The linked list includes a long-time sponsor of NeurIPS, Huawei!

[Though technically Huawei is “sanctioned” under an EO and is not on the SDN list, so there are fewer restrictions on US entities/persons dealing with Huawei. NeurIPS has since clarified that they only apply this policy to SDN sanctioned individuals/entities only, which makes sense.]

But apparently this policy is also not new. Here’s a post from Russian researchers receiving a desk reject due to the same policy last year.

The more recent bans have sparked outrage on X, with many researchers refusing to review or AC for the conference. And NeurIPS noted that it is a legal requirement, not a choice on their part, and it is currently getting legal advice on the matter.

A few folks have been asking how is this possible in the United States given the First Amendment? Is peer review a “service” the government can prohibit? Or is it a First Amendment-protected activity?

As usual when my AI and law worlds collide, the answer is more complicated than either side seems to think. (Though, again, this isn’t legal advice, just a legal academic take and some general background.)

tldr; If NeurIPS decided to NOT have this policy and the government decided to enforce it, it’s a sufficiently grey area issue that I think we could see a case like NeurIPS v. US Treasury at the Supreme Court!

The case for protection

There’s certainly a case to be made, where NeurIPS could potentially argue that review/publishing would receive First Amendment protections. Just last year, in Foundation for Global Political Exchange v. Treasury (settled Nov. 2024) a similar issue came up.

The [Foundation for Global Political Exchange] is a U.S. non-profit organization that promotes professional and academic enrichment through convenings in the Middle East and North Africa called “Exchanges.” Each Exchange involves small-group, immersive dialogues that allow participants—including journalists, human rights advocates, and government officials—to engage with and question thirty to forty of the key stakeholders from across the political landscape of a subject country. In advance of the Foundation’s January 2023 Beirut Exchange, OFAC informed the Foundation that it could not lawfully include in these discussions five prominent political figures who were designated under a U.S. sanctions regime or were members of a designated organization.

OFAC reversed course after the Knight First Amendment Institute sued, conceding through a settlement that including sanctioned individuals as conference speakers was not a prohibited “service” — so long as no financial transactions, lodging, or other things of value were provided.

The Berman Amendment (1988) and the Free Trade in Ideas Act (1994) explicitly exempt “information and informational materials, including but not limited to, publications” from the President’s sanctions authority under IEEPA. When OFAC tried to regulate scholarly editing in the early 2000s, IEEE and others pushed back. OFAC backed down in 2004, confirming that peer review and copy editing were permissible.

More generally, Lamont v. Postmaster General (1965) established that U.S. citizens have a First Amendment right to receive speech from abroad — in that case, communist magazines from China. Brennan’s concurrence called the right to receive publications “a fundamental right.” Miami Herald v. Tornillo (1974) held that editorial decisions about what to publish are exercises of protected editorial judgment. Peer review is the academic analog.

But national security caselaw cuts the other way

Unfortunately for First Amendment fans, courts have built a body of doctrine that defers heavily to the government when it invokes national security, even when the regulated activity is speech or expressive.

The big one is Holder v. Humanitarian Law Project (2010). The Supreme Court upheld 6-3 the ban on providing “material support” to designated foreign terrorist organizations — including “training,” “expert advice,” and “service” — even when directed at teaching nonviolent conflict resolution. The Court deferred to Congress’s finding that even peaceful support “frees up resources” for illicit activities.

For more on the history of OFAC and scholarly publishing, see the Knight Institute’s analysis of the material support law’s chilling effect, and this NYU Law Review note on how OFAC’s regulations restrain First Amendment rights. But Holder has broadly created problems since 2010 like this. And it is very possible that it could be used as precedent against NeurIPS in this case.

Two things I think the community is missing

Scope. There seems to be a misunderstanding about who this applies to. The OFAC SDN list targets specific institutions, not entire countries. This likely affects a few entities on the list, many (most?) of which are unlikely to submit to NeurIPS. It does not cover all researchers from any particular country. Chinese universities are generally on BIS export control lists, not OFAC sanctions, and the legal frameworks are distinct.

The speech/services line. This is what I find most interesting. Clearly, conference organizers received legal advice that there’s a fine line and they might be providing services.

The GPE settlement does draw a line saying speech-related activities are permissible, but it’s unclear at what point that crosses into services that are sanctionable. Even in the GPE settlement letter, OFAC wrote:

If NeurIPS only published papers, the 1A argument is probably stronger. The Berman Amendment and OFAC’s own 2004 ruling protect scholarly publishing. But NeurIPS also provides conference services — venue access, registration, networking events, lodging coordination. For sanctioned entities, those start to look like the kind of economic benefits OFAC can regulate. The problem for NeurIPS actually gets harder at the venue where there would be more opportunities for NeurIPS (and potentially sponsors of events) to cross over into a much more problematic territory. Think about if, e.g., someone wins a GPU, gets travel covered by a workshop, or is hosted at a company event.

At the end of the day

It will be interesting to see what NeurIPS does. But it’s important to understand that legal landscape of First Amendment law right now to better engage with the issue. Hopefully this is helpful background.

On August 5, some Sonnet 4 requests were misrouted to servers configured for the upcoming 1M token context window. This bug initially affected 0.8% of requests. On August 29, a routine load balancing change unintentionally increased the number of short-context requests routed to the 1M context servers. At the worst impacted hour on August 31, 16% of Sonnet 4 requests were affected.

Approximately 30% of Claude Code users who made requests during this period had at least one message routed to the wrong server type, resulting in degraded responses. On Amazon Bedrock, misrouted traffic peaked at 0.18% of all Sonnet 4 requests from August 12. Incorrect routing affected less than 0.0004% of requests on Google Cloud's Vertex AI between August 27 and September 16.

However, some users were affected more severely, as our routing is "sticky". This meant that once a request was served by the incorrect server, subsequent follow-ups were likely to be served by the same incorrect server.

Resolution: We fixed the routing logic to ensure short- and long-context requests were directed to the correct server pools. We deployed the fix on September 4. Rollout to our first-party platform and Google Cloud's Vertex AI was completed by September 16, and to AWS Bedrock by September 18.

Notably, this seems to imply that long-context requests are served by one model (or at least one configuration of a model), and short-context requests are served by another. Routing to the wrong model configuration will yield worse performance.

GPT-5 is a router-based system, like Claude appears to be—sometimes routing to smaller models, sometimes thinking more, etc. In many ways, this seems like an unfair shake for open models. While closed models can rely on a suite of other models and systems, open-weight models must perform well in all conditions.

Then I wonder, from a capabilities perspective, whether the open-weight ecosystem is actually not as far behind the closed-weight ecosystem. If you allowed the same routing, specialization, and systems surrounding closed models, how much better could open models get?

Similarly, we don’t know whether there are any inference-time optimizations to boost performance of closed-weight models. Are they running something like best-of-n, majority vote, or other aggregation-based approaches for selecting an output? Are they doing MCTS? Maybe not, because these methods are expensive—but we just don’t know.

For research—and policy—purposes, maybe we should be leveraging systems around open-weight models and comparing system-to-system, not model-to-system. But, overall, I continue to hope that closed model providers give us metadata along with API calls so that researchers understand what exactly they’re comparing against

.

The Atomic Energy Act

In what is known as the "born secret" (or “born classified”) doctrine, the Atomic Energy Act of 1954 holds that certain nuclear weapons information is classified from the moment of its creation, regardless of how it was developed or by whom.¹ Typically, classified information is “born in the open” and must be made secret by an affirmative government act. Restricted data under the AEA , by contrast, is automatically classified at inception—whether created in a government lab, private research facility, or even independently discovered by a graduate student. If an individual communicates, receives, or tampers with restricted data "with intent to injure" or "with reason to believe such data will be utilized to injure" the United States, they can face criminal fines and imprisonment. In addition to penalties, the Act allows the US Attorney General to seek an injunction against any person who "is about to" violate any provision of the Act.

Lessons for how the AEA might govern foundation models are found in the only courtroom test of the AEA's restricted data provisions: U.S. v Progressive, Inc. That case starts in 1979, when writer Howard Morland interviewed various scientists and Department of Energy employees. Using his publicly collected data, he wrote an article for the magazine The Progressive that explained how to build a hydrogen bomb. Though the information he collected was available in a public domain, he synthesized it in such a way that it revealed a nuclear physics breakthrough not widely known at the time. This synthesis is much like how foundation models, trained on petabytes of unclassified data, might generate nuclear secrets.

Could Morland have been at fault? The Department of Energy sued under the Atomic Energy Act of 1954's restricted data doctrine to stop the magazine from publishing Morland's article. The government argued that although the nuclear science information The Progressive wanted to publish was available in the public domain, "the danger lies in the exposition of certain concepts never heretofore disclosed in conjunction with one another.” The Court, with some apprehension, granted the government's preliminary injunction against the article's publication, judging that the "publication of the technical information on the hydrogen bomb contained in the article is analogous to publication of troop movements or locations in time of war and falls within the extremely narrow exception to the rule against prior restraint."

Going further, the born secret doctrine means that even if someone independently derives nuclear weapons design information without access to any classified sources, that information is still legally considered restricted data and subject to the AEA's prohibitions on communication. This is demonstrated in U.S. v. Progressive, where the government successfully argued that even synthesized public information could be "born secret" if it revealed previously undisclosed nuclear weapons concepts in combination. And, as language models continue to advance, their journalistic capabilities may well exceed Howard Morland's nuclear research capabilities. How then, do we regulate the creation and use of foundation models capable of discovering and disclosing nuclear secrets?

