{"id":"6140a4d0-5180-4f4f-919e-ea9844f32b62","arxiv_id":"2507.03034","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper organizes data protection in generative AI into a four-level hierarchy covering non-usability, privacy preservation, traceability, and deletability, and maps techniques and regulations onto it.","lead":"This perspective paper proposes a four-level taxonomy for protecting data in the generative AI era: non-usability, privacy preservation, traceability, and deletability. A smart generalist might read it to understand why ordinary data-protection rules fail when data becomes training material, prompts, and AI-generated outputs.","discovery_kind":"unification","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The hierarchy's ordering assumption is unsupported: traceability and deletability are orthogonal under the paper's own definitions, so the claimed utility/control gradient does not follow.","rationale":"The reader's weakest_assumption identifies the same load-bearing concern, and my read agrees with it. The strongest_claim about the four-level taxonomy is only as strong as the ordering assumption; the paper's own technique descriptions provide counterexamples to that ordering. This is an internal-consistency concern, not a disagreement with an external consensus. I credit the paper for a clear review of techniques and a plausible regulatory mapping; those parts do not require a strict ordering. Because the fix is a reframing rather than a rejection, the verdict remains CONDITIONAL/UNCHANGED rather than REJECT. The concrete 2x2 test can decide whether the hierarchy claim is essential or merely rhetorical.","tokens_in":22703,"tokens_out":3958,"duration_ms":49396,"concrete_test":"Construct two minimal but coherent deployments of the same protected data asset. System A watermarks the training data for ownership verification and provides no machine-unlearning endpoint, satisfying Level 3 but not Level 4. System B provides a certified unlearning procedure for the same data but records no provenance and embeds no watermark, satisfying Level 4 but not Level 3. If both systems are accepted as satisfying the paper's own definitions (Section II.B and Section III), then traceability and deletability are not strictly ordered by permissiveness, and the 'each successive level relaxes protections' claim fails. The authors should either prove a dominance relation among all four goals or relabel the taxonomy as four complementary protection dimensions.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on Section II.B's assertion that 'each successive level in this hierarchy relaxes the protections on data slightly, trading off some degree of control for greater data utility.' The definitions of the four levels do not establish this total order. Level 3 (traceability) requires the ability to verify provenance and modifications; Level 4 (deletability) requires the ability to remove a data item's influence from a trained model. These are logically orthogonal: a watermarked dataset can be used in a model that has no unlearning mechanism, so traceability holds without deletability; conversely, an unlearning service can erase influence without any watermarking or audit log, so deletability holds without traceability. A similar incomparability exists between non-usability and privacy-preservation: unlearnable examples (Section III, Level 1) and differential privacy (Section III, Level 2) both intentionally mask features, and encryption is a mechanism that can serve any level. Since no operational definition of data utility or degree of control is given, the claimed single utility/control gradient is an additional assumption rather than a consequence of the categorization. The taxonomy remains useful as a checklist of four protection dimensions, but the hierarchical ordering is not supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This perspective paper argues that data protection in the generative AI era should be organized into a four-level hierarchical taxonomy: data non-usability, privacy-preservation, traceability, and deletability. It motivates the taxonomy by surveying the AI lifecycle—training data, trained models, deployment-integrated data, user inputs, and AI-generated content—and then maps representative techniques (encryption, unlearnable examples, differential privacy, watermarking, membership inference, machine unlearning) onto the four levels. It also analyzes a set of international regulations, classifying each regulation as covering some subset of the four levels, and discusses emerging challenges around AIGC, cross-jurisdictional enforcement, and ethics. The paper's central claim is that this hierarchy captures a utility–control gradient and provides a structured lens for comparing techniques and regulations.","tokens_in":22811,"tokens_out":2039,"duration_ms":25223,"significance":"If the taxonomy is accepted, it could serve as a useful organizing device for a scattered literature spanning unlearnable examples, differential privacy, watermarking, and machine unlearning, and it could give regulators a shared vocabulary. The paper is strongest as a broad survey: it covers a commendable range of techniques and regulations, and the four categories are natural and memorable. It is weaker as a conceptual contribution because the hierarchical ordering—the element that makes the taxonomy more than a checklist—is not derived from the definitions given. The policy mapping in Table I is also presented without a transparent rubric. The paper does not contain machine-checked proofs or falsifiable quantitative predictions, but that is not expected for a perspective piece; its value is in synthesis and framing.","major_comments":[{"comment":"The central claim that the four levels form a strict hierarchy ordered by a utility–control trade-off is