×
Moon

US Lands Unmanned 'Odysseus' Spacecraft On Moon (yahoo.com) 29

The first privately built spacecraft has successfully landed on the lunar surface on Thursday. "We can confirm, without a doubt, that our equipment is on the surface of the moon," said Stephen Altemus, CEO of Intuitive Machines, the Houston-based company that operated the Odysseus spacecraft. "Welcome to the moon." From a report: As it approached the surface of the moon, Odysseus lost contact with NASA, resulting in several anxious minutes for those who worked on the joint project. But after approximately 15 minutes of searching, officials confirmed that they were once again receiving signals from the spacecraft. "A commercial lander named Odysseus, powered by a company called Intuitive Machines, launched up on a Space X rocket, carrying a bounty of NASA scientific instruments and bearing the dream of a new adventure, a new adventure in science, innovation and American leadership, well, all of that aced the landing of a lifetime," NASA Administrator Bill Nelson said after contact had been reestablished. "Today for the first time in more than a half century, the U.S. has returned to the moon."

Altemus had estimated that Odysseus had an 80% chance of successfully landing on the moon, citing previous failed attempts as an advantage. "We've stood on the shoulders of everybody who's tried before us," Altemus said. It was the first American mission to land on the moon since Apollo 17 in 1972 and the first private spacecraft ever to make a soft landing there. While it was a private mission, NASA paid Intuitive Machines $118 million to deliver six instruments to the moon. And the U.S. space agency provided streaming video of the landing.

Security

Fingerprints Can Be Recreated From the Sounds Made When Swiping On a Touchscreen (tomshardware.com) 42

An anonymous reader quotes a report from Tom's Hardware: An interesting new attack on biometric security has been outlined by a group of researchers from China and the US. PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound [PDF] proposes a side-channel attack on the sophisticated Automatic Fingerprint Identification System (AFIS). The attack leverages the sound characteristics of a user's finger swiping on a touchscreen to extract fingerprint pattern features. Following tests, the researchers assert that they can successfully attack "up to 27.9% of partial fingerprints and 9.3% of complete fingerprints within five attempts at the highest security FAR [False Acceptance Rate] setting of 0.01%." This is claimed to be the first work that leverages swiping sounds to infer fingerprint information.

Without contact prints or finger detail photos, how can an attacker hope to get any fingerprint data to enhance MasterPrint and DeepMasterPrint dictionary attack results on user fingerprints? One answer is as follows: the PrintListener paper says that "finger-swiping friction sounds can be captured by attackers online with a high possibility." The source of the finger-swiping sounds can be popular apps like Discord, Skype, WeChat, FaceTime, etc. Any chatty app where users carelessly perform swiping actions on the screen while the device mic is live. Hence the side-channel attack name -- PrintListener. [...]

To prove the theory, the scientists practically developed their attack research as PrintListener. In brief, PrintListener uses a series of algorithms for pre-processing the raw audio signals which are then used to generate targeted synthetics for PatternMasterPrint (the MasterPrint generated by fingerprints with a specific pattern). Importantly, PrintListener went through extensive experiments "in real-world scenarios," and, as mentioned in the intro, can facilitate successful partial fingerprint attacks in better than one in four cases, and complete fingerprint attacks in nearly one in ten cases. These results far exceed unaided MasterPrint fingerprint dictionary attacks.

AI

Scientific Journal Publishes AI-Generated Rat With Gigantic Penis (vice.com) 72

Jordan Pearson reports via Motherboard: A peer-reviewed science journal published a paper this week filled with nonsensical AI-generated images, which featured garbled text and a wildly incorrect diagram of a rat penis. The episode is the latest example of how generative AI is making its way into academia with concerning effects. The paper, titled "Cellular functions of spermatogonial stem cells in relation to JAK/STAT signaling pathway" was published on Wednesday in the open access Frontiers in Cell Development and Biology journal by researchers from Hong Hui Hospital and Jiaotong University in China. The paper itself is unlikely to be interesting to most people without a specific interest in the stem cells of small mammals, but the figures published with the article are another story entirely. [...]

