Audrey Tang

Preparing people for a risk before it reaches them is what we call prebunking. If you show people what could happen, perhaps through case studies, they can prepare. Otherwise, it catches them by surprise. Many people may still assume that if a video looks and sounds like Audrey Tang, it must be Audrey Tang. Since the invention of photography, we have said that seeing is believing. That is no longer the case. Seeing and believing are now completely detached.

Synthetic media is almost impossible to trace. You can generate very convincing videos and audio of Audrey Tang on a laptop in airplane mode, without a network connection. If the laptop is offline while it generates the material, it is impossible to trace.

That needs to become common knowledge: we should demand a digital signature on videos and audio. As I said yesterday, no bank will cash an unsigned cheque. We need to treat unsigned images and audio in exactly the same way.

Yes, specifically investment-scam and impersonation-scam advertisements. Those are down by 99 percent and 98 percent respectively on the advertising platform. That's progress.

According to Reuters and the Ministry of Digital Affairs, the reductions last year were 96 and 94 percent respectively. Now they are 99 and 98 percent, measured against the peak.

Oh, okay.

Bengio and my friend Maria Ressa, a journalist from the Philippines, co-chair the independent panel. I'm glad you spoke with him.

I think there are two things to distinguish here, and fixing them requires engineering, not just good intentions. We often talk about people becoming polarized by images, videos or reports designed to provoke outrage and drive engagement. But there is a mirror-image risk: an AI system that tells you only what you want to hear so that you keep paying for the next subscription.

These are different revenue models. Social media depended on advertising revenue, so it had an incentive to enrage people, keep them engaged and encourage impulsive purchases. AI agents are usually paid for through subscriptions or token charges rather than advertising. That creates an incentive to keep users in a bubble where the AI confirms everything they think. It may not polarize society in the same way as before, but it is actually balkanizing society, with each person trapped in a separate bubble.

So we have two risks driven by two different incentive structures. We need a third way: AI infrastructure maintained communally, rather than through advertising or subscriptions.

I talked about this yesterday as "data as soil," rather than "data as oil." Oil has no local context. An AI that treats data as oil doesn't read the room — or read the air, as you say here in Japan.

Reading the air means treating the relationships among the three of us as the protagonists, rather than any one person. Think of the three connections between us. If an AI joins our group and improves those relationships, it is reading the air. But if one AI attaches itself to me, another to you and another to the editor, each trying to earn a separate subscription, they pull us apart. They treat us as sources of oil. That's not reading the air or reading the room.

Building trust by treating data as soil means using AI systems that are loyal only to the relationships within particular communities. I call this technocommunitarianism: a third way beyond systems driven by engagement or addiction.

As you know, I have been using AI systems tuned for my own use on a MacBook for more than three years. I spoke to BBC Newsday in London three years ago, and their headline was "Why the Taiwanese minister lets AI write her emails?"

If AI drafts all my emails, of course I still need to read them before hitting send. Otherwise, you become an unleashed wolf — or perhaps a fox. It's not that powerful. At least a fox! But what really matters here is the private context.

Most of my email drafts are not sent exactly as they were first written. I revise many of them several times before sending. I would not want OpenAI, Anthropic or anyone else in the cloud to see those private drafts and exchanges. They belong to the context shared by the person writing to me and myself. But if the AI is trained here on this MacBook, that isn't a problem. It works in airplane mode. You can see it working offline, without that material going anywhere else.

It starts with bringing compute to data. Many people don't realize that this doesn't require much memory: 16 gigabytes is enough. As you can see, this laptop is in airplane mode, with no Wi-Fi connection, yet the AI is faster than ChatGPT. It is also much closer to where the data lives, so it can read my email and calendar without an internet connection.

You can do this right now with Ollama and other tools, but many people don't know that. I was delighted yesterday when the keynote speaker before me, Fukuda-san, said he also had it running on his MacBook.

That's my answer: when I run it here, I take responsibility. If it generates a bad email and I send it anyway, that is 100 percent my responsibility.