not supported by the definitions given. Section II.B states that 'each successive level in this hierarchy relaxes the protections on data slightly, trading off some degree of control for greater data utility,' but traceability (Level 3) and deletability (Level 4) are logically orthogonal under the paper's own descriptions: a watermarked dataset can be used in a model with no unlearning mechanism, and an unlearning service can erase influence without any watermarking or audit trail. Similarly, non-usability via encryption and non-usability via unlearnable examples are different in kind, and privacy-preservation is not obviously 'more permissive' than non-usability because privacy-preserving techniques such as differential privacy also mask task-relevant information. Since no operational definition of 'data utility' or 'degree of control' is provided, the claimed gradient is an additional assumption rather than a consequence of the categorization. The taxonomy remains useful as a set of four protection dimensions, but the hierarchy should either be justified with explicit ordering criteria or reframed as a multi-dimensional framework.","section":"Section II.B"},{"comment":"The assignment of protection levels to regulations is asserted without a stated methodology or rubric, and some entries appear inconsistent with the accompanying text. For example, CCPA is marked as covering N (non-usability), but the text describes CCPA as supporting L2 and L4 protections and does not identify any general prohibition on using data for AI training. Conversely, the text states that deletability (L4) is 'nominally protected under Chinese law' with limited enforcement, yet the PIPL row in Table I lists only N, P, T and omits D. Because the paper uses Table I to support the claim of 'regulatory blind spots,' the mapping should be justified with explicit criteria for what counts as coverage at each level, or the table should be replaced with a more cautious qualitative comparison.","section":"Table I and Section IV"},{"comment":"Grouping encryption and authorization under 'non-usability' conflates access control with inherent unusability. Encryption prevents access by unauthorized parties, but the data remains perfectly usable by authorized parties and can be decrypted; unlearnable examples, by contrast, aim to make the data unusable even when the adversary has full access. These are different threat models with different guarantees. The paper should either distinguish these subcases explicitly or explain why they belong to the same level despite their different failure modes.","section":"Section III, Level 1"}],"minor_comments":[{"comment":"The word 'AI-enpowered' should be 'AI-empowered'.","section":"Section I"},{"comment":"The phrase 'such like k-anonymity and L-diversity' should be 'such as k-anonymity and L-diversity'.","section":"Section III, Privacy-preservation"},{"comment":"The leftmost subfigure in Figure 3 is labeled 'Level 4: Unlearnability' while the text and Figure 2 use 'Deletability'; these terms are related but not identical and should be aligned.","section":"Figure 3"},{"comment":"The abstract and Section II.B describe the taxonomy as 'hierarchical,' but Figure 2's caption and the surrounding text sometimes describe it as a 'spectrum' or 'gradient'; the terminology should be made consistent if the hierarchy claim is retained.","section":"Section II.B"},{"comment":"The discussion of data protection vs. data safety is useful but overlaps considerably with the introduction; consider condensing to avoid repetition.","section":"Section V.A"}],"recommendation":"major_revision","confidential_remarks":"The paper is a well-written and broad perspective, but the central 'hierarchy' claim needs reworking. I would be comfortable with acceptance if the authors either justify the ordering or explicitly present the four levels as orthogonal dimensions rather than a strict hierarchy. The Table I mapping should also be made transparent. The paper is within scope for a cs.LG perspective venue, but the authors should be careful not to overclaim novelty: several prior surveys cover subsets of these techniques, and the contribution is the synthesis rather than the individual technical descriptions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The four-level taxonomy is a genuinely useful organizing device. Grouping data protection into non-usability, privacy-preservation, traceability, and deletability gives researchers and regulators a shared vocabulary, and the lifecycle view in Figure 1 plus the regulation mapping in Table I are the real contributions. The technique review for each level is competent, and the discussion of data protection versus data safety, AIGC copyright ambiguity, and cross-jurisdictional enforcement shows the authors have thought beyond the taxonomy itself. This is a solid perspective piece, not a research paper, and it does not need new empirical results to be worth reading.\n\nThe soft spots are real but not fatal. The biggest one is the ordering claim. Section II.B asserts that each successive level relaxes protections and trades control for utility, and Figure 2 presents a strict ladder from strong protection/low utility to weak protection/high utility. The paper's own definitions do not establish that. Traceability and deletability are logically orthogonal: a watermarked dataset can be used in a model with no unlearning mechanism, and an unlearning service can erase influence without any watermarking or audit log. Both allow near-full utility; neither is inherently more permissive than the other. Privacy-preservation and traceability are similarly incomparable. The taxonomy still works splendidly as four independent protection dimensions; what does not work is the claim that they form a total order. This needs to be reframed or defended.