{"id":62667,"date":"2025-08-12T22:54:13","date_gmt":"2025-08-12T22:54:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/62667\/"},"modified":"2025-08-12T22:54:13","modified_gmt":"2025-08-12T22:54:13","slug":"how-ai-poisoning-is-fighting-bots-that-hoover-data-without-permission","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/62667\/","title":{"rendered":"How AI poisoning is fighting bots that hoover data without permission"},"content":{"rendered":"<p><img decoding=\"async\" class=\"Image\" alt=\"New Scientist. Science news and long reads from expert journalists, covering developments in science, technology, health and the environment on the website and the magazine.\" width=\"1350\" height=\"900\" src=\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/08\/SEI_261190983.jpg\"   loading=\"eager\" fetchpriority=\"high\" data-image-context=\"Article\" data-image-id=\"2491633\" data-caption=\"\" data-credit=\"Renaud Vigourt\"\/><\/p>\n<p>Gone are the days when the web was dominated by humans posting social media updates or exchanging memes. Earlier this year, for the first time since the data has been tracked, <a href=\"https:\/\/www.imperva.com\/resources\/resource-library\/reports\/2025-bad-bot-report\/\" rel=\"nofollow noopener\" target=\"_blank\">web-browsing bots, rather than humans<\/a>, accounted for the bulk of web traffic.<\/p>\n<p>Well over half of that <a href=\"https:\/\/www.newscientist.com\/article\/mg24833133-200-hordes-of-automated-bots-run-the-internet-can-we-bring-them-to-heel\/\" rel=\"nofollow noopener\" target=\"_blank\">bot traffic<\/a> is from malicious bots, hoovering up personal data left unprotected online, for instance. But an increasing proportion comes from bots sent out by artificial intelligence companies to gather data for their models or respond to user prompts. Indeed, ChatGPT-User, a bot powering <a href=\"https:\/\/www.newscientist.com\/article\/2472068-revealed-how-the-uk-tech-secretary-uses-chatgpt-for-policy-advice\/\" rel=\"nofollow noopener\" target=\"_blank\">OpenAI\u2019s ChatGPT<\/a>, is now responsible for 6 per cent of all web traffic, while ClaudeBot, an automated system developed by AI company Anthropic, accounts for 13 per cent.<\/p>\n<p>The AI companies say such data scraping is vital to keep their models up to date. Content creators feel differently, however, seeing AI bots as tools for copyright infringement on a grand scale. Earlier this year, for example, <a href=\"https:\/\/www.newscientist.com\/article\/2484002-disney-and-universal-lawsuit-may-be-killing-blow-in-ai-copyright-wars\/\" rel=\"nofollow noopener\" target=\"_blank\">Disney and Universal sued AI company Midjourney<\/a>, arguing that the tech firm\u2019s image generator plagiarises characters from popular franchises like Star Wars and Despicable Me.<\/p>\n<p>Few content creators have the money for lawsuits, so some are adopting more radical methods of fighting back. They are using online tools that make it harder for AI bots to find their content \u2013 or that manipulate it in a way that <a href=\"https:\/\/arxiv.org\/abs\/2310.13828\" rel=\"nofollow noopener\" target=\"_blank\">tricks bots into misreading it<\/a>, so that the AI begins to confuse images of cars with images of cows, for example. But while this \u201cAI poisoning\u201d can help content creators protect their work, it might also inadvertently make the web a more dangerous place.<\/p>\n<p>Copyright infringement<\/p>\n<p>For centuries, copycats have made a quick profit by mimicking the work of artists. It is one reason why we have intellectual property and copyright laws. But the arrival in the past few years of AI image generators such as Midjourney or <a href=\"https:\/\/www.newscientist.com\/article\/2264022-ai-illustrator-draws-imaginative-pictures-to-go-with-text-captions\/\" rel=\"nofollow noopener\" target=\"_blank\">OpenAI\u2019s DALL-E<\/a> has supercharged the issue.<\/p>\n<p>A central concern in the US is what is known as the fair use doctrine. This allows samples of copyrighted material to be used under certain conditions without requesting permission from the copyright holder. Fair use law is deliberately flexible, but at its heart is the idea that you can use an original work to create something new, provided it is altered enough and doesn\u2019t have a detrimental market effect on the original work.<\/p>\n<p>Many artists, musicians and other campaigners argue that AI tools are blurring the boundary between fair use and copyright infringement to the cost of content creators. For instance, it isn\u2019t necessarily detrimental for someone to draw a picture of Mickey Mouse in, say, The Simpsons\u2019 universe for their own entertainment. But with AI, it is now possible for anyone to spin up large numbers of such images quickly and in a manner where the transformative nature of what they have done is questionable. Once they have made these images, it would be easy to produce a range of T-shirts based on them, for example, which would cross from personal to commercial use and breach the fair use doctrine.