Abstract:

There is an urgent need for a criminal law response to attacks against large Generative AI (GenAI) models. The application of criminal law faces evaluative challenges: it is difficult to classify training data as data within a computer information system; alterations to data that do not impair system functionality are often overlooked in evaluations; attacks involving the theft of models are difficult to classify as acts of unlawful control; and output biases are difficult to classify as causing a computer system to malfunction. By adopting an interpretive approach to revitalize existing criminal law provisions, expanding the interpretation of“data in computer information systems,”reinterpreting the essence of“system crime”, and reconstructing the dimension of consequences in destructive crimes, we can thereby achieve comprehensive regulation of attack-related conduct.

Key words: data security, crime of illegally obtaining computer information system data, crime of illegally controlling computer information system, crime of damaging computer information system, expansive interpretation