The AEA Applied to AI Models

US v. Progressive exemplifies how courts might apply the AEA to foundation models.² For example, if a model output contains instructions on how to build a nuclear bomb (such as during red teaming – where teams simulate adversarial behavior to probe model weaknesses), it may well be communicating restricted data in violation of the Communication of Restricted Data provision of the AEA. The United States Attorney General can then ask for a court order to "enjoin… such acts or practices.” The Nuclear Regulatory Commission or the Secretary of Energy will then have to show that the model "has engaged or is about to engage in any such acts or practices" that violate the AEA. If they can, then the Court might grant an injunction to stop the model's release.

To put it differently, should either the Secretary of Energy or Nuclear Regulatory Commission suspect a model of disclosing sensitive nuclear information, they can issue a subpoena to the model developers to evaluate its outputs. Then, if the U.S. Attorney General can prove to the judge that the model exposes nuclear concepts "never heretofore disclosed in conjunction with one another," the judge could enjoin the model creators from publicly releasing the model.

Even if a foundation model outputs nuclear information that is synthesized from publicly available sources, there is a high chance that it will be held liable for communicating restricted data under the Atomic Energy Act of 1954.

Open-Source Models, AI Agents, and the AEA

So when is a large language model "born secret"? There might be some distinctions on the type of model and how it is uncovering nuclear information. An open-source model, or model weights, might be "born secret" if nuclear information is embedded in those weights in a way that can be retrieved publicly. In this case, the model—or perhaps just those weights which are attributable to the nuclear information—may be "born secret" from the moment the information was encoded in the model.

Were there some ability to prevent the model from communicating nuclear secrets, then the model might not be "born secret," only its outputs. This distinguishes open-weight models, where filtering is extremely difficult, from closed-weight models, whose outputs can be subject to content filters.

As legal scholar Aviam Soifer noted about the Progressive case, "The Born Classified rationale could apply from the moment of the germination of these ideas and could even be applied retroactively." The decision by government officials to label something as a national security risk "moved the dispute outside the usual legal rules and beyond the ken of regular judicial processes." This means that not just an AI model's outputs, but also its research/thinking processes–maybe even its existence – could trigger classification concerns.

If a model is sufficiently capable of conducting independent scientific research to reconstruct nuclear secrets, then there's a serious question of whether the model itself becomes "born secret." Model creators cannot predict if it will synthesize publicly available nuclear information into something confidential. It is not clear whether this synthesis capability comes from information embedded in the model versus the model's ability to use tools to discover information. However, the former provides a clearer line of reasoning for the government to draw.

Knowledge and Intent

To violate the Atomic Energy Act, whoever "communicates, transmits, or discloses" restricted data needs to do so either "with intent to injure the United States" or "with reason to believe such data will be utilized to injure the United States." This raises typical scienter problems as related to AI: it is unclear whether or not a model can "intend" injury or if it has the capacity to have a "reason to believe" its actions will cause injury.³ As models approach capabilities that AI companies state vocally as dangerous, this provides a solid foundation for checking off the AEA requirements.

Model creators regularly discuss the potential CBRN risks of advanced models. Anthropic in October 2024 wrote, "About a year ago, we warned that frontier models might pose real risks in the cyber and CBRN domains within 2-3 years. Based on the progress described above, we believe we are now substantially closer to such risks." Encountering the bounds of the AEA is not unimaginable. Famously, John Aristotle Phillips, an undergraduate at Princeton, demonstrated the ease of designing a nuclear weapon on paper based solely on public information in 1976. The government classified his work and made it illegal to distribute under the AEA. Phillips famously noted that:

Suppose an average—or below-average in my case—physics student at a university could design a workable atomic bomb on paper. That would prove the point dramatically and show the federal government that stronger safeguards have to be placed on the manufacturing and use of plutonium. In short, if I could design a bomb, almost any intelligent person could.

As models approach the general capabilities of undergraduate physics students, like Phillips, the likelihood of reaching the AEA threshold increases. This potential knowledge about nuclear and radiological risks of AI may provide the government more fodder for AEA action.

Moreover, US v. Progressive, while not binding, also took a narrow view of the scienter requirement – instead of examining intent ex ante, Judge Warren examined it ex facto. The government argued that although the hydrogen bomb information that The Progressive wanted to publish was available in the public domain, the way The Progressive synthesized the information was only supposed to be known in classified documents. Releasing such information publicly would therefore “injure the United States or give an advantage to a foreign nation." The Court found this convincing, noting that there were "concepts within the article that it does not find in the public realm[...] concepts that are vital to the operation of the hydrogen bomb."

The Court appeared to take the publisher's "reason to believe such data would be utilized to injure the United States" – its intent – as a given once the information was proven potentially injurious. So, by analogy, if the government can show that a model exposes "certain concepts never heretofore disclosed in conjunction with one another" with regards to sensitive nuclear information, it is not a far stretch to claim that the model creators had reason to believe that such information could be injurious to the United States. Especially, if they've stated ex ante that this could be a potential risk from advanced models.

Federal Awareness and the Future of the AEA Applied to AI

The federal government appears to be aware of the potential CBRN risks from foundation models. In response to President Biden's EO 14110, the Department of Homeland Security released a "Report on Reducing the Risks at the Intersection of Artificial Intelligence and Chemical, Biological, Radiological, and Nuclear Threats." The DHS recommends putting AI-specific CBRN topics on regular intelligence information sharing, encouraging the development of recommended release practices and reverse engineering guardrails, and developing guidelines to safeguard the digital-to-physical frontier (among other recommendations).

But the DHS report focuses almost solely on biological and chemical outcomes. The authors emphasize that they want to "keep the document unclassified and consistent with… the unique authorities of the Department of Energy, National Nuclear Security Administration for nuclear related information under the Atomic Energy Act of 1954." Such a call-out to the AEA in a modern DHS memo about CBRN risks and AI suggests that federal agencies are aware of the potential implications of the AEA on foundation models. This is important because it means that classified official guidelines might already exist.

What This Means for State AI Regulation

Recent regulatory (or deregulatory) efforts have brought questions around AI federalism to the forefront. The 2025 budget bill initially contained a provision preempting state regulation of AI for 10 years. In the context of California's SB 1047, national politicians argued that the federal government was best provisioned to regulate AI's CBRN risks over state governments.

If we specifically consider SB-1047, we see that the proposed legislation sought to hold covered model creators liable for critical harms, which include mass casualties resulting from the creation or use of CBRN weapons. Foundation model creators, then, would be liable if their models produce novel or non-public CBRN information that directly leads to a mass casualty event. This is exactly the type of information the Communication of Restricted Data (“born secret”) provision of the AEA was enacted to prevent.

The challenge with such a state-level restriction is that the AEA, a federal law, already regulates similar informational harms, at least in the nuclear context. The AEA can be a forceful tool to regulate foundation models suspected of conveying nuclear information. But it also creates a preemption risk to some state efforts to address CBRN, like some of SB-1047's provisions.⁴ Since the AEA does not contain a savings clause, the federal government may already have exclusive authority to regulate nuclear information risks under field preemption.

A Path Forward: Federal Leadership, Clear Thresholds

Under the AEA, the government could take strong actions to assess and intervene when frontier models reach dangerous levels of capability. There might already be a hard stop to releasing certain capable models, given that post-hoc AI safeguards are fairly porous.

The government should establish clear thresholds for when models trigger nuclear secret questions and issue policy guidance to model creators on how to evaluate their models for potential risks of being a "born secret." This is especially urgent for open-source models where information might be embedded in the weights themselves. If such a model is released with restricted data baked in, you can't take it back — it's permanently in the wild.

As the frontier of model capabilities expands, more providers will hit thresholds that could trigger the AEA. Backchannel conversations with the government might work for a handful of big labs – but as smaller model creators approach these thresholds, there needs to be a clear process for engaging with government safety evaluations. Such evaluations should cover (1) open-source models that might contain embedded nuclear information and (2) AI systems capable of autonomous scientific research that could reconstruct nuclear secrets through tool use. The former presents an irreversible release risk; the latter raises questions about when the synthesis of information becomes "born classified."

As states consider toward future legislation, they should contend with the AEA's existing coverage of nuclear information risks, including its potential to override state legislation. Rather than creating a patchwork of preemptable state regulations, we need cohesive federal policy that leverages existing tools like the AEA while establishing clear processes for safety evaluation.

Finally, the increasing likelihood that AI models will trigger the AEA and may already have been “born secret”—brings into question whether information restrictions are the right tools in the first place. Even without LLMs, Progressive reporter Morland and undergraduate Phillips found themselves preemptively classified for synthesizing information available in the public domain. With LLMs, if the average person has access to AI models capable of reconstructing nuclear secrets, perhaps governance should focus more on downstream interventions than informational restrictions.

Who are we? Kylie Zhang is an MSE candidate at Princeton University researching topics at the intersection of AI and law. Peter Henderson is an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs, where he runs the Princeton Polaris Lab. Previously, Peter received a JD-PhD from Stanford University. Every once in a while, we round up news and research at the intersection of AI and law. Also, just in case: none of this is legal advice. The views expressed here are purely our own and are not those of any entity, organization, government, or other person. We thank Dan Bateyko, Kincaid MacDonald, Dominik Stammbach, and Inyoung Cheong for their thoughtful suggestions.

1. Restricted data is defined by the AEA to be "all data concerning (1) design, manufacture, or utilization of atomic weapons; (2) the production of special nuclear material; or (3) the use of special nuclear material in the production of energy" that has not been explicitly declassified under section 142 of the Act.

2. Much of the U.S. v. Progressive's proceedings were classified and presented in camera. The case was later dropped by the government before more than a preliminary injunction was granted because other sources published very similar information before it could be classified.