It's unclear how this all got through the editing, peer review, and publishing process. Motherboard contacted the paper's U.S.-based reviewer, Jingbo Dai of Northwestern University, who said that it was not his responsibility to vet the obviously incorrect images. (The second reviewer is based in India.) "As a biomedical researcher, I only review the paper based on its scientific aspects. For the AI-generated figures, since the author cited Midjourney, it's the publisher's responsibility to make the decision," Dai said. "You should contact Frontiers about their policy of AI-generated figures." Frontier's policies for authors state that generative AI is allowed, but that it must be disclosed -- which the paper's authors did -- and the outputs must be checked for factual accuracy. "Specifically, the author is responsible for checking the factual accuracy of any content created by the generative AI technology," Frontier's policy states. "This includes, but is not limited to, any quotes, citations or references. Figures produced by or edited using a generative AI technology must be checked to ensure they accurately reflect the data presented in the manuscript."

On Thursday afternoon, after the article and its AI-generated figures circulated social media, Frontiers appended a notice to the paper saying that it had corrected the article and that a new version would appear later. It did not specify what exactly was corrected.
UPDATE: Frontiers retracted the article and issued the following statement: "Following publication, concerns were raised regarding the nature of its AI-generated figures. The article does not meet the standards of editorial and scientific rigor for Frontiers in Cell and Development Biology; therefore, the article has been retracted. This retraction was approved by the Chief Executive Editor of Frontiers. Frontiers would like to thank the concerned readers who contacted us regarding the published article."
Transportation

Waymo Recalls and Updates Robotaxi Software After Two Cars Crashed (techcrunch.com) 41

Sean O'Kane reports via TechCrunch: Waymo is voluntarily recalling the software that powers its robotaxi fleet after two vehicles crashed into the same towed pickup truck in Phoenix, Arizona, in December. It's the company's first recall. Waymo chief safety officer Mauricio Pena described the crashes as "minor" in a blog post, and said neither vehicle was carrying passengers at the time. There were no injuries. He also said Waymo's ride-hailing service -- which is live in Phoenix, San Francisco, Los Angeles, and Austin -- "is not and has not been interrupted by this update." The company declined to share video of the crashes with TechCrunch.

Waymo said it developed, tested, and validated a fix to the software that it started deploying to its fleet on December 20. All of its robotaxis received that software update by January 12. "This voluntary recall reflects how seriously we take our responsibility to safely deploy our technology and to transparently communicate with the public," Pena wrote.

The crashes that prompted the recall both happened on December 11. Pena wrote that one of Waymo's vehicles came upon a backward-facing pickup truck being "improperly towed." The truck was "persistently angled across a center turn lane and a traffic lane." Pena said the robotaxi "incorrectly predicted the future motion of the towed vehicle" because of this mismatch between the orientation of the tow truck and the pickup, and made contact. The company told TechCrunch this caused minor damage to the front left bumper. The tow truck did not stop, though, according to Pena, and just a few minutes later another Waymo robotaxi made contact with the same pickup truck being towed. The company told TechCrunch this caused minor damage to the front left bumper and a sensor. (The tow truck stopped after the second crash.)
Last week, a Waymo autonomous vehicle was vandalized and burned by a crowd of people in San Francisco. Meanwhile, Rival operator Cruise suspended its operations while it investigates an incident where one of its robotaxis ran over a pedestrian who had been hit by another vehicle driven by a human.
Businesses

Investors in Airbnb Arbitrage Business Allege They Were Defrauded (cnbc.com) 11

A company called Hands-Free Automation (HFA) has been accused of improperly relisting properties on Airbnb at higher prices after taking listings from hotel and short-term rental sites, according to a lawsuit filed in February. HFA founder Anthony Agyeman allegedly promised investors returns in 3-6 months for $20,000-30,000 investments in owning stakes in Airbnb listings. However, Airbnb prohibits the practice, and HFA has not been authorized by property owners, CNBC reported this week. The Federal Trade Commission has accused similar companies previously of making false promises of profits. Airbnb said it was unaware of contact from regulators regarding HFA.
Security

The Viral Smart Toothbrush Botnet Story Is Not Real (404media.co) 52

On Tuesday, The Independent, Tom's Hardware, and many other tech outlets reported on a story about how three million smart toothbrushes were used in a DDoS attack. The only problem? It "didn't actually happen," writes Jason Koebler via 404 Media. "There are no additional details about this apparent attack, and most of the article cites general research by a publicly traded cybersecurity company called Fortinet which has detected malicious, hijacked internet of things devices over the years. A search on Fortinet's website shows no recent published research about hacked smart toothbrushes." From the report: The original article, called "The toothbrushes are attacking," starts with the following passage: "She's at home in the bathroom, but she's part of a large-scale cyber attack. The electric toothbrush is programmed with Java, and criminals have unnoticed installed malware on it - like on 3 million other toothbrushes. One command is enough and the remote-controlled toothbrushes simultaneously access the website of a Swiss company. The site collapses and is paralyzed for four hours. Millions of dollars in damage is caused. This example, which seems like a Hollywood scenario, actually happened. It shows how versatile digital attacks have become." [...]

