The Infocomm Media Development Authority (IMDA) and Aicadium published “Generative AI: Implications for Trust and Governance” on 7 June 2023, a discussion paper outlining issues which ought to be consider as Singapore moves towards possible greater adoption of generative Artificial Intelligence (Generative AI) in society. As organisations continue to consider and adopt Generative AI technologies in the course of their activities, the paper advocated for discourse and global co-operation to ensure safe and responsible use of Generative AI. IMDA’s paper was published in conjunction with the official launch of the AI Verify Foundation, a subsidiary of IMDA.

What is Generative AI?

Generative AI refers to AI models that are able to learn from underlying data, and generate new content through data (e.g. new content, literature, audios and videos) provided by a user. The most prolific example of such an AI model would be ChatGPT. Generative AI has demonstrated itself to be able to address several use cases that may significantly impact our daily lives.

Risks of Generative AI

The discussion paper outlined six key risks associated with Generative AI, to serve as a useful map for organisations, policymakers and users to consider:

1. Generative AI often make false or erroneous responses. The knowledge base of Generative AI is limited by the datasets upon which such AI models were trained. When presented with novel questions or scenarios, they are forced to make educated guesses based on that dataset, which could lead to erroneous responses known as “hallucinations” or “confabulations”. Uninitiated users may be misguided by such responses. This may pose significant risk if a user relies on erroneous responses (e.g. legal submissions) generated by the AI model.
2. Generative AIs are capable of “memorising” data, posing a threat to privacy, security and intellectual property (IP). Researchers note that Generative AI tend to retain names and numbers for long periods of time. Unintentional memorisation poses serious risks to privacy, especially if AI models “memorise” personal data like medical records, or confidential information belonging to an organisation. If a user were to insert prompts to the AI model that include confidential information, that confidential information will now be out in the wild.
3. Malicious activities can be significantly enhanced using Generative AI. Disinformation can be spread more quickly and convincingly through AI-generated articles and images, making impersonation and reputational attacks much easier to conduct. Additionally, anyone may be able to use Generative AI to conduct malicious activities like generating malware or instigating Distributed Denial-of Service attacks.
4. Debatable as to whether existing intellectual property infrastructures can address the issues associated with the content created by Generative AI. Generative AI themselves are capable of explicitly replicating the style and expression of creators with little effort from the human user. Accordingly, AI development has made forgery, false attribution, and copyright infringement much harder to combat. Additionally, there is the question of whether a system can be considered as being the author of a work (at law) and who should own the intellectual property associated with AI created original works.
5. Generative AIs retain inherent biases that may persist in applications that build upon them. Where the datasets upon which Generative AI are not curated, human biases would likely be introduced into the system. Such images or text generated by AI could enforce gender, racial, or national stereotypes. For example, Stable Diffusion provided images of men when prompted to generate images of a “doctor”, while a prompt for “nurse” generated images of women. These biases could act to further marginalise minorities and underprivileged groups, especially if similar AI are utilised in government institutions. Even where datasets are curated, the biases of the party curating the datasets would / could seep into responses provided by Generative AI.
6. AIs often disregard human values and goals to achieve their given objective. Instructing AI requires a significant amount of precision to perform as intended. Objectives are often given with the assumption that it would perform like how a human might. As AI models do not follow conventional human logic, they may sacrifice common sense in favour of blindly achieving their objectives, leading to potentially harmful outcomes.

Key takeaways

It is clear from the discussion paper that there are several emerging issues associated with the adoption of Generative AI. In Singapore, there is no specific omnibus AI law to govern the use of Generative AI. However, there are several key issues that are pertinent to consider under existing laws:

1. Data protection: Singapore’s Personal Data Protection Act (PDPA) requires companies to delete personal data as part of their retention limitation obligations. This presents unique challenges for businesses hoping to use AI to manage personnel or customer records.
2. IP issues: IP issues permeate throughout the entire life cycle of the use of the IP system. If a business user were to provide critical IP assets as prompts to an AI model, there may be difficulties associating with the extent of derivative IP assets that may be used by the AI system.
3. Confidentiality: There is a risk that business user may provide confidential information to the AI Model. Once the AI Model has learned such confidential information, there is a risk that the same information may be made available to the world at large (including an organisation’s competitors).
4. Attribution of liability: Organisations will need to assess what happens when business users were to rely erroneously on the output generated by the AI Models.

Generative AI may address many use cases and there may be tremendous benefits to be had through the use of Generative AI. Organisations may unlock many opportunities with Generative AI. However, given the uncertainties and pitfalls outlined above, it will do well for organisations to put in place an AI Policy to serve as guardrails for business users before allowing the AI models to be operationalised.