this post was submitted on 18 Dec 2023
264 points (93.7% liked)

Technology

83696 readers
689 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS
 

Data poisoning: how artists are sabotaging AI to take revenge on image generators::As AI developers indiscriminately suck up online content to train their models, artists are seeking ways to fight back.

top 49 comments
sorted by: hot top controversial new old
[–] gaiussabinus@lemmy.world 50 points 2 years ago (1 children)

This system runs on the assumption that A) massive generalized scraping is still required B) You maintain the metadata of the original image C) No transformation has occurred to the poisoned picture prior to training(Stable diffusion is 512x512). Nowhere in the linked paper did they say they had conditioned the poisoned data to conform to the data set. This appears to be a case of fighting the last war.

[–] sukhmel@programming.dev 13 points 2 years ago

It is likely a typo, but "last AI war" sounds ominous πŸ˜…

[–] Blaster_M@lemmy.world 47 points 2 years ago

Takes image, applies antialiasing and resize

Oh, look at that, defeated by the completely normal process of preparing the image for training

[–] zwaetschgeraeuber@lemmy.world 28 points 2 years ago (1 children)

nightshade and glaze never worked. its scam lol

[–] kromem@lemmy.world 11 points 2 years ago

Shhhhh.

Let them keep doing the modern equivalent of "I do not consent for my MySpace profile to be used for anything" disclaimers.

It keeps them busy on meaningless crap that isn't actually doing anything but makes them feel better.

[–] qooqie@lemmy.world 24 points 2 years ago

Unfortunately for them there’s a lot of jobs dedicated to cleaning data so I’m not sure if this would even be effective. Plus there’s an overwhelming amount of data that isn’t β€œpoisoned” so it would just get drowned out if never caught

[–] Kushia@lemmy.ml 22 points 2 years ago

Artists and writers should be entitled to compensation for using their works to train these models, just like any other commercial use would. But, you know, strict, brutal free-market capitalism for us, not the mega corps who are using it because "AI".

[–] Potatos_are_not_friends@lemmy.world 22 points 2 years ago (2 children)

Imagine if writers did the same things by writing gibberish.

At some point, it becomes pretty easy to devalue that content and create other systems to filter it.

[–] scorpious@lemmy.world 9 points 2 years ago

if writers did the same things by writing gibberish.

Aka, β€œX”

[–] books@lemmy.world 2 points 2 years ago (2 children)

I mean isn't that eventually going to happen? Isn't ai going to eventually learn and get trained from ai datasets and small issues will start to propagate exponentially?

I just assume we have a clean dataset preai and messy gross dataset post ai... If it keeps learning from the latter dataset it will just get worse and worse, no?

[–] General_Effort@lemmy.world 3 points 2 years ago

Not really. It's like with humans. Without the occasional reality checks it gets weird, but what people chose to upload is a reality check.

The pre-AI web was far from pristine, no matter how you define that. AI may improve matters by increasing the average quality.

[–] LWD@lemm.ee 2 points 2 years ago* (last edited 2 years ago)
[–] kromem@lemmy.world 13 points 2 years ago* (last edited 2 years ago)

This doesn't actually work. It doesn't even need ingestion to do anything special to avoid.

Let's say you draw cartoon pictures of cats.

And your friend draws pointillist images of cats.

If you and your friend don't coordinate, it's possible you'll bias your cat images to look like dogs in the data but your friend will bias their images to look like horses.

Now each of your biasing efforts become noise and not signal.

Then you need to consider if you are also biasing 'cartoon' and 'pointillism' attributes as well, and need to coordinate with the majority of other people making cartoon or pointillist images.

When you consider the number of different attributes that need to be biased for a given image and the compounding number of coordinations that would need to be made at scale to be effective, this is just a nonsense initiative that was an interesting research paper in lab conditions but is the equivalent of a mouse model or in vitro cancer cure being taken up by naturopaths as if it's going to work in humans.

[–] HejMedDig@feddit.dk 12 points 2 years ago (1 children)

Let's see how long before someone figures out how to poison, so it returns NSFW Images

[–] AVincentInSpace@pawb.social 4 points 2 years ago* (last edited 2 years ago) (2 children)

companies would stumble all over themselves to figure out how to get it to stop doing that before going live. source: they already are. see bing image generator appending "ethnically ambiguous" to every prompt it receives

it would be a herculean if not impossible effort on the artists' part only to watch the corpos scramble for max 2 weeks.

when will you people learn that you cannot fight AI by trying to poison it. there is nothing you can do that horny weebs haven't already done.

