Ethical aspects of using AI in Drupal

I think there are better people then me to take a stance here, but one thing that is an important foundation.

Any and all models has biases in them and will always have that and the only way you can steer it to your bias (because you also have it) is testing and having guardrails. This is extra important in agents, as opposed to pure LLM calls, because agents are by design taking their own decisions.

Testing we have in https://www.drupal.org/project/ai_agents_test → - this means that you can setup tests against decision making and produced text. With this you can test any and all models for not just efficacy, but also if it follws your wanted bias and also find the model with the smallest echological footprint that handles the task at hand. We don't need to throw OpenAI at everything, when there are tasks even a CPU server model could handl.

Guardrails is coming up ✨ Create the concept of Guardrail agents Active , and while the main reason for this is to protect against prompt injection, this can also be used to make sure that the LLM answers in neutral ways, without to much bias in one or the other direction.

Yesterday, I had a look at this paper ( only looked at their methods for testing AI models).
Expressing stigma and inappropriate responses prevents LLMs from safely replacing mental health providers

While I'm also likely not the best to answer this, one of the things I appreciate about the approach in the AI module is how it's AI provider agnostic. If you have ethical concerns about using the OpenAI provider → , you are able to switch to one of the various other ones out there, including a completely open source solution with the Ollama Provider → . Then you have complete control over which model you're using, where the hardware is running, and how.

The choice of which AI solution you put together is completely in your hands.

Does Drupal AI need a bot defender/moderator module?

I'd say probably not. Being hit by bots on a Drupal site is due to unethical behaviour of some other AI solution, not the one in Drupal. While it's important to find some good defence, that's outside the scope of Drupal AI, in my view.

The other way round, when Drupal is crawling remote resources, this is what we are controlling, and here we should provide measures that respect guardrails set by the remote side.

Millions of websites to get 'game-changing' AI bot blocker

I agree with what @robloach said and also agree what was noted in the blog post: https://www.jamesmatthewsaunders.ai/post/ai-ethics-and-open-source-why-w... in that:

The agnostic approach for choosing the AI provider means you can choose which provider most aligns with your business ethics.

In the blog post, the following quote resonates: "AI shouldn’t be about replacing people. It should be a force multiplier. It’s here to help us work more efficiently and solve bigger problems faster" Our Maestro → module AI extensions do exactly that: Use AI to offload the mundane tasks humans do so that they can focus on more productive tasks. However, if a business automates a business process and that replaces people, is that an ethics problem that Drupal must guard against?

The idea of guardrail agents to cleanse inputs is the new-normal approach when dealing with safeguarding your AI-enabled sites. I think it also comes down to education of the community when using new AI tools: Cleansing inputs and creating prompts which do not leak, override/harm your website or otherwise provide faulty information. It's not good enough to assume everyone/everything is a good actor when it comes to using AI. It's a new version of SQL injection for our age.

AI bots are becoming a real issue. Many of our clients face massive bot hits and we have to spend a lot of energy on traffic shaping on the CDN/WAF level.

Note that CDN providers such as Cloudflare make it really easy (or even default settings) to block AI scrapers:

• https://blog.cloudflare.com/declaring-your-aindependence-block-ai-bots-s...
• https://www.fastly.com/blog/take-back-control-make-ai-bots-play-by-your-...
• ...

I think the traffic part is not what we can influence, that happens before traffic hits Drupal websites.

But what we can do is provide functionality to make sure the AI(s) we use (in our agentic systems) can be restricted to deliver ethical results.

IMO the way to go is to provide string guardrail functionality with sensible defaults. There is already an issue for guardrails ✨ Create the concept of Guardrail agents Active , and we are currently looking for contributors that are willing to take this on.