AI in Society: Law and Ethics

CRISP-DM consists of six stages: business understanding, data understanding, data preparation, modeling, evaluation, and deployment. The first is business understanding, which decides the business problem to be solved and the criteria for what counts as success. Examining the quality and distribution of the data is data understanding, handling missing values and creating features is data preparation, and incorporating it into a business system is the deployment stage. It is also worth keeping in mind that the six stages are not a one-way flow but are depicted as a cycle that iterates, going back to earlier stages.

PoC stands for proof of concept, and it is the process of building something small and trying it out before investing in full-scale development, to confirm whether that data achieves the needed accuracy and, if it does, whether the business can actually run on it. Since the goal is not to build a finished product, unless the conditions for moving forward and for withdrawing are decided beforehand, you end up repeating trials that produce no results. Running monitoring and retraining after production deployment is MLOps, assigning correct-answer labels is annotation, and redesigning the business workflow itself is BPR — all of which refer to processes separate from a PoC.

Annotation is the work of manually attaching correct-answer labels or region information to raw data, and it is indispensable for supervised learning. If the standard for attaching labels varies from worker to worker, it sets the ceiling on the model's performance right there, so designing work instructions and a quality check is key. Gathering and organizing a large amount of text is a corpus; splitting into training and validation sets, and handling missing values and outliers, are separate tasks within data preparation — neither is the act of attaching labels itself.

Data leakage is a phenomenon in which information that would not actually be obtainable at the time of prediction gets mixed into the training data, making the accuracy measured during validation come out far higher than the true capability. It happens in forms such as including the date a cancellation request was received when predicting churn, computing the mean and standard deviation used in preprocessing from the whole dataset including the validation data, or randomly splitting time-series data while ignoring time order. Fitting too closely to the training data is overfitting, and its cause lies not in "using information you should not have used" but in "fitting too closely." The amount of needed data ballooning as dimensions increase is the curse of dimensionality — both have a different cause from leakage.

MLOps is the idea of not ending things once a model is deployed, but monitoring the distribution of input data, the tendency of predictions, and even business metrics, and running as a system the cycle of updating the training data and rebuilding the model when a gap appears, then deploying it again. As the world changes, the tendency of inputs changes too, and accuracy quietly declines, so a single check is not enough. Borrowing computing resources is the use of the cloud, and bundling the runtime environment for reproducibility is the role of Docker — both are tools that support MLOps, but neither is itself the definition of MLOps.

BPR stands for business process reengineering, and it refers to the effort of redesigning the workflow itself, going back to the purpose of the business, rather than partially improving the existing procedure. If you place AI on top while keeping the procedure as is, it can end up just adding a step where a person transcribes the AI's output, producing no effect; the success or failure of AI adoption is decided here more often than by accuracy alone. Hearing requirements is grasping stakeholders' needs, and shaping data into a learnable form is data preparation — neither is the redesign of the business process itself.

Waterfall is an approach that fixes each stage in order starting from requirements definition, on the premise of not going back. However, AI development has the nature that you do not know how far the accuracy will reach until you actually train the model, so the deliverable and the requirements cannot be fixed in advance. For that reason, the exploration and PoC stages take an agile form that proceeds through short iterations, and once the achievable accuracy comes into view, a combination is used where the main development stage is then fixed. This property also directly affects how the development contract is designed, that is, whether to use a contract for work (ukeoi) or a quasi-mandate contract (jun-inin).

Docker is a technology that bundles the runtime environment, including the application and its libraries, as a container. Because the same container can be run on both the development machine and in production, mismatches such as "it worked on my machine" due to version differences are reduced. Keeping progress and results together with an explanation in a single document is Jupyter Notebook, making something callable over HTTP is a web API, and borrowing computing resources only for as long as needed is the use of the cloud — all of which refer to other tools used in AI development.