[–] General_Effort@lemmy.world 3 points 2 years ago

It can only target open source, so it wouldn't bother corpos at all. The people behind this object to not everything being owned and controlled. That's the whole point.

[–] HejMedDig@feddit.dk 1 points 2 years ago (1 children)

The Nightshade poisoning attack claims that it can corrupt a Stable Diffusion in less than 100 samples. Probably not to NSFW level. How easy it is to manufacture those 100 samples is not mentioned in the abstract

[–] AVincentInSpace@pawb.social 2 points 2 years ago* (last edited 2 years ago) (1 children)

yeah the operative word in that sentence is "claims"

I'd love nothing more than to be wrong, but after seeing how quickly Glaze got defeated (not only did it make the images nauseating for a human to look at despite claiming to be invisible, not even 48 hours after the official launch there was a neural network trained to reverse its effects automatically with like 95% accuracy), suffice to say my hopes aren't high.

[–] HejMedDig@feddit.dk 1 points 2 years ago

You seem to have more knowledge on this than me, I just read the article πŸ™‚

[–] RagingRobot@lemmy.world 11 points 2 years ago (1 children)

So it sounds like they are taking the image data and altering it to get this to work and the image still looks the same just the data is different. So, couldn't the ai companies take screenshots of the image to get around this?

Not even that, they can run the training dataset through a bulk image processor to undo it, because the way these things work makes them trivial to reverse. Anybody at home could undo this with GIMP and a second or two.

In other words, this is snake oil.

[–] uriel238@lemmy.blahaj.zone 10 points 2 years ago* (last edited 2 years ago)

The general term for this is adversarial input, and we've seen published reports about it since 2011 when ot was considered a threat if CSAM could be overlayed with secondary images so they weren't recognized by Google image filters or CSAM image trackers. If Apple went through with their plan to scan private iCloud accounts for CSAM we may have seen this development.

So far (AFAIK) we've not seen adversarial overlays on CSAM though in China the technique is used to deter trackng by facial recognition. Images on social media are overlaid by human rights activists / mischief-makers so that social media pics fail to match secirity footage.

The thing is like an invisible watermark, these processes are easy to detect (and reverse) once users are aware they're a thing. So if a generative AI project is aware that some images may be poisoned, it's just a matter of adding a detection and removal process to the pathway from candidate image to training database.

Similarly, once enough people start poisoning their social media images, the data scrapers will start scaning and removing overlays even before the database sets are sold to law enforcement and commercial interests.

[–] yuki2501@lemmy.world 1 points 2 years ago

Feeding garbage to the garbage. How fitting.

Fighting the uphill battle to irrelevance ..

[–] drmoose@lemmy.world -1 points 2 years ago (2 children)

Just don't out your art to public if you don't want someone/thing learn from it. The clinging to relevance and this pompous self importance is so cringe. So replacing blue collar work is ok but some shitty drawings somehow have higher ethical value?

[–] Catoblepas@lemmy.blahaj.zone 4 points 2 years ago (2 children)

"Just don't make a living with your art if you aren't okay with AI venture capitalists using it to train their plagiarism machines without getting permission from you or compensating you in any way!"

If y'all hate artists so much then only interact with AI content and see how much you enjoy it. πŸ€·β€β™‚οΈ

[–] cm0002@lemmy.world 3 points 2 years ago (2 children)

using it to train their plagiarism machines

That's simply not how AI works, if you look inside the models after training, you will not see a shred of the original training data. Just a bunch of numbers and weights.

[–] fruitycoder@sh.itjust.works 5 points 2 years ago

| Just a bunch of numbers and weights

I agree with your sentiment, but it's not just that the data is encoded as a model, but it's extremely lossy. Compression, encoding, digital photography, etc is just turning pictures into different numbers to be processed by some math machine. It's the fact that a huge amount of information is actually lost during training, intentionally, that makes a huge difference. If it was just compression, it would be a gaming changing piece of tech for other reasons. YouTube would be using it today, but it is not good at keeping the original data from the training.