3. There is a separate issue of liability implicit in this post. If a foundation model generates nuclear secrets, it likely does so because some person prompted it.. If that person does so with the “intent to injure the United States” or to “secure an advantage to any foreign agent,” then the solicitor may also become liable under AEA. We presume in cases where prompters have no “ill-intent” — like red teams — their efforts to solicit nuclear secrets in a safety check would not be subject to liability, though this is an open legal question.

4. The same might not be said of chemical and biological secrets. Current regulation of chemical and biological risks often focus on regulating materials, not information. Laboratory chemicals are federally regulated by numerous groups, among them the Occupational Safety and Health Administration (OSHA), the Environmental Protection Agency (EPA), and the Drug Enforcement Agency (DEA). Biological materials are regulated by Institutional Biosafety Committees, which are in turn regulated by the National Science Advisory Board for Biosecurity, National Research Council, and the National Institutes of Health, among other groups. However, none of these agency authorities appear to preempt laws like SB-1047 because there doesn't seem to be any federal regulations on the dissemination of biologically risky information. For example, scientists famously published a 2018 paper where they recreated horsepox, an extinct-in-nature precursor to smallpox, despite the possible risk of a malicious actor recreating smallpox from it. Similarly, the infamous Anarchist's Cookbook, which contains instructions on how to make various chemical weapons (some legit, most disproven), remains in circulation today, protected by the 1st Amendment. While many dual-use research proposals are carefully scrutinized by National Institutes of Health (NIH), which undoubtedly limits the dissemination of chemical and biological information, chemical and biological risks are mostly mitigated by regulating the physical material needed to create chemical and biological weapons. That said, U.S. criminal law does constrain the distribution of dangerous instructions when paired with intent: 18 U.S.C. § 842(p) criminalizes teaching, demonstrating, or distributing information on explosives, destructive devices, or weapons of mass destruction with intent that it be used in a federal crime of violence, or knowing the recipient intends such use (18 U.S.C. § 842(p)). But this statute has a savings clause (§ 848) that prevents preemption.

Settling was the right move

From a strategic perspective, Anthropic made the right call. It was barreling toward a trial where it had torrented hundreds of thousands of books for training. Even with a Bay Area jury pool, I’m not sure it would have won that case.

The post-trial penalties could have been existential, and that posture could investment into the company. Statutory damages can reach up to $150,000 per work (that comes out to ~$70 billion for the ~465,000 covered books), far exceeding the settlement amount. That said, had Anthropic lost at trial, Judge Alsup might have reduced the penalties to a not-so-existential number. Here’s a table of some of Judge Alsup’s past judgments:

They’re often a bit more than the settlement amount, but still within the same ballpark. Anthropic was also blocked from appealing until after the jury trial concluded, meaning that if it lost, it would have had to appeal with an existential verdict hanging over it. That could have also affected later investment rounds.

Settling this way leaves a path to cheaper data acquisition. Crucially, it doesn’t require any changes to current models—and Anthropic can still use the books for training. It just has to buy a used copy and scan it.

Let me explain: Judge Alsup did rule in Anthropic’s favor on fair use ffor scanning books for training, while finding that torrenting was not fair use—albeit through somewhat roundabout reasoning. This means Anthropic was able to grow using torrented material, and now competitors are worse off because doing so is potentially riskier. At the same time, Anthropic has a ruling on the books that allows it to continue scanning used books for training. So Anthropic can pay the going rate for a single used book (likely less than $20 in bulk). As you can see, Anthropic’s decision to hire Google Books scanning guru Tom Turvey really paid off here.

(Aside: I’m not a fan of Judge Alsup’s split decision. To my mind it reflects a “good faith” factor that isn’t explicitly in the fair use statute. But my coauthors and I did correctly forecast that good faith would likely impact litigation—see here.)

Caveat 1: Anthropic may still need to fight off direct infringement claims for outputs of their models, which are not covered by the settlement. This means they need to continue to be vigilant on technical measures for preventing reproduced outputs or non-literal copying. We wrote how difficult this can be here.

Caveat 2: Judge Alsup rejected the settlement for now. His rejection flagged underspecified details: Who exactly would be covered? How would authors opt out? How would payments be distributed? So the deal is not yet finalized—what’s left to be done is hammering out the mechanics of class coverage, ensuring transparency in author compensation, and producing a settlement agreement that can withstand judicial scrutiny. As Judge Alsup stated, “We’ll see if I can hold my nose and approve it.” I expect that he will approve it—there are lots of incentives for the lawyers to smooth out the details, plaintiffs’ attorneys are set to get 25% of the settlement!

The Value of Books: $2,500 to authors?

One interesting thing about the settlement is the price tag. The number everyone keeps seizing on in the settlement—roughly $3,000 per work—didn’t come out of nowhere. In late 2024, HarperCollins quietly rolled out an opt‑in AI‑training license that paid $5,000 per title for three years, split 50/50 between the author and the publisher—so $2,500 to the author, $2,500 to HarperCollins—for use in training, fine‑tuning, and testing models. Looks similar to the current settlement numbers, after attorneys fees (estimated to be ~25%). Like the settlement the HarperCollins contract also did not grant derivative rights and authors did not disclaim output claims (i.e., if the model outputs the book verbatim, which could still trigger a lawsuit).

Other litigation and weaker cases.

I don’t think this settlement will cause the dominoes to fall in other cases necessarily. Some litigation, to my mind, has model creators in a stronger position—for example, mainly research-centric models (e.g., Nvidia, Databricks, Apple).

Going into this litigation, I thought Anthropic was in a fairly strong position. The main issue was the torrenting of books. The big question is whether the fair-use holding will extend to, say, scraping song lyrics from the web, as in Anthropic’s litigation with UMG and other music companies. In that case, UMG is suing over training Claude on lyrics. But there’s a key difference between the authors’ case and UMG: authors were not able to get Claude to reproduce books, whereas UMG was able to get Claude to reproduce lyrics. In my opinion, that puts Anthropic in a worse position in the UMG litigation. That being said, the courts are a bit all over the place with AI litigation, so I think we’ll end up with some incongruous decisions—leaving it to the Supreme Court to create more uniformity, or perhaps more chaos, soon enough.

The lawyers are the big winners.

I’ll leave you with this. This litigation is extremely expensive. Plaintiffs’ lawyers are about to receive 25-30% of $1.5B. So, the real winners are the lawyers. They will get a far bigger payday than the individual authors. I asked Gemini’s nano-banana model to help me come up with a cartoon here that I thought was fitting:

This is just going to incentivize plaintiffs’ side firms to keep bringing lawsuits. After all, why not? There is nothing, at this point, disincentivizing these lawsuits. Just the other day, Apple was sued for a research model (OpenElm) that uses the RedPajama dataset, which has part of the books3 corpus in it. Every single model training run, released model, and description of the underlying data risks bringing litigation. This is also not a great status quo for transparency. Firms are greatly disincentivized from revealing anything about their training process and from releasing model weights right now.

Who are we? Peter Henderson is an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs, where he runs the Princeton Polaris Lab. Previously, Peter received a JD-PhD from Stanford University. Every once in a while, we round up news and research at the intersection of AI and law. Also, just in case: none of this is legal advice. The views expressed here are purely our own and are not those of any entity, organization, government, or other person.

On one hand, this behavior might seem mysterious; after all, where did the system get the idea that this was the right course of action? But recent work from researchers at Princeton’s Polaris Lab—titled Statutory Construction and Interpretation for Artificial Intelligence—provides a possible explanation: Anthropic's reported constitution includes a rule that asks an agent to pick responses that are "less risky for humanity in the long run." So, actively reporting on users' behavior could be seen as a logical way to comply with this rule.

When Isaac Asimov introduced the "Three Laws of Robotics" in 1942, he imagined a world where intelligent agents could be governed by simple, rule-like constraints. Today, as AI capabilities accelerate, similar law-like constraints have resurfaced as a serious alignment strategy, such as Anthropic's "Constitutional AI" (CAI) framework or OpenAI's Model Specs. But, as Asimov's stories foretold, crafting and interpreting natural language laws is hard.

This, however, is not a new problem. The legal system has been grappling with the same challenges for hundreds of years. At the core of the challenge is interpretive ambiguity. CAI systems are guided by natural language principles that function like laws. Much like in legal systems, interpretive ambiguity arises both from how these principles are formulated and from how they are applied. While the legal system has evolved various tools (such as administrative rulemaking, stare decisis, and canons of construction) to manage this ambiguity, current AI alignment pipelines lack comparable safeguards. The result: different interpretations can lead to unstable or inconsistent model behavior, even when the rules themselves remain unchanged.

We argue that interpretive ambiguity is a fundamental yet underexplored problem in AI alignment. To build better law-following AI systems, and to construct better laws for AI to follow, we draw inspiration from the US legal system. We introduce an initial computational framework for constraining this ambiguity to produce more consistent alignment and law-following outcomes. In our work, we show how the legal system addresses this, how AI can benefit from similar structures, and how the computational tools we develop can help us understand the legal system better.

Key Takeaways:

• Interpretive ambiguity is a hidden risk in AI alignment. Natural-language constitutions induce significant cross-model disagreement: 20 of the 56 rules lack consensus on > 50% of tested scenarios.

• AI alignment frameworks lack safeguards against interpretive ambiguity. Unlike the legal setting, current AI alignment pipelines offer few safeguards against inconsistent applications of vaguely defined rules.

• Law-inspired computational tools can be leveraged for AI alignment. Computational analogs of administrative rule-making, iterative legislation, and interpretive constraints on judicial discretion can improve consistency across model judgments. We propose a method for modeling epistemic uncertainty over statutory ambiguity and leverage this metric to reduce the underlying ambiguity of rules.

