Google Gemini routes personal Drive files and emails to human annotators
737 points
• 3 days ago
• Article
Link
当 Google 在 2023 年首次推出 Gemini Workspace extensions 时，公司明确承诺：从 Gmail 、 Docs 和 Drive 检索到的个人内容不会被人工审核员查看。然而，Google 已悄悄改变了这一立场。近期对官方支持文档的更新，以及对其 2023 年原始公告的细微修改，已证实：通过这些 extensions 连接的数据确实会被路由到人工审核流程中。 Google 还明确告诫用户，如果他们的应用包含机密信息，而这些信息是他们希望避免被人眼看到的，那么就不要连接这些应用。
这种数据摄取方式尤其令人担忧，因为它会在日常的后台对话中自动发生，而不需要像 @Drive 或 @Gmail 这类明确的用户提示。由于底层的大语言模型工具调用和上下文注入本身具有概率性，单次测试未必能暴露真实行为。具体取决于系统如何解析请求，它可能选择零检索、只给出通用的元数据摘要，提取包含敏感个人身份信息的未脱敏部分引文，甚至直接执行全文件摄取——把完整文档喂入会话上下文。
想要验证这一行为的用户，不能只做一次测试。因为系统是非确定性的，用户需要删除对话历史并反复提交相同问题，才能观察到不同的结果。研究人员通过要求模型打印其检索工具返回的精确文本和元数据，发现过模型会暴露完整的账号、确认细节以及个人交易数据，甚至可能把一封电子邮件的全文内容连同标头一起转储出来。
这些结果凸显了数据保护上的巨大漏洞。 Google 的自动清理机制往往难以有效对叙述性数据进行去标识化，例如姓名、地点和事件细节的组合——这些信息叠加起来足以指向某个人。归根结底，这种变化意味着对最初"严格隔离"的承诺的背离。用户如今需要正视这样的现实：他们的私人文件和电子邮件可能会因为随口一问就被拉入会话，随后又被交由人工承包商进行审查。
When Google first introduced Gemini Workspace extensions in 2023, the company explicitly promised that personal content retrieved from Gmail, Docs, and Drive would not be seen by human reviewers. However, Google has quietly reversed this stance. Recent updates to official support documentation and a subtle edit to their original 2023 announcement now confirm that data connected through these extensions is indeed routed into human review pipelines. Google explicitly warns users against connecting their apps if they contain confidential information that they would prefer to keep hidden from human eyes.
The ingestion process is particularly concerning because it occurs autonomously during casual background conversations, rather than requiring explicit user prompts like @Drive or @Gmail tags. Because the underlying large language model tool-calling and context injection are probabilistic, a single test might not reveal the behavior. Depending on how the system resolves a query, it may opt for zero retrieval, provide a generic metadata summary, extract partial unredacted quotations containing sensitive personally identifiable information, or perform a full-file ingestion where the complete document is fed into the session context.
For users attempting to verify this behavior, simply testing once is insufficient. Because the system is nondeterministic, one must delete their conversation history and repeat queries to observe the varying outcomes. By asking the model to print the exact text and metadata returned by its retrieval tool, researchers have observed instances where the model exposes full account numbers, confirmation details, and personal transaction data, or even the entire text dump of an email including its headers.
These findings highlight a significant gap in data protection. Google's automated scrubbers often struggle to effectively deidentify narrative data, such as combinations of names, locations, and event details that collectively identify an individual. Ultimately, the shift represents a departure from the original guarantee of strict isolation. Users now face a reality where their private files and emails can be pulled into a session through casual interaction, subsequently exposing that data to human contractors for review.
