Ethical and social risks of harm from Language Models

In plain words

Large language models are text predictors trained on huge collections of writing from the web. Because they learn from that writing, they can repeat its unfair stereotypes, leak private details they memorised, state falsehoods in a confident tone, and be misused by people who want to scam or manipulate others. This paper does not build a model or measure one. It sorts the possible harms into a list of 21 risks, grouped into six areas, so that teams can see the whole landscape before they ship a product.

For each risk the paper asks where the harm starts: in the training data, in the model's basic training objective, in how people use it, or in how a product is designed. That matters because the fix depends on the source. Removing private text from the training data helps with one risk, but does little for another that comes from people deliberately misusing the model. The paper also notes that fixing one risk can make another worse, so the list is meant to be read as a whole.

TL;DR

This is a 2021 DeepMind report that organises the ethical and social risks of large language models into a taxonomy of 21 risks in six areas §1§2. Each risk is described by its mechanism, the types of harm it can cause, and whether it is observed or only anticipated tab. 1. The paper proposes no method, trains no model and reports no experimental results. Use it as a checklist for risk assessment, not as an implementation guide.

Problem

Language models are growing in size and capability and are being built into products quickly. The paper argues that responsible innovation requires a structured account of the harms they can cause, before and after deployment §1. Existing work covers individual harms, but no single taxonomy covered them together §1. The paper sets its scope narrowly: it covers risks from operating language models, not from training them, and excludes multimodal models, benefit analysis and speculative long-term risks §1, "Limitations".

It also states its own limits. It is a snapshot from autumn 2020 to summer 2021 and may miss risks that only appear later §1, "Limitations".

Method

The paper's "method" is a classification, not an algorithm. It collects potential risks from AI ethics, AI safety, linguistics, NLP and sociotechnical studies, and adds risks from the authors' own experience §1. It then groups the risks into six areas and, within each area, describes each risk's mechanism, harm types and examples §2 tab. 1.

The six areas and their 21 risks, as summarised in the paper's overview table tab. 1:

Each risk carries a label. The paper calls a risk "observed" when it has been seen in practice, and "anticipated" when more work is needed to show how likely or significant it is §1 §2. By the paper's own labels, 11 risks are observed and 10 are anticipated. That count is ours, taken from the labels in each risk's section §2.1–§2.6.

The paper also discusses where harms originate, which it treats as a guide to mitigation rather than a rule: training-data curation, model robustness, the training objective, the intended application, deployment access, and product design § Discussion. It groups mitigations into policy, participatory, technical, research-management, operational and product-design types § Identifying and implementing mitigation approaches.

The paper also gives a procedure for turning a risk into an action, which it describes in prose § Discussion. Distilled into steps, it reads:

# Risk-mapping procedure  [§ Discussion]
# Input:  a list of candidate risks for one model
# Output: for each risk, its origin and candidate mitigations

def map_risks(candidate_risks):
    # 1. Name the point where each harm starts  [§ Discussion]
    for risk in candidate_risks:
        origin = find_origin(risk)  # data, objective, use or product

    # 2. List mitigations at that origin and at other levels  [§ Discussion]
    for risk in candidate_risks:
        mitigations = list_mitigations(risk, origin)

    # 3. Check that a fix for one risk does not worsen another  [§ Discussion]
    for risk in candidate_risks:
        check_side_effects(risk, mitigations)

    return candidate_risks

The paper names the origins and mitigation types in text but does not define find_origin or list_mitigations as functions, so the code above is a summary of its steps, not an algorithm it specifies.

Background on the object of study is the standard autoregressive language-model factorisation. The paper defines a language model as a distribution over sequences, factored into next-token conditionals app. Definitions:

p(w) = p(w_1) \cdot p(w_2 \mid w_1) \cdots p(w_T \mid w_1, \ldots, w_{T-1}) app. Definitions, unnumbered equation

The paper notes that the model outputs a distribution rather than text, and that greedy decoding often performs poorly in practice, while beam search and nucleus sampling tend to work better app. Definitions.

Hyperparameters

Not applicable. The paper states no training, architecture or evaluation hyperparameters and proposes no model §1. The only numbers it gives come from cited third-party studies (see Results).

Results

Not applicable. The paper reports no experiments of its own. Its contribution is the taxonomy §1 tab. 1. Table 2 maps each risk to the literature that the authors cite as evidence, separately for NLP work and for LMs such as GPT-2, GPT-3, T5 and Gopher tab. 2.

Some examples in the text are quoted from cited work and are not this paper's findings. They are listed here so that implementers do not mistake them for results of this paper:

• GPT-3 analogised "Muslim" to "terrorist" in 23% of test cases, as reported by the cited study §2.1, "Examples".
• Carlini et al. estimated that at least 0.1% of GPT-2 samples were copied verbatim from the training corpus, as reported in the cited study §2.2, "Examples".
• In a cited question-answering study, a T5-11B model's Exact Match score dropped from 44.7 to 22.0 after test questions that could be answered by copying training answers were removed §2.2, "Examples".

All of these are author-reported by the cited works. None were re-measured here.

Paper vs code

No official code. The arXiv record has no code link, and the paper describes no software. A GitHub repository search for the title's key terms returned only unrelated third-party repositories, and a search restricted to the deepmind organisation returned nothing. No code was cloned.

Pitfalls

• Not a method. There is no algorithm, training recipe or metric to implement. An implementer who needs one should read the cited mitigation work, not this card's taxonomy.
• Section numbers. The LaTeX source does not number the risk subsections in the text. The numbers used here (§2.1 to §2.6 for the six areas) follow the paper's own cross-references, for example "2.5 Human-Computer Interaction Harms" § Discussion. Individual risks are cited by their area, and the risk name is given in the text.
• Discussion section numbers. The Discussion and later chapters are not numbered in the source, so they are cited by title.
• Label inconsistency. The abstract numbers the areas I, II, III, V, V, VI, with a typo at area IV. The body uses I to VI. This card uses the body numbering §1 §2.
• Wording differs between table and body. For example, "Lower performance for some languages and social groups" in the text is "Lower performance by social group" in Table 1 tab. 1 and in the reference table tab. 2.
• Observed vs anticipated. The "observed" label marks a risk seen in practice, but many observed risks are supported mainly by examples from earlier models such as GPT-2 and GPT-3 §2.1. Check whether a risk still holds for the model you use.
• Dated examples. The examples come from 2019 to 2021 models. Several of the risks (for example, the environmental and inequality ones) are explicitly hard to forecast §2.6.
• Scope limits. The paper excludes training-time harms (labour conditions, supply chains, training energy) except as briefly noted §1, "Limitations". It also excludes multimodal models and risks that depend on specific applications §1, "Limitations". The cards for other risk topics should cover those.
• Data quality is the common root. The paper repeatedly links many risks to the training corpus, so curating data affects several areas at once § Discussion. The paper also warns that mitigating one risk can worsen another, for example toxicity filters that disadvantage some dialects § Discussion.
• Benchmarks are needed. The paper says many of the risks have no adequate benchmark, and that setting "fair enough" thresholds requires participatory and political decisions § Directions for future research.

Lineage

• Builds on: prior work on the risks of language models that the paper cites in its introduction, including AI ethics and sociotechnical analyses §1. Named examples in the text include Bender et al. (2021) and Bommasani et al. (2021) §1.
• Compared against: not applicable; the paper proposes a taxonomy, not a method to compare.
• Superseded by: not stated.