[ai-control] Re: Proposed "AI System Inference" and "AI User Input" categories

[Tyler Martin <[e-mail]>]

Regarding your two cases, I agree they’re not fundamental. I’ll incorporate them as examples in the PR I’m putting together for the inference categories.

However, after reading the whole document, I noticed a couple of things that I wanted to bring up.

First, the training and inference definitions seem to have a bit of a gap. Training is described as “production or refinement of a model,” while inference is “all use that doesn’t modify learned parameters.” A model trained on another model’s outputs—like distillation or synthetic data from an asset—could argue for escaping both. The student model never sees the original asset because the teacher model inferred on it. Probably its own issue.

Second, and I don’t think it’s been discussed this way before: the vocabulary doesn’t really differentiate between a private answer for one person and an answer that’s shared with everyone. Paul mentioned the individual-use aspect on #150, but it’s more of a rights issue than a category. The private/public distinction is really key to understanding the economics of content use, and right now, there’s no way to express a preference across that line.

Tyler

> On Aug 19, 2026, at 4:50 PM, Martin Thomson <[e-mail]> wrote:
> 
> It might be worth poking a little at the boundaries of this.
> 
> The examples we've seen so far seem pretty clear to me.  A system is given the bytes of an asset or a simple pointer to those bytes.  That's pretty clearly covered by the "explicitly"/"directly" language.
> 
> The case where the description is less direct is worth examining. At least a little.  If there is unambiguous identification in natural language, such as "the Microsoft home page", is that equivalent to "https://microsoft.com/" ?  Or "the Wikipedia article on hats" vs. "https://en.wikipedia.org/wiki/Hat"?  Such instructions are often a little more vague than that: "the last ten articles on A", "emails from B", ...
> 
> Another angle that is worth considering is that there are human operators of systems.  The person who coded up a harness or the person responsible for its configuration and operation.  Are they users?  If such a human provides a library of material for use in grounding, is that sufficiently direct to qualify?
> 
> I don't know that any of this points to fundamental problems, but it might be useful to think about these.
> 
> --Martin
> 
> On Thu, Aug 20, 2026, at 03:50, Nate Hake wrote:
>> Hi all - 
>> 
>> I have updated PR 216 (diff here 
>> <https://github.com/natehake/drafts/commit/160ccdccf5ca3bc2887f125d32f2800379c8c580>) 
>> to incorporate the proposed language from Timid Robot, and to add an 
>> definition of Inference (which I modified to mirror our new AI-train 
>> definition based on "learned parameters"). I think this addresses some 
>> of the concerns raised in this thread around streamlining the language 
>> and making it less complex. 
>> 
>> Mirja and Chris are raising valid points that will require further 
>> consideration about how to capture the intended user/system distinction 
>> in a way that works for all and is clear. For my part I feel like there 
>> surely must be some combination of words that captures what it means 
>> for a human being to select something vs for that something to be 
>> selected by a bot (or "agents", as they are now called thanks to this 
>> latest marketing rebrand). The depressing alternative is that we really 
>> have already reached the Dead Internet Theory coming into existence. 
>> 
>> Anyway, I will think on further words that might help clarify here and 
>> invite other proposals from the group. 
>> 
>> 
>> 
>> ***
>> Nate Hake
>> Founder
>> TravelLemming.com <http://travellemming.com/> <https://travellemming.com/>
>> 
>> 
>> On Wed, Aug 19, 2026 at 10:34 AM Mirja Kuehlewind (IETF) 
>> <ietf=[e-mail]> wrote:
>>> It seems _you_ have on view of this but if the spec cannot convey that clearly to the reader that is a problem. As the line is very blurry, I’m not very positive that there is a clear definition that also holds in the near future. But that’s the discussion to have (as Chris just basically said in his email as well).
>>> 
>>>> On 19. Aug 2026, at 19:05, Leonard Rosenthol <[e-mail]> wrote:
