GPT-6 Sol & Luna: New challenges to the privacy boundaries of AI painting

GPT-6 Sol & Luna: New challenges to the privacy boundaries of AI painting

The privacy risks and countermeasures of AI painting from GPT-6 Sol & Luna

The week GPT-6 Sol & Luna was released, I fed 200 selfies of myself to an open source LoRA training script. Three hours later, the model could generate photos of "me" in any angle, any light, and any expression-even my mom couldn't tell the difference between real and fake during a video call. This is not science fiction, it is what happened in my 3090 video memory last week. The privacy boundary of AI painting is no longer a question of "whether it will be abused", but a question of "how many gaps are left that have not been modeled."

How many ordinary people's faces are hidden in the training set? LAION-5B claims to be 5.8 billion graphic pairs, and Common Crawl has crawled public images from the web for 12 years. The circle of friends you posted in 2015, the little red book you passed down in 2018, and the LinkedIn avatar you hung in 2021 are all in it. After the training set of Stable Diffusion 2.0 is deduplicated, there are still 2.3 billion images, of which faces account for about 14%. According to conservative estimates, the facial features of at least 300 million people around the world have been vectorized, compressed, and weighted. You didn't sign an agreement, didn't get a cut, and didn't even know that you had become a "training material."

Silicon Valley's narrative is "a public pool of data, and models benefit all mankind." Stability AI founder Emad Mostaque once said: "We are building a public library of human visual knowledge." It sounds beautiful, but the library never archives readers 'fingerprints, irises, and gait. One of the selling points of GPT-6 Sol is "consistent identity generation"-enter a reference map and maintain the same personality for the entire sequence. This technology is neutral in itself, but the moment it is deployed to the API, it is a "zero-threshold deep forgery generator." Midjourney v6 has been able to reverse extrapolate a 3D human head model from a single photo and combine it with a video generation model to produce an "person" oral video in five minutes at a cost of less than US$0.50.

Domestic manufacturers are moving more aggressively. In the "AI Photo" Mini programs tested internally by a leading factory, users uploaded 9 selfies and generated 50 "blockbusters" in half an hour, with a Retention rate of 68%. The background log shows that "Authorized for Model Optimization" is checked by default for uploaded pictures, and the exit entry is hidden in the three-level menu. What's worse is that the hidden watermark in the generated image can only be read by our own Detection Tools, and screenshots, compression, and forwarding will be invalid. This is not that "privacy protection is not enough", it is the business model that determines- your face is the fuel, the model is the engine, and monetization is the steering wheel . The Internet in China is accustomed to using "user experience" to package data collection, and Silicon Valley is accustomed to using "open innovation" to package the same thing. In essence, they both regard biometric information as free raw materials.

The opposition will say: "Publicly released pictures have no privacy expectations. The model learns patterns not individuals, and generates new pixels not replicas." This statement was torn apart by the plaintiff's lawyers in the New York Times trial against OpenAI. The lawyer demonstrated in court: Enter "a 1998 graduation photo-style photo", and the model outputs the background wall brick texture, photo frame chamfers, and even badge font strokes, pixel-aligned with the three original training drawings held by the plaintiff. This is not a learning mode, but a approximate recitation after lossy compression. Not to mention fine-tuning technologies such as DreamBooth and Textual Inversion, which specifically separate "individual characteristics" from the distribution, parameterize and reuse them. You can call this "feature extraction", but I only see "biometrics are stored into storage without authorization."

Put this matter in the gene sequencing industry to see it more clearly. 23andMe collects saliva for gene testing, users sign informed consent forms, data is de-labeled, samples can be applied for destruction, and FDA regulatory reports are interpreted. AI painting collects faces with zero notification, zero consent, irrevocable, and no supervision. Human faces are more sensitive than genes-genes cannot be collected remotely without sensing, but human faces can; genes cannot verify identity in real time, but human faces can; gene leaks mainly affect insurance pricing, and human faces can directly penetrate payment, customs clearance, login, and monitoring. Link. We have spent 20 years on genetic legislation, but how much time have we left for people's face?

Protection measures cannot rely solely on "self-discipline". Technology side: Federal learning prevents data from leaving the device, differential privacy adds noise to the gradient, machine forgetting allows the model to "forget" specific samples, and watermark traceability generates links-these are all in the paper, which has high implementation costs and large reasoning delays., easy to fail under counter-attacks, and manufacturers have no incentive to take the initiative. Legal side: China's "Interim Provisions on the Management of Generative AI Services" require "legal sources of training data" and labeling of generated content, but law enforcement focuses on "service providers" and not "model open source providers." The weights of LLaVA, Stable Diffusion, and Flux models run on personal graphics cards, and supervision is out of reach. The EU AI Act attempts to include "high-risk AI" in compliance audits, and model weights must also be registered, but implementation in the open source community is still a gray area.

I know an entrepreneur who makes a facial core SDK. Last year, the price was reduced to 0.03 yuan per time by a certain Short Video platform. This year, the platform itself launched the "AI Face Change Detection" interface and intercepted his customers. He complained to me: "I used to sell shovels, but now the platform digs its own gold mines, sells shovels, and collects tolls." This happens again in AI painting: the platform uses your face to train the model, the model generates a video of "you" to bring goods, fraud, and spread rumors, and the platform then sells you "deep forgery detection services"- Creating risks, peddling antidotes, and collecting tolls are all the same company. This is not a market failure, but the precise operation of the business model.

There is not much that can be done, but every one needs to be fought for: promote legislation on the Protection of Facial Information and include "model weights include facial features" in the supervision of biometric information; force commercial models to establish a "data traceability register", which picture contributes which neurons, whether it can be deleted, and how much model performance is lost after deleting, are written in black and white into the compliance report; The open source community promotes a "revocable training" architecture that isolates individual characteristics into pluggable Adapters. When users exercise the right to delete, they only need to destroy the Adapter without having to retrain the entire model; the terminal side deploys a "generated content watermark detector" to allow counterfeit content to be marked on the first hop of the propagation link.

Your face does not belong to you, who trained the model. This may sound like alarmist, but in front of GPT-6 Sol & Luna, it is just a statement of the current state of technology. The next generation model will make "consistent identity generation" a default capability, built into mobile photo albums, integrated into video conferencing filters, and encapsulated into the metaverse digital human interface. When we talk about privacy, we won't even be able to find the "opt-out" entrance.