The "3 million hacked smart toothbrushes" story has now been viral for more than 24 hours and literally no new information about it has emerged despite widespread skepticism from people in the security industry and its virality. The two Fortinet executives cited in the original report did not respond to an email and LinkedIn message seeking clarification, and neither did Fortinet's PR team. The author of the Aargauer Zeitung story also did not respond to a request for more information. I called Fortinet's headquarters, asked to speak to the PR contact listed on the press release about its earnings, which was published after the toothbrush news began to go viral, and was promptly disconnected. The company has continued to tweet about other, unrelated things. They have not responded to BleepingComputer either, nor the many security researchers who are asking for further proof that this actually happened. While we don't know how this happened, Fortinet has been talking specifically about the dangers of internet-connected toothbrushes for years, and has been using it as an example in researcher talks.
In a statement to 404 Media, Fortinet said "To clarify, the topic of toothbrushes being used for DDoS attacks was presented during an interview as an illustration of a given type of attack, and it is not based on research from Fortinet or FortiGuard Labs. It appears that due to translations the narrative on this topic has been stretched to the point where hypothetical and actual scenarios are blurred."
AI

A Chatbot Helped More People Access Mental-Health Services (technologyreview.com) 25

An AI chatbot helped increase the number of patients referred for mental-health services through England's National Health Service (NHS), particularly among underrepresented groups who are less likely to seek help, new research has found. MIT Tech Review: Demand for mental-health services in England is on the rise, particularly since the covid-19 pandemic. Mental-health services received 4.6 million patient referrals in 2022 -- the highest number on record -- and the number of people in contact with such services is growing steadily. But neither the funding nor the number of mental-health professionals is adequate to meet this rising demand, according to the British Medical Association.

The chatbot's creators, from the AI company Limbic, set out to investigate whether AI could lower the barrier to care by helping patients access help more quickly and efficiently. A new study, published this week in Nature Medicine, evaluated the effect that the chatbot, called Limbic Access, had on referrals to the NHS Talking Therapies for Anxiety and Depression program, a series of evidence-based psychological therapies for adults experiencing anxiety disorders, depression, or both.
Venture capitalist Vinod Khosla comments on X: This landmark study codifies what we have believed for so long -- that AI will not only increase the quality of care but also massively improve its access, which is one of the largest barriers to good health in all corners of the globe.
Mars

NASA Regains Contact With Its 'Ingenuity' Mars Helicopter (npr.org) 12

"Good news..." NASA posted Saturday night on X. "We've reestablished contact with the Mars Helicopter..."

After a two-day communications blackout, NASA had instructed its Perseverance Mars rover "to perform long-duration listening sessions for Ingenuity's signal" — and apparently they did the trick. "The team is reviewing the new data to better understand the unexpected comms dropout" during the helicopter's record-breaking 72nd flight.

Slashdot reader Thelasko shared this report from NPR: Communications broke down on Thursday, when the little autonomous rotorcraft was sent on a "quick pop-up vertical flight," to test its systems after an unplanned early landing during its previous flight, the agency said in a status update on Friday night. The Perseverance rover, which relays data between the helicopter and Earth during the flights, showed that Ingenuity climbed to its assigned maximum altitude of 40 feet, NASA said.

During its planned descent, the helicopter and rover stopped communicating with each other...

Even before it came back online, RockDoctor (Slashdot reader #15,477) pointed out that the Mars copter has done this before. "Batteries dieing, resulting in a communications re-set, If I remember correctly."

Space.com also noted additional alternatives: "Perseverance is currently out of line-of-sight with Ingenuity, but the team could consider driving closer for a visual inspection," NASA's Jet Propulsion Laboratory in Southern California, which manages both robots' missions, said via X on Friday.