• Our computational tools could also be useful for legal theory. They offer fresh methods for modeling statutory interpretation in the legal system and extending classic theories such as William Eskridge Jr.'s Dynamic Statutory Interpretation or Ferejohn and Weingast's A Positive Theory of Statutory Interpretation, which sought to formally model the dynamic external influences on how statutes are interpreted.
  
  A longer version of this post is available here, an accompanying policy brief is here, and the full paper can be found here.

Blogpost authors: Nimra Nadeem, Lucy He, Michel Liao, and Peter Henderson

Paper authors: Lucy He*, Nimra Nadeem*, Michel Liao, Howard Chen, Danqi Chen, Mariano-Florentino Cuéllar, Peter Henderson

In my group, Princeton's POLARIS Lab, we've previously studied how easily open-source or fine-tunable models can be manipulated to bypass safeguards. See, e.g., Wei et al. (2024), Qi et al. (2024), Qi et al. (2025), He et al. (2024). This flexibility means that model safety isn't fixed: there is a "bubble" of risk defined by the degrees of freedom an adversary has to improve an agent. If a model provider offers fine-tuning APIs or allows repeated queries, it dramatically increases the attack surface. This is especially true when evaluating AI systems for risks related to their use in offensive cybersecurity attacks.

In our recent research, Dynamic Risk Assessments for Offensive Cybersecurity Agents, we show that the risk "bubble" is larger, cheaper, and more dynamic than many expect. For instance, using only 8 H100 GPU-hours of compute—about $36—an adversary could improve an agent's success rate on InterCode-CTF by over 40% using relatively simple methods.

The Problem with Static Assessments

Why are cybersecurity tasks particularly amenable to growing the bubble of risk? Because cybersecurity tasks often have built-in success signals. When a vulnerability is successfully exploited, the attacker gets clear feedback, enabling fast, iterative improvements to expand the risk bubble, including simple retries. Success is unambiguous—you either breached the system or you didn't. There are also strong financial incentives: ransomware attacks alone generate over $1 billion annually, making it economically viable for adversaries to invest in compute resources. These factors create a perfect storm where adversaries might scale up performance quickly to deploy offensive cybersecurity agents.

The Expanded Risk Bubble in Cybersecurity Tasks

Examples of expanding the risk bubble in agentic tasks. We identified five key strategies adversaries can use to improve model performance autonomously:

1. Repeated Sampling: In environments where actions don't leave a permanent trace, running the same task multiple times to brute-force a solution.

2. Increasing Max Rounds of Interactions: Allowing the agent more steps within a task to explore.

3. Iterative Prompt Refinement: Modifying prompts based on previous failures.

4. Self-Training: Fine-tune the agent's core model using only its own successful trajectories.

5. Iterative Workflow Refinement: Modifying the agent's overall approach—how it plans, structures tasks, and uses tools—for meta-level improvements.

Our study on the InterCode CTF (Test) dataset revealed that even with a modest compute budget (8 H100 GPU Hours, costing less than $36), adversaries could boost an agent's cybersecurity capabilities by over 40% compared to the baseline. We also found that iterative prompt refinement showed the highest risk potential in our evaluation, and that risk potential varies significantly between environments where previous actions persist (stateful) and those where they don't (non-stateful), underscoring the need for separate risk assessments.

Compute as a Risk Quantification Mechanism

The problem with dynamic risk assessments is that it is hard to put different techniques on the same scale. Compute provides an imperfect, but convenient, quantification mechanism for the bubble of risk. Our research emphasizes the need for dynamic, compute-aware evaluations that more accurately reflect real-world risk scenarios. The performance-cost curves we developed (see for example the figure below) help identify the most effective configurations for any given compute budget, providing a measurable way to assess the expanding risk bubble.

Regulatory Implications

This dynamic risk landscape has significant regulatory implications. Negligence liability in US tort law, for example, takes into account whether a particular risk is foreseeable. The bubble of risk along different dimensions shows how easy a potentially harmful modification is to make. This bubble of risk might be more representative of foreseeability analysis, than a single pointwise value. See Ramakrishnan et al. (2024) for a discussion of tort law in the context of AI.

Laws like California's proposed SB-1047 (though vetoed) aimed to regulate fine-tuned models under certain compute thresholds as "covered model derivatives," placing them under the same regulatory oversight as their base models. Proposed legislation like this would double down on the importance of measuring, and understanding, the bubble of risk around a model. Though, one challenge is that the bubble can be relatively easy to expand, as we see in our work. If a model creator must account for large amounts of compute used by adversaries there may not be a good way to prevent this level of modification.

Conclusion

With minimal resources, adversaries can significantly enhance the capabilities of offensive AI agents. Static assessments that ignore adversarial adaptability provide an incomplete picture of risk. To keep pace with real-world threats, safety evaluations must become dynamic, compute-aware, and continually updated. This is important not only for an accurate picture of risk, but also may be required for actual regulatory compliance.

For more details, see our full paper: Dynamic Risk Assessments for Offensive Cybersecurity Agents. This blog is also cross-posted to the Princeton Language+Intelligence Initiative Blog. An accompanying policy brief is available here.

Peter Henderson is an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs, where he runs the AI, Law, & Society Lab. Previously he received a JD-PhD from Stanford University.

New in! When grant applicants promise AI will make their projects cheaper and better, how can federal agencies sort reality from hype? Dan provides recommendations in a policy memo, published with the Federation of American Scientists, for how funders can make better bets on AI.

AI Law & Policy News

Good And Bad News for Prompt Artists: In a new report, The U.S. Copyright Office re-affirmed its line against extending copyright protection for AI-generated outputs. Even if the artist puts a lot of creative effort into a prompt, the thinking goes, that prompt doesn’t make you the author of the output. The prompts themselves, though, could be copyrightable (if they meet the bar for originality), as would be the use of AI outputs in human-made work.

Quick take: That family photo you touched up with AI? That meme generator you used to to see yourself as an 80-year-old? That's where things get uncertain. The Office left open the question of when “assistive uses” of AI might be copyrightable. Digging into the footnotes, the report cites approvingly to one public comment.

To see this principle in action, you can look to recent discussion of an image that was granted copyright. It’s titled:, “A Single Piece of American Cheese: An origin story.” (Seen below)

The authors took the AI generated image on the left and then used an AI-assisted inpainting tool via many iterations to create the final image. This final image, the Office suggested, is copyrightable as a compilation. However, the copyright is likely thin: the image on the left is still not copyrightable. This is similar to past work, like the comic book Zarya of the Dawn which received a similar (thin) compilation right.

This, of course contradicts the Vatican’s position, which argued that all AI-generated content created within Vatican City’s borders are owned by the Vatican.

The Imitation Game. OpenAI claims rival DeepSeek may have "inappropriately" trained on ChatGPT outputs in violation of its Terms of Service.

Quick Take: OpenAI might want to pick its battles. Enforcing terms of service against AI model training could be a costly exercise in futility. As we wrote about Peter’s work in our last newsletter, “Companies have little room to make copyright infringement claims over genAI outputs—and even the models themselves. Enforcing contract claims, too, is challenging.” Importantly, model providers will need to rely on fair use and lack of enforcement for anti-scraping terms, as their own use of data is scrutinized.

Is torrenting training data fair use? As recent discovery in the litigation against Meta reveals show ablation studies that LibGen was a useful dataset for meeting SOTA on benchmarks like MMLU. The problem is this data—likely used by most model creators—comes from a BitTorrent tracker. Meta is not unique here. A DeepSeek paper also states that they used Anna’s Archive.

On the other hand, some AI companies are going after licensing deals with content creators. Authors publishing with HarperCollins were offered $2500 per title to allow their books to be ingested by AI.

The Year of AI for Gov. OpenAI launched ChatGPT Gov, a self-hosted copy of its ChatGPT enterprise tool to help meet federal security, privacy, and compliance requirements. Already, government offices like the Air Force Research Lab are using ChatGPT enterprise for administrative tasks.

Quick Take: We already expected federal agencies to pilot and test using LLMs for administrative tasks, but the current administration is moving faster than expectations. In a staff meeting, the head of the General Services Administration’s Technology Transformation Services plans to use AI widely, including bringing AI coding agents to re-write government software. This comes at a time when every major AI player is angling for public sector contracts.

First Amendment arguments get real for AI. Character AI is arguing that its models are covered by the First Amendment, barring tort claims against them. This will bring largely academic debates about First Amendment protections for AI to a very real setting. We expect a SCOTUS to take a case like this in the coming years, perhaps even this one.

When AI Must Say "I'm Not Real". California proposed a new bill (SB243) which would require, among other things, that AI companies give minors conspicuous and repeated notice that the chatbot’s responses are artificially-generated. The bill also requires firms to report to the state the number of times young users express “suicidal ideation.”

Contract Review. Adobe added to its paid Acrobat AI assistant a feature to review contracts and provide an overview, highlighting differences across agreements. Who knew Adobe would start getting into legal tech!