Rant not really for you, but in case someone else nitpicks in the future :)

[–] Catoblepas@lemmy.blahaj.zone 1 points 2 years ago (1 children)

If the individual images are so unimportant then it won't be a problem to only train it on images you have the rights to.

[–] Astarii_Tyler@lemmy.world 3 points 2 years ago (1 children)

They do have the rights because this falls under fair use, It doesn't matter if a picture is copyrighted as long as the outcome is transformative.

[–] Catoblepas@lemmy.blahaj.zone 3 points 2 years ago

I'm sure you know something the Valve lawyers don't.

[–] teichflamme@lemm.ee 2 points 2 years ago (1 children)

It has literally nothing to do with plagiarism.

Every artist has looked at other art for inspiration. It's the most common thing in the world. Literally what you do in art school.

[–] Catoblepas@lemmy.blahaj.zone 3 points 2 years ago (1 children)

It's not an artist any more than a xerox machine is. It hasn't gone to art school. It doesn't have thoughts, ideas, or the ability to create. It can only take and reuse what has already been created.

[–] teichflamme@lemm.ee 3 points 2 years ago

The ideas are what the prompts and fine tuning is for. If you think it's literally copying an existing piece of art you just lack understanding because that's not how it works at all.

[–] cm0002@lemmy.world -2 points 2 years ago (1 children)

Right, if you post publicly, expect it to be used publicly

[–] Ilovethebomb@lemm.ee 2 points 2 years ago (1 children)

Yeah, no. There's a difference between posting your work for someone to enjoy, and posting it to be used in a commercial enterprise with no recompense to you.

[–] ASeriesOfPoorChoices@lemmy.world -1 points 2 years ago (2 children)

Wait until you find out how human artists learn.

[–] BURN@lemmy.world 2 points 2 years ago (1 children)

They learn completely different from an AI model, considering an AI model cannot learn

[–] Ilovethebomb@lemm.ee 1 points 2 years ago (1 children)

And you don't see how those two things are different?

And you don't see how those two things are similar?

[–] Kedly@lemm.ee -4 points 2 years ago (1 children)

Man, whenever I start getting tired by the amount of Tankies on Lemmy, the linux users and decent AI takes in users rejuvenates me. The rest of the internet has jumped full throttle on the AI hate train

[–] BURN@lemmy.world 4 points 2 years ago (4 children)

The β€œAI hate train” is people who dislike being replaced by machines, forcing us further into the capitalist machine rather than enabling anyone to have a better life

[–] fruitycoder@sh.itjust.works 10 points 2 years ago

No disagreement, but it's like hating water because the capitalist machine used to run water mills. It's a tool, what we hate is the system and players working to entrench themselves and it. Should we be concerned about the people affected? Yes, of course, we always should have been, even before it was the "creative class" and white collar workers at risk. We should have been concerned when it was blue collar workers being automated or replaced by workers in areas with repressive regimes. We should have been concerned when it was service workers being increasingly turned into replaceable cogs.

We should do something, but people are titling at windmills instead of the systems that oppress people. We should be pushing for these things to be public goods (open source like stability is aiming for, distributed and small models like Petals.dev and TinyML). We should be pushing for unions to prevent the further separation of workers from the fruits of their labor (look at the Writer's Guild's demands during their strike). We should be trying to only deal with worker and community cooperatives so that innovations benefit workers and the community instead of being used against them. And much more! It's a lot, but it's why I get mad about people wasting their time being made AI tools exist and raging against them instead of actually doing things to improve the root issues.

The "AI hate train" runs on fear and skips stops for reason, headed for a fictional destination.

[–] General_Effort@lemmy.world 3 points 2 years ago

Not saying that there aren't people like that, but this ain't it. This tool specifically targets open source. The intention is to ruin things that aren't owned and controlled by someone. A big part of AI hate is hyper-capitalist like that, though they know better than saying it openly.

People hoping for a payout get more done than people just being worried or frustrated. So it's hardly a surprise that they get most of the attention.

[–] Kedly@lemm.ee 1 points 2 years ago

Thing is, its capitalism thats our enemy, not the tech that is freeing us up from labour. Its not the tech thats the problem, its our society, and if fucking sucks that I'm just as poor as the rest of you, but because I finally have a tool that lets me satisfactorily lets me access my creativity, I'm being villianized by the art community, even though the tech I am using is open source and no capitalist is profiting off of me