proposals concerns transparency: the law should mandate and fund independent investigations of serious incidents that occur during the testing of new tools, and make the reports on such investigations public. This, in the EFF's view, would give society genuine oversight of the industry.

The foundation's overall conclusion is measured and practical: like any regulation of technology, cybersecurity rules for AI labs should be careful, precise and workable.

Source: EFF Deeplinks