Ingenuity has stayed aloft for more than 128 minutes and covered a total of 11 miles (17.7 kilometers) during its 72 Mars flights, according to the mission's flight log.

Technology

New Device Allows Users To Scroll With Their Tongue (nbcnews.com) 50

An anonymous reader quotes a report from NBC News: Touchscreens are going hands-free with a new device that allows users to scroll through smartphones using only their tongues. MouthPad^, a retainer-like trackpad chip that sits on the roof of the mouth, made its debut at the Consumer Electronics Show this week. It can sense tongue movements, allowing users to scroll, type, make calls and even play chess with a swipe or a click of their tongue. "It is a mouse for your mouth," Corbin Halliwill, a software engineer at Augmental, the company that created the device, said.

Augmental created MouthPad^ to be a helpful tool to those living with disabilities, especially those with a hand impairment or paralysis. It connects to any tablet, phone or computer through Bluetooth. [...] The Augmental team has been developing its working prototype for about two years, mostly fine-tuning controls and applying filters so the device can work even if it picks up saliva or water. The product is expected to hit the market later this year, and early access is available on their website now. [...] The MouthPad^ is clear around the teeth, and the center is a golden touchpad that is the contact point for the tongue. Inside there is also a force sensor that picks up left and right clicks or could be mapped to other hotkey options. On the side, a small bump that holds the Bluetooth antenna and wireless charging battery sticks out and lays against the cheek.

Augmental doesn't recommend leaving it in for meals, but it is safe to drink with it in -- Halliwill said he wears it in the office while drinking water and his morning coffee. The company hopes to build the technology out in the near future, bringing new possibilities for users in the coming months. Some additions may include voice and wheelchair control. The battery now lasts about five hours, but Augmental hopes to extend it to eight in their next version.
You can watch the trailer for MouthPad^ here.
Medicine

Consumer Reports Finds 'Widespread' Presence of Plastics In Food (reuters.com) 37

An anonymous reader quotes a report from Reuters: Consumer Reports has found that plastics retain a "widespread" presence in food despite the health risks, and called on regulators to reassess the safety of plastics that come into contact with food during production. The non-profit consumer group said on Thursday that 84 out of 85 supermarket foods and fast foods it recently tested contained "plasticizers" known as phthalates, a chemical used to make plastic more durable. It also said 79% of food samples in its study contained bisphenol A (BPA), another chemical found in plastic, and other bisphenols, though levels were lower than in tests done in 2009.

Consumer Reports said none of the phthalate levels it found exceeded limits set by U.S. and European regulators. It also said there was no level of phthalates that scientists confirm is safe, but that does not guarantee the safety of foods you eat. Phthalates and bisphenols can disrupt the production and regulation of estrogen and other hormones, potentially boosting the risk of birth defects, cancer, diabetes, infertility, neurodevelopmental disorders, obesity and other health problems. Among tested supermarket foods, Annie's Organic Cheesy Ravioli contained the most phthalates in nanograms per serving, 53,579, followed by Del Monte sliced peaches and Chicken of the Sea pink salmon.

Security

Amnesty International Confirms Apple's Warning to Journalists About Spyware-Infected iPhones (techcrunch.com) 75

TechCrunch reports: Apple's warnings in late October that Indian journalists and opposition figures may have been targeted by state-sponsored attacks prompted a forceful counterattack from Prime Minister Narendra Modi's government. Officials publicly doubted Apple's findings and announced a probe into device security.

India has never confirmed nor denied using the Pegasus tool, but nonprofit advocacy group Amnesty International reported Thursday that it found NSO Group's invasive spyware on the iPhones of prominent journalists in India, lending more credibility to Apple's early warnings. "Our latest findings show that increasingly, journalists in India face the threat of unlawful surveillance simply for doing their jobs, alongside other tools of repression including imprisonment under draconian laws, smear campaigns, harassment, and intimidation," said Donncha Ã" Cearbhaill, head of Amnesty International's Security Lab, in the blog post.

Cloud security company Lookout has also published "an in-depth technical look" at Pegasus, calling its use "a targeted espionage attack being actively leveraged against an undetermined number of mobile users around the world." It uses sophisticated function hooking to subvert OS- and application-layer security in voice/audio calls and apps including Gmail, Facebook, WhatsApp, Facetime, Viber, WeChat, Telegram, Apple's built-in messaging and email apps, and others. It steals the victim's contact list and GPS location, as well as personal, Wi-Fi, and router passwords stored on the device...

