Share to Facebook Share to Twitter Share to Linkedin Is it okay to encourage AI biases bounty hunting or are we making things worse by doing so? getty Wanted: AI bias hunters . That could be a modern-day ad that you’ll begin to see popping up on social media channels and making appearances in various online job postings. This is a relatively new concept or role. It carries with it controversy. Some ardent believers fervently argue that it makes abundant sense and should have been happening all along, while others are rather nervously doing some serious head-scratching and not so sure that this is a good idea. The gist of the role consists of ferreting out of AI any hidden biases or embedded discriminatory practices. To the rescue come the eager and altogether erstwhile AI biases hunters. They would presumably be computer-savvy bounty hunters. More so, hopefully, steeped in the depths of AI capabilities. ADVERTISEMENT Have gun, will travel, and can via AI-skilled keen marksmanship manage to expose those unsavory and untoward AI biases. This raises a slew of thorny questions about the sensibility of pursuing such a tactic when it comes to discovering AI biases. As I will discuss momentarily, please know that the advent of AI has also brought with it the emergence of AI biases. A torrent of AI biases. For my ongoing and extensive coverage of AI Ethics and Ethical AI, see the link here and the link here , just to name a few. How are we to discover that a particular AI system has biases? You might entrust the AI developers that devised the AI to do so. The thing is, they might be so mired in biases that they themselves cannot recognize the biases within their concocted AI. It all looks good to them. Or they might be so excited about the AI and have a sense of self-pride about it that to have to then take a critical eye to examine it for biases would be difficult and a real downer. Lots of other such reasons might seem to undercut having the AI developers take on this task, including lack of skills to figure out the embedded biases, lack of time in a project to do so, etc. Okay, so go ahead and hire outside consultants to do the dirty work for you, as it were. Turns out that consultants will happily scrutinize your AI for biases, charging you a pretty penny to do so (lots and lots of pennies). Realize that you need to pay for them to come up to speed with your AI system. You need to then have them rummage around, which might take an untold number of costly laborious hours. Using consultants is an option if you have the budget for it. ADVERTISEMENT Into the potential “gap” of how to find those insidious AI biases come the heroic and dashing AI biases bounty hunters. You don’t usually pay them upfront. They try to find the AI biases on their own time and have to foot their own bills as they do so. Only if they successfully find biases do they get paid. I suppose you could readily assert that in a suitable manner of thinking, that’s the conventional definition of a bounty hunter. Get paid if you succeed. Don’t get paid if you aren’t successful. Period, end of story. Bounty programs have existed since at least the time of the Romans and thus we might surmise that they do work, having successfully endured as a practice over all of these years. Here’s a fascinating piece of historical trivia for you. Reportedly, a posted message during the Roman Empire in the city of Pompeii proclaimed that bounty hunters were needed to find a copper pot that went missing from a small shop. The reward for the recovery of the copper pot was an impressive prize of sixty-five bronze coins. Sorry to say that we don’t know if any bounty hunter found the copper pot and claimed the bronze coins, but we do know that bounty hunting has certainly continued since those ancient times. In more modern times, you might be aware that in the 1980s there were some notable bounties offered to find computer bugs or errors in off-the-shelf software packages and then in the 1990’s Netscape markedly offered a bounty for finding bugs in their web browser (becoming one of the most prominent firms of that day to do so). Google and Facebook had each opted toward bounty hunting for bugs starting in 2010 and 2013 years, respectively. A few years later, in 2016 even the U. S. Department of Defense (DoD) got into the act by having a “Hack the Pentagon” bounty effort (note that the publicly focused bounty was for bugs found in various DoD-related websites and not in defense mission-critical systems). ADVERTISEMENT Let’s dig more deeply into the bug bounty topic. I realize that I am mainly aiming to talk about AI biases in bounty hunting in this discussion, but there are some quite relevant parallels to the bug bounty arena. Some are demonstrably puzzled that any firm would want to offer a bounty to find bugs (or, in this case, AI biases) in their systems. On the surface, this seems like a “you are asking for