The good thing about this local model is that it is predictable. In this setup, the same prompt always gives me the same output. With ChatGPT or Claude, even the same prompt produces a different answer every time, depending on who else is using the system at the time and how those uses interfere with one another. That's non-deterministic. Here, it is deterministic. You can make it neutral — well, I can make it predictable and replayable. If it doesn't do what I want, I can change it.

My point is that complete local steerability also means complete accountability. I don't need the government or a big tech company to take responsibility for this. It is clearly my responsibility.

Yes, you can give it a try. It's very easy.

You can do the same thing on a Windows computer. Ollama runs on Windows too. You can install it, download a small model and try it. It's very easy.

Nvidia's CEO Jensen Huang calls what I just demonstrated "personal supercomputing." Think back to when I was born in 1981. Most people didn't type into a computer of their own; they typed into a terminal, a screen with a keyboard. Everything went to the cloud — well, to a mainframe, as it was called then. That market was highly concentrated, usually in IBM's hands; no other company had a comparable share. Whether you worked at a bank, a government or a research institution, you were typing into an IBM machine.

Then personal computing arrived. You could run a spreadsheet locally, do desktop publishing and use all sorts of other applications. It became difficult to say which country was in the lead. Which country leads Linux? That's a hard question to answer, because Linux is not a race. It's a mission, and everybody wins.

Even if you run Windows rather than Linux, you can run Linux inside Windows through WSL. Microsoft doesn't have to pay Linux, or the country of Finland, for that. It's a common good that everyone, including Microsoft, can use. It took Microsoft a while to adjust. Some of its leaders initially called Linux something like a cancer, but later they changed course and joined forces with GitHub. More recently, Microsoft signed a statement with Nvidia and others saying that openness is good for security. It took time to come around. But for this generation, open source, such as Linux, Android, Signal and Wikipedia, is part of everyday life. It is now entirely normal to see open source as a counterweight to excessive concentration.

Mythos is an interesting case. For many people, it was the first model to demonstrate the long-range planning capability I mentioned. People struggled to reconcile its cyberattack capabilities with how vulnerable our critical infrastructure was. That brought people together around the same idea: initially limit access to defenders so they can prioritize repairs. Anthropic's effort is called Glasswing; OpenAI's is called Daybreak. Mythos was later released as Fable, and the smaller model, Opus 5, was trained. If you give Opus 5 your source code and ask it to find vulnerabilities and bugs, it says, "Yes, I can do that." But suppose you give it a proprietary program you downloaded from someone else, without the source code, and ask it to find vulnerabilities in the binary. Then Opus says, "You are an attacker, not a defender. A defender has the source code. You don't, so you must be an attacker."

So the model would refuse. One way to mitigate the risk is to prioritize defense: begin with what we call defense-dominant uses, rather than making the capabilities dual-use from the outset.

If all the defenders have access and can defend themselves, perhaps the technology can then be made generally available. It's about the timing. Once everybody is vaccinated against a virus and a cure is available, lifting a quarantine causes much less harm than lifting it when there is neither a vaccine nor a cure.

If defenses spread before offensive capabilities do, the attackers cannot cause as much damage. But if defenders are still learning how to use Mythos while attackers already have full use of it, that's like lifting quarantine before vaccination or a cure is available.

That is very dangerous.

Yes. Think of it as a bridge, not a permanent gate that says we will never develop AI beyond a certain threshold. We need to cross the bridge rather than fall off the cliff. The bridge is defense dominance: accelerating the spread of defensive technology.

Take the example of masks that I gave on stage yesterday. It's hard to imagine using a mask as a weapon. How would you do that? It isn’t possible. If producing masks becomes easy and distributed enough that everyone can make an N95-grade mask in their kitchen, we are much better off than if that capability remains scarce.

In that case, proliferation is good. We need to test whether each new capability shifts the balance toward defense or offense, and spread the defensive capabilities first.