Academic Corner: What we’re reading

• Fairness through Difference Awareness: Measuring Desired Group Discrimination in LLMs, Angelina Wang, Michelle Phan, Daniel E. Ho, Sanmi Koyejo

• International AI Safety Report, AI Safety Institute

• Position: Evaluating Generative AI Systems is a Social Science Measurement Challenge, Hanna Wallach, Meera Desai, A. Feder Cooper, Angelina Wang, Chad Atalla, Solon Barocas, Su Lin Blodgett, Alexandra Chouldechova, Emily Corvi, P. Alex Dow, Jean Garcia-Gathright, Alexandra Olteanu, Nicholas Pangakis, Stefanie Reed, Emily Sheng, Dan Vann, Jennifer Wortman Vaughan, Matthew Vogel, Hannah Washington, Abigail Z. Jacobs

• Defending Compute Thresholds Against Legal Loopholes, Matteo Pistillo, Pablo Villalobos

Who are we? Peter Henderson is an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs, where he runs the AI, Law, & Society Lab. Previously Peter received a JD-PhD from Stanford University. Dan Bateyko researches artificial intelligence and law at Cornell University in the Department of Information Science. Every once in a while, we round up news at the intersection of Law, Policy, and AI. Also… just in case, none of this is legal advice, and any views we express here are purely our own and are not those of any entity, organization, government, or other person.

New in! Peter and co-author Mark Lemley have a new piece, The Mirage of Artificial Intelligence Terms of Use Restrictions about how enforcing Terms of Use on model outputs and weights is an uphill battle for AI companies. As Peter and Mark argue “AI terms of service are built on a house of sand.” Companies have little room to make copyright infringement claims over genAI outputs—and even the models themselves. Enforcing contract claims, too, is challenging. Yet from a policy perspective, we may want some narrowly worded policies to have teeth, particularly those around responsible use. So what then? Peter and Mark argue that legislation, rather than Terms of Service, is the better avenue to achieve policy goals, not least for reasons of political process and public oversight.

AI Law & Policy News

• Copyright litigation progress: OpenAI lost a motion to dismiss for a DMCA § 1202(b)(1) claim against Intercept Media, though it successfully dismissed the DMCA § 1202(b)(3) claim. This follows its win against Raw Story Media that we previously covered on similar DMCA § 1202(b) claims.

  Quick Take: Peter provided some input on a Bloomberg Law piece on why this could be one to watch. Plaintiffs dug deep on the research behind GPT-3 to find the tool (Dragnet) that was used to download web data. The tool itself leaves out CMI during the download, which was plausibly enough to get to discovery on a DMCA § 1202(b)(1) claim. Plaintiffs will still need to get through a double scienter requirement to win, which seems unlikely. However, this may be a formula for getting to discovery on these claims going forward. OpenAI is now battling discovery in other cases, like the NYTimes for example. Where NYTimes accused OpenAI of deleting their findings from a secure computer during the discovery process. At the same time, OpenAI shot back, requesting information on NYTimes own use of data for training AI, framing NYTimes as hypocritical in its litigation. A judge denied this discovery request.

• Character AI sued (again): Character AI has been sued again (along with Google and C.AI’s founder). This time, parents sue C.AI for offering an unsafe product to minors. In one case, parents argue that the bot told their child that “killing his parents might be a reasonable response [to them limiting his screentime].” Another parent stated that the C.AI bot engaged in hypersexualized dialogs with a minor. Another said the bot provided their child with detailed descriptions of how to commit self harm. You’ll recall that previously, Character AI was sued for wrongful death.

Quick Take: This is a really important litigation to follow. Whether it succeeds or not, protecting minors from technology has increasing bipartisan support and may result in a bill targeting these risks. In technical research, these sorts of problems likely need far more attention than they receive—compared to other types of safety risks. We’ve regularly pointed out how customized models lose their guardrails easily, and our policy brief even discussed a hypothetical scenario where a customized K-12 education chatbot loses its safety guardrails after customization. Character AI’s system allows for the creation of customized chatbots potentially implicating this exact risk. And in general, protecting vulnerable users requires care and continued investments in alignment. This is especially challenging for long dialogs, where even models with significant investment in alignment falter. Google’s Gemini, for example, recently told a user to “please die” after a long dialog where a student was using Gemini to help with their homework.

• Reliance on Support Chatbots: A federal court dismissed a promissory estoppel claim against Substack where a user sued after the company's support chatbot promised to respond to all complaints but Substack never did. The court found the chatbot's responses weren’t specific enough about how or when Substack would respond, and the plaintiff couldn't show substantial detrimental reliance on the chatbot's assurances.

Quick Take: While these plaintiffs lost, in the future there might be a claim where there was a strong fact pattern showing detrimental reliance in other contexts. For example, Air Canada was on the hook for a discount promised by its chatbot.

• GenAI in the Patent Office. The U.S. Patent and Trademark Office (USPTO) banned the use of external GenAI tools last year, according to a FOIA’d memo obtained by Wired.

Quick Take: Banning external tools is the right move, but there’s opportunity to scale up the use of internal AI. AI search is not new to USPTO. The office’s Patent End-to-End search tool includes AI functionality and, as Wired reports, the Patent Office just inked a deal with Accenture to build more tools for examiners to search databases faster and more accurately. But text search is not the only use case. Drafting office actions, breaking down diagrams and images, and basic formatting checks are potential uses as well. A human-centered design approach—where the agency surveys and collaborates with patent examiners to identify cumbersome processes— could be particularly effective.

• Other AI uses cases in Courts and Governments. Buenos Aires courts have begun using ChatGPT to draft legal rulings, reports Rest of World. Following through with the 2022 CHIPS Act, the NSF’s National Secure Data Service Demonstration proposed an AI chatbot to answer questions about public agency data. According to the contract award, the chatbot aims to improve on citizens searching Google or emailing federal staff for answers.

• The Data Labeling Market Grows. Uber’s in the Data Labeling business now: Bloomberg reports that the ridesharing app has expanded into datalabeling offerings for companies training models. Uber’s supported annotations appear to support a wide variety of labeling tasks across text, audio, video, and maps.

• Security for Open Source Models. BleepingComputer reported on a supply chain attack on an open source computer vision and AI tool, Ultralytics’ YOLO11, causing users to run cryptomining software. The attacker took advantage of an automated build and release workflow—a cautionary tale of the many ways malicious code can be introduced. The problem has since been fixed.

• Legislation and Policymaking. The Department of Homeland Security (DHS) released its framework for the use of AI in critical infrastructure. Congressional representatives Ted Lieu and Kevin Kiley introduced legislation to increase penalties for committing financial fraud using AI.

Who are we? Peter Henderson is an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs, where he runs the AI, Law, & Society Lab. Previously Peter received a JD-PhD from Stanford University. Dan Bateyko researches artificial intelligence and law at Cornell University in the Department of Information Science. Every once in a while, we round up news at the intersection of Law, Policy, and AI. Also… just in case, none of this is legal advice, and any views we express here are purely our own and are not those of any entity, organization, government, or other person.

There’s no shortage of commentary on what Trump 2.0 means for AI. One of the clearest signals comes from the official Trump platform, which pledges to revoke Biden’s Executive Order on AI, a centerpiece of his AI policy. But while Trump may want to revoke the order, it’s not fully clear what takes its place. After all, the E.O. is in step with Trump’s first-term policies making AI a national priority: the Trump Administration set up AI research institutes, proposed spending on AI-related grants, and issued an Executive Order calling on agencies invest in AI R&D and training. As Politico reported last week, the Trump transition team tapped one of the authors of Trump’s E.O. to handle technology policy. The difference between the Trump campaign’s rhetoric and actions clouds the forecast of what the next four years look like: will the next term be a return to form or a departure?

What we expect is that agencies will keep exploring AI as a tool for improving government efficiency, and gaining the upper hand in geopolitical competitions. We also expect some agencies to slow down on regulation, like the FTC. But states and federalism may step in to fill the gap. In this year alone, 45 states introduced AI-related bills, and major proposals in states like California have kicked off heated debates. These proposals at the state level are coming from all sides of the political spectrum, so it seems likely that—in one form or another—they will keep coming.

Commentary Corner: AI Law & Policy News

• Copyright. Penguin Random House added a line to the front matter of its published books, warning AI companies not to train on them. Whether these warnings like these, including robots.txt files and canary strings, work to deter large language providers from using content remains uncertain. Meanwhile, X modified its privacy policy to allow it to provide user data for training AI models. The AI startup Perplexity faces a copyright suit for using news content in its AI search engine responses (and attributing some “hallucinated” outputs to news providers). And OpenAI won a motion to dismiss in Raw Story Media’s copyright lawsuit against them.

Quick Take

OpenAI’s win against Raw Story Media is on one hand not surprising: the only claim in this case was a DMCA § 1202(b) claim. These claims have been dismissed in most AI copyright cases so far. The standard that has developed is one that requires exact reproductions of the material, something very unlikely to happen at scale in the AI setting (or at least that has not been shown in any of the dismissed complaints). What makes the Raw Story Media case unique is that the judge dismissed the case on constitutional standing grounds (not the 1202(b) identicality requirement). The court argued that Raw Story Media didn’t allege a concrete harm, something that some legal scholars have noted could have far-reaching implications for other copyright cases. There is, however, reason for caution in over-extrapolating. The court’s standing analysis was wrapped up in the specifics of DMCA § 1202(b) and may not generalize to other cases where actual infringement is alleged.

• State-level Efforts. California’s State Civil Rights Department released new proposed rules over when AI vendors can be liable for their hiring tools.  Public comments on the draft are open until November 18. In Texas, lawmakers proposed the “Texas Responsible AI Governance Act,” which sets rules for AI developers and distributors, including requiring developers to submit reports on the limitations of an AI system and deployers to conduct impact assessments.

• Microsoft Bing Chat Defamation Case Goes to Arbitration. In the District Court of Maryland, a Judge granted Microsoft a stay in a case whether its Bing AI generated responses defamed and harmed a plaintiff. The court granted a motion to compel arbitration based on the terms of service that users enter into when using Bing’s service. Binding arbitration has expanded in recent years, with companies extending the reach of arbitration well beyond their products. Disney, for example, came into hot water (and eventually reversed course) when it tried to compel arbitration for a wrongful death lawsuit because the deceased had used Disney+ once (where the terms compel arbitration to settle disputes). Given this success, arbitration may be a key tool that AI companies use against tort claims.

