Chapter 51 Hallucination, Bias, Privacy, and Copyright: Continuous Governance

The assistant answers “750 yuan per room per night,” cites the current policy and stays within its tool budget. A user then discovers that their hotel address is in a debugging log. Another asks why an irrelevant employee label changes the answer. A source owner disputes permission to reuse a document. The answer’s factual correctness settles none of these questions.

Chapter 50 gave us evidence about system behavior. We now need a way to decide who must act on that evidence, which data the assistant may keep, and when a previously acceptable system needs review. Governance is this continuing arrangement of responsibilities, rules and evidence. A policy document helps only when someone can identify the affected records and check what the system actually did.

51.1 Follow the information, not just the answer

Our example still concerns the fictional Beijing lodging policy. Version 1 allows 600 yuan during 2025; version 2 allows 750 from 2026. The user asks about the current limit and optionally supplies feedback. No real travel records or employee groups are used.

Table 51.1 — The lifecycle and its responsible role. The retention periods below are authored teaching policies, not periods prescribed by law.

Data and purpose	Responsible role	Retention or deletion rule	Checkable evidence
Versioned policy and retrieval index: answer dated questions	Policy owner	Retain public historical versions; exclude inapplicable versions from current answers; remove withdrawn sources from the index and invalidate dependent caches	Source version, effective dates, license, index digest
Assembled model input: make the bounded decision	Service owner	Request lifetime; no default memory across requests	Allowed input fields and actual serialized input
Operational content: authorized debugging	Data steward	Seven days; erase eligible subject copies in logs, memory, cache and feedback	Expiry run and deletion counts
Audit metadata: reconcile approved actions	Security reviewer	Thirty days in this simulation; document any separately applicable hold	Action/approval references and expiry record, without credentials
Feedback: resolve a disputed answer	Policy owner	Seven days for the original content; keep a synthetic regression when possible	Correction record, source decision and rerun

Retaining v1 for historical questions does not mean selecting it for today’s request. Likewise, removing an index entry does not erase a copy in a log. A lifecycle inventory names these different stores so that “deleted” and “current” have testable meanings.

The roles in this project are fictional assignments. They describe responsibilities a service would need, not people who have accepted operational duties. The Data Card records source composition, intended use, provenance and license. The System Card adds components, evaluation results, excluded uses, failure responses and responsible roles. Cards expose claims and limitations; they are not certificates of safety or lawful operation.

51.2 A correct citation can still carry a wrong claim

A hallucination here is a generated claim that lacks the required support, such as “600 is the current limit” or “the order has been cancelled” without a receipt. The exact support gate can reject these failures in our fixed corpus. But suppose the policy office itself publishes a mistaken 750 limit. The assistant can accurately quote an authentic, applicable source and still give a substantively wrong instruction.

The checks therefore answer different questions: does the text match the source, is this source applicable, and is the source itself correct? The service can automate the first two under explicit rules. The third may require the policy owner’s investigation. RAG reduces some missing-evidence problems; retrieval is not an independent guarantee of truth.

Example 51.1 — Close a correction with evidence. A report says today’s answer was 600. Preserve the necessary request date and cited version, not every personal detail in the conversation. The record shows that v1, valid during 2025, was selected for a 2026-09-14 request. The policy owner confirms that v2 is the current source. The service owner fixes applicability filtering and invalidates the affected cache. Two reruns are required: today’s question must yield 750, and the historical 2025 question must still yield 600.

The local correction record and execution produce exactly those two amounts. The original historical source remains available for its proper purpose. A repair that simply replaces every occurrence of 600 would destroy valid historical answers. Closing the report requires both checks and a named decision, not merely changing the answer shown to one user.

This feedback loop continues after release: record the issue, identify scope, assign responsibility, correct the relevant component, rerun affected cases, and review residual risk. A new source version or a changed model can reopen the issue even if yesterday’s tests passed.

51.3 Equal treatment needs a stated comparison

Bias is not one universal score. We must specify which people or situations are being compared, which outcome matters, and which differences are relevant to the task. For this policy, an invented group label “amber” or “violet” should not alter the applicable lodging limit when date and policy are identical.

