On Sun, Jul 26, 2026 at 05:04:50PM -0500, Marc Haber wrote:
> I am concerned however that people would not vote for a permissive
> version if the "keep confidential things and credentials off AI
> tools" is not present.
What I believe this prohibition is trying to protect against is
ensuring that confidential information isn't used as part of some AI
Training, risking that the confidential information might be discorged
in a future LLM output.
That's a fair concern, but there are a number of ways this can be
prevented.
(a) Using a Local LLM running on your own system.
(b) Making sure that the Cloud LLM provider doesn't use the data for
training purposes. For example, ChatGPT does *not* use chat data
for training for their Business and Enterprise accounts *ever*,
but for personal/individual accounts, the use of your data for
training is enabled by default, but you can turn it off[1].
Google stated that it doesn't use GMail data *ever* for Training;
you can explicitly opt in the use of your GMail and other Google
Docs data as input for Retrieval Augmented Generation (RAG) for
*your* queries; that is, it will use your data to help answer a
query, but it isn't use for training future LLM models[2].
[1]
https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance
[2] https://www.snopes.com/news/2025/11/21/google-ai-emails-chats/
It might be a good idea to make that available as part of training for
people who want to use AI tools responsibly. But as far as I'm
concerned, it's not that different from being careful not to check in
API keys into a git repository and then publishing it on github or
Salsa. The solution is to teach people how to perform due diligence
checks. The solution is not to ban git because someone being careless
could leak information.
If we want to add something to the policy, my suggestion is to make it
be very specific --- make sure that your private data is not made
available such that it could be used as training data for an LLM.
- Ted