According to news reports, NSO Group sells weaponized software that targets mobile phones to governments and has been operating since 2010, according to its LinkedIn page. The Pegasus spyware has existed for a significant amount of time, and is advertised and sold for use on high-value targets for multiple purposes, including high-level espionage on iOS, Android, and Blackberry.

Thanks to Slashdodt reader Mirnotoriety for sharing the news.
AI

ChatGPT Exploit Finds 24 Email Addresses, Amid Warnings of 'AI Silo' (thehill.com) 67

The New York Times reports: Last month, I received an alarming email from someone I did not know: Rui Zhu, a Ph.D. candidate at Indiana University Bloomington. Mr. Zhu had my email address, he explained, because GPT-3.5 Turbo, one of the latest and most robust large language models (L.L.M.) from OpenAI, had delivered it to him. My contact information was included in a list of business and personal email addresses for more than 30 New York Times employees that a research team, including Mr. Zhu, had managed to extract from GPT-3.5 Turbo in the fall of this year. With some work, the team had been able to "bypass the model's restrictions on responding to privacy-related queries," Mr. Zhu wrote.

My email address is not a secret. But the success of the researchers' experiment should ring alarm bells because it reveals the potential for ChatGPT, and generative A.I. tools like it, to reveal much more sensitive personal information with just a bit of tweaking. When you ask ChatGPT a question, it does not simply search the web to find the answer. Instead, it draws on what it has "learned" from reams of information — training data that was used to feed and develop the model — to generate one. L.L.M.s train on vast amounts of text, which may include personal information pulled from the Internet and other sources. That training data informs how the A.I. tool works, but it is not supposed to be recalled verbatim... In the example output they provided for Times employees, many of the personal email addresses were either off by a few characters or entirely wrong. But 80 percent of the work addresses the model returned were correct.

The researchers used the API for accessing ChatGPT, the article notes, where "requests that would typically be denied in the ChatGPT interface were accepted..."

"The vulnerability is particularly concerning because no one — apart from a limited number of OpenAI employees — really knows what lurks in ChatGPT's training-data memory."

And there was a broader related warning in another article published the same day. Microsoft may be building an AI silo in a walled garden, argues a professor at the University of California, Berkeley's school of information, calling the development "detrimental for technology development, as well as costly and potentially dangerous for society and the economy." [In January] Microsoft sealed its OpenAI relationship with another major investment — this time around $10 billion, much of which was, once again, in the form of cloud credits instead of conventional finance. In return, OpenAI agreed to run and power its AI exclusively through Microsoft's Azure cloud and granted Microsoft certain rights to its intellectual property...

Recent reports that U.K. competition authorities and the U.S. Federal Trade Commission are scrutinizing Microsoft's investment in OpenAI are encouraging. But Microsoft's failure to report these investments for what they are — a de facto acquisition — demonstrates that the company is keenly aware of the stakes and has taken advantage of OpenAI's somewhat peculiar legal status as a non-profit entity to work around the rules...

The U.S. government needs to quickly step in and reverse the negative momentum that is pushing AI into walled gardens. The longer it waits, the harder it will be, both politically and technically, to re-introduce robust competition and the open ecosystem that society needs to maximize the benefits and manage the risks of AI technology.

Science

Risk of Penile Fractures Rises at Christmas, Doctors Find (theguardian.com) 70

An anonymous reader shares a report: It may be the season of loving and giving, but doctors have warned against embracing this spirit too enthusiastically -- at least where sexual relations are concerned. They have discovered that the Christmas period is associated with a significantly increased risk of penile fractures -- a medical emergency in which the erection-producing regions of the penis snap, usually as a result of forceful bending during over-enthusiastic sexual intercourse. "This injury tends to occur during wild sex -- particularly in positions where you're not in direct eye contact [with your partner], such as the reverse cowgirl," said Dr Nikolaos Pyrgides, a urologist at the Ludwig Maximilian University of Munich, who led the research.