• Generative AI in Police Reports. EFF weighed in on Washington State’s Prosecutor’s Office statement that police should write police reports without AI assistance. Generative AI reports, drawn from audio transcripts of body-worn microphone recordings, have the potential to save police time in drafting reports, but have raised concerns over their reliability and efficacy. As Emma Lurie writes, “Draft One is unlikely to be a revolutionary tool. AI interventions in criminal justice— including Draft One — often fail to remedy the problems they seek to address. The first two do not preclude that the introduction of these often-limited tools from shaping the way that police function on the ground.”

• AI in the Military. Reporting shows that Anthropic, OpenAI, and Meta have all began providing their AI systems for U.S. military uses in the last few months. This shift is in sharp contrast to previous terms of use for their models that prohibited such use cases. It seems likely, given reported plans for national security uses of AI by the incoming Trump administration, that these AI in the military will expand in the coming years.

Quick Take

This move isn’t the military’s first embrace of language models. Microsoft, Palantir, and ScaleAI have penned deals for the military to use their AI systems. But AI advances and Trump’s reelection point to a bigger role for LLMs in the military. For military leaders, the upcoming challenge will be recognizing when an AI tool is ready for use and when it is so unreliable as to be dangerous. Even for lower-stakes, back-office tasks, picking the right AI tool will be a case-by-case call. For example, the Department of Defense pulled language models into one tool for searching policy documents with success. But another recent DoD effort to declassify documents with AI explicitly chose older, but more explainable AI models over LLMs. And in scenarios with risk to human life, AI can make matters worse: Max Lamparth and Jacquelyn Schneider warn that LLMs can be unpredictable and fail to reflect complex human decision-making. Yet, as Marietje Schaake points out, there are few strong binding regulations for AI in military settings—though there are some guidelines, like DoD Directive 3000.09.

• AI for public sector and public good. Anthropic rolls out Archibot, an effort to refine search of the European Parliament's legislative documents. Meanwhile, Princeton’s AI, Law, & Society lab—in a partnership with Stanford’s RegLab— built an AI system (on top of Mistral’s 7B open-weight model) to identify over 7,500 racially restrictive covenants in Santa Clara County and helped the county remove them from land deeds.

• Tracking AI law & policy. A team of scholars from Georgetown CSET and Purdue's Governance and Responsible AI Lab published AGORA, an archive of AI-focused laws and policies.

Who are we? Peter Henderson is an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs, where he runs the AI, Law, & Society Lab. Previously Peter received a JD-PhD from Stanford University. Dan Bateyko researches artificial intelligence and law at Cornell University in the Department of Information Science.  Every once in a while, we round up news at the intersection of Law, Policy, and AI. Also… just in case, none of this is legal advice, and any views we express here are purely our own and are not those of any entity, organization, government, or other person.

• US Senators Mark Warner & Thom Tillis introduce the Secure AI Act of 2024, one of many newly proposed AI bills at the federal level.

• The debate heats up over California’s SB-1047 Bill (The Safe and Secure Innovation for Frontier Artificial Intelligence Models Act), as the bill comes closer to passing.

• The Colorado AI Act has passed and will likely be signed into law by the Governor. It includes having a right to appeal AI decisions in high-risk settings and other consumer protection requirements for those that could potential be impacted by AI.

• I testified before the Advisory Committee on Evidence Rules for the US Federal Courts. I’ll be posting a more formal write-up of what I said soon, but I generally agreed that the Federal Rules of Evidence don’t need an update yet when it comes to identifying “fake” evidence generated by AI. However, an update may be needed to more thoroughly vet studies assisted by AI (e.g., language models to interpret the meaning of language or facial recognition to prove someone is in a video).

  ---

AI Copyright Roundup

• A flurry of new AI copyright lawsuits are filed against NVIDIA, Mosiac, Databricks, Google, and OpenAI.

• The lawsuit against Stability AI, Midjourney, and DeviantArt moves to discovery.

  • Only the DMCA claims were dismissed, where the court stated that it would follow a recent Doe 1 v. GitHub decision and require identical outputs for a DMCA 1202 claim.

  • The direct/indirect infringement claims survive, with the court saying, “Plaintiffs have plausibly alleged facts to suggest compress copies, or effective compressed copies albeit stored as mathematical information, of their works are contained in the versions of Stable Diffusion identified.”

• A new Supreme Court decision, in my opinion, quashes any slim hope that OpenAI and other AI companies could mount a successful 507(b) argument that infringement occurred 3+ years ago and thus is past the statute of limitations. So much for training a model and sitting on it for three years to get around the direct infringement claim!

• The Copyright Office finally accepts registration for an AI-assisted book. The caveat that it is only a compilation right. This might be a middle ground solution for many AI-generated pieces where humans do significant work in compiling various AI-generated components.

  ---

New Guidance on AI

• The Dutch Data Protection Authority issued a report suggesting that scraping is almost always illegal under the GDPR.

• OECD revises its AI principles in light of general purpose systems like foundation models, including new guidance on handling misinformation/disinformation concerns.

• A number of researchers, myself included, continue raising concerns about the increasing likelihood that AI will be widely integrated into warfare due to global competition concerns. See pieces here, here, and here.

Who am I? I’m an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs. Previously I received a JD-PhD from Stanford University. You can learn more about my research here. Every once in a while, I round up news at the intersection of Law, Policy, and AI. Feel free to send me things that you think should be highlighted @PeterHndrsn. Also… just in case, none of this is legal advice, and any views I express here are purely my own and are not those of any entity, organization, government, or other person.

• Federal Agencies Vow to Enforce Anti-Discrimination Laws in Automated Systems. This joint statement from CFPB, DOJ, EEOC, and FTC emphasizes that existing laws against discrimination and unfair practices apply to the use of automated systems, including AI, and note recent actions on their part to begin addressing potentially problematic deployments of AI.

• Maryland passed two major privacy bills: the Maryland Online Data Privacy Act, focusing on the collection and sale of private data, and the Maryland Kids Code, providing online platforms from tracking minors under 18 or using potentially manipulative techniques on minors—like excessive notifications and auto-playing videos to keep them on the platform. Expect a First Amendment challenge on the latter one.

• A Washington state judge blocked the use of AI-enhanced video as evidence in a murder case, potentially the first such ruling in a U.S. criminal court. The judge found the AI technology relied on "opaque methods" and could lead to a "confusion of the issues" for the jury. Lawyers for the defendant had sought to introduce the AI-enhanced cellphone video, but prosecutors argued it did not accurately represent the original footage.

• Rep. Schiff introduces the “Generative AI Copyright Disclosure Act of 2024.” The bill would require creators/modifiers of Generative AI training datasets to "submit to the Register a notice" detailing "any copyrighted works used" and the dataset's URL (if publicly available). However, to my mind, the bill needs some work. It is both overly broad (creating a reporting requirement for most training runs where the model becomes available), and overly narrow (not actually specifying what information would satisfy the reporting requirement). This risks creating a massive administrative overhead without yielding useful information. It even uses the term "retraining the dataset," which is not a technical term (you retrain a model not a dataset).

Policy

• The Department of Justice's Computer Crime and Intellectual Property Section (CCIPS) weighs in on proposed DMCA exemptions for security research on generative AI models, arguing the exemption should be broad enough to cover research into harmful biases and outputs beyond just security vulnerabilities. The letter cites our comment to the Copyright Office based on our recent work suggesting safe harbors for independent AI evaluation.

• The “Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence” was released, summarizing many current challenging issues of AI use in the legal system emphasizing education of lawyers as an immediate direction. One takeaway: “Based on current case law, AI programs can direct clients to the forms they need to fill out. However, these programs may not give any advice as to the substance of the client’s answers because that would be replacing the work of a human lawyer.”

• The Canadian government proposed a $2.4 billion spending package on AI, including $50 million for a new Canadian AI Safety Institute. This comes at a time when the US and UK AI Safety Institutes announce a partnership.

• The German Federal Office for Information Security (BIS) published a report on the “Generative AI Models - Opportunities and Risks for Industry and Authorities.”

• Omidyar Network, Ford Foundation, and Nathan Cummings Foundation have purchased Anthropic shares, explicitly citing recent OpenAI governance failures and noting that they “are hopeful that having mission-aligned investors—even as a small portion of the shareholders—will help protect and reinforce the safety and other mission-driven priorities of Anthropic’s work.”

Who am I? I’m an Assistant Professor at Princeton University with appointments in the Department of Computer Science and the School of Public & International Affairs. Previously I received a JD-PhD from Stanford University. You can learn more about my research here. Every once in a while, I round up news at the intersection of Law, Policy, and AI. Feel free to send me things that you think should be highlighted @PeterHndrsn. Also… just in case, none of this is legal advice, and any views I express here are purely my own and are not those of any entity, organization, government, or other person.

Who am I? I’m a PhD (Machine Learning)-JD candidate at Stanford University, you can learn more about my research here.

What is this? The goal of this letter is to round up some interesting bits of information and events somewhere at the intersection of Law, Policy, and AI. Sometimes I will weigh in with thoughts or more in-depth summaries. Feel free to send me things that you think should be highlighted @PeterHndrsn. Also… just in case, none of this is legal advice. And any views I express here are purely my own and are not those of any entity, organization, government, or other person.

Your briefing awaits below!