<\/p>\n<p>Keen to protect their commercial interests, some content creators in the US are taking legal action. The Disney and Universal lawsuit against Midjourney, launched in June, is just the latest example. Others include an <a href=\"https:\/\/www.nytimes.com\/2023\/12\/27\/business\/media\/new-york-times-open-ai-microsoft-lawsuit.html\" rel=\"nofollow noopener\" target=\"_blank\">ongoing legal battle between The New York Times and OpenAI<\/a> over alleged unauthorised use of the newspaper\u2019s stories.<\/p>\n<p><img decoding=\"async\" class=\"Image\" alt=\"CPR5D2 Le Roi Lion\" width=\"1350\" height=\"900\" src=\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/08\/SEI_2604519021.jpg\"   loading=\"lazy\" data-image-context=\"Article\" data-image-id=\"2490730\" data-caption=\"Disney sued AI company Midjourney over its image generator, which they say plagiarises Disney characters\" data-credit=\"Photo 12\/Alamy\"\/><\/p>\n<p class=\"ArticleImageCaption__Title\">Disney sued AI company Midjourney over its image generator, which they say plagiarises Disney characters<\/p>\n<p class=\"ArticleImageCaption__Credit\">Photo 12\/Alamy<\/p>\n<\/p>\n<p>The AI companies strongly deny any wrongdoing, insisting that data scraping is permissible under the fair use doctrine. In an <a href=\"https:\/\/cdn.openai.com\/global-affairs\/ostp-rfi\/ec680b75-d539-4653-b297-8bcf6e5f7686\/openai-response-ostp-nsf-rfi-notice-request-for-information-on-the-development-of-an-artificial-intelligence-ai-action-plan.pdf\" rel=\"nofollow noopener\" target=\"_blank\">open letter to the US Office of Science and Technology Policy<\/a> in March, OpenAI\u2019s chief global affairs officer, Chris Lehane, warned that rigid copyright rules elsewhere in the world, where <a href=\"https:\/\/www.theguardian.com\/technology\/2025\/feb\/19\/eu-accused-of-leaving-devastating-copyright-loophole-in-ai-act\" rel=\"nofollow noopener\" target=\"_blank\">there have been attempts to provide stronger copyright protections<\/a> for content creators, \u201care repressing innovation and investment\u201d. OpenAI has previously said it would be \u201cimpossible\u201d to develop AI models that meet people\u2019s needs without using copyrighted work. Google takes a similar view. In an open letter also published in March, the company said, \u201cThree areas of law can impede appropriate access to data necessary for training leading models: copyright, privacy, and patents.\u201d<\/p>\n<p>However, at least for the moment, it seems the campaigners have the court of public opinion on their side. When the site IPWatchdog analysed public responses to an inquiry about copyright and AI by the US Copyright Office, it found that <a href=\"https:\/\/ipwatchdog.com\/2025\/05\/01\/using-ai-to-analyze-the-sentiment-of-public-comments-on-ai-and-copyright\/id=188585\/\" rel=\"nofollow noopener\" target=\"_blank\">91 per cent of comments<\/a> contained negative sentiments about AI.<\/p>\n<p>What may not help AI firms gain public sympathy is a suspicion that their bots are sending so much traffic to some websites that <a href=\"https:\/\/x.com\/kwiens\/status\/1816128302542905620\" rel=\"nofollow\">they are straining resources<\/a> and perhaps <a href=\"https:\/\/xeiaso.net\/notes\/2025\/amazon-crawler\/\" rel=\"nofollow noopener\" target=\"_blank\">even forcing some websites to go offline<\/a> \u2013 and that content creators are powerless to stop them. For instance, there are techniques content creators can use to opt out of having bots crawl their websites, including reconfiguring a small file at the heart of the website to say that bots are banned. But there are indications that bots can sometimes <a href=\"https:\/\/arxiv.org\/html\/2505.21733v1\" rel=\"nofollow noopener\" target=\"_blank\">disregard such requests<\/a> and continue crawling anyway.<\/p>\n<p>AI data poisoning<\/p>\n<p>It is little wonder, then, that new tools are being made available to content creators that offer stronger protection against AI bots. One such tool was launched this year by Cloudflare, an internet infrastructure company that provides its users protection against distributed denial-of-service (DDoS) attacks, in which an attacker floods a web server with so much traffic that it knocks the site itself offline. To combat AI bots that may pose their own DDoS-like risk, Cloudflare is fighting fire with fire: it produces a maze of AI-generated pages full of nonsense content so that AI bots expend all their time and energy looking at the nonsense, rather than the actual information they seek.