For the life of me I will never understand the thought process that leads you to say "we don't really know who developed this LLM but I'm going to feed all of my business's data to it"
I mean sure there are investors and a little more open-ness, but with the example of Mythos we don't even know if public will get access to the "good" stuff because it's too dangerous.
If your only opinion on trusting these companies more than one based in China is, they are Chinese then good luck, all the best.
This isn't the case (yet).
Sure "China bad, US good" is naive, but certainly not more naive than suggesting that companies and individuals have similar rights and protections as each other.
> and they need US govt approval before model releases
This is just not true and it would be a gigantic legal battle to make it true against the model companies' wishes, which is indicative of your entire misunderstanding here.
So it may not be strictly true for the moment, but it is certainly something that the current US govt can mandate at any time.
1) Far from them actually trying to do it
2) Very, very far from them actually doing it successfully
The US government absolutely cannot "just tell" private entities what products they're allowed to create and sell, and the fact that LLMs are arguably a form of expression will make these particular products extremely hard to regulate – especially as a broad "government checkpoint" on incremental product updates.
In China, it really is as simple as the government deciding that it doesn't like your products and ta-da, you can no longer sell them.
It's beyond naive to act like these are similar in any meaningful sense.
The AI oligarchs have no loyalty and when it comes to making money and they will drop the king at their first opportunity and the king in return will do the same.
Your business data is probably worthless, even considered harmful for the pretrain corpus.
Your interactions and decision making process are most valuable parts of the whole business.
please tell me you are not in charge of the data of any business I'm a client of
Llm provider sells usage of their model. You use it to write code. Other clients use it to write code as well. If the llm provider trains with user data, then the usage benefits other users. If you pay the company to generate code,then by definition it is useful, and highly likely that other customers care about it.
Replace writing code with anything, a lawyer, a psychologist, a confessional. The IO is inherently useful to users of the same category.
That is to say nothing of adversarial use, that is, being useful because a counterparty might find it useful, so an attacker might find common code patterns, a lawyer might see what the opposition might be advised, a boy might see what a girl asks or gets advised, etc..
If this sounds too complex to you, just think of training on data as exfiltration with added steps, because that's what it is
In any case, relying on the chance that the LLM inference won't train on your data because of it's presumably low value is as good a strategy as crossing your fingers or venerating the god of rain. You should be relying on contractual clauses at least when including professional and client data.
What you need to know is who is the provider for the LLM, and whether their endpoints are zero data retention enabled and opted out of training. OpenRouter gives you an easy way to control this.
It's the same way we trust OpenAI to not train on our data if we've opted out although there is no control on whether they can retain the data indefinitely.
And even if they dont train on the data. Who guarantees us, they dont let another AI model analyse all the data, exfiltrating all kinds of intelligence and using it? I only can imagine what OpenAI and Anthropic know….
And just like that, I totally agree with you
There are several components of the Fair Use test, "transformation" is just one of them. The most important dimension is the effect on the market, i.e. the effect on incentives.
You probably shouldn't base your legal analysis on pithy internet comments regardless of how succinct or agreeable they are to you.
"Copyright violation" is what we call the set of things that destroy the incentive for people to create original work by unduly benefitting from someone else's original work.
Ask yourself
1. How would you know the provider has violated the contract?
2. How could you prove it?
3. Why would OpenRouter take your side in this (unlike your example with OpenAI, you're not a signing party)?
4. How would OpenRouter enforce the contract after all three above are somehow resolved in your favor?
IANAL, but IMO it's all a legal theater.
EDIT: formatting
Its of course highly dependant on the use case and the environment, but simply saying that the only important part is to know where the data goes is too simple.