Plurality means seeing conflict as a source of energy. Here in Japan, many people feel that differences of opinion or ideology disrupt harmony, so they keep their distance. But if you channel that conflict through something like a geothermal engine, even violent forces can produce upward motion. You can turn the energy of conflict into co-creation.

Take Community Notes on X. Each note adds context to a post, and Grok now drafts many of them. A note has to withstand challenges from both sides of an ideological divide.

The left wing and the right wing each look for flaws in the other's notes. Only notes that survive that scrutiny and win support from both sides — the "upwing" — get attached to posts and spread widely. The Community Notes algorithm is an example of Plurality: it uses differences of opinion as a source of energy.

It's a logical extension of what I just said. If difference is voice, you want many different voices: Plurality. But if difference is noise, something you want to eliminate, you move toward Singularity. There is one dominant voice, and everything else is dismissed as noise.

That is the shape of Singularity: technology reinforces one direction and rapidly improves itself, drawing everything around it in like a black hole. Diversity disappears. There is no more noise, just one voice.

Technological singularity also describes a point at which AI capabilities advance beyond our ability to understand what is happening. That is the definition: we can no longer even reason about it.

That's another reason the race framing makes no sense to me. During a race, you might move between first and second place. But here the finish line, Singularity, is defined as something incomprehensible. It's like racing toward a cliff and then falling over it. You are accelerating, I suppose, but you can no longer understand what is happening. What does winning mean at that point? Nobody can say. That's why I would rather call it a mission.

Taiwan is not a homogeneous society. We have plenty of polarization, but we have managed to turn that energy into co-creation through this geothermal engine.

As I briefly mentioned yesterday, in 2024 we saw a spike in synthetic fraud advertisements online. Simply asking people what the government should do can produce very polarized answers. Some want top-down censorship; others want the government to do nothing, pointing out that Taiwan has the greatest internet freedom in Asia and is, alongside Japan, one of Asia's two most democratic countries. But conventional polls are not plural: they offer a fixed set of options and ask each person to choose individually, as if answering a phone call.

So we ran a deliberative poll. We sent 200,000 text messages from the number 111. Thousands of people volunteered, and we randomly selected 447 through stratified sampling, so that their demographics reflected Taiwan's population. Up to that point, it was like an ordinary poll. But instead of questioning people one by one, we put them in groups of 10. Each person spoke with nine others and had to convince them before an idea could advance. They could propose new ideas, rather than choose only from a fixed list, and ask experts questions. Many ideas that sounded good to an individual no longer seemed so good after group deliberation.

For example, one proposal was to require social media companies to publish their advertising algorithms, so people could understand why fraud received so much exposure. During the discussion, people pointed out that criminals could also see those algorithms and might be better at gaming them than ordinary users. Restricting access to experts would create another risk: the experts might be tempted to sell that knowledge to criminals. After deliberation, support for the measure dropped 27 percent, to around 55 percent. It still had a majority, but no longer an overwhelming one. People went from thinking it was clearly a good idea to thinking, "Maybe not right now." Other measures survived: mandatory know-your-advertiser checks, or KYC; joint liability; and slowing connections for violations. Those became law and led to the reductions we discussed earlier. To me, the most interesting part is that conflict did more than produce consensus. It forced ideas that appealed to individuals to be tested in group discussion, rather than simply being pushed through.

Yes, extensively. This is what we call civic AI: AI used for civic purposes. But it doesn't make judgments on people's behalf. That would be like sending a robot to the gym to lift weights for us. We would lose muscle, and we would lose friends too.

The AI acts as connective tissue. It provides real-time transcription, so people can see what has just been said and reflect on it. Transcription also helps people understand one another across different accents and varieties of spoken Mandarin.

AI also provides summarization, I believe. Before the assembly, we used AI for a wiki survey, where people could freely suggest what would be useful. We used Polis and Talk to the City to visualize the Polis conversation. I'm happy to see tools we tried in 2024 now being used in Japan too. With Idobata and Polis sense-making tools, people here are also...

No, they met online. Each person saw the other 9 participants in a 3×3 grid on their screen.

Yes, synchronously.