<\/p>\n<p>The tool, known as <a href=\"https:\/\/blog.cloudflare.com\/ai-labyrinth\/\" rel=\"nofollow noopener\" target=\"_blank\">AI Labyrinth<\/a>, is designed to trap the 50 billion requests a day from AI crawlers that Cloudflare says it encounters on the websites within its network. According to Cloudflare, AI Labyrinth should \u201cslow down, confuse, and waste the resources of AI crawlers and other bots that don\u2019t respect \u2018no crawl\u2019 directives\u201d. Cloudflare has since released <a href=\"https:\/\/www.bbc.co.uk\/news\/articles\/cvg885p923jo\" rel=\"nofollow noopener\" target=\"_blank\">another tool<\/a>, which asks AI companies to pay to access websites, or else be blocked from crawling its content.<\/p>\n<p>An alternative is to allow the AI bots access to online content \u2013 but to subtly \u201cpoison\u201d it in such a way that it renders the data less useful for the bot\u2019s purposes. The tools <a href=\"https:\/\/glaze.cs.uchicago.edu\/\" rel=\"nofollow noopener\" target=\"_blank\">Glaze<\/a> and <a href=\"https:\/\/nightshade.cs.uchicago.edu\/\" rel=\"nofollow noopener\" target=\"_blank\">Nightshade<\/a>, developed at the University of Chicago, have become central to this form of resistance. Both are free to download from the university\u2019s website and can run on a user\u2019s computer.<\/p>\n<p>Glaze, released in 2022, functions defensively, applying imperceptible, pixel-level alterations, or \u201cstyle cloaks\u201d, to an artist\u2019s work. These changes, invisible to humans, cause AI models to misinterpret the art\u2019s style. For example, a watercolour painting might be perceived as an oil painting. Nightshade, published in 2023, is a more offensive tool that poisons image data \u2013 again, imperceptibly as far as humans are concerned \u2013 in a way that encourages an AI model to make an incorrect association, such as learning to link the word \u201ccat\u201d with images of dogs. Both tools have been downloaded more than 10 million times.<\/p>\n<p><img decoding=\"async\" class=\"Image\" alt=\"Figure 7. Examples of images generated by the Nightshade-poisoned SD-XL models and the clean SD-XL model, when prompted with the poisoned concept\" width=\"1350\" height=\"338\" src=\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/08\/SEI_260452568.jpg\"   loading=\"lazy\" data-image-context=\"Article\" data-image-id=\"2490732\" data-caption=\"The Nightshade tool gradually poisons AI bots so that they represent dogs as cats\" data-credit=\"Ben Y. Zhao\"\/><\/p>\n<p class=\"ArticleImageCaption__Title\">The Nightshade tool gradually poisons AI bots so that they represent dogs as cats<\/p>\n<p class=\"ArticleImageCaption__Credit\">Ben Y. Zhao<\/p>\n<\/p>\n<p>The AI poisoning tools put power back in the hands of artists, says <a href=\"https:\/\/people.cs.uchicago.edu\/~ravenben\/\" rel=\"nofollow noopener\" target=\"_blank\">Ben Zhao<\/a> at the University of Chicago, who is the senior researcher behind both Glaze and Nightshade. \u201cThese are trillion-dollar market-cap companies, literally the biggest companies in the world, taking by force what they want,\u201d he says.<\/p>\n<p>Using tools like Zhao\u2019s is a way for artists to exert the little power they have over how their work is used. \u201cGlaze and Nightshade are really interesting, cool tools that show a neat method of action that doesn\u2019t rely on changing regulations, which can take a while and might not be a place of advantage for artists,\u201d says <a href=\"https:\/\/www.eff.org\/about\/staff\/jacob-hoffman-andrews\" rel=\"nofollow noopener\" target=\"_blank\">Jacob Hoffman-Andrews<\/a> at the Electronic Frontier Foundation, a US-based digital rights non-profit.<\/p>\n<p>The idea of self-sabotaging content to try to ward off alleged copycats isn\u2019t new, says <a href=\"https:\/\/www.su.se\/english\/profiles\/elro0365-1.442578\" rel=\"nofollow noopener\" target=\"_blank\">Eleonora Rosati<\/a> at Stockholm University in Sweden. \u201cBack in the day, when there was a large unauthorised use of databases \u2013 from telephone directories to patent lists \u2013 it was advised to put in some errors to help you out in terms of evidence,\u201d she says. For instance, a cartographer might deliberately include false place names on their maps. If those false names then appear later in a map produced by a rival, it would provide clear evidence of plagiarism. The practice still makes headlines today: music lyrics website Genius <a href=\"https:\/\/www.rollingstone.com\/music\/music-news\/genius-google-stole-lyrics-morse-code-848781\/\" rel=\"nofollow noopener\" target=\"_blank\">claimed to have inserted different types of apostrophes<\/a> into its content, which it alleged showed that Google had been using its content without permission. Google denies the allegations, and a court case filed by Genius against Google was dismissed.