Over the last few months, we’ve seen an increase in the use of AI and machine learning with the widespread adoption of ChatGPT and other AI tools. The concept of these tools is exciting and can help save time, simplify research and offer 24/7 reliability to do exactly what you ask.
But with this new AI tool comes a new problem: how do we know what's true? How can you establish trust in its outputs?
As a leading provider of digital trust, which enables individuals and businesses to engage online with confidence that their footprint in a digital world is secure, we’re aware at DigiCert of the concerns with ChatGPT and looking forward at how the AI industry can establish better trust and security. I’ll dive into some of those concerns and how trust could be established for AI in this post.
ChatGPT is designed to provide accurate information to users, but as with any technology, it is not infallible. Sometimes ChatGPT makes mistakes. It’s prone to bias, has limited information past 2021, has security and privacy concerns and has even been known to make up information — and for some issues it is self-aware.
When we asked ChatGPT what the top challenges and concerns are with using it, it responded with the following:
While ChatGPT has many benefits, there are also some challenges that come with using an AI language model:
ChatGPT has also been known to make up information that sounds plausible or to spread misinformation. However, sometimes ChatGPT gets it wrong because the internet had it wrong first.
The truth is that both can be at fault. ChatGPT relies on the information it has been trained on, which can sometimes be inaccurate or out of date. And the internet as a whole is filled with unverified information that can be misleading or outright false.
Recently, my wife and I drove to a museum that our phones insisted was open, only to find it closed for the season. This kind of misinformation can be frustrating and even dangerous, especially if it leads to wasted time, money or effort. Furthermore, it can be exploited by bad actors.
There are also privacy issues with ChatGPT. Any information shared with ChatGPT will be kept. Just as you wouldn’t share sensitive, proprietary or confidential data or code online, you shouldn’t share it with any AI, as the AI will store it and use it to continue learning. Imagine sharing confidential information with the AI and then another user asks about it and has access to that information because you shared it. If you wouldn’t share it publicly, then you probably shouldn’t share it with ChatGPT. Additionally, employers should provide training and guidance on how to use ChatGPT securely and privately.
The solution to establishing trust in AI is independent verification. Certificate Authorities (CAs) play an important role in providing independent verification of information so that it can be relied upon. CAs are organizations that verify the authenticity of other organizations and their information, which are used to secure online transactions and communications. The best-known examples are the verification of domain ownership and legal identities, but there are no technical reasons to restrict independent verification of such information.
By verifying that a digital certificate belongs to the entity it claims to belong to, a CA can help ensure that sensitive information is protected and that users can trust the websites and services they use. But CAs can also verify other types of information, such as business registration, domain ownership and legal status. Many newer public key infrastructure (PKI) efforts are attempting to extend digital trust to additional verifiable attributes, like professional titles, where and how digital keys were generated, whether an image is protected by a trademark and so on.
Thus, it is important that information be accurate in order to be helpful. The best information is information independently verified, by organizations like CAs. While ChatGPT and the internet can be useful tools for finding information, they should not be relied upon exclusively. By combining technology with independent verification, we can ensure that the information we use is trustworthy and reliable.
Right now, it’s a bit of a Wild West for AI. But I anticipate that as the AI industry matures, more regulation will be put in place against using AI for malicious purposes, similar to how we’re seeing more regulation now in sectors like the IoT and software development. I wouldn’t be surprised if in the future we use a verification solution for AI outputs like digital certificates to certify that content is authentic. PKI is a tried-and-true technology that has been applied to numerous use cases from devices, users, servers, software and content to establish digital trust, so why not to AI?