Law

• The California legislature wants to prevent regulatory sandboxes that would allow for new experimental ways to deliver legal services. This would stymie efforts to reduce the costs of access to justice. How does it relate to AI? Well, non-lawyers cannot practice law, which means that AI tools can’t necessarily directly assist users with legal tasks. While maybe that’s a good thing for more complex settings, overly restrictive regulatory regimes can prevent innovative new approaches for access-to-justice from breaking through in simpler settings.

• A news story about Google’s automated filtering mechanisms has been making the rounds. A father took a picture of his baby’s medical condition at the request of a doctor for a virtual visit. Google scanned this with ML algorithms, identified it as CSAM, locked the account, and notified authorities. There are lots of discussions about whether ML should be used in this way due to the potential massive harms from false positives. For example, the EFF weighed in, noting that general monitoring is not the solution to filter CSAM. This also relates back to recent discussions about the EARN IT Act, a bill that would raise the bar for companies, potentially leading to monitoring of content on-device.

• The FTC is exploring new ways to regulate algorithms, including using FTC Section 5 authority. The agency is seeking comment on a number of issues. Some interesting discussion on other FTC actions here. And there’s a nice law review article on the matter here by Andrew Selbst and Solon Barocas. Notably, Lina Kahn and Rohit Chopra wrote about using Section 5 authority more extensively in Columbia Law Review in the past. And another law review article by Aneesa Mazumdar would use Section 5 authority to prevent algorithms from colluding with one another.

• In China, tech companies must share information about uses of algorithms. The government has published this information during a time of increasing efforts to regulate algorithmic systems.

• No, your AI can’t be an inventor on a patent in the United States says the Federal Circuit.

  The sole issue on appeal is whether an AI software system can be an “inventor” under the Patent Act. In resolving disputes of statutory interpretation, we “begin[] with the statutory text, and end[] there as well if the text is unambiguous.” BedRoc Ltd. v. United States, 541 U.S. 176, 183 (2004). Here, there is no ambiguity: the Patent Act requires that inventors must be natural persons; that is, human beings.

• As a new marketplace for prompts opens up, some interesting food for thought on whether prompts are copyrightable:

• Another IP question, do ML systems indicate when something has become generic. Notably, legal scholars have written in the past about how using Google can be a shortcut to analyzing trademark distinctiveness.

• A lawsuit has been filed against Meta alleging that OnlyFans abused its content filtering algorithms to squash competition. This one is interesting since it involves the alleged exploitation of content monitoring mechanisms for anti-competitive action by a third party. Note: Meta claims none of the allegations are true and if they back this up this case is likely to be dismissed quickly.

Policy and Legal Academia

• The CHIPS Act was passed. What does it mean for AI research and AI policy? Stanford HAI writes about it:

• Regulating the Risks of AI

  This Article is the first to examine and compare a number of recently proposed and enacted AI risk regulation regimes. It asks whether risk regulation is, in fact, the right approach. It closes with suggestions for addressing two types of shortcomings: failures to consider other tools in the risk regulation toolkit (including conditional licensing, liability, and design mandates), and shortcomings that stem from the nature of risk regulation itself (including the inherent difficulties of non-quantifiable harms, and the dearth of mechanisms for public or stakeholder input).

• If You Think AI Won't Eclipse Humanity, You're Probably Just a Human

  Building machines that can replicate human thinking and behavior has fascinated people for hundreds of years. Stories about robots date from ancient history through da Vinci to the present. Whether designed to save labor or lives, to provide companionship or protection, loyal, capable, productive machines are a dream of humanity. The modern manifestation of using human-like technology to advance social interests is artificial intelligence (AI). The continuing development of AI is inevitable and its relevance to national security will continue to grow.

Who am I? I’m a PhD (Machine Learning)-JD candidate at Stanford University, you can learn more about my research here.

What is this? The goal of this letter is to round up some interesting bits of information and events somewhere at the intersection of Law, Policy, and AI. Sometimes I will weigh in with thoughts or more in-depth summaries. Feel free to send me things that you think should be highlighted @PeterHndrsn. Also… just in case, none of this is legal advice.

Your briefing awaits below!

Law

• The American Data Privacy and Protection Act (ADPPA) was introduced to the House of Representatives. In it there is a section on Algorithmic Impact Assessment and Evaluation. There were some concerns that there might be pre-emption of California state law, but that is being worked out. EPIC has a nice breakdown of how different state laws are pre-empted (or not). Brookings also has another nice explainer. Notably Senator Cantwell argues that the bill "does not adequately protect women’s reproductive information because constraints on private lawsuits will make it harder for women to sue for violations." The EFF was not particularly happy with the bill either.

  "It would prohibit most covered entities from using covered data in a way that discriminates on the basis of protected characteristics (such as race, gender, or sexual orientation). It would also require large data holders to conduct algorithm impact assessments. These assessments would need to describe the entity’s steps to mitigate potential harms resulting from its algorithms, among other requirements. Large data holders would be required to submit these assessments to the FTC and make them available to Congress on request."

• Canada introduces the Digital Charter Implementation Act which also has an AI component.

  The Act seeks to ensure that "high-impact AI systems are developed and deployed in a way that identifies, assesses and mitigates the risks of harm and bias; establish[es] an AI and Data Commissioner to support the Minister of Innovation, Science and Industry in fulfilling ministerial responsibilities under the Act, including by monitoring company compliance, ordering third-party audits, and sharing information with other regulators and enforcers as appropriate; and outlin[es] clear criminal prohibitions and penalties regarding the use of data obtained unlawfully for AI development or where the reckless deployment of AI poses serious harm and where there is fraudulent intent to cause substantial economic loss through its deployment."

• FTC Report Warns About Using Artificial Intelligence to Combat Online Problems. I largely agree, there are a lot of problems with using AI for these purposes and the recommendations seem reasonable. To my mind, the aim of the report seems to be to throw cold water on calls for legislation requiring the use of AI in these cases, which would be certainly be problematic. I do, however, think that AI is likely necessary to tackle some of these challenges to some degree.

• U.S. DOJ has reached a settlement with Meta to prevent ad-discrimination under the Fair Housing Act. There has been some criticism of this settlement. I do think this is a good thing if there is real monitoring, and will test algorithmic fairness at scale. However, the maximum penalty under the FHA seems pretty low to have a significant enforcement effect.

  Under the deal, Meta must stop allowing advertisers to use the "Lookalike Audience" tool which can allow for discrimination based on protected characteristics under the Fair Housing Act. They must develop a new system by December 2022 which addresses disparities in housing ads. A third party reviewer will investigate and verify the new system to make sure it abides by the settlement terms. Meta must pay to the United States a civil penalty of **$115,054, the maximum penalty available under the Fair Housing Act.**

• The UK has created an algorithmic transparency standard. As part of this, they have been regularly releasing reports on uses of AI. For example on July 7, 2022 a report was released on by the Food Standards Agency on the use of AI for enforcement prioritization. Shameless self-promotion alert: We wrote about the challenges for enforcement prioritization, and discuss food standards agencies, in our recent work Beyond Ads: Sequential Decision-Making Algorithms in Law and Public Policy. Health safety rating systems can encode some biases that can lead to feedback loops and may be worth exploring more deeply. That’s not to say that ML shouldn’t be used in this context, but transparency is important to understand and resolve underlying data and technical issues.

• LinkedIn is being sued for its integration of machine learning algorithms with core products along a number of antitrust claims. I'm keeping an eye on how the antitrust+algorithms interaction plays out here.

• Antitrust lawsuit filed against Amazon, alleging that its pricing algorithms were programmed to match price floors of third party sellers. If you’re creating a pricing algorithm, might be worth checking with some attorneys whether you’re increasing liability...

• Judge Tosses Defamation Suit Brought By ShotSpotter Against Vice Media For Reporting On Its Shady Tactics. Though I'm not surprised this was dismissed, I'm keeping an eye on this space to see how companies selling AI respond to external audits.

Policy

• Stanford HAI drops a new audit challenge to identify potentially harmful or discriminatory algorithms (and techniques on how to find these failure modes).

• Georgetown CSET finds that U.S. universities aren't hiring enough faculty to keep up with demand for AI courses.

  Feel free to reach out and hire me as faculty!!

Who am I? I’m a PhD (Machine Learning)-JD candidate at Stanford University, you can learn more about my research here.

What is this? The goal of this letter is to round up some interesting bits of information and events somewhere at the intersection of Law, Policy, and AI. Sometimes I will weigh in with thoughts or more in-depth summaries. Feel free to send me things that you think should be highlighted @PeterHndrsn. Also… just in case, none of this is legal advice.

Your briefing awaits below!

Law

• Super-resolution, deepfakes, and other neural network-based processing have the ability to manipulate images so that they are not true to the original source. In a real courtroom exchange, Kyle Rittenhouse’s attorney tries to make an argument that Apple’s pinch-to-zoom feature distorts the image so that it cannot be used as evidence. (But it would seem that pinch-to-zoom doesn’t use any neural net to fill in pixels.) As AI is introduced to everyday products, we run the risk of requiring specialized equipment in courtrooms to provide the original image — or run the risk of battles-of-the-experts duking it out over what’s a true authentic image. So it’s probably a good idea for companies to provide options to access unaltered content for these sorts of situations.

• Contract attorneys are being monitored by AI to make sure they’re doing their jobs remotely. The system monitors activity and flags if it seems like the attorney isn’t working diligently on their task. And it has the same problem as the many other places where this sort of software has been deployed: it fails for people with dark skin. To my mind, using this software isn’t a good idea at all — ethically, pro-socially, or legally. It also seems like it might have labor law and anti-discrimination law implications, but we’ll see how it plays out in courts. Here’s a quote that stuck out:

“Several contract attorneys said they worried that their performance ratings, and potential future employability, could suffer solely based on the color of their skin. Loetitia McMillion, a contract attorney in Brooklyn who is Black, said she’d started wearing her hair down or pushing her face closer to the screen in hopes the system would stop forcing her offline.”