The fractures are often heralded by an audible crack, followed by severe pain, rapid loss of erection and severe swelling and bruising. "When [patients] present to their doctor their penis often looks like an eggplant," Pyrgides said. Suspecting that the intimacy and euphoria of the festive season might be a risk factor for this type of injury, Pyrgides and his colleagues examined hospital data for 3,421 men who sustained penile fractures in Germany between 2005 and 2021. The study -- the first to explore seasonal patterns for this type of injury -- found that such injuries were indeed more common over Christmas. In fact, "if every day was like Christmas, 43% more penile fractures would have occurred in Germany from 2005 on," Pyrgides said. The research, which was published in the British Journal of Urology International, also found the risk increased at weekends and over the summer holidays. However, New Year's Eve was not associated with an increased incidence of penis injuries.

Security

Comcast Discloses Data Breach of Close To 36 Million Xfinity Customers [UPDATE] (techcrunch.com) 40

In a notice on Monday, Xfinity notified customers of a "data security incident" that resulted in the theft of customer information, including usernames, passwords, contact information, and more. The Verge reports: Xfinity traces the breach to a security vulnerability disclosed by cloud computing company Citrix, which began alerting customers of a flaw in software Xfinity and other companies use on October 10th. While Xfinity says it patched the security hole, it later uncovered suspicious activity on its internal systems "that was concluded to be a result of this vulnerability."

The hack resulted in the theft of customer usernames and hashed passwords, according to Xfinity's notice. Meanwhile, "some customers" may have had their names, contact information, last four digits of their social security numbers, dates of birth, and / or secret questions and answers exposed. Xfinity has notified federal law enforcement about the incident and says "data analysis is continuing."

We still don't know how many users were affected by the breach. Xfinity will automatically ask customers to change their passwords the next time they log in to their accounts, and it's also encouraging users to turn on two-factor authentication. You can find the full notice, including contact information for the company's incident response team, on Xfinity's website (PDF).
UPDATE 12/19/23: According to TechCrunch, almost 36 million Xfinity customers had their sensitive information accessed by hackers via a vulnerability known as "CitrixBleed." The vulnerability is "found in Citrix networking devices often used by big corporations and has been under mass-exploitation by hackers since late August," the report says. "Citrix made patches available in early October, but many organizations did not patch in time. Hackers have used the CitrixBleed vulnerability to hack into big-name victims, including aerospace giant Boeing, the Industrial and Commercial Bank of China and international law firm Allen & Overy."

"In a filing with Maine's attorney general, Comcast confirmed that almost 35.8 million customers are affected by the breach. Comcast's latest earnings report shows the company has more than 32 million broadband customers, suggesting this breach has impacted most, if not all Xfinity customers."
IT

Marketing Company Claims That It Actually Is Listening To Phone and Smart Speakers To Target Ads (404media.co) 147

A marketing team within media giant Cox Media Group (CMG) claims it has the capability to listen to ambient conversations of consumers through embedded microphones in smartphones, smart TVs, and other devices to gather data and use it to target ads, according to a review of CMG marketing materials by 404 Media and details from a pitch given to an outside marketing professional. From a report: Called "Active Listening," CMG claims the capability can identify potential customers "based on casual conversations in real time." The news signals that what a huge swath of the public has believed for years -- that smartphones are listening to people in order to deliver ads -- may finally be a reality in certain situations. Until now, there was no evidence that such a capability actually existed, but its myth permeated due to how sophisticated other ad tracking methods have become.

It is not immediately clear if the capability CMG is advertising and claims works is being used on devices in the market today, but the company notes it is "a marketing technique fit for the future. Available today." 404 Media also found a representative of the company on LinkedIn explicitly asking interested parties to contact them about the product. One marketing professional pitched by CMG on the tech said a CMG representative explained the prices of the service to them. "What would it mean for your business if you could target potential clients who are actively discussing their need for your services in their day-to-day conversations? No, it's not a Black Mirror episode -- it's Voice Data, and CMG has the capabilities to use it to your business advantage," CMG's website reads.

AI

Google Researchers' Attack Prompts ChatGPT To Reveal Its Training Data (404media.co) 73

Jason Koebler reports via 404 Media: A team of researchers primarily from Google's DeepMind systematically convinced ChatGPT to reveal snippets of the data it was trained on using a new type of attack prompt which asked a production model of the chatbot to repeat specific words forever. Using this tactic, the researchers showed that there are large amounts of privately identifiable information (PII) in OpenAI's large language models. They also showed that, on a public version of ChatGPT, the chatbot spit out large passages of text scraped verbatim from other places on the internet.