A corpus refers to a large amount of text data gathered and organized for natural language processing. Depending on its use, it may also have part-of-speech or syntactic information attached. A general collection of data published for research and development is an open dataset, which also includes images and audio and is not limited to text. A vector representation of words is a product of training, not a collection of data, and morphological analysis is a method for processing text — neither matches the definition of a corpus. Note that a corpus also has a license and terms of use, so whether commercial use or redistribution is allowed needs to be checked individually.

Open innovation is the idea of not staying closed within one's own in-house research and development, but actively bringing in outside technology, knowledge, and people to create value. The syllabus lists industry-academia collaboration and collaboration with other companies or other industries under the same mid-level topic, and its means include joint research with universities and other research institutions, and teaming up with a partner that has data or a sales channel one does not have in-house. Releasing something for free is the idea of open source, which points in the opposite direction from bringing in outside resources. An in-house cross-department structure and the use of published datasets do not, either of them, refer to collaboration with an outside party.

Anonymously processed information is processed so that a specific individual cannot be identified and so that the original personal information cannot be restored. Because it has been processed this far, it can, following the prescribed procedure, be provided to a third party without the individual's consent. Pseudonymously processed information, on the other hand, is processed to the degree that a specific individual cannot be identified unless cross-referenced with other information; the effort of processing is lighter, such as just removing the name, and it retains analytical value, but in exchange it generally cannot be provided to a third party, and it is intended for internal analytical use by the business. Remember it as: the lighter the processing, the less it can be taken outside — that helps avoid mixing the two up.

Personal identification codes include physical-characteristic data such as fingerprint data, facial recognition data, and codes converted from DNA base sequences, as well as numbers assigned to an individual such as My Number, passport numbers, and driver's license numbers. These count as personal information on their own, so it is incorrect to think that without a name they are not personal information. Whether something counts as personal information is also not decided by whether consent was obtained at acquisition, and it does not become personal information only once put into a database. Note that information that has been systematically organized into a searchable state is called personal data, and additional obligations attach to it.

GDPR is the EU's General Data Protection Regulation, a piece of EU legislation separate from Japan's Act on the Protection of Personal Information. Its distinguishing feature is extraterritorial application: if there are circumstances such as offering goods or services to people located within the EU, or monitoring the behavior of people within the EU, it can apply even to a business developing within Japan. So whether a business is subject to it cannot be judged solely by whether its base is in the EU. It also should be kept in mind that it is not an extension of Japanese law, and it is not non-binding guidance either.

Article 30-4 of the Copyright Act provides that, when the purpose is not to enjoy the thoughts or feelings expressed in a copyrighted work oneself, nor to have another person enjoy them, the work may be used to the extent found necessary. "Enjoy" refers to appreciating the thoughts or feelings expressed in a work to obtain intellectual or emotional satisfaction, and the act of reading it in as data for machine learning is understood not to fall under this. Item 2 of the same article explicitly names information analysis, and the creation and use of training data falls under this. Being published for free, not being for a commercial purpose, and the amount used being small are, none of them, requirements set by this provision.

Article 30-4 carries a proviso stating that this does not apply in cases that, in light of the type and purpose of the copyrighted work and the manner of the use, would unreasonably harm the interests of the copyright holder. So it cannot be said that "anything goes for AI training." For example, if you copy a database sold for information-analysis purposes without purchasing it and use it for training, that is considered to fall under the proviso because it harms the market for that database. Also, even if the input stage of training is lawful, if the generated output resembles an existing copyrighted work, copyright infringement can separately become an issue at the output stage of generation or use. Input and output are evaluated separately. Whether the work was purchased for a fee is not the standard that decides whether this provision applies.

Because copyright is a system that protects a human's creative expression, something an AI merely output automatically does not become a copyrighted work. On the other hand, if a human has been involved to the degree that they can be said to have given it its essential creative characteristics in expression, there is room for copyrightability to be recognized. The key to the judgment is creative contribution, and things such as the specificity of the instructions and trial and error, and the degree of selection and revision of the generated output, are examined case by case. Therefore both the view that it never becomes a copyrighted work and the view that the person who gave the instruction always gains rights are incorrect. Note also that, separately from copyright law, the terms of use of the service used may set out how the generated output is handled, so both need to be checked.