Example 51.2 — Remove an irrelevant route. The deliberately bad baseline assigns amber 750 and violet 600 using the group label. Its gap is $750-600=150$ yuan per room per night. The corrected input projection omits that label and sends the same question, date, topic and language to the workflow. Actual local runs return 750 for both, so the gap in this pair becomes $750-750=0$.

This is a controlled invariance check: change one irrelevant attribute and hold the task constant. The bad mapping is authored to expose the defect; it is not a measured social disparity. The two corrected runs verify this particular route. They do not establish fairness across real populations, languages, disability access, refusal rates or unequal opportunities to use the service. Group information hidden in free text could also survive a field-level projection.

Preference alignment can make responses more agreeable or better match a feedback objective. It does not by itself establish factual correctness, group fairness, lawful use or adequate human review. Each requires its own criteria and evidence. A refusal policy that treats every unusual name as suspicious could reduce some errors while unfairly denying service; count such consequences instead of declaring every refusal a safety success.

51.4 Minimize input and account for every copy

A credential belongs in the host’s authorization path, not in the model’s request text. A hotel address is unnecessary for asking the fictional city-wide limit. Our allowed-field projection retains question, on_date, topic and locale; it drops separate credential, hotel_address and group fields. The recorded result contains those four retained fields and no supplied credential.

That operation is data minimization for a stated purpose. It does not recognize all private information. If the user puts an address inside question, this simple projection retains it. A real service needs appropriate collection design and additional handling for such text; the fixture does not claim to solve that problem.

Example 51.3 — Deletion has a denominator too. Four synthetic stores—logs, memory, cache and feedback—each contain one record for Mira and one for Leo. There are $4\times2=8$ stored records. Erasing Mira’s eligible copies removes one from each store, leaving $4\times1=4$ records. Deleting only the log would remove one of four Mira copies and leave three behind.

The local function actually performs all four removals and returns counts: each store changes from 2 to 1. Its receipt does not copy the erased content into a new “deletion log.” This verifies in-memory fixture deletion. It does not erase a backup, a provider’s copy or information already incorporated into model weights. Those require separate inventories, policies and mechanisms.

Before model input

1. Outside the modelQuestion + date + topic
2. An operationSelect necessary fields
3. Text piecesNo credential or hotel address

Field selection is a data-minimization control, not semantic detection of every secret.

Four retained stores

1. Application recordLogs 2 → 1; memory 2 → 1
2. Application recordCache 2 → 1; feedback 2 → 1
3. Application recordReceipt: counts, no content

Deleting these copies does not erase model weights or an unlisted backup.

Figure 51.1 — A deletion request follows every retained copy. Original teaching diagram · CC BY-SA 4.0

Figure 51.1 shows why a single request can leave several independently managed copies. In this project, model memory is not enabled by default. We still include a synthetic memory store in the deletion exercise so a future addition cannot silently escape the inventory.

Retention expiry is a second path to deletion. Give a content record creation day 0 and retention 7 days, and an audit record creation day 0 and retention 30 days. Our authored rule keeps a record only while the current day is strictly less than creation day plus retention days. At day 7, the content record expires because $7<0+7$ is false; the audit record remains because $7<0+30$ is true. The actual expiry fixture changes from two records to one. Days are logical teaching units; this is not a scheduler running for a week.

51.5 Permission to access is not permission to reuse

The fictional policies and original diagrams have stated licenses. The public human-judgment slice used in Chapter 50 has a different, CC BY 4.0 license and retains attribution and modification notes. A tool’s ability to download a file does not grant copyright permission to reproduce it, train on it or use it for every purpose.

Copyright questions concern protected expression and permitted uses. Privacy concerns personal information and its handling. A public document can implicate both, and a license may not resolve every right. Record source, license, intended use, modifications and any unresolved restrictions before admission to the corpus. If permission is insufficient for the intended reuse, withhold that source and seek an appropriate substitute. Avoid turning a summarizer into an unrestricted reproduction service.

Legal obligations also depend on jurisdiction, dates, roles and facts. As verified on 2026-09-14, China’s Personal Information Protection Law has an applicability rule in Article 3, purpose/minimization requirements in Article 6, a minimum-necessary retention principle with stated exceptions in Article 19, and deletion conditions and limitations in Article 47. It took effect on 2021-11-01. These provisions do not prescribe our arbitrary seven- and thirty-day teaching periods, and this chapter does not determine whether a real service complies with the law.

