Question for Instructure (Security, privacy, and copyright with Smart Search)

[netzela]

In the “What is Smart Search” panel, I highlighted a couple of sentences that could raise an eyebrow for faculty at our institution....




The question we'd like to ask is: How does Instructure communicate security and privacy around Smart Search? In other words, if a faculty member’s only experience thus far has been with generative AI, such as ChatGPT, how does Instructure reassure faculty that embeddings are not fed to public LLMs and that security, student privacy, and copyright protection over course material is maintained?

Is there a statement or documentation on this available from Instructure?

[Beth_Yag]

From the FAQ:

What AI is being used?

Our Smart Search feature relies on an AI-adjacent technology called “embeddings.”  It currently uses the Cohere Embed Multilingual model hosted on AWS. The “nutrition label” below answers some key questions at-a-glance related to the AI model, data, privacy and security. 

This might be partially what you are looking for. 

[feathj · Accepted solution]

Howdy! I am one of the engineers working on the smart search feature, and I would love to help answer your question here.

We take security and privacy very seriously on our engineering team, especially as it pertains to our new AI features and tools. Our goal is to be a transparent and open with how data is stored and retained, what models are being used, and whether or not any third parties are also processing data. One of the ways that we have decided to do this is via an "AI nutrition facts" label for each of our AI products. I have attached the most up to date smart search label for your reference. We are currently evaluating the best way to display this and keep it up to date.

At a high level:

* Data is not sent to any third parties, other than AWS, which is our cloud computing platform

* The model we are using is not trained on customer data

* It is possible for PII to be processed in this system, if that PII is contained within the indexed course material, however as stated above, it is not sent to any third party entities and remains within each regional datacenter for canvas

Let me know if I can help clarify anything else.

[feathj]

Did not see Beth's response before replying, but hopefully I added a bit more context.

[netzela]

Thank you both for this information, it's very helpful!