An employee invention is an invention made by an employee as part of their duties. The right to obtain a patent arises in principle in the employee, the inventor, but if provided for in advance in work rules or the like, it can instead be made to belong to the employer from the moment it arises. In that case, the employee is recognized as having the right to receive a reasonable monetary or other economic benefit, so it is not a system where the right is taken without any compensation. The key point is also that it does not always belong to the employer, and there is room for it to belong to the employer, too — the treatment changes depending on whether such a provision exists.

The three requirements for a trade secret are that it is managed as a secret (secret management), that it is technical or business information useful for business activities (usefulness), and that it is not publicly known (non-public knowledge); protection is granted only once all three are satisfied. Novelty and inventive step are requirements for obtaining a patent, not requirements for a trade secret. Whereas a patent is a system that grants a monopoly in exchange for disclosing the content, a trade secret is a system that protects by not disclosing, so information one does not want to disclose, such as the weights of a trained model or ingenuity in preprocessing, is protected this way instead.

Limited provision data refers to information that is provided as a business to specific persons, accumulated in a substantial amount by electromagnetic means, and managed. This category was set up to protect transactions such as selling or sharing data, and its significance is that it can be protected without satisfying all three requirements of a trade secret. This is because, once it is provided to multiple parties, it does not necessarily strictly satisfy non-public knowledge. Information kept as a secret only within one's own company is protected on the trade secret side instead, and this category has no relation to whether a patent was applied for or granted.

A contract for work (ukeoi) is a contract that promises the completion of a job; if it is not completed, payment cannot be claimed, and liability is borne for a deliverable that does not conform to the contract. A quasi-mandate contract (jun-inin) is a contract for entrusting the handling of affairs, and what it promises is not completion but carrying out the work with the duty of care of a good manager. Because in AI development you do not know what accuracy you can reach until you actually train the model, a common split is to use a quasi-mandate contract for the exploration and PoC stages and a contract for work once the specification is fixed for the implementation stage. The Ministry of Economy, Trade and Industry's Contract Guidelines on the Utilization of AI and Data also present this pattern of splitting the contract by stage.

Hard law is legislation established by the state, whose violation carries binding force, and the Act on the Protection of Personal Information and the Copyright Act fall under this. Soft law is a set of rules with no legal binding force, such as guidelines, industry self-regulation, and corporate codes of conduct. Since soft law is not legislation, the distinction between legislation with and without penalties does not apply to it. It is also not a distinction between domestic and international, nor between old and new. In fields where technology changes quickly, an approach is taken of first indicating a direction with soft law and turning only the necessary parts into legislation, and Japan's AI policy is, in the main, centered on soft law.

A risk-based approach is the idea of varying the strength of regulation or response according to the magnitude of risk posed by an AI's use case. Even the same facial recognition technology has a completely different impact on people depending on whether it is used to unlock a phone screen versus for constant surveillance in a public space. Imposing the same strong regulation regardless of use case would stop even low-harm uses, while uniformly loosening it would leave high-harm uses unchecked. So strong obligations are assigned to high-impact uses and light treatment to low-impact ones. Businesses also use the same idea internally, sorting in-house AI projects by risk level and routing only the high-risk ones to strict review.

Privacy by design is the idea of building in privacy protection from the planning and design stage, rather than adding measures after a problem occurs. Decisions such as designing not to collect data in the first place, deleting it after the necessary period, or processing it in a form that cannot be identified, become more costly the later they are made. Disclosing the purpose of use and limiting viewing privileges are, in themselves, correct efforts, but they lack the viewpoint of when they are built in, so they do not describe this idea. It is a counterpart concept to security by design, which builds in security measures from the design stage.