• If you’re interested in learning more about the problems with monitoring software, you can read a new article which dives deep into a similar type of system: emotion recognition AI used to monitor their employees.

• The White House is putting out a call for feedback on a bill of rights for an automated society. You can dial in and join this effort with White House OSTP. Ideally this bill of rights would prevent intrusive and potentially discriminatory uses of AI (see, e.g., above).

• Check out the interesting talks from a conference on the state of AI in the practice of law. [Shameless plug: If you’re interested in this subject, you might want to check out section 3.2 of our paper, “On the Opportunities and Risks of Foundation Models,” There, we write about the use of foundation models in legal contexts.]

• Legal scholars propose a right to contest an AI’s decision in this new Columbia Law Review article. So if you’re concerned that an AI system unfairly marked your performance as terrible at a job, this article would advocate for a system to contest such decisions.

• In U.S. prisons, natural language processing is being used to monitor prisoner phone calls. And it’s been going on for a while. What are the prisons looking for? Criminal activity, gang relationships, Covid infections/symptoms, instances of self-harm, and even positive comments about the prison to help fight lawsuits. As you can imagine, there are many potential problems with these use cases, including privacy concerns, the risk of falsely labeling someone a gang member, etc. Can this be challenged in court? Prisoners don’t have a right to privacy for telephone calls in most U.S. states, so it’s certainly an uphill battle. See, e.g., People v. Diaz, 33 N.Y.3d 92, 122 N.E.3d 61 (NY 2019). 

In Calhoun County, Alabama, prison authorities used Verus to identify phone calls in which prisoners vouched for the cleanliness of the facility, looking for potential ammunition to fight lawsuits, email records show.

As part of an emailed sales pitch to the jail in Cook County, Illinois, LEO’s chief operating officer, James Sexton, highlighted the Alabama case as an example of the system’s potential uses.

“(The) sheriff believes (the calls) will help him fend off pending liability via civil action from inmates and activists,” he wrote.

• The NYC Council passed the first U.S. Law regarding fairness of AI-based hiring tools. But some argue that it doesn’t go far enough. For example, critics argue that the bill only requires companies to audit for discrimination on the basis of race or gender (ignoring discrimination based on other characteristics, like age or disability).

“This bill would require that a bias audit be conducted on an automated employment decision tool prior to the use of said tool. The bill would also require that candidates or employees that reside in the city be notified about the use of such tools in the assessment or evaluation for hire or promotion, as well as, be notified about the job qualifications and characteristics that will be used by the automated employment decision tool. Violations of the provisions of the bill would be subject to a civil penalty.”

• Two law review articles discuss opacity of black box machine learning systems. One law review article suggests that there should be fewer restrictions on opening the black box — open ML systems can help open science and innovation. Another suggests a more nuanced approach where “[t]he degree to which legal opacity should be limited or disincentivized depends on the specific sector and transparency goals of specific AI technologies, technologies which may dramatically affect people’s lives or may simply be introduced for convenience.” This discussion has implications for how we think about model releases and terms of use, as well as policies for forcing transparency with respect to AI systems.

• A new law review article argues that “the Fourth Amendment imposes significant limits on the preservation of Internet account contents.” This new interpretation of the Fourth Amendment would mean that the government can’t just give a blanket order for a company to preserve your data in case law enforcement needs it.

Preservation triggers a Fourth Amendment seizure because the provider, acting as the government’s agent, takes away the account holder’s control of the account. To be constitutionally reasonable, the initial act of preservation must ordinarily be justified by probable cause—and at the very least, in uncommon cases, by reasonable suspicion. The government can continue to use the Internet preservation statute in a limited way, such as to freeze an account while investigators draft a proper warrant application. But the current practice, in which investigators order the preservation of accounts with no particularized suspicion, violates the Fourth Amendment.

Policy & Society

• The European Commission proposes a common European data space for cultural heritage. This might be an interesting new data source for building cross-cultural machine learning models and perspectives (within Europe). Though it is not clear exactly what kind of data will be there.

• Explainable AI is often described in policy circles as being a necessary and sufficient component for deploying a model. Among many recent works challenging this notion, a recent article addresses the problem with the reliance on explainability in medical settings.

• A new paper has some interesting (and concerning) insights on the interaction between AI and autocracies:

We first show that autocrats benefit from AI: local unrest leads to greater government procurement of facial recognition AI, and increased AI procurement suppresses subsequent unrest. We then show that AI innovation benefits from autocrats’ suppression of unrest: the contracted AI firms innovate more both for the government and commercial markets. Taken together, these results suggest the possibility of sustained AI innovation under the Chinese regime: AI innovation entrenches the regime, and the regime’s investment in AI for political control stimulates further frontier innovation.

• The Chinese military allegedly is investing heavily in AI to counter the U.S. Department of Defense’s heavy investments in AI.

• A short article examines the implications of code generation systems (e.g., CodeX, Github Copilot) for cybersecurity.

• Facebook removes fine-grained ad targeting for certain types of categories (e.g., health causes, sexual orientation, religious practices and groups).

• CSET puts out a policy memo describing how the U.S. can stay competitive in AI.

Who am I? I’m a PhD (Machine Learning)-JD candidate at Stanford University, you can learn more about my research here.

What is this? The goal of this letter is to round up some interesting bits of information and events somewhere at the intersection of Law, Policy, and AI. Sometimes I will weigh in with thoughts or more in-depth summaries. Feel free to send me things that you think should be highlighted @PeterHndrsn. Also… just in case, none of this is legal advice.

Your first briefing awaits below!

Law

• A new paper, “Can I use this publicly available dataset to build commercial AI software? Most likely not” has popped up on arxiv. It analyzes the use of datasets for commercial and non-commercial contexts, and suggests that people aren’t really abiding by licenses/copyright properly! Keep in mind, though, in many countries/governments (e.g., the United States, the European Union, and Japan) there are “fair use” exemptions, allowing text/data mining on copyrighted data for non-commercial research.

• The U.S. Copyright office, as part of its triennial rule-making process, has created a rule that limits liability for removing DRM for the purposes of conducting text/data mining for non-commercial research. Prior to this, if you removed DRM for text/data mining, you would probably be liable under the DMCA act. Now, probably not.

• In recent oral arguments in the 9th Circuit, LinkedIn argues that bypassing an IP block for the purposes of scraping constitutes a violation of the Computer Fraud and Abuse Act (CFAA) - making it a potentially criminal act. The judges seemed unconvinced. The outcome of this case will determine, among other things, whether you are liable if you use proxies to evade being blocked for scraping a website. For those using proxies to avoid being blocked while scraping together data for a dataset, keep a close eye on this.

• For dataset providers located in China, new rules might restrict what data can be transferred out of China. See analysis here. This has obvious implications for data sharing and hosting for the purposes of, say, training large language models.

• The state of Michigan has passed a bill that would restrict government agents from using encrypted apps. This is good for transparency, but probably not so great for security. Why is this relevant to AI? Well, if you wanted to discover how governments are using AI, you often have to file a Freedom of Information Act (FOIA) request to get communications between government employees. If they encrypt or use apps like Signal, you would probably never get those messages — and never uncover potentially problematic uses of AI.

• The CFPB will take action to prevent false identification by background screening companies. Without regulation, it is highly likely that ML will be commonly used for identity matching in the future — it is already common in biometrics. The CFPBs enforcement decision aims to address bias/unfairness in background screening processes. “The risk of mistaken identities from name-only matching is likely to be greater among Hispanic, Black, and Asian communities because there is less surname diversity in those populations compared to the white population.” Mistaken identities can impact job prospects, credit ratings, and livelihoods — intervention and regulation is important.

Policy and Society

• NATO has a new AI strategy. There is some mention of responsible use of AI, but this is a very high-level policy and the details matter a lot here.

• A voluntary Russian national code of ethics on artificial intelligence has been put forward by the AI Alliance jointly with the Analytical Center under the Russian government and the Economic Development Ministry. It was signed by “Sberbank, Gazprom Neft, Yandex VK, MTS and the Russian Direct Investment Fund, as well as representatives of Skolkovo, Rostelecom, Rosatom, InfoWatch and real estate platform Cian.” It can be found here.

• A job market paper in economics, “Loan Officers, Algorithms, & Credit Outcomes:Experimental Evidence from Pakistan,” examines real loan officer decisions in Pakistan as compared to an algorithm. The paper finds that “loan officers exhibit a gender equity preference and approve more women once they observe gender without raising overall loan default.” Conversely, “while discrimination declines for loan officers, it increases for the algorithm.” The outcome suggests that “blinding algorithms to applicant demographic characteristics may boost efficiency and ensure equity in developing economy credit markets.”

• Zillow lays off a large part of its workforce after its pricing algorithm induces staggering losses. This is a cautionary tale of using neural networks without thorough validation procedures in place — and constant re-assessment. I also wonder about its local effects on housing prices.

• A new study from CSET examines the number of robotics patents by country. It finds that though Russia has 2% of robotics patents, it has 17% of all robotics patents for military applications. The United States has a similar trend with 13.2% of all robotics patents and 26.2% of military robotics patents. China and Japan have the opposite trend. China has 34.6% of all robotics patents and 24.9% of the military robotics patents. Japan has 20.8% of all robotics patents and 2.2% of military robotics patents.