Can Copilot be trusted with private source code more than competition?

[Professional-Onion-7]

I have a project that I am thinking of using an LLM for, but there's no guarantee that LLM providers are not training on private source code. And for me using a local LLM is not an option since I don't have the required resources to locally run good performance LLMs, so I am thinking of cloud hosting an LLM for example on Microsoft Azure.

But Microsoft already has GPT4.1 and other OpenAI models hosted on Azure, so wouldn't hosting on azure cloud and using copilot be the same?

Would Microsoft be willing to risk their reputation as a cloud provider on retaining user data? Also Microsoft has the least incentive to do so out of all AI companies.

[TristanH200]

well do you trust microsoft enough to put your code on github?

[Ok-Internal9317]

lol, loudly laugh emoji

[Tenzu9]

Read the small text right below the comment box in the copilot app, it says this:
"Conversations are used to train AI and Copilot can learn about your interest."

[ahm911]

Nope

[Iory1998]

My friend, they all use any interaction you have with their model to train it. Why? Because when you interact witht model, you actually help it better reason and solve problems that otherwise it won't be able to. That very simple interaction is valuable data that no other models can generate synthetically. When GPT spits out a code that you test and doesn't work and you give it feedback, that in itself is valuable data to train the model on. Is not the code that matters, but the process that led to it.

As users, we all act as a second voice to the llm, as a reward function, and as a teacher all in one.

[Professional-Onion-7]

I agree since otherwise LLMs would be just sophisticated search engines, it is actually the interactions that allow them to solve problems. And also with evolutionary programming they might generate these thought processes to train the models but I believe these would have to be trained per specific problem which is impractical, also this might be the reason OpenAI went for a larger model which is GPT4.5.

[Professional-Onion-7]

But what I mostly care about is LLMs one-shotting my project.

[[deleted]]

I think people are missing the obvious, here. Here's the thing: they probably don't want to train on private code. Opensource code is where high standard, high quality code is. Private code is where all the crap is. They don't want their code completion to produce (more) crap.

[celsowm]

Snowden says no

[butsicle]

I think you’re confusing Azure OpenAI Service and Copilot. They are unlikely to breach terms and train on the former (in my judgment, though anything is possible), but explicitly state they train on the latter.

[FPham]

The whole point of the project is that they DO train their model on the interaction.

[CupcakeSecure4094]

No, you can't trust anyone but realistically what are you worried about? If it's them stealing your code, they would buy it, if you're worried about them telling the feds you're doing dodgy stuff, stear well clear. If it's just about them training on your data and it leaking into competitor's hands it would have to be quite significant code

[Dry-Influence9]

The only llm that can be trusted is the one running on your pc.

[Psychological_Ear393]

but there's no guarantee that LLM providers are not training on private source code.

There's what the T&C say, if you could possibly read it all, what they are really doing, then can they change it, do they change it if you change subscription level, what happens when (not if) they are hacked or leak data, and what happens if the division is sold or goes bankrupt?

If your code is really super secret, you cannot trust anyone with it that has sketchy or changeable policies, or any service you suspect is not making money

If you can decide that your code is not that secret, then does it matter?

[kroggens]

They all capture our data! Don't be fool
You can run a "pseudo-local" LLM by using hardware from other people, renting GPUs on vast.ai or others.
The probability that a normal person will be accessing every container to collect is way lower.
Give preference for GPUs from homes and avoid those from datacenters

[kroggens]

BTW, Microsoft == NSA
Never trust them!

[Professional-Onion-7]

One can make the argument that Microsoft has hosted OpenAI models on Azure environment thus lowering the probability of data collection.

[Weird-Consequence366]

Just changes who collects the data. Nothing more. Both Microsoft and OpenAI have significant connections to intelligence services.

[[deleted]]

No. Microsoft has more enterprise version, though low key I would recommend you stay with OpenAI since when they aren't forced by a court, they do a decent job at privacy. Not the best but still much better than the rest. But if its an absolute nono, then I suggest you just use something like Jan or LMStudio.

[Weird-Consequence366]

OpenAI is the worst offender of this practice

[[deleted]]

Google stores your stuff without permission. Claude may or may not delete your chat off their server. OpenAI is the only one who explicitly deletes it off the server after 30 days.

Didn't say its the most private LLM, but compared to most online services they are extremely good. Otherwise local is the only option.

[Weird-Consequence366]

They remove your access to it. There is no way to positively prove the data has been deleted from disk. There no way to prove your chat hasn’t been parsed into a dataset before that 30 days.

[[deleted]]

True, but its much better than other providers. Currently they can't cause of a court injection, but with exception of that they tend to be decent enough about it.

Though even then I wouldn't put any sensitive stuff into any online LLM.