Hacker News Reader

Hacker News

Comment by blibble | Hacker News Reader

Parent Full thread

blibble

> It's not like they can just execute a DELETE statement or do an entirely new training run.

if it costs them $10 million to remove my PII that's their problem

if they don't like it then they can stop operating it entirely

View on HN

> if it costs them $10 million to remove my PII that's their problem

It is an engineering problem and this is (largely) an engineering forum. Tomorrow solving this might be a part of your job as well, so idk why are you so dismissive.

It's a manufactured engineering problem. They created, collected, and processed data before thinking of the ethical and legal problems that may arise. Their lack of innovation to prevent this issue is why they now face a significant challenge in retroactively making their product ethical and legal.

I completely agree with the parent post, it's not my problem that their product was badly designed. If it takes them 10 million dollars to comply with the various data protection laws around the world, that's none of my concern.

What engineering problem isn't "manufactured"?

Hell, pii itself is manufactured. God damn houses! Builders never stopped to think someone I don't want to talk to could use my address to find me!

The house was manufactured according to the building and fire safety codes. You can't build a house and then go "well it's too expensive to comply with fire safety/building code and I only just found out about the concept of zoning laws, I'll try to do better next time". People will get mad and you may very well be forced to tear it back down or stop inhabiting it.

OpenAI either chose to have this problem or they're completely incompetent, and I doubt the latter is true. They knew damn well that they will encounter PII in their dataset and they knew damn well that there are laws surrounding that. The GDPR was well under way and in the news when their company formed, let alone when their various GPT models were finished, and 20 years before that there were already European privacy laws regarding data collection and other PII use.

They chose to train a huge model without implementing a safeguard against PII and now they'll have to live with the consequences. One of those consequences may be "their investment money is going down the drain in fines" or maybe even "their product is illegal across the EU and the EU still wants to see the money from those fines".

Yeah, but fire is a manufactured problem. Animals live quite well without fire. Build out of mud and don't use thatch.

Weird to see a Hacker News thread devolve into lightning denialism just to protect a private company's bad engineering.

You clearly understand nothing about building code. If you used mud to-spec, it is not flammable!

So if you were an engineer at OpenAI, how would you propose going about deleting data from a trained LLM that's already in use?

Remove it from the training set and train again. Don't do it per data erasure request, batch them and run it, say, every 30 days.

Large language models take months to train on thousands of GPUs (LLaMA trained for around 5 months on 2048 A100-80GB, consuming around 2,638 MWh), it's nowhere near viable to re-train them from scratch to remove some training data

that's fine

if their business model isn't compatible with the law then they can wind up the company and return the remaining capital to their investors

it's no different to companies complaining that the cost of legal disposal of toxic waste renders their business nonviable

And what about their competitors and the open source LLMs?

I'm pretty certain they're subject to the rule of law too

> it's nowhere near viable to re-train them from scratch to remove some training data

Tough. If their business is only viable by ignoring the law, they shouldn't be in business.

This is a boring attitude. Every problem is a manufactured problem, the only core problems we have are food and reproduction.

"Ethical and legal problems" are actually largely consumer's perspective problems and have little to do with actual ethics or legal precedents.

Welcome to the real world, where people leave their personal data all around the internet without any concern. This IS an engineering problem, just like implementing "the right to be forgotten" in a search engine is - it would likely only concern notable people anyway.

> it's not my problem that their product was badly designed. If it takes them 10 million dollars to comply with the various data protection laws around the world, that's none of my concern.

Well sure, from the consumerist standpoint, that is definitely not your problem. But if a consumer is all you amount to, then why even bother posting here? Karen rhetorics is lazy, tiresome for everyone around and brings nothing interesting to the discussion.

Chances are OpenAI will show the government investigating PII removal requests how "it would literally cost us 10M to honor every request immediately instead of removing it for the next training run in x months". I doubt a government will fine them / force them to withdraw business in that country once they understand the ramifications of PII removal requests in a modern LLM world, as long as they are eventually followed through.

I don't know about other laws, but GDPR does not say “immediately”, but “without undue delay”. In practice, it is within one month, extensible by up to two months (cf. art 12).

Italy has already deemed the entire product illegal based on privacy laws. I wouldn't be so sure about the government choosing not to fine them.

Any ramifications concerning the removal of PII is not the government's problem. If they can't use PII in a legal way, they shouldn't have collected it in the first place.

> Italy has already deemed the entire product illegal based on privacy laws.

Not exactly... in fact, to the point that you're just spreading misinformation.

They didn't "deem the entire product illegal" at any point, and after OpenAI initially responding to Italy's objections by removing access for all Italians, they have since (a week ago) re-opened to Italian users having taken steps they presumably believe are enough for Italy to be OK with them operating there again.

https://www.reuters.com/technology/chatgpt-is-available-agai...

I very much doubt this is the last we hear from EU countries with regard to OpenAI / other LLMs and GDPR... but that's not the same as claiming Italy have already ruled it to be totally illegal.

Italy has already reversed that decision, as OpenAI made the requested changes and is now in compliance.

It might be easier to delete all personal data indiscriminately than to process individual requests. A government might suggest that as a way to stay in compliance.

Reply on news.ycombinator.com