>>>> 
>>>> Yes, it is user provided if the user pasted in a link instead of providing the physical asset….because the user provided a direct reference to it.
>>>> 
>>>> If you ask the agent to find something for you, that is NOT user provided as they only sent you in that direction.
>>>> 
>>>> Leonard
>>>> 
>>>> *From: *Mirja Kuehlewind (IETF) <ietf=[e-mail]>
>>>> *Date: *Wednesday, August 19, 2026 at 6:42 AM
>>>> *To: *Leonard Rosenthol <[e-mail]>
>>>> *Cc: *Mirja Kuehlewind (IETF) <[e-mail]>; Paul Keller <[e-mail]>; [e-mail] <[e-mail]>
>>>> *Subject: *Re: [ai-control] Proposed "AI System Inference" and "AI User Input" categories
>>>> 
>>>> *EXTERNAL: Use caution when clicking on links or opening attachments.*
>>>> 
>>>> 
>>>> 
>>>> I still don’t think it is always that clear what is user provided and what not and how much indirection is okay. Is it user provided if I provide a link instead of the image? If I use a prompt that the AI assistant should find me a similar picture from web page X, is that user provided or not?
>>>> 
>>>> 
>>>> 
>>>>> On 19. Aug 2026, at 15:09, Leonard Rosenthol <lrosenth=[e-mail]> wrote:
>>>>> 
>>>>> User-directed inference - since a user is providing a system with a “reference image” that is used at inference time.
>>>>> 
>>>>> 
>>>>> *From: * Mirja Kuehlewind (IETF) <ietf=[e-mail]>
>>>>> *Date: *Wednesday, August 19, 2026 at 4:50 AM
>>>>> *To: *Leonard Rosenthol <[e-mail]>
>>>>> *Cc: *Paul Keller <[e-mail]>; [e-mail] <[e-mail]>
>>>>> *Subject: *Re: [ai-control] Proposed "AI System Inference" and "AI User Input" categories
>>>>> 
>>>>> *EXTERNAL: Use caution when clicking on links or opening attachments.*
>>>>> 
>>>>> 
>>>>> 
>>>>> I’m not objecting to allow this use case. I don’t know why you put it this way. However, it is not clear to me which preference would apply to this use case. Therefore I don’t see how having the two proposed categories would help that use case.
>>>>> 
>>>>>> On 18. Aug 2026, at 16:18, Leonard Rosenthol <lrosenth=[e-mail]> wrote:
>>>>>> 
>>>>>> Mirja - you seem to always refer to the “AI system” as the decider in these cases, and I wonder if that is where the disconnect is between your view and what of myself and others.
>>>>>> 
>>>>>> Users don’t always interact directly with the “AI system”.  They may be interacting with applications that happen to offer AI functionality as part of a larger suite of capabilities.  In those cases, the “AI system” may never actually see the assets involved in the process.
>>>>>> 
>>>>>> Let me give you an example that has been shipping for at least *18 months* now - this is the example the Bradley quoted in a previous message.  Adobe Photoshop (which I assume you are familiar with) offers users the ability to fill an area of their image based on a prompt (“Generative Fill”).  In addition to the prompt, a user may supply a “reference image” that can be noted by the prompt to contain elements (e.g., people, things, etc.) as well as reflect colors, styles, etc. of its author.  Photoshop will check if the provided “reference image” contains a Content Credential containing a “training & data mining assertion” which restricts inference usage.  If so, we  notify the user and given them the option to continue or stop.   In this way, we (Adobe) are respecting the preferences of the author/owner/rightsholder of the “reference image” to the best of our ability *BUT*​ we recognize that there are numerous situations where it is perfectly reasonable for the user to have the right to override that (e.g., they purchased a license out of band, etc.)
>>>>>> 
>>>>>> The above scenario fits perfectly with the Vocab document that we are writing.  It enabled the declaration of the preference by the rightsholder, it allowed the processor (Ps in this case) to choose to respect the preference, and it allows taking into account those additional considerations that may exist.
>>>>>> 
>>>>>> I don’t see why you would object to allowing for this.
>>>>>> 
>>>>>> Leonard
>>>>>> 
>>>>>> *From: * Mirja Kuehlewind (IETF) <ietf=[e-mail]>
>>>>>> *Date: *Tuesday, August 18, 2026 at 7:00 AM
>>>>>> *To: *Paul Keller <[e-mail]>
>>>>>> *Cc: *[e-mail] <[e-mail]>
>>>>>> *Subject: *[ai-control] Re: Proposed "AI System Inference" and "AI User Input" categories
>>>>>> 
