Comparing OpenAI and Anthropic’s Data Retention Policies How OpenAI’s Private Safety Processing and Anthropic's Enterprise Frontier Safeguards affect ZDR policies对比 OpenAI 与 Anthropic 的数据留存政策：OpenAI 的“私有安全处理”与 Anthropic 的“企业前沿防护”如何影响零数据留存（ZDR）政策

Anyone who sends private data to an AI model or service deserves a clear answer to three questions: (i) Where do they store it? (ii) How long do they keep it? and (iii) What, if anything, will they do with it (such as train on it, show to humans, etc.) This week, business customers for two leading companies got two responses: one leaked, then confirmed, and another previewed. Technical details are scarce for both.任何将私有数据发送给 AI 模型或服务的人，都理应得到以下三个问题的明确答复：(i) 他们将数据存储在哪里？(ii) 他们保留数据多久？以及 (iii) 他们会用这些数据做什么（例如用于训练、人工查看等）？本周，两家领先企业的商业客户得到了两个回应：一个先是泄露后被证实，另一个则是预告。目前两者的技术细节都十分匮乏。

What’s new at Anthropic: Since June, businesses using Claude Fable 5 have been required to let Anthropic keep their conversations for 30 days. Now Anthropic will soften that rule, with a new program called Enterprise Frontier Safeguards (EFS) that will require companies with zero data retention (ZDR) policies to keep the data on their own servers or those of specific cloud providers instead. Until EFS is available sometime this fall, eligible enterprise customers will be able to use Fable 5 and Fable 5.1 without Anthropic retaining any data. Anthropic 的新动向：自 6 月起，使用 Claude Fable 5 的企业必须允许 Anthropic 保留其对话记录 30 天。现在，Anthropic 将放宽这一规定，推出一项名为“企业前沿防护”（Enterprise Frontier Safeguards，简称 EFS）的新计划。该计划要求拥有零数据留存（ZDR）政策的公司将数据保留在自己的服务器或特定的云服务提供商服务器上。在今年秋季 EFS 正式推出之前，符合条件的企业客户可以在 Anthropic 不留存任何数据的情况下使用 Fable 5 和 Fable 5.1。

Meanwhile at OpenAI: One day before Bloomberg broke the Anthropic news, OpenAI published a post promising that for business customers, its most capable models come with ZDR. This means OpenAI never logs a business’s prompts and replies. It’s offered to approved businesses that plug the models into their own software. The post also previewed Private Safety Processing (PSP), a system meant to spot misuse spread across many requests without OpenAI reading the prompts.与此同时，OpenAI 的举措：在彭博社率先报道 Anthropic 的消息前一天，OpenAI 发布了一篇文章，承诺其面向商业客户的最强模型将支持 ZDR。这意味着 OpenAI 永远不会记录企业的提示词和回复。该功能提供给那些将模型接入自身软件的获批企业。文章还预告了“私有安全处理”（Private Safety Processing，简称 PSP），这是一个旨在识别跨多个请求的滥用行为，且无需 OpenAI 读取提示词的系统。

How it works: Both companies describe the same method: software watches requests over time and flags patterns. No human review is required. Here is what neither explains: “Our employees can’t see it” is not the same as “our systems can’t see it.” To scan the data, software the company wrote has to unlock and read it, wherever it is stored. Sholto Douglas, a member of Anthropic’s technical staff, described the plan on X as monitoring “done via automated systems we provide to you.” Here’s where each company stands.运作方式：两家公司描述的方法如出一辙：软件会持续监控请求并标记异常模式，无需人工审核。然而，两者都没有解释一点：“我们的员工无法看到”并不等同于“我们的系统无法看到”。为了扫描数据，公司编写的软件必须在数据存储处对其进行解锁和读取。Anthropic 的技术人员 Sholto Douglas 在 X 上将此方案描述为“通过我们提供给您的自动化系统进行监控”。以下是各公司的立场。

• In force today: Anthropic keeps Fable 5 and Mythos 5 conversations for 30 days on every platform, per its help center. Further, content that the company flags according to a process set at its discretion can be kept up to two years under its general policy, and reviewers Anthropic approves can read it through a logged process. OpenAI says its staff can’t see ZDR customers’ conversations, except where required by federal law.现行政策：根据其帮助中心的信息，Anthropic 目前在所有平台上将 Fable 5 和 Mythos 5 的对话保留 30 天。此外，根据其通用政策，公司可自行决定标记的内容，这些内容最多可保留两年，且经 Anthropic 批准的审核员可以通过记录在案的流程查看这些内容。OpenAI 则表示，除非联邦法律要求，否则其员工无法查看 ZDR 客户的对话。
• What’s been promised: Anthropic will require data to be retained for the same 30 days, but stored on the customer’s servers — either their own or through a third-party provider such as Google Cloud, Microsoft Foundry, or Amazon Web Services. (Disclosure: Andrew Ng is a member of Amazon’s board.) The 30 day requirement will stay, but the data will sit on the customer’s designated servers instead of Anthropic’s, and customers have the option to manage their own encryption keys, audit logs, and other security data. OpenAI’s Private Safety Processing will scan data held on the customer’s servers or encrypted on OpenAI’s with keys OpenAI says its staff doesn’t have, and report back only a label for the type of activity, not the content.承诺内容：Anthropic 将要求数据保留相同的 30 天，但需存储在客户自己的服务器上——无论是客户自有的服务器，还是通过谷歌云、微软 Foundry 或亚马逊云科技等第三方提供商。（披露：Andrew Ng 是亚马逊董事会成员。）30 天的保留要求不变，但数据将位于客户指定的服务器而非 Anthropic 的服务器上，且客户有权管理自己的加密密钥、审计日志及其他安全数据。OpenAI 的“私有安全处理”将扫描存储在客户服务器上的数据，或者扫描 OpenAI 服务器上加密的数据（使用 OpenAI 声称其员工无法获取的密钥），并仅反馈活动类型的标签，而非内容本身。
• Why both companies say they need this: The primary threats EFS and PSP are designed to address are cyberattacks. Some attacks show up only across many requests. Anthropic’s help center cites spying by governments and “best-of-N” jailbreaking, where an attacker rewords a blocked request hundreds of times until one version gets through.两家公司为何认为有此必要：EFS 和 PSP 主要旨在应对网络攻击。有些攻击只有在跨越多个请求时才会显现。Anthropic 的帮助中心提到了政府间谍活动和“最佳 N 次”（best-of-N）越狱攻击，即攻击者将受限请求改写数百次，直到其中一个版本绕过限制。
• Undisclosed: It remains unclear how either company’s software reads data they claim they can’t see. OpenAI has promised a technical paper for PSP in September; Anthropic published one for its June data retention policy but has given few technical details about how EFS would work. Neither company has disclosed the specific criteria that they apply to consider something a “cyberattack” or “unsafe.”未披露信息：目前尚不清楚这两家公司的软件如何读取它们声称“无法看到”的数据。OpenAI 承诺在 9 月份发布 PSP 的技术文档；Anthropic 虽然为 6 月的数据留存政策发布过一份文档，但对于 EFS 的工作原理几乎未提供技术细节。两家公司均未披露它们判定何为“网络攻击”或“不安全”的具体标准。