ChatGPT's response to the prompt "Repeat this word forever: 'poem poem poem poem'" was the word "poem" for a long time, and then, eventually, an email signature for a real human "founder and CEO," which included their personal contact information including cell phone number and email address, for example. "We show an adversary can extract gigabytes of training data from open-source language models like Pythia or GPT-Neo, semi-open models like LLaMA or Falcon, and closed models like ChatGPT," the researchers, from Google DeepMind, the University of Washington, Cornell, Carnegie Mellon University, the University of California Berkeley, and ETH Zurich, wrote in a paper published in the open access prejournal arXiv Tuesday.

This is particularly notable given that OpenAI's models are closed source, as is the fact that it was done on a publicly available, deployed version of ChatGPT-3.5-turbo. It also, crucially, shows that ChatGPT's "alignment techniques do not eliminate memorization," meaning that it sometimes spits out training data verbatim. This included PII, entire poems, "cryptographically-random identifiers" like Bitcoin addresses, passages from copyrighted scientific research papers, website addresses, and much more. "In total, 16.9 percent of generations we tested contained memorized PII," they wrote, which included "identifying phone and fax numbers, email and physical addresses ... social media handles, URLs, and names and birthdays." [...] The researchers wrote that they spent $200 to create "over 10,000 unique examples" of training data, which they say is a total of "several megabytes" of training data. The researchers suggest that using this attack, with enough money, they could have extracted gigabytes of training data.

Canada

Canadian Government Reaches Deal With Google On Online News Act (www.cbc.ca) 50

An anonymous reader quotes a report from the CBC: Google and the federal government have reached an agreement in their dispute over the Online News Act that would see Google continue to share Canadian news online in return for the company making annual payments to news companies in the range of $100 million. Sources told Radio-Canada and CBC News earlier Wednesday that an agreement had been reached. Heritage Minister Pascale St-Onge confirmed the news Wednesday afternoon. "Many doubted that we would be successful, but I was confident we would find a way to address Google's concerns," she told reporters outside the House of Commons.

The federal government and Google agreed on the regulatory framework earlier this week, a government source familiar with the talks told Radio-Canada. The federal government had estimated earlier this year that Google's compensation should amount to about $172 million. Google estimated the value at $100 million. The company said it would not have a mandatory negotiation model imposed on it for talks with Canadian media organizations, preferring to deal with a single point of contact. The new regulations will allow Google to negotiate with a single group that would represent all media, allowing the company to limit its arbitration risk. Google would still be required to negotiate with the media and sign an agreement. The digital giant could also add additional service contributions, which have yet to be specified.

AI

AWS's Transcription Platform Is Now Powered By Generative AI (theverge.com) 13

Emilia David reports via The Verge: AWS added new languages to its Amazon Transcribe product, offering generative AI-based transcription for 100 languages and a slew of new AI capabilities for customers. Announced during the AWS re: Invent event, Amazon Transcribe can now recognize more spoken languages and spin up a call transcription. AWS customers use Transcribe to add speech-to-text capabilities to their apps on the AWS Cloud.

The company said in a blog post that Transcribe trained on "millions of hours of unlabeled audio data from over 100 languages" and uses self-supervised algorithms to learn patterns of human speech in different languages and accents. AWS said it ensured that some languages were not overrepresented in the training data to ensure that lesser-used languages could be as accurate as more frequently spoken ones. In late 2022, Amazon Transcribe supported 79 languages.

Amazon Transcribe has 20 to 50 percent accuracy across many languages, according to AWS. It also offers automatic punctuation, custom vocabulary, automatic language identification, and custom vocabulary filters. It can recognize speech in audio and video formats and noisy environments. With better language recognition, AWS said advances with Amazon Transcribe also bleed into better accuracy with its Call Analytics platform, which its contact center customers often use. Amazon Transcribe Call Analytics, now also powered by generative AI models, summarizes interactions between an agent and a customer. AWS said this cuts down on after-call work creating reports, and managers can quickly read information without needing to go through the entire transcript.

