{"id":2404,"date":"2024-09-17T07:48:18","date_gmt":"2024-09-17T15:48:18","guid":{"rendered":"https:\/\/blog.mozilla.org\/netpolicy\/?p=2404"},"modified":"2024-09-17T07:48:18","modified_gmt":"2024-09-17T15:48:18","slug":"managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/","title":{"rendered":"Managing Misuse Risk for Dual-Use Foundation Models &#8212; Mozilla Submits Comments to NIST"},"content":{"rendered":"<p>In July 2024, the U.S. AI Safety Institute (AISI), under the National Institute of Standards and Technology (NIST) released draft guidance on <a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/ai\/NIST.AI.800-1.ipd.pdf\"><i>Managing Misuse Risk for Dual-Use Foundation Models<\/i><\/a>. This draft, intended for public comment, is focused specifically on foundation models \u2013 the largest and most advanced AI models available \u2013 and namely those built by closed model developers in big tech labs. The AI Safety Institute&#8217;s framework laid out in the document \u201cfocuses on managing the risk that models will be deliberately misused to cause harm\u2026\u201d<\/p>\n<p>According to NIST\u2019s AISI, the document is meant to build on the existing AI Risk Management Framework (to which <a href=\"https:\/\/foundation.mozilla.org\/en\/blog\/managing-ai-risks-mozilla-files-comments-to-nist\/\">Mozilla provided comments<\/a>) to address both the technical and social aspects of misuse risks by providing best practices for organizations.<\/p>\n<p>Mozilla takes seriously its role as a steward of good practices, especially when it comes to protecting open-source, privacy, and fighting for the principles in <a href=\"https:\/\/www.mozilla.org\/en-US\/about\/manifesto\/\">Mozilla\u2019s Manifesto<\/a>. We\u2019ve led the way in advancing safer and more trustworthy AI, releasing an in-depth report on <a href=\"https:\/\/foundation.mozilla.org\/en\/insights\/trustworthy-ai-whitepaper\/\">Creating Trustworthy AI<\/a> in 2020 and bringing together forty AI leaders to discuss critical questions related to openness and AI at the 2024 <a href=\"https:\/\/blog.mozilla.org\/en\/mozilla\/ai\/introducing-columbia-convening-openness-and-ai\/\">Columbia Convening<\/a>. As such, Mozilla encourages legislators and regulators to do their part and protect the interests of individuals and to make technology more useful and accessible for all.<\/p>\n<p>However, while the AISI draft guidelines do an excellent job in highlighting the theoretical risks posed by foundation models created by large and largely private developers, it takes a narrow view of the way AI is developed today, including at the current technology frontier. In our <a href=\"https:\/\/blog.mozilla.org\/netpolicy\/files\/2024\/09\/NIST-AI-800-1-IPD_Mozilla_Final-.pdf\">full comments<\/a>, we focused on encouraging the AISI to expand the lens through which it examines how AI is developed today. In particular, we believe that the AISI should work to ensure that its guidelines are adapted to take into account the unique nature of open source. Below is a list of highlights from Mozilla&#8217;s comments on the existing draft:<\/p>\n<ul>\n<li aria-level=\"1\">The current draft focuses on AI services deployed on the internet and accessed through some interface or API. The reality is that the majority of AI research and development is occurring on locally deployed AI models that are collaboratively developed and freely distributed. NIST should rework the draft\u2019s front matter and glossary to better capture the state of the AI ecosystem.<\/li>\n<li aria-level=\"1\">The practices outlined in the draft place a disproportionate burden on any AI developer outside of the small handful of very large AI companies. Mozilla believes that NIST should ensure that requirements are applicable to organizations of all sizes and capability levels, and should take into account the potential negative impact of misuse at different organizational scales.<\/li>\n<li aria-level=\"1\">The recommendations for implementing the practices outlined in the draft imply that the AI model is centrally controlled and deployed. Open-source and collaborative development environments don\u2019t align with this approach, rendering this guidance inapplicable, unhelpful, or at worst &#8211; harmful. Given the strong evidentiary basis for open-source helping mitigate risk and make software safer, NIST should ensure open-source AI is considered and supported in its work.<\/li>\n<li aria-level=\"1\">The document should define \u201cgradients of access\u201d as a way to provide a framework for AI risk management discussions and decision making. These gradients should represent incremental steps of access to an AI model (e.g. chat interface, prompt injection, training, direct weights visibility, local download, etc.) and each should be accompanied by its associated risks.