\n\nMinor issues: the introduction calls this \"the first timely overview\" even though the authors cite Meurisch and Mühlhäuser (2021), a prior survey on data protection in AI services. That overclaim should just be removed. The exhaustiveness of the four levels is asserted rather than argued, and Table I's regulation assignments could use a note explaining the method (or at least acknowledging that the assignments are interpretive). There are also a few copyedit leftovers (\"AI-enpowered,\" \"inflict societal and individual\"), but those are trivial.\n\nThe paper deserves a serious referee. The taxonomy is likely to be cited and used, especially by policy-adjacent readers, but it needs a revision that either proves the hierarchy or, more sensibly, presents the four levels as a structured set of goals rather than a strict sequence. I would send it to review with a recommendation of major revision, and I would expect it to be publishable afterwards.","headline":"A useful four-goal taxonomy for AI data protection, but the claimed utility/control hierarchy is not supported by the paper's own definitions and should be softened before publication.","tokens_in":23446,"tokens_out":2247,"would_cite":true,"duration_ms":28741,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Data protection in the generative-AI era should be organized as a four-level hierarchy—non-usability, privacy preservation, traceability, and deletability—that trades control against utility.","keywords":["data protection","generative AI","data non-usability","privacy preservation","traceability","deletability","machine unlearning","AI governance"],"falsifier":"A concrete test: take a fixed dataset and model, measure utility (for example test accuracy or downstream task performance) under a representative technique from each level—unlearnable examples, differential privacy, watermarking, and machine unlearning—and measure protection strength (for example attack success rate or verification rate). If the levels do not produce a monotone ordering in both dimensions—if a traceability watermark degrades utility more than a privacy-preserving mechanism, or a privacy mechanism offers weaker protection than a traceability one—then the single-gradient hierarchy is falsified.","tokens_in":22426,"feed_emoji":"🛡️","tokens_out":4858,"duration_ms":48919,"temperature":0.7,"pith_summary":"The paper argues that 'data protection' in the generative-AI era is no longer about guarding static files; data flows through every stage of the AI lifecycle, from training sets to prompts to model outputs, and each artifact can be copied and leaked independently. To make sense of this, it proposes a four-level hierarchical taxonomy: data non-usability, privacy preservation, traceability, and deletability. Each level is defined by a different trade-off between how much control the owner keeps and how much utility the data can still deliver, from fully blocking use to allowing full use with a right to later removal. The paper maps existing techniques and regulations onto the four levels, revealing that most legal frameworks cover the first three levels while deletability remains the weakest in both technical and regulatory terms. A sympathetic reader would care because the taxonomy gives researchers, developers, and regulators a common language to say precisely which protection goal they mean, rather than treating all AI data protection as a single undifferentiated obligation.","feed_headline":"AI data protection needs four levels: block, shield, trace, erase","feed_subtitle":"The taxonomy ties encryption to machine unlearning on one control-versus-utility ladder for regulators and developers.","key_machinery":"The central object is the four-level hierarchical taxonomy itself: data non-usability, privacy preservation, traceability, and deletability. The hierarchy is the mechanism: it places every data-protection technique and every legal instrument on a gradient from maximal control with zero utility to minimal control with full utility, and it extends the scope of protected data beyond raw samples to trained model weights, system prompts, external knowledge bases, user inputs, and AI-generated content. The paper uses this ladder as an analytical lens to compare techniques—encryption and unlearnable examples at level 1; differential privacy and federated learning at level 2; watermarks and membership inference at level 3; retraining and machine unlearning at level 4—and to score regulations by which levels they actually enforce.","core_discovery":"The paper's central claim is that the many disparate data-protection problems raised by modern AI—artists blocking style mimicry, hospitals keeping patient records private, companies tracing leaked datasets, users erasing their influence from models—are not separate issues but positions on a single spectrum of control versus utility. It proposes a four-level hierarchy: level 1 non-usability (data cannot be used for training or inference at all), level 2 privacy preservation (data may be used while sensitive attributes are shielded), level 3 traceability (data is used almost fully but carries mechanisms to track origin and modification), and level 4 deletability (data is fully used up front on the condition that its influence can later be removed from the model). The paper claims each successive level relaxes protection slightly and increases utility, and it uses this ladder to organize representative technical approaches and to map existing regulations, revealing that most laws cover non-usability, privacy, and traceability but deletability remains technically and legally underdeveloped.","pith_inferences":["The paper leaves implicit that the same artifact can sit at different levels for different parties—a dataset could be non-usable to unauthorized trainers, traceable to the public, and