it” kind of strategy. If you let the world know that you welcome those that might try to find holes in your software, it seems tantamount to telling burglars to go ahead and try to break into your house. Even if you already believe that you’ve got a pretty good burglar alarm system and that no one should be able to get into your secured home, imagine asking and indeed pleading with burglars to all descend upon your place of residence and see if they can crack into it. Oh, the troubles we weave for ourselves. The same could be said about asking for bounty hunters to find biases in your AI. First, it perhaps implies that you already believe or even outright know that your AI does have biases. That is a shockingly forthright implied admission that few would seem willing to make and could potentially backfire. ADVERTISEMENT Second, you don’t know for sure what those bounty hunters might do. They could opt to tell the whole world that they found biases in your AI. One supposes this might forfeit getting the bounty, though some might relish the attention or aim to bolster their status for getting consulting gigs and other revenue-generating possibilities. It could perhaps be entirely altruistic. It might be a form of AI activism. I can keep going. Third, there could be a sneaky twist to the whole affair. A bounty hunter claiming to be searching for AI biases might be devilishly poking around to find ways to attack your AI system. The whole thing is a charade to ultimately undertake a severe cyberattack. You might have assumed they were trying to help, while they have wrongdoing in their hearts. Sad, but possible. Fourth, we can get even more slyly contorted on this matter. A bounty hunter finds some embarrassing and potentially lawsuit-spurring AI biases. The bounty is some amount of dollars that we will call X. Rather than claiming the bounty, the bounty hunter does a kind of oddish ransomware provocation. If you pay the bounty hunter an amount of ten times X or maybe the skies the limit, they will tell you about the AI biases. You have until Sunday night at midnight to answer. After that point in time, the AI biases will be revealed for all to see. Yikes, a dastardly predicament to be in. ADVERTISEMENT Fifth, the latest are those so-called “hack to return” cybercrooks that after having stolen a bunch of online dough, they decide to repent and return some of the ill-gotten booty that they grabbed up. The company getting its monies partially returned is then willing to consider the remaining stolen amount as an after-the-fact bounty rewarded to the thieves. Seems like everyone “wins” in that the bulk of the funds are given back and meanwhile the cybercrooks are not legally pursued, plus they get the pirate bounty to boot. Is this prudent or insidiously perpetuating wrongful acts? I realize that some of you might be saying that nobody should be releasing AI that has any biases in it. That would seem to solve this whole dilemma about whether to use AI biases bounty hunters or not. Just don’t get yourself into a bounty situation. Make sure your AI developers do the right thing and do not allow AI biases into their AI systems. Perhaps use consultants to do a double-check. In essence, do whatever you need to do to avoid ever thinking about or asking those AI bias bounty hunters to come to the table. Yes, that would seem entirely sensible. The problem is that it is also a bit dreamy. The complexity of many AI systems is so great that trying to ensure that not a single ounce of AI biases emerges is going to be arduous to do. On top of that, some AI systems are purposely devised to adjust and “learn” as they go along. This means that at some future point in time the AI that you devised, which let’s pretend at first was purely clean and without biases, might gravitate toward embodying biases (I do not mean that in an anthropomorphic way, as I will explain further as we go along on this topic). ADVERTISEMENT Those that favor bounty hunting for software bugs are prone to argue that it makes sense to offer such bounties. We can consider their rationale and see if it applies to the AI biases realm too. Proponents of bug bounties emphasize that rather than trying to pretend that there aren’t any holes in your system, why not encourage holes to be found, doing so in a “controlled” manner? In contrast, without such a bounty effort, you could just hope and pray that by random chance no one will find a hole, but if instead you are offering a bounty and telling those that find a hole that they will be rewarded, it offers a chance to then shore-up the hole on your own and then prevents others from secretly finding it at some later point in time. The same could be said in the use case of AI biases. If you offer a sufficient bounty, hopefully, the bounty hunters will bring the discovery of AI biases to your attention. You can then cope with the AI biases in a relatively quiet and measured