<\/li>\n<\/ul>\n<p>We hope that the AI Safety Institute continues to build on its foundational work in the field and works to develop guidelines, recommendations, and best practices that will not only stand the test of time but take into account the broader field of participants in the AI ecosystem. When such regulations are well designed, they propel the AI sector towards a safer and more trustworthy future. Mozilla\u2019s full comments on <a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/ai\/NIST.AI.800-1.ipd.pdf\"><i>Managing Misuse Risk for Dual-Use Foundation Models<\/i><\/a> can be <a href=\"https:\/\/blog.mozilla.org\/netpolicy\/files\/2024\/09\/NIST-AI-800-1-IPD_Mozilla_Final-.pdf\">found here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In July 2024, the U.S. AI Safety Institute (AISI), under the National Institute of Standards and Technology (NIST) released draft guidance on Managing Misuse Risk for Dual-Use Foundation Models. This &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/\">Read more<\/a><\/p>\n","protected":false},"author":144,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[391305,51,15890],"tags":[],"coauthors":[306191],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Managing Misuse Risk for Dual-Use Foundation Models - Mozilla Submits Comments to NIST - Open Policy &amp; Advocacy<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mozilla\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/\",\"url\":\"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/\",\"name\":\"Managing Misuse Risk for Dual-Use Foundation Models - Mozilla Submits Comments to NIST - Open Policy &amp; Advocacy\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#website\"},\"datePublished\":\"2024-09-17T15:48:18+00:00\",\"dateModified\":\"2024-09-17T15:48:18+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/33edd7d4d73723140487082573041c83\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/netpolicy\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Managing Misuse Risk for Dual-Use Foundation Models &#8212; Mozilla Submits Comments to NIST\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/netpolicy\/\",\"name\":\"Open Policy &amp; Advocacy\",\"description\":\"Mozilla&#039;s official blog on open Internet policy initiatives and developments\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/netpolicy\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/33edd7d4d73723140487082573041c83\",\"name\":\"Mozilla\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/image\/f32381c01597770b1131dff44b9d6de1\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f84bd67e8e3ab3bcc9676910aecf5700?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f84bd67e8e3ab3bcc9676910aecf5700?s=96&d=mm&r=g\",\"caption\":\"Mozilla\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Managing Misuse Risk for Dual-Use Foundation Models - Mozilla Submits Comments to NIST - Open Policy &amp; Advocacy","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/","twitter_misc":{"Written by":"Mozilla","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/","url":"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/","name":"Managing Misuse Risk for Dual-Use Foundation Models - Mozilla Submits Comments to NIST - Open Policy &amp; Advocacy","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/netpolicy\/#website"},"datePublished":"2024-09-17T15:48:18+00:00","dateModified":"2024-09-17T15:48:18+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/33edd7d4d73723140487082573041c83"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/netpolicy\/2024\/09\/17\/managing-misuse-risk-for-dual-use-foundation-models-mozilla-submits-comments-to-nist\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/netpolicy\/"},{"@type":"ListItem","position":2,"name":"Managing Misuse Risk for Dual-Use Foundation Models &#8212; Mozilla Submits Comments to NIST"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/netpolicy\/#website","url":"https:\/\/blog.mozilla.org\/netpolicy\/","name":"Open Policy &amp; Advocacy","description":"Mozilla&#039;s official blog on open Internet policy initiatives and developments","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/netpolicy\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/33edd7d4d73723140487082573041c83","name":"Mozilla","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/image\/f32381c01597770b1131dff44b9d6de1","url":"https:\/\/secure.gravatar.com\/avatar\/f84bd67e8e3ab3bcc9676910aecf5700?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f84bd67e8e3ab3bcc9676910aecf5700?s=96&d=mm&r=g","caption":"Mozilla"}}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/posts\/2404"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/comments?post=2404"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/posts\/2404\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/media?parent=2404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/categories?post=2404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/tags?post=2404"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/coauthors?post=2404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}