/>iDifferent businesses have different concerns when it comes to bringing AI into their workflows. For example, businesses looking to use AI to help answer questions from the public may be concerned about AI hallucinations (incorrect or misleading results that AI models generate) that can expose the business to liability or reputational harm. Some businesses may be concerned about the privacy of employees and customers. Many may be concerned about possible liability for copyright infringement. And, some (or maybe all) may be concerned about keeping their proprietary competitive data safe so that the AI platform doesn’t share the business’s data with competitors.
Businesses can stop their proprietary competitive data from becoming publicly available on public AI platforms only by preventing that AI from training on their data. One way to do this is by choosing to use an open-source AI platform on the business’s internal servers instead of using a closed-source AI platform that is hosted on servers not controlled by the business.
An open-source AI platform is one in which the code and information ingested into the AI may be “freely” downloaded onto a private server. (“Freely” is in quotation marks because the license terms, while not requiring monetary payment, sometimes require other consideration, as discussed below.) Once that code and information is hosted on a private server, hidden from the public internet, any information that is fed into that platform remains on the private server, preventing the disclosure of data to the public. In contrast, closed-source AI platforms are hosted on servers external to the business, and any information that is fed into that platform may be used to train the platform, exposing private data to the danger of disclosure.
However, despite this clear benefit of open-source AI over closed-source AI, the choice is not clear cut. Just as with open-source versus closed-source software, open-source and closed-source AI each have benefits and drawbacks.
Generative AI Trains on Content, Including Content Fed to It from User Prompts
Many businesses already incorporate some form of AI into their workflows. In most cases these are single-purpose AI models that are trained to do one thing. These models don’t present the same dangers as the more-robust generative AI that businesses may be interested in bringing into their workflows, nor can they create the same possible benefits and efficiencies. Generative AI is multipurpose and has the ability to generate content – audio, video, text, photographic – in practically any area. Generative AI gains this ability by “training” on content.
In some cases, generative AI trains on publicly and freely available content. In other cases, it trains on content from websites that attempt to limit the free availability of their content. Of great concern is that, in many cases, generative AI is trained by information that is fed into it by users seeking information. For a business, this means that if an employee enters a prompt into a publicly available generative AI platform, the AI gathers information from that prompt and can then share the information with others.
For example, if an employee enters a business’s financial information into a public generative AI platform and asks the platform to create a forecasting model, that financial information – along with the identity of the business – is now in the public domain and is part of the “knowledge” of that public platform that may be shared with others.
Because generative AI must train on huge amounts of data, creating a generative AI platform is very expensive. Therefore, only companies with a tremendous amount of capital may practically develop generative AI platforms, limiting the number of robust platforms. The large tech companies, such as Apple, Meta, Microsoft, Alphabet, X and OpenAI, have created their own generative AI platforms, and each of these companies controls its own platform. This private control of the powerful platforms creates dangers that are currently the subject of government inquiry and debate.
Government and Industry Debate the Pros and Cons of Open-Source AI
In October 2023, President Biden issued an Executive Order1 on “Safe, Secure, and Trustworthy Artificial Intelligence.” This Order was directed to companies that own and control generative AI platforms, Congress, the Department of Justice, federal civil rights offices, the Department of Health and Human Services, and other agencies, requiring them to, for example, share testing and safety results of their platforms with the government; develop standards, tools and tests to ensure that the platforms are safe, secure and trustworthy; and address algorithmic discrimination.
The Order also directed the National Telecommunications and Information Administration (NTIA) to review the risks and benefits of AI models and develop policy recommendations to maximize those benefits while mitigating the risks. In February 2024, NTIA issued its requests for comments2 to solicit public feedback in response to the Order. The request received more than 300 comments3, focused largely on the pros and cons of open-source AI versus closed-source AI.
The Cybersecurity Infrastructure and Security Agency (CISA)4 issued comments in favor of open-source AI, with appropriate safeguards in place to protect against bad actors seeking to exploit the platforms. CISA also released a blog post5 urging the public not to forget lessons learned from open-source software when deploying open-source AI. The Federal Trade Commission (FTC) recently released a blog post6 in favor of open-source AI, again with appropriate protections in place. Industry7 also has joined the debate between open-source and closed-source AI.
This debate is directed to and between governing bodies and the few companies that control generative AI platforms. Cybersecurity and consumer protection are primary focuses of government, while companies may have commercial motivations dictating their positions in this debate. However, the opinions circulating about open-source and closed-source AI don’t provide guidance to individual businesses regarding what makes the most sense for them.
Understanding and Weighing the Pros and Cons of Open-Source and Closed-Source AI
For individual businesses seeking to deploy an AI platform, concerns likely include ease of customization, cybersecurity, privacy, hallucinations, accuracy, copyright infringement and, yes, protection of proprietary competitive data.
Some of the concerns regarding open-source AI have been debated and dissected for years with respect to open-source software, and a few principles are widely accepted. For example, open-source software code that is publicly available has the benefit of a global community of programmers, adding functionality and cybersecurity protections that individual businesses can easily incorporate into their software that is based on the same open-source code.
With respect to copyright matters, businesses have learned to look at the specific license that governs the open-source code that they’d like to customize for their internal use. In many cases, the license requires that any customer software based on that open-source code also be released as open-source. For many businesses, the requirement of open-sourcing their proprietary software weighs heavily against using open-source software.
Another copyright concern with open-source software is that, since the origin and development of the software is often unclear, it is possible that some of the code incorporated into the “open-source” software is actually copyrighted and not subject to an open-source license. An extreme case concerning copyright infringement arising from the use of open-source software was decided by the Supreme Court in 2021 in Google LLC v. Oracle America Inc.8
These same considerations surround the use of open-source AI platforms. On one hand, cybersecurity and functionality is developed by a global community, making the platform simple to adopt and customize, and providing some measure of comfort regarding the safety of information in the face of a bad actor. With respect to a business’s proprietary competitive information, open-source AI platforms should keep this information safe from disclosure to the public, while the information may be less secure when using closed-source AI platforms.
On the other hand, the specific license terms to which open-source AI platforms are subject may be full of minefields. Specific dangers to consider with open-source AI platforms’ licenses are the indemnities for hallucinations and misinformation; trickle-down copyright infringement (i.e., if the platform is found liable for copyright infringement based on the content on which it trained, the business that uses that platform also may be liable for the copyright infringement); requirements to open-source any customized software built on the platform; and risk of termination of the license for any reason.
A good start for a business seeking to deploy AI is to consult with a legal professional with expertise in internet law, technology, cybersecurity and data protection to help weigh the pros and cons of using open-source AI platforms and to help draft contracts that protect the business from sharing its proprietary competitive data.
6 https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/open-weights-foundation-models
7 https://about.fb.com/news/2024/07/open-source-ai-is-the-path-forward/;
https://x.com/elonmusk/status/1767108624038449405?lang=en
8 https://www.supremecourt.gov/opinions/20pdf/18-956_d18f.pdf