way. This might forestall a much larger and more daunting problem later on, namely that somebody else finds AI biases in your AI and screams about it to the high heavens. ADVERTISEMENT Generally, a firm wishing to enable bugs bounty hunting effort will put in place a Vulnerability Disclosure Policy (VDP). The VDP indicates how the bugs are to be found and reported to the firm, along with how the reward or bounty will be provided to the hunter. Usually, the VDP will require that the hunter end up signing a Non-Disclosure Agreement (NDA) such that they won’t reveal to others what they found. The notion of using an NDA with bounty hunters has some controversy. Though it perhaps makes sense to the company offering the bounty to want to keep mum the exposures found, it also is said to stifle overall awareness about such bugs. Presumably, if software bugs are allowed to be talked about, it would potentially aid the safety of other systems at other firms that would then shore up their exposures. Some bounty hunters won’t sign an NDA, partially due to the public desire and partially due to trying to keep their own identity hidden. Keep in mind too that the NDA aspect doesn’t arise usually until after the hunter claims they have found a bug, rather than requiring it beforehand. Some VDPs stipulate that the NDA is only for a limited time period, allowing the firm to first find a solution to the apparent hole and then afterward to allow for wider disclosure about it. Once the hole has been plugged, the firm then allows a loosening of the NDA so that the rest of the world can know about the bug. The typical time-to-resolution for bounty hunted bugs is reportedly around 15-20 days when a firm wants to plug it right away, while in other cases it might stretch out to 60-80 days. In terms of paying the bounty hunter, the so-called time-to-pay, after the hole has been verified as actually existing, the bounty payments reportedly tend to be within about 15-20 days for the smaller instances and around 50-60 days for the larger instances (these are constantly changing industry indications and only mentioned as illustrative). ADVERTISEMENT Should AI biases bounty hunters also be asked to participate in a VDP and deal with an NDA? You can get a yes and a no to that question. Yes, some firms should go that route. No, you might not necessarily opt to go that route. Factors include the size and nature of the AI, the potential of any AI biases exposures involved, and a bunch of other ethical, legal, and business considerations that come to bear. I might add that establishing a bounty hunting endeavor for AI biases of your AI is a much taller order than you might assume at an initial glance. We will start with the formidable possibility that you will be overwhelmed by AI biases bounty hunters. Right now, you would be hard-pressed to find many that would have such a calling card. There aren’t many around. It is the days of the Wild West in that regard. But if the notion of AI biases in bounty hunting catches on, especially when the bounties are plentiful and richly rewarding, you can bet that everyone will dive into the biases hunting swimming pool. ADVERTISEMENT Do you want all sorts of riffraff pursuing AI biases in your AI system? You will get some takers that are actually experts at this sort of thing. You will get other takers that are amateurs and might make a mess or cry wolf. The next thing you know, anybody that can spell “Artificial Intelligence” will be coming to dig in your goldmine of an AI system for those precious AI biases gold nuggets. The gold rush is on. That might not be good for you. You will need to scrutinize the bounty hunter submissions. There will be a lot of “noise” in the reported claims, in the sense that many of the claimed AI biases do not exist, though the bounty hunter insists that they found some. Imagine how much labor your own AI teams will be required to examine the bounty claims, explore the validity of each, and then potentially go back and forth with the bounty hunter about whether gold was discovered or not. Some would argue that’s another reason to do the whole thing yourself. You might inevitably discover that the bounty thing is more trouble than it was worth. Here’s another question to ponder. How will the bounty hunters know what an AI bias looks like? In essence, without some semblance of what to be looking for, any shiny rock could be claimed as showcasing an AI bias in the perceived AI goldmine being excavated. ADVERTISEMENT In the days of the Old West, suppose you offered a reward for the capture of Billy the Kid (a famous outlaw). If you did so and did not include a picture of what Billy looked like, imagine the number of bounty hunters that might drag into the sheriff’s office someone that they hoped or thought was Billy the Kid. You might get inundated with false Billy’s. This is bad since you’d need to presumably look at ea