<\/p>\n<p>Even calling it \u201csabotage\u201d is debatable, according to Hoffman-Andrews. \u201cI don\u2019t think of it as sabotage necessarily,\u201d he says. \u201cThese are the artist\u2019s own images that they are applying their own edits to. They\u2019re fully free to do what they want with their data.\u201d<\/p>\n<p>It is unknown to what extent AI companies are taking their own countermeasures to try to combat this poisoning of the well, either by ignoring any content that is marked with the poison or trying to remove it from the data. But Zhao\u2019s attempts to break his own system showed that Glaze was still 85 per cent effective against all countermeasures he could think of taking, suggesting that AI companies may conclude that dealing with poisoned data is more trouble than it\u2019s worth.<\/p>\n<p>Spreading fake news<\/p>\n<p>However, it isn\u2019t just artists with content to protect who are experimenting with poisoning the well against AI. Some nation-states may be using similar principles to push false narratives. For instance, US-based think tank the Atlantic Council claimed earlier this year that Russia\u2019s Pravda news network \u2013 whose name means \u201ctruth\u201d in Russian \u2013 has <a href=\"https:\/\/www.atlanticcouncil.org\/blogs\/new-atlanticist\/exposing-pravda-how-pro-kremlin-forces-are-poisoning-ai-models-and-rewriting-wikipedia\/\" rel=\"nofollow noopener\" target=\"_blank\">used poisoning<\/a> to trick AI bots into disseminating fake news stories.<\/p>\n<p>Pravda\u2019s approach, as alleged by the think tank, involves posting millions of web pages, sort of like Cloudflare\u2019s AI Labyrinth. But in this case, the Atlantic Council says the pages are designed to look like real news articles and are being used to promote the Kremlin\u2019s narrative about Russia\u2019s war in Ukraine. The sheer volume of stories could lead AI crawlers to over-emphasise certain narratives when responding to users, and an analysis published this year by US technology firm NewsGuard, which tracks Pravda\u2019s activities, found that <a href=\"https:\/\/www.newsguardtech.com\/special-reports\/moscow-based-global-news-network-infected-western-artificial-intelligence-russian-propaganda\/?utm_source=www.turingpost.com&amp;utm_medium=newsletter&amp;utm_campaign=91-ai-literacy-full-email&amp;_bhlid=bb8089c1b95caab75d3ef29352e220af5f3e2f18\" rel=\"nofollow noopener\" target=\"_blank\">10 major AI chatbots outputted text in line with Pravda\u2019s views<\/a> in a third of cases.<\/p>\n<p>The relative success in shifting conversations highlights the inherent problem with all things AI: technology tricks used by good actors with good intentions can always be co-opted by bad actors with nefarious goals.<\/p>\n<p>There is, however, a solution to these problems, says Zhao \u2013 although it may not be one that AI companies are willing to consider. Instead of indiscriminately gathering whatever data they can find online, AI companies could enter into formal agreements with legitimate content providers and ensure that their products are trained using only reliable data. But this approach carries a price, because licensing agreements can be costly. \u201cThese companies are unwilling to license these artists\u2019 works,\u201d says Zhao. \u201cAt the root of all this is money.\u201d<\/p>\n<p class=\"ArticleTopics__Heading\">Topics:<\/p>\n<p><a class=\"ArticleTopics__ListItemLink\" href=\"https:\/\/www.newscientist.com\/article-topic\/artificial-intelligence\/\" rel=\"nofollow noopener\" target=\"_blank\">artificial intelligence<\/a>\/<a class=\"ArticleTopics__ListItemLink\" href=\"https:\/\/www.newscientist.com\/article-topic\/chatgpt\/\" rel=\"nofollow noopener\" target=\"_blank\">ChatGPT<\/a>                <\/p>\n","protected":false},"excerpt":{"rendered":"Gone are the days when the web was dominated by humans posting social media updates or exchanging memes.&hellip;\n","protected":false},"author":2,"featured_media":62668,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[554,733,4308,1921,86,56,54,55],"class_list":["post-62667","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-chatgpt","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/62667","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=62667"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/62667\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/62668"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=62667"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=62667"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=62667"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}