How to Safeguard Business Interests in Generative AI Applications

The field of generative AI has witnessed remarkable advancements in the recent years. It is propelled by ground-breaking innovations like generative adversarial networks (GAN) in 2014, transformer neural networks in 2017 and reinforcement learning with human feedback (RLHF) in the same year. Accompanied by these algorithmic strides, continuous hardware acceleration has unlocked unprecedented capabilities, empowering the training of large language models (LLMs) on colossal natural language datasets.

However, the true turning point came with OpenAI’s game-changing release of ChatGPT. This momentous launch, followed by the announcement of GPT3.5 and DALL-E 2 models on Microsoft Azure, Google Bard, GPT4 and Microsoft CoPilot, ignited a wildfire of interest that has rapidly intensified, shaping the landscape of generative AI in an exponential manner.

Today, businesses are actively exploring the potential of generative AI, engaging in use case identification, conducting proof-of-value exercises, executing pilots, and integrating the technology into their operational processes.

Common Enterprise Applications for Generative AI

There are four broad areas in which generative AI finds application within enterprises:

• Enterprise virtual assistants and knowledge search
  This encompasses use cases such as question-and-answering, intelligent search and summarization on enterprise documents. The aim is to enhance customer experience, drive employee productivity and accelerate research and development.
• Content generation for digital commerce and media
  Generative AI can be harnessed to develop digital marketing accelerators for adaptive storytelling, generate dynamic digital avatars with natural speech interactions, generate scripts and images for advertisements, create conversational interfaces for digital commerce, and perform content generation across various media channels.
• Acceleration in software development lifecycle
  Generative AI is considered as a transformative technology for accelerating software development processes by assisting in code generation, converting legacy code for migration purposes, generating documentation and test cases, and providing aid in software incident management.
• Synthetic data generation
  Many analyst firms are predicting that large proportion of digital data will be AI generated. Most of that data will be used for training AI models. This entails using generative AI to create synthetic data when real data is either unavailable or inaccessible due to regulatory constraints or real data doesn’t have required variations. Generative AI facilitates data anonymization to address privacy and security requirements and enable the simulation of environments such as digital twins and the metaverse.

Challenges for Generative AI Models

Some of the biggest challenges for generative AI models, such as GPT or PaLM, are data privacy and protection, but businesses are also concerned about generative AI models violating regulations and general norms:

• Copyright violations
  Some models are trained on large amounts of internet data, including codes, and utilize this data or code to generate responses that may be identical to the original data. This potentially infringes on original copyright.
• Data privacy
  Internet data may contain personal information that, if not masked, can remain in the models’ responses. There is still a long way to go until all personal information is filtered.  Additionally, other aspects such as private business websites, browsing history, and chat history may also be used for training generative AI models. The interesting aspect is that once trained, this information is difficult to erase or forget.
• Ethical or responsible use of AI
  Lack of explainability, use of inappropriate or unsafe language, biases in responses, and wrong responses with high confidence are areas of concern for many businesses.

Key Considerations for a Stronger Generative AI Approach

There are solutions to above concerns, some of which may be easy to implement while others may take longer efforts. Considering the potential benefits of generative AI, many enterprises have begun efforts to build stronger solutions. The following considerations can help companies be sure they’re addressing critical risks or concerns from an application architecture perspective.

Information security

To safeguard confidential information, it is crucial to limit employees' direct access to interfaces like ChatGPT. Organizations should provide access to purpose-built business applications that utilize generative AI models within a robust information security framework. This can be achieved by leveraging enterprise-grade frameworks offered by cloud service providers or implementing in-house solutions within the secure enterprise network. The information security framework should cover all aspects of data interchange with generative AI models, including prompts, custom training and fine-tuning data, the trained model instance, and the generated responses. Encryption, access control, and data retention controls must be implemented to ensure the highest level of protection for these data elements.

Restriction to purpose

General-purpose generative AI models like GPT and Bard are trained on enormous corpora of information across almost every discipline of human knowledge. This makes it possible, intentionally or unintentionally, to elicit responses from the AI that are irrelevant to business purposes and are potentially harmful. Exposing customers or employees to such responses can negatively impact business outcomes, credibility, goodwill and even result in legal liability.

To mitigate these risks, businesses should develop specialized individual applications that are restricted to specific business purposes, built on top of the generative AI models. Each request to the application should be programmatically evaluated to ascertain relevance to the intended purpose before providing a response. This filtering process can be achieved using a custom-trained classification model.

Implementing this filtering mechanism will establish necessary guardrails to ensure that the application is used solely for its intended purpose and prevent unintended usage.

Custom training and finetuning

Many enterprise use cases of generative AI can leverage knowledge available within the enterprise itself. This requires custom training or fine-tuning and provides a higher level of control over the data used to train the models, resulting in increased transparency. Moreover, a transparency framework can be created on top of the enterprise document corpus used for custom training, by storing document embeddings. This framework enables tracing back the responses to the source documents used for training, providing transparency and explainability in the system’s responses. Consequently, it builds credibility. Custom training and fine-tuning also help achieve fairness by providing control over the data used to train the models.

Response moderation

Response moderation is necessary to detect and remove harmful elements in the generated responses, including irrelevant, inappropriate, plagiarized, or copyrighted content. The likelihood of harmful content increases in use cases that rely heavily on the pre-trained knowledge of the model, which comes from training that has happened outside the enterprise. Therefore, the implementation and rigor of response moderation should vary depending on the specific use case. Programmatic response moderation can be achieved using available services that detect different types of harmful content, combined with an ensemble of custom-trained classification models.

While these broad principles can help mitigate many of the risks associated with generative AI in an enterprise setting, their applicability varies depending on the use case. For example, a virtual assistant used by employees will have higher adaptability for custom training, thus presenting relatively lower risks when implemented alongside the other principles. On the other hand, a marketing catchphrase generator or code generator relies more on the pre-trained knowledge of the model and therefore has a higher propensity of generating plagiarized or copyrighted content.

Businesses should conduct a risk assessment for each individual use case, considering the applicability of these principles, to determine their roadmap of adapting generative AI based on the specific risk profile of each use case.

Anindito De
Head of AI and Automation CoE and Practice, Wipro

Swapnil Belhe
Chief Architect of Generative AI CoE and Practice, Wipro