148 comments • Comments Link
• Consumer Gemini 的"Connected Apps"功能带来显著的隐私风险：从个人的 Gmail 或 Drive 帐户读取到的数据，可能会被汇入人工标注与训练流程中。
• Google 的 AI 工具在 Enterprise 和 Workspace 版本中仍保持更严格的数据策略，但由于产品设计存在模糊地带，用户容易产生疑惑，进而削弱了企业用户之间的信任。
• 用户反映，系统中持续且不透明的提示让他们在被要求授权"Connected Apps"时感到压力；同时，他们也对缺乏针对单个文件或具体服务的清晰、细粒度授权机制不满。
• 将 Google Photos 、 Drive 等平台上的个人数据汇总用于训练生成式 AI，引发担忧：AI 模型可能把推断出来、生成出来或本就敏感的关联当作客观事实。
• 不少用户正在主动从 Google 服务迁移到诸如用于照片的 Immich 、用于存储的 Nextcloud 等自托管替代方案，原因是他们对 Google 隐私做法的信心已出现根本性崩塌。
• 对许多人来说，自托管电子邮件依然是一项复杂且高风险的任务；更稳妥的做法是保留自托管前端，同时把发送环节交给成熟的服务商，以避免交付能力和正常运行时间方面的问题。
• 虽然有人认为市场竞争和新进入者能阻止垄断行为，但也有人指出，前沿 AI 的资本密集型特征形成了一道"利润护城河"，从而限制有意义的替代方案。
• 行业内对人类审查员来改进 AI 模型的依赖，与用户隐私之间存在天然矛盾：敏感的个人互动往往会被标记出来接受人工分析，而且缺乏明确、易于找到的退出选项。
• 越来越多的人开始质疑打着"AI 竞赛"旗号所做的取舍——为了满足现代模型对数据的贪婪需求，隐私与质量被迫让步。
• 借助不可变构建（immutable builds）、 gVisor 隔离以及多重签名等更高级的自托管安全配置，说明对于有时间和专业能力去落地的人来说，技术上完全存在高度安全、私密的替代方案。
向 AI 集成的生产力工具转型，进一步加剧了人们对数字隐私被侵蚀的担忧，尤其是在面向消费者的服务越来越多地接触私人通信与文档时。尽管官方政策会区分消费者数据与企业数据处理，但由于这些流程的透明度不足，普遍的不信任情绪由此滋生，并促使部分用户转向自托管基础设施。这种变化凸显了中心化"智能"云生态系统所提供的便利性，与个人数据主权可控之间的鸿沟不断扩大。归根结底，这场讨论也反映出人们对大型科技公司当前发展路径的普遍疲惫：推动 AI 功能的"必要性"往往以长期隐私与数据安全为代价。 • Consumer Gemini's "Connected Apps" feature creates significant privacy risks, as data fetched from personal Gmail or Drive accounts can be funneled into human annotation and training pipelines.
• Enterprise and Workspace versions of Google's AI tools maintain stricter data policies, but the ambiguity in product design causes confusion and undermines trust among business users.
• Users report feeling pressured by persistent, opaque prompts to authorize "Connected Apps," leading to frustration over the lack of clear, granular consent mechanisms for individual files or services.
• The aggregation of personal data across platforms like Google Photos and Drive to train generative AI creates fears that AI models will treat inferred, generated, or sensitive associations as objective fact.
• Many users are actively migrating away from Google services toward self-hosted alternatives like Immich for photos and Nextcloud for storage, citing a fundamental loss of confidence in Google's privacy practices.
• Self-hosting email remains a complex and risky endeavor for many, with recommendations to maintain a self-hosted front end while delegating delivery to established providers to avoid deliverability and uptime issues.
• While some argue that market competition and new entrants prevent monopolistic behavior, others contend that the capital-intensive nature of frontier AI creates a "profit moat" that restricts meaningful alternatives.
• The industry-wide reliance on human reviewers to improve AI models creates a inherent conflict with user privacy, as sensitive personal interactions are often flagged for human analysis without explicit, easy-to-find opt-outs.
• There is a growing cynicism regarding the trade-offs made in the name of the "AI race," where privacy and quality are sacrificed to satisfy the insatiable data requirements of modern models.
• Advanced self-hosting setups utilizing immutable builds, gVisor isolation, and multi-signature security demonstrate that highly secure, private alternatives are technically feasible for those with the time and expertise to implement them.
The transition toward AI-integrated productivity tools has accelerated concerns over the erosion of digital privacy, particularly as consumer-facing services increasingly process private correspondence and documents. While official policies distinguish between consumer and enterprise data handling, the perceived opacity of these processes leads to widespread mistrust, driving a subset of users toward self-hosted infrastructure. This shift highlights a deepening divide between the convenience of centralized, "smart" cloud ecosystems and the desire for sovereign control over personal data. Ultimately, the discussion reflects a broader exhaustion with the current trajectory of big tech, where the necessity of adopting AI features often comes at the cost of long-term privacy and data security.