ChatGPT reached 100 million users in January 2023, just two months after its release. That’s a record-breaking pace for an app. Numbers of this magnitude show the emergence of generative AI (AI that creates new content such as text, images, audio, and video). But with that comes new security and intellectual property (IP) issues that companies must address.
ChatGPT is used and abused by businesses and criminal gangs alike. This has security implications for your business, your employees, and the intellectual property you create, own, and protect.
How is ChatGPT used?
With over 100 million users, ChatGPT has many applications. However, there are many real world examples of how companies are leveraging this app. IT companies apply the app to software development, debugging, chatbots, data analysis, and more. Service companies are streamlining sales, improving customer service, and automating routine tasks. The government and public service sector see the benefits of drafting laws and bills and producing content in multiple languages. And countless people use this app as a personal productivity tool.
Of course, like all innovations, thieves find uses. Generative AI tools are used in phishing attempts, making them faster to execute, harder to detect, and more gullible. ChatGPT mimics real human conversations. That means the typos, weird phrasing, and bad grammar that often alert users to phishing scams could soon disappear. Luckily, criminals can use generative AI to cause trouble, but cybersecurity professionals can use his ChatGPT to combat crime.
Explore Watsonks
ChatGPT pitfalls and their impact on intellectual property
OpenAI, developer of ChatGPT, points out the dangers of generative AI apps. They state that “the output is sometimes inaccurate, untrue, and misleading” and, in their own words, the tool “hallucinates” or simply fabricates the output. It says that it is only Generative AI models improve by learning from increasingly large language datasets, but inaccuracies are still common. The output generated by the app requires human fact-checking and quality control before use or distribution.
These inaccuracies can complicate the Company’s intellectual property rights. Intellectual property rights fall into four main categories: patents, trademarks, copyrights and trade secrets. Anyone claiming intellectual property rights to something that is partially AI-generated must first verify its accuracy. To further complicate matters, one major problem with AI-generated IP remains unresolved: ownership.
Who owns the ChatGPT output? It’s complicated.
Subject to the current ChatGPT Terms of Service, where permitted by law, your input (prompts, questions, text, etc. that you enter when seeking output from the tool) is owned by you. Based on the input, the service will provide the output. Inputs and outputs are collectively referred to as “Content” in the Terms of Service. These Terms state that OpenAI assigns to you all right, title and interest in and to the Output.
However, OpenAI cannot assign rights to content that it did not originally own. The terms of use also state that the user is responsible for the content generated. This includes ensuring that you do not violate applicable laws or OpenAI’s Terms of Use. The term also notes that one user’s output can be exactly the same as another user’s output. For example, use the question “Why is the sky blue?” If two different users ask the same question, both outputs can be the same.
Many issues revolve around the intersection of AI and intellectual property. While some have been sentenced, others have not yet reached litigation and remain unresolved. Thaler v. Vidal ruled on patent issues in the United States In April 2023, the U.S. Supreme Court upheld a ruling that AI inventorship does not exist and that patents can only be obtained by humans. But Congress is currently considering the issue and is seeking guidance on how AI inventorship should be treated.
In March 2023, the U.S. Copyright Office issued guidance for copyright registration of works containing AI-generated material. When applying for copyright, the applicant must disclose whether the material contains AI-generated content. The guidance also states that applicants must account for human contributions to the work, and that sufficient human copyrights must be established to ensure copyright protection for that portion of the work. It is
What about user input? It’s complicated too.
AI language models use data to continuously improve the model. ChatGPT captures chat history data to help train models. Training that model can use user input. Entering confidential or proprietary information may expose the company’s intellectual property to theft or dissemination. Samsung discovered this the hard way when a Samsung engineer accidentally leaked internal source code during his upload to ChatGPT. In response, the company temporarily banned employees from using generative AI tools on company-owned devices.
Samsung is not alone. A data security service discovered and blocked requests to enter sensitive data into his ChatGPT from 4.2% of his client company’s 1.6 million employees. Inputs included client data, source code, and other proprietary and confidential information. An executive pasted a corporate strategy into an app and requested a PowerPoint deck. In another case, a doctor entered a patient’s name and condition into a model for reference when writing a letter to an insurance company. The concern is that this sensitive data may reappear as output in response to the appropriate query.
What can security teams do to protect IP?
Generative AI is a rapidly changing target. Care must be taken to keep employees and sensitive information safe. Review and update your security posture regularly. For now, here are some simple things you can do to protect your IP.
- Opt out of model training. Turn off chat history and model training in ChatGPT data control settings. OpenAI says in its terms of service that disabling it may limit the app’s functionality, but it may be a fair price to pay to keep your IP safe.
- Provide employee training. Communicate to staff how these models work and that their input may become public and harm the company, partners, customers, patients, or other employees. It also teaches staff how generative AI can improve phishing and vishing plans, increasing vigilance against these types of attacks.
- Please check the terms of use. ChatGPT’s Terms of Service will be updated as issues arise between users. Please check the terms of use for this and other generative AI tools frequently to ensure that you are protected.
- Follow relevant intellectual property legal procedures. Globally, there will be more laws and rulings on the intersection of intellectual property and generative AI. Corporate legal teams must follow court proceedings and keep security teams informed of how compliance with security guidelines and laws may be affected.
- Use the principle of least privilege. Give employees the minimum access and privileges they need to do their jobs. This can help reduce unauthorized access to information that can be shared with external AI tools.
The ease of ubiquity of generative AI has democratized and accelerated its adoption. This technology-driven trend will cause disruption. This raises the question of intellectual property protection. See how IBM can help you capitalize on the opportunities of generative AI while protecting against risks.