deletable to the original contributors—so the hierarchy is best read as a relation between an asset, an actor, and a lifecycle stage.","A natural testable extension is to build a benchmark that classifies existing protection techniques by their utility drop: measure, for a fixed model and dataset, how much accuracy is lost under an unlearnable-example defense, differential privacy, watermarking, and machine unlearning, and check whether the paper's predicted ordering of utility actually holds.","The taxonomy suggests a cross-disciplinary design pattern: future systems could dynamically switch protection levels depending on jurisdictional requirements, much as the paper suggests with adaptive watermarking and context-aware deletion, which would make compliance a technical parameter rather than a legal afterthought."],"forward_implications":["If the taxonomy is right, a developer can specify a protection target precisely—'I need deletability, not non-usability'—and pick techniques and compliance measures accordingly, instead of treating data protection as one undifferentiated obligation.","Regulators can audit their instruments level by level; the paper's Table I shows, for instance, that most Chinese regulations cover non-usability, privacy, and traceability but leave deletability weak, and that the United States lacks a comprehensive federal data-protection regime.","The taxonomy redefines what counts as protected data in the AI era: not just training datasets but model weights, system prompts, retrieval-augmented knowledge bases, user prompts, and AI-generated content that later becomes training data.","The paper's analysis implies that technical feasibility lags legal rights: deletion rights exist in law, but machine unlearning is not yet reliable enough to guarantee that a data point's influence is truly gone.","Traceability and non-usability can act as technical substitutes where copyright law is uncertain, for example watermarking AI-generated content or cloaking artists' styles when AI-generated content itself is not copyrightable."],"supporting_citations":[{"why":"Supplies the right-to-erasure and processing-limitation provisions that the paper maps onto its non-usability and deletability levels.","marker":"[13]"},{"why":"Defines machine unlearning, the technical basis for the deletability level.","marker":"[77]"},{"why":"Introduces unlearnable examples, a representative level-1 non-usability technique.","marker":"[33]"},{"why":"Presents Glaze style cloaking, a leading example of level-1 non-usability for artists.","marker":"[68]"},{"why":"Establishes differential privacy, the core level-2 privacy-preservation technique.","marker":"[69]"},{"why":"Provides federated learning, a representative non-tampering level-2 privacy technique.","marker":"[93]"},{"why":"Demonstrates dataset ownership verification via backdoor watermarking, a level-3 traceability method.","marker":"[30]"},{"why":"Shows prompt watermarking for protecting system prompts, a level-3 traceability technique for deployment data.","marker":"[49]"},{"why":"Introduces membership inference, a non-intrusive level-3 traceability method.","marker":"[102]"}],"fun_headline_variants":["AI data protection: a four-rung ladder from blocking to erasure","Guard AI data at every stage: block, shield, trace, erase","Four levels to safeguard AI data without killing utility","Rethink data protection: one spectrum from refuse to erase"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The taxonomy assumes that non-usability, privacy preservation, traceability, and deletability can be ranked on a single scale of control-versus-utility, with each level strictly less restrictive than the last.","fun_headline_variants_meta":{"raw":{"variants":["AI data protection: a four-rung ladder from blocking to erasure","Guard AI data at every stage: block, shield, trace, erase","Four levels to safeguard AI data without killing utility","Rethink data protection: one spectrum from refuse to erase"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000717,"raw_usage":{"total_tokens":3233,"prompt_tokens":969,"completion_tokens":2264,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":2192}},"tokens_in":585,"tokens_out":2264,"duration_ms":17215,"temperature":1.0,"reasoning_tokens":2192,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T20:33:42.740605+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete test: take a fixed dataset and model, measure utility (for example test accuracy or downstream task performance) under a representative technique from each level—unlearnable examples, differential privacy, watermarking, and machine unlearning—and measure protection strength (for example attack success rate or verification rate). If the levels do not produce a monotone ordering in both dimensions—if a traceability watermark degrades utility more than a privacy-preserving mechanism, or a privacy mechanism offers weaker protection than a traceability one—then the single-gradient hierarchy is falsified.","supporting_citations":[{"cited_title":"Machine unlearning,","cited_arxiv_id":null,"evidence_quote":"Defines machine unlearning, the technical basis for the deletability level."},{"cited_title":"Glaze: Protecting artists from style mimicry by text-to-image models,","cited_arxiv_id":null,"evidence_quote":"Presents Glaze style cloaking, a leading example of level-1 non-usability for artists."},{"cited_title":"Communication-efficient learning of deep networks from decentralized data,","cited_arxiv_id":null,"evidence_quote":"Provides federated learning, a representative non-tampering level-2 privacy technique."},{"cited_title":"Membership inference attacks against machine learning models,","cited_arxiv_id":null,"evidence_quote":"Introduces membership inference, a non-intrusive level-3 traceability method."}],"review_version":1}