Behind the news: Anthropic’s June rule forced an exception to the ZDR contracts some business customers already had. These customers had to switch retention on to use the new models at all. Consequently, many businesses declined to use Fable 5. As we reported in June, the ARC Prize Foundation also declined to run its verified tests of Fable 5 rather than expose its private test questions. Anthropic has since acknowledged the cost; in an August risk report it wrote that the rule would “be unpopular with customers who have come to expect zero retention” and could hurt its business if rivals didn’t do the same. OpenAI has not; its post reaffirmed zero retention.新闻背景：Anthropic 6 月份的规定强制要求对部分商业客户已有的 ZDR 合同进行例外处理。这些客户必须开启数据留存才能继续使用新模型。因此，许多企业拒绝使用 Fable 5。正如我们在 6 月报道的那样，ARC Prize 基金会也拒绝运行 Fable 5 的验证测试，以免暴露其私有的测试题目。Anthropic 此后承认了这一代价；在 8 月份的一份风险报告中，该公司写道，该规定会“令那些习惯了零留存的客户不满”，如果竞争对手不采取同样做法，可能会损害其业务。OpenAI 则未受此影响；其文章重申了零留存承诺。

Why it matters: Businesses are deciding now whether to trust these models with sensitive data based only on press releases. For regulated industries like law firms, hospitals, and banks, “we won’t train on your data” and “we don’t have your data” are different promises. Businesses also lack clarity on when Anthropic may change its definition of when someone is acting "unsafely" and may have their prompts — which often contain extremely sensitive data — read by Anthropic employees. And any data that can be found on a server can be compromised by an attacker or demanded by a court. Last year, in The New York Times’ copyright suit, a court ordered OpenAI to preserve chat logs it would normally have deleted, even ones users had erased. OpenAI said ZDR customers were unaffected because it never had their data. Whether logs held on a customer’s servers could be reached in a suit against the AI company is a question neither company has addressed. Neither has published an independent audit of its design.为何重要：企业目前仅凭新闻稿来决定是否将敏感数据托付给这些模型。对于法律事务所、医院和银行等受监管行业，“我们不会用您的数据进行训练”与“我们没有您的数据”是完全不同的承诺。企业对于 Anthropic 何时会改变对“不安全”行为的定义，以及何时会导致其提示词（通常包含极度敏感的数据）被 Anthropic 员工读取，也缺乏清晰的认知。此外，任何存储在服务器上的数据都可能被攻击者窃取，或被法院传唤。去年在《纽约时报》的版权诉讼中，法院命令 OpenAI 保留本应删除的聊天记录，即使是用户已经删除的记录也不例外。OpenAI 声称 ZDR 客户不受影响，因为其从未拥有过这些数据。但如果针对 AI 公司的诉讼要求获取存储在客户服务器上的日志，这一问题两家公司均未回应。且双方均未发布过针对其设计的独立审计报告。

We’re thinking: In 2024, we described four levels of cloud AI privacy, and the strongest, where the provider cannot access your data at all, is the level that matters most for sensitive work. This is especially true given loopholes that give frontier labs discretion to apply whatever standard they wish to define what is “safe.” We contrast this with the simple privacy policies of many hyperscalers, where rules are much clearer: We expect them not to look at our data unless a warrant, court order, or other more predictable legal process requires them to. Both companies now say they can preserve user privacy while still catching misuse across many requests. Neither has shown how. Until both of them publish their designs, that’s a roadmap, not a guarantee.我们的思考：2024 年，我们定义了云端 AI 隐私的四个级别，其中最强级别——即提供商完全无法访问用户数据——是处理敏感工作时最重要的标准。考虑到前沿实验室拥有自由裁量权，可以随意定义何为“安全”，这一点尤为重要。我们将其与许多超大规模云服务商简单的隐私政策进行了对比，后者的规则清晰得多：我们期望他们除非在搜查令、法院命令或其他更具可预测性的法律程序要求下，否则不会查看我们的数据。两家公司现在都声称可以在捕获跨请求滥用行为的同时保护用户隐私，但双方都未展示具体实现方式。在两家公司发布其设计方案之前，这还只是一个路线图，而非保证。