A feature that ends up acting as a substitute for a sensitive attribute is called a proxy variable. A postal code correlates strongly with race and income through the area of residence, and the history of one's school or club activities can correlate with gender. As long as such features remain, the model indirectly learns the same discrimination even if the gender or race column is removed from the input. Therefore, checking fairness is done not by removing input fields but by tabulating outputs by attribute and measuring the difference. Furthermore, there are multiple definitions of fairness — such as equalizing the acceptance rate across attributes, or equalizing the error rate — and in general it is not possible to satisfy all of them at the same time, so which definition to adopt needs to be chosen and explained according to the use case.

An Adversarial Attack is an attack that adds a tiny change to the input, one that is almost imperceptible to the human eye, to make a model in operation produce an incorrect judgment. It targets the inference stage; the model itself is not rewritten. Mixing tampering into the training data to distort the training result is data poisoning, which instead targets the training stage. Making a large number of queries to reproduce an equivalent model is model extraction, and tampering with a model's parameters or its distributed artifacts is model poisoning — each targets a different point in time and a different target. Defenses against any of these proceed based on the idea of security by design, which builds in security from the design stage.

Model extraction is an attack that feeds a large number of inputs into a target model, collects the outputs, and reproduces an equivalent model on hand. What is stolen is the model itself, and this can be pulled off even if the model is only offered as a public API. Data extraction, by contrast, is an attack that pulls out information that was in the training data by observing the outputs; what is stolen there is the data. Mixing tampering into the training data is data poisoning, and tampering with a model's parameters or its distributed artifacts is model poisoning — the former targets the training stage, and the latter the training or distribution stage. Organizing by what is stolen and at what point in time helps avoid mixing these up.

A filter bubble is a phenomenon in which a recommendation algorithm selects information to match a user's preferences, and as a result that person ends up wrapped in a bubble, seeing only information suited to their own tastes; the cause lies in optimization by the algorithm. Users are not even aware that this selection is happening. An echo chamber is when people with the same opinion repeat broadcasting and agreeing with each other in a closed space, coming to believe that opinion is the only correct one, and its cause lies in the human tendency to gather with similar people. Fake video or audio being received as genuine is deepfakes and fake news, and the basis for a judgment being untraceable is the black box problem — both belong to separate mid-level topics.

A deepfake refers to a technology, and its resulting product, that uses deep learning to create video or audio that makes it look as if a real person said things they never said and did things they never did. Impersonating a real person is at its core, so its aim differs from generating the face of a nonexistent person. It is used for defamation, fraud, and interference with elections, and it greatly increases the persuasive power of fake news. As a countermeasure, in addition to research into detection technology, efforts are being made to embed provenance information at the time of filming or generation, so that later alteration can be verified. Summarizing text and visualizing the basis for a judgment are, neither of them, about misuse.

The provenance of data is a record of what data was obtained from where, and how it was processed before being used for training. Without this record, when a problem arises in the output, one cannot trace back to the data that caused it, making it impossible to fix or explain. Transparency does not mean only disclosing the model's internals; it also includes showing, according to the audience, what it is being used for, what data it was built with, and where its limitations lie. Reducing computing resources, speeding up inference, and increasing the amount of data are, none of them, the purpose of recording provenance. Along with this, it is also worth keeping track of traceability, which makes it possible to trace which data, through which model, produced which decision.

An ethics assessment is a procedure that, at the planning stage of an AI project, identifies and evaluates the anticipated impacts and risks, and the strictness of the subsequent review is adjusted according to the result. Continuing to watch trends in output and complaints after operation has begun is monitoring, confirming from an independent position whether operation follows policy is an AI audit, and putting one's own company's policy into writing and presenting it externally is an AI policy — each is a different component that makes up AI governance. Alongside these are keeping human involvement at key decision points, reproducibility, which makes it possible to rebuild a model later, and traceability, which makes it possible to trace the path of a decision.