[ai-control] Re: Proposed "AI System Inference" and "AI User Input" categories

[Chris Needham <[e-mail]>]

I think I agree with the distinction Leonard is making, but we do need to make that much clearer in the spec so it better answers the kinds of questions that Mirja is asking.

For example, the proposed language in issue 216, "assets whose location has been explicitly specified by the user", could be interpreted to include "find me a similar picture from web page X" or "summarise articles from Wikipedia on topic X" - because these prompts both include some form of "location".

The alternatives discussed in that issue have the same problem. They all depend on an interpretation of "location", which I suggest we need to clarify.

Chris
________________________________
From: Leonard Rosenthol <lrosenth=[e-mail]>
Sent: 19 August 2026 18:05
To: Mirja Kuehlewind (IETF) <ietf=[e-mail]>
Cc: Mirja Kuehlewind (IETF) <[e-mail]>; Paul Keller <[e-mail]>; [e-mail] <[e-mail]>
Subject: [ai-control] Re: Proposed "AI System Inference" and "AI User Input" categories


External: Think before clicking

Yes, it is user provided if the user pasted in a link instead of providing the physical asset….because the user provided a direct reference to it.

If you ask the agent to find something for you, that is NOT user provided as they only sent you in that direction.

Leonard

From: Mirja Kuehlewind (IETF) <ietf=[e-mail]>
Date: Wednesday, August 19, 2026 at 6:42 AM
To: Leonard Rosenthol <[e-mail]>
Cc: Mirja Kuehlewind (IETF) <[e-mail]>; Paul Keller <[e-mail]>; [e-mail] <[e-mail]>
Subject: Re: [ai-control] Proposed "AI System Inference" and "AI User Input" categories


EXTERNAL: Use caution when clicking on links or opening attachments.


I still don’t think it is always that clear what is user provided and what not and how much indirection is okay. Is it user provided if I provide a link instead of the image? If I use a prompt that the AI assistant should find me a similar picture from web page X, is that user provided or not?



On 19. Aug 2026, at 15:09, Leonard Rosenthol <lrosenth=[e-mail]> wrote:

User-directed inference - since a user is providing a system with a “reference image” that is used at inference time.


From: Mirja Kuehlewind (IETF) <ietf=[e-mail]>
Date: Wednesday, August 19, 2026 at 4:50 AM
To: Leonard Rosenthol <[e-mail]>
Cc: Paul Keller <[e-mail]>; [e-mail] <[e-mail]>
Subject: Re: [ai-control] Proposed "AI System Inference" and "AI User Input" categories


EXTERNAL: Use caution when clicking on links or opening attachments.


I’m not objecting to allow this use case. I don’t know why you put it this way. However, it is not clear to me which preference would apply to this use case. Therefore I don’t see how having the two proposed categories would help that use case.

On 18. Aug 2026, at 16:18, Leonard Rosenthol <lrosenth=[e-mail]> wrote:

 Mirja - you seem to always refer to the “AI system” as the decider in these cases, and I wonder if that is where the disconnect is between your view and what of myself and others.

Users don’t always interact directly with the “AI system”.  They may be interacting with applications that happen to offer AI functionality as part of a larger suite of capabilities.  In those cases, the “AI system” may never actually see the assets involved in the process.

Let me give you an example that has been shipping for at least 18 months now - this is the example the Bradley quoted in a previous message.  Adobe Photoshop (which I assume you are familiar with) offers users the ability to fill an area of their image based on a prompt (“Generative Fill”).  In addition to the prompt, a user may supply a “reference image” that can be noted by the prompt to contain elements (e.g., people, things, etc.) as well as reflect colors, styles, etc. of its author.  Photoshop will check if the provided “reference image” contains a Content Credential containing a “training & data mining assertion” which restricts inference usage.  If so, we  notify the user and given them the option to continue or stop.   In this way, we (Adobe) are respecting the preferences of the author/owner/rightsholder of the “reference image” to the best of our ability BUT​ we recognize that there are numerous situations where it is perfectly reasonable for the user to have the right to override that (e.g., they purchased a license out of band, etc.)

The above scenario fits perfectly with the Vocab document that we are writing.  It enabled the declaration of the preference by the rightsholder, it allowed the processor (Ps in this case) to choose to respect the preference, and it allows taking into account those additional considerations that may exist.

I don’t see why you would object to allowing for this.

Leonard

From: Mirja Kuehlewind (IETF) <ietf=[e-mail]>
Date: Tuesday, August 18, 2026 at 7:00 AM
To: Paul Keller <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: [ai-control] Re: Proposed "AI System Inference" and "AI User Input" categories

EXTERNAL: Use caution when clicking on links or opening attachments.


Even with one category the AI system can decide to adhere to it in some cases but not in others. Only if the system always tries to follow the preference this makes a difference but if the line is not clear that will lead to random/not understandable outcomes for the user.



> On 18. Aug 2026, at 12:25, Paul Keller <[e-mail]> wrote:
>
> Hi all,
>
> I was on vacation for the past three weeks and am just catching up with this thread. First of all, massive thanks to Nate for sharing the proposal and for engaging with all the feedback. The thread raises a lot of important issues, and I agree with Leonard and Bradley that it will be more productive to have the discussion in London.
>
> On the substance, I want to come back to one aspect of the proposal that I think matters. We proposed two inference categories rather than one because it allows the vocabulary to account for the different positions people and organisations hold here. We know (since at least last year's London meeting) that there are strongly held and conflicting beliefs about whether preferences against the use of assets as input into a trained system are useful, desirable or ethical. We also know that for many people there is a meaningful distinction between a use that follows from a user providing an asset and a use where the system fetches the asset itself, possibly without the user being aware of it. Our proposal tries to acknowledge that distinction.
>
> On the declaring side, this lets a rights holder express a global preference against use as input to a trained AI system by combining both categories (the position Nate has articulated), or a narrower preference against systems autonomously fetching the asset by setting only the system-directed category.
>
> Equally important, and I think this is the overlooked part: the split also changes what is possible on the consuming side. A monolithic inference category admits only two responses (honour it for all inference, or not at all) because the category itself draws no distinction between the two situations. With two categories, a third response becomes available: honouring the preference where the system identifies the asset, and not where the user does. Several people here have said that distinction is meaningful; a single category leaves no way to act on it. And because the proposal names both cases, which of these positions a consumer has taken is legible to the declaring party rather than invisible.
>
> I realise some here will be uncomfortable that this makes room for a provider that honours only the system-directed category. I think that is a legitimate position, and more importantly it is what answers the concern Farz, Jo and Lila have raised repeatedly — most concretely in Farz's example of the doctor needing a local model to translate a PDF that carries a negative preference. A monolithic category gives a provider no way to respect autonomous-access preferences while leaving human-directed use alone. The split does. I would personally hope providers respect user agency in this way, but that hope is not a reason to prevent rights holders from expressing a preference to the contrary.
>
> So in short: splitting inference into two gives more granularity on both sides of the equation, which seems a sensible way of dealing with the fact that we have genuinely strong differences of opinion about what is desirable here.
>
> Looking forward to the discussion in London,
>
> Paul
> --
> ai-control mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

--
ai-control mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]

--
ai-control mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]