>>>>>> EXTERNAL: Use caution when clicking on links or opening attachments.
>>>>>> 
>>>>>> 
>>>>>> Even with one category the AI system can decide to adhere to it in some cases but not in others. Only if the system always tries to follow the preference this makes a difference but if the line is not clear that will lead to random/not understandable outcomes for the user.
>>>>>> 
>>>>>> 
>>>>>> 
>>>>>>> On 18. Aug 2026, at 12:25, Paul Keller <[e-mail]> wrote:
>>>>>>> 
>>>>>>> Hi all,
>>>>>>> 
>>>>>>> I was on vacation for the past three weeks and am just catching up with this thread. First of all, massive thanks to Nate for sharing the proposal and for engaging with all the feedback. The thread raises a lot of important issues, and I agree with Leonard and Bradley that it will be more productive to have the discussion in London.
>>>>>>> 
>>>>>>> On the substance, I want to come back to one aspect of the proposal that I think matters. We proposed two inference categories rather than one because it allows the vocabulary to account for the different positions people and organisations hold here. We know (since at least last year's London meeting) that there are strongly held and conflicting beliefs about whether preferences against the use of assets as input into a trained system are useful, desirable or ethical. We also know that for many people there is a meaningful distinction between a use that follows from a user providing an asset and a use where the system fetches the asset itself, possibly without the user being aware of it. Our proposal tries to acknowledge that distinction.
>>>>>>> 
>>>>>>> On the declaring side, this lets a rights holder express a global preference against use as input to a trained AI system by combining both categories (the position Nate has articulated), or a narrower preference against systems autonomously fetching the asset by setting only the system-directed category.
>>>>>>> 
>>>>>>> Equally important, and I think this is the overlooked part: the split also changes what is possible on the consuming side. A monolithic inference category admits only two responses (honour it for all inference, or not at all) because the category itself draws no distinction between the two situations. With two categories, a third response becomes available: honouring the preference where the system identifies the asset, and not where the user does. Several people here have said that distinction is meaningful; a single category leaves no way to act on it. And because the proposal names both cases, which of these positions a consumer has taken is legible to the declaring party rather than invisible.
>>>>>>> 
>>>>>>> I realise some here will be uncomfortable that this makes room for a provider that honours only the system-directed category. I think that is a legitimate position, and more importantly it is what answers the concern Farz, Jo and Lila have raised repeatedly — most concretely in Farz's example of the doctor needing a local model to translate a PDF that carries a negative preference. A monolithic category gives a provider no way to respect autonomous-access preferences while leaving human-directed use alone. The split does. I would personally hope providers respect user agency in this way, but that hope is not a reason to prevent rights holders from expressing a preference to the contrary.
>>>>>>> 
>>>>>>> So in short: splitting inference into two gives more granularity on both sides of the equation, which seems a sensible way of dealing with the fact that we have genuinely strong differences of opinion about what is desirable here.
>>>>>>> 
>>>>>>> Looking forward to the discussion in London,
>>>>>>> 
>>>>>>> Paul
>>>>>>> --
>>>>>>> ai-control mailing list -- [e-mail]
>>>>>>> To unsubscribe send an email to [e-mail]
>>>>>> 
>>>>>> --
>>>>>> ai-control mailing list -- [e-mail]
>>>>>> To unsubscribe send an email to [e-mail]
>>>>> 
>>>>> --
>>>>> ai-control mailing list -- [e-mail]
>>>>> To unsubscribe send an email to [e-mail]
>>>> 
>>> 
>>> -- 
>>> ai-control mailing list -- [e-mail]
>>> To unsubscribe send an email to [e-mail]
>> -- 
>> ai-control mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
> 
> -- 
> ai-control mailing list -- [e-mail] <mailto:[e-mail]>
> To unsubscribe send an email to [e-mail] <mailto:[e-mail]>