Deepfake - AI的兩面效應

在2017年，Reddit這個知名的娛樂、社交及新聞網站中的一位名為"deepfakes"的會員發佈了一個由AI合成的名人偽造視頻，從此開始這種AI合成技術被稱為Deepfake。Deepfake一詞由"Deep Learning"和"Fake"組合而成，它是一種利用人工智能深度學習模型的技術。其原理是通過兩個神經網絡相互對抗，經過交替優化訓練後，生成的內容可以與真實人物難以區分。

最初，Deepfake技術主要用於宣傳和創意用途，並且在大多數影片中，作者都會聲明其影片是假的。此外，Deepfake甚至被用於彌補原本無法實現的事情，其中最著名的應用是在好萊塢電影《玩命關頭7》和《星際大戰》中的主角保羅·沃克。沃克在拍攝期間意外身亡，他的角色由他的弟弟代替完成，然後使用Deepfake技術連接電影中的場景，最終使電影完成並上映。

然而，儘管這種技術表面上看起來無害且有著良好的意圖，但它卻帶來了許多法律問題和信息風險。隨著技術的發展，任何人都可以輕易製作假影片或假聲音，其中可能包含不良意圖。由於Deepfake可以模仿任何人的外貌和聲音，這意味著任何人，尤其是知名人士，都可能被放置在虛假的情境中，從而造成名譽損害。此外，Deepfake技術可能被濫用於政治操作、偽造新聞和商業領域，這些都可能成為其負面影響的例子。而最接近普通人的可能就是由Deepfake技術產生的詐騙。

由Deepfake產生的詐騙主要可以分為三種。首先是電話詐騙，主要是模仿親朋好友的聲音，以此來騙取金錢和個人信息。詐騙者不僅模仿聲音，還能模仿說話的語調、斷句和口音。其次是視訊詐騙，由於Deepfake技術可以合成影片和語音，這意味著你可能會接到看似是你認識的人打來的視訊通話。第三種是恐嚇詐騙，主要是通過合成不雅照片或影片來恐嚇並勒索當事人。

在接下來難辦真相的網絡世界中，Deepfake只是當今科技社會所面臨的一個問題，法律和社會規範應該如何跟上這一步？如何解決其中涉及的著作權和倫理問題？這些都是需要進行深入討論和驗證的重要課題。

尹展軒
Senior IT Consultant

More Updates

Whether you are travelling overseas, staying at a hotel, or working remotely while enjoying your vacation, there is one thing many of us rely on every day — 𝗵𝗼𝘁𝗲𝗹 𝗪𝗶-𝗙𝗶.After checking in, it is common to connect your laptop or phone to the hotel network without thinking twice. But have you ever wondered:“𝗖𝗮𝗻 𝗜 𝗿𝗲𝗮𝗹𝗹𝘆 𝘁𝗿𝘂𝘀𝘁 𝘁𝗵𝗶𝘀 𝗪𝗶-𝗙𝗶 𝗻𝗲𝘁𝘄𝗼𝗿𝗸?”Public Wi-Fi networks are convenient, but they can also become a target for attackers. A compromised hotel Wi-Fi gateway could potentially allow attackers to manipulate network traffic, redirect users to fake login pages, and steal sensitive information such as Microsoft 365 credentials.Some common risks include:🔹 Fake Wi-Fi login portals🔹 DNS redirection to malicious websites🔹 Credential harvesting through fake Microsoft 365 login pages🔹 Session hijacking attemptsA few simple steps can greatly reduce the risk:✅ Avoid accessing sensitive accounts on unknown networks✅ Use a trusted VPN when connecting through public Wi-Fi✅ Enable Multi-Factor Authentication (MFA)✅ Verify the website address before entering credentials✅ Avoid installing unexpected certificates or applications requested by public networks

𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗔𝗜 𝗗