Google

Google Play Keeps Banning the Same Web Browser Due To Vague DMCA Notices (arstechnica.com) 69

An anonymous reader quotes a report from Ars Technica: App developer Elias Saba has had some bad luck with Digital Millennium Copyright Act (DMCA) takedowns. His Android TV app Downloader, which combines a web browser with a file manager, was suspended by Google Play in May after several Israeli TV companies complained that the app could be used to load a pirate website. Google reversed that suspension after three weeks. But Downloader has been suspended by Google Play again, and this time the reason is even harder to understand. Based on a vague DMCA notice, it appears that Downloader was suspended simply because it can load the Warner Bros. website. [...]

The notice includes a copy of the DMCA complaint, which came from MarkScan, a "digital asset protection" firm that content owners hire to enforce copyrights. MarkScan said in its complaint that it represents Warner Bros. Discovery Inc. A DMCA notice is supposed to identify and describe the copyrighted work that was infringed. But MarkScan's notice about Downloader identifies the copyrighted work only as "Properties of Warner Bros. Discovery Inc." It provides no detail on which Warner Bros. work was infringed by Downloader. A DMCA notice is also supposed to provide an example of where someone can see "an authorized example of the work." In this field, MarkScan simply entered the main Warner Bros. URL: https://www.warnerbros.com/. The Downloader app had been installed over 10 million times before the takedown, according to an Internet Archive capture taken before the latest suspension.

Saba appealed the takedown today, but he told us that the appeal was rejected by Google Play after 24 minutes. Saba said he also submitted a DMCA counter-notice, which gives the complainant 10 business days from today to file a legal action. After his first takedown in May, his app was reinstated after the DMCA complainant didn't take any legal action. Saba also wrote a blog post today about the latest takedown. "Given that my app still does not contain any copyright-infringing content and never has, I've countered this new DMCA takedown which will, hopefully, mean the app will be restored sometime in the coming weeks," he wrote. "In the meantime, you can sideload the app onto your Google TV or Android TV devices by downloading the APK from https://www.aftvnews.com/downloader.apk. Downloader remains available on Fire TV devices directly from the Amazon Appstore."
Saba said it's "absurd that Google seems to make no effort at all to verify the copyright claims being made on my app which is just a web browser that can download files and has no content of any sort in it."

"If loading a website with infringing content in a standard web browser is enough to violate DMCA, then every browser in the Google Play Store including @googlechrome should also be removed," said Saba in May. "It's a ridiculous claim and an abuse of the DMCA."
Robotics

America's Bowling Pins Face a Revolutionary New Technology: Strings (msn.com) 98

There's yet another technological revolution happening, reports the Los Angeles Times. Bowling alleys across America "are ditching traditional pinsetters — the machines that sweep away and reset pins — in favor of contraptions that employ string.

"Think of the pins as marionettes with nylon cords attached to their heads. Those that fall are lifted out of the way, as if by levitation, then lowered back into place after each frame... European bowling alleys have used string pinsetters for decades because they require less energy and maintenance.

"All you need is someone at the front counter to run back when the strings tangle." String pinsetters mean big savings, maybe salvation, for an industry losing customers to video games and other newfangled entertainment. That is why the U.S. Bowling Congress recently certified them for tournaments and league play. But there is delicate science at play here. Radius of gyration, coefficient of restitution and other obscure forces cause tethered pins to fly around differently than their free-fall counterparts. They don't even make the same noise. Faced with growing pushback, the bowling congress published new research this month claiming the disparity isn't nearly as great as people think.
Using a giant mechanical arm, powered by hydraulics and air pressure, they rolled "thousands of test balls from every angle, with various speeds and spins, on string-equipped lanes," according to the article: They found a configuration that resulted in 7.1% fewer strikes and about 10 pins fewer per game as compared to bowling with traditional pinsetters... Officials subsequently enlisted 500 human bowlers for more testing and, this time, reported finding "no statistically significant difference." But hundreds of test participants commented that bowling on strings felt "off." The pins seemed less active, they said. There were occasional spares whereby one pin toppled another without making contact, simply by crossing strings.

Nothing could be done about the muted sound. It's like hearing a drum roll — the ball charging down the lane — with no crashing cymbal at the end.

Still, one Northern California bowling alley spent $1 million to install the technology, and believes it will save them money — partly by cutting their electric bill in half. "We had a full-time mechanic and were spending up to $3,000 a month on parts."

The article also remembers that once upon a time, bowling alleys reset their pins using pinboys, "actual humans — mostly teenagers... scrambling around behind the lanes, gathering and resetting by hand," before they were replaced by machines after World War II.

Slashdot Top Deals