NIST’s AI RMF and its generative-AI profile help organize risks and responsibilities; they are governance guidance, not a substitute for applicable law or a compliance certification. A legal review, when needed, must examine the actual service rather than a successful textbook test.

51.6 Make refusal and escalation distinguishable

An evidence gap, a forbidden request and an uncertain operation need different responses. For absent or conflicting evidence, abstain and seek the relevant source or date. For a cross-tenant request or secret disclosure, refuse without revealing whether another tenant’s record exists. For a timeout after a possible commit, reconcile the receipt or send the case for review; do not invent success or retry with a new key.

The Risk Register links each risk to affected data, an owner, a control, an evidence artifact and a remaining limitation. Its eight entries cover stale facts, group treatment, privacy copies, rights, injection, duplicate effects, tenant leakage and supply-chain changes. Review dates create an obligation to reconsider evidence; a risk does not disappear because its row has an owner.

KA-8’s Data Card, System Card, versioned Risk Register and refusal policy are in the shared assistant data directory. The Notebook executes minimization, the paired-label check, deletion, expiry and the dated correction. Human roles and legal judgments are declared simulation boundaries, not fabricated real approvals.

51.7 Summary

Governance follows data from collection through use, logging, correction and deletion. Factual support, fairness, privacy and rights require distinct evidence and responsible decisions. Small controls can make a precise improvement while leaving substantial limits. The next chapter tests what happens when someone deliberately places misleading instructions in the information this system reads.

51.8 Exercises

1. A repair removes v1 entirely after a current-answer complaint. Which valid request breaks, and what two checks should replace that repair?
2. A cache is omitted from Mira’s deletion job. Using Example 51.3, how many Mira records remain? Why is a “log deletion succeeded” message insufficient?
3. A record is created on day 3 and retained for 7 days under the stated strict inequality. Is it retained on days 9 and 10? Explain the boundary.
4. Both group labels now receive 750, but users asking in one language are refused twice as often. Has the pair test established fairness? Propose the next evidence to collect without assuming every refusal is wrong.
5. A retrieved source is authentic and relevant but has no established reuse permission. The answer also contains a user’s address. Name two distinct issues and their responsible follow-up.

51.9 Reference answers

1. A question dated in 2025 loses its valid 600 source. Keep versioned history, enforce applicability and check current 750 plus historical 600. Invalidate only the affected cache entries or dependency scope.
2. One Mira cache record remains: the other three stores removed theirs. A successful operation on one store says nothing about unvisited stores; the deletion inventory and count evidence must cover all four.
3. Expiry is day $3+7=10$. Day 9 satisfies $9<10$ and is retained. Day 10 does not satisfy $10<10$ and expires. An inclusive comparison would implement a different policy.
4. No. The pair checks one irrelevant label under one request. Compare refusal reasons and supported/unsupported cases across languages, with an explicit sample and independent review. Unequal input needs can affect raw rates, while unequal handling can still exist within comparable cases.
5. The policy owner must establish appropriate rights or exclude the source; accessibility and authenticity are insufficient. The data steward/service owner must examine why the address was collected, exposed or retained, minimize unnecessary content and apply the relevant deletion/incident process. A copyright license would not automatically settle the privacy issue.

51.10 References

• NIST AI RMF 1.0, GOVERN categories 1–6. These organize continuing responsibility, documentation and third-party risk; they do not certify this assistant.
• NIST AI 600-1, Generative AI Profile, §§2.2, 2.4, 2.6 and 2.10. These distinguish confabulation, privacy, harmful bias and intellectual-property concerns.
• Mitchell et al., Model Cards for Model Reporting, Figure 1 and §4; Gebru et al., Datasheets for Datasets, §3. These motivate documentation of intended use, composition, evaluation and limitations; the project’s System Card adapts that documentation idea to its components.
• Personal Information Protection Law, official CAC reproduction, Articles 3, 6, 19, 47 and 74. These support the narrowly scoped legal statements above; applicability needs the actual facts.
• Creative Commons Attribution 4.0 legal code, §§2–3. It specifies the license terms for the separately attributed human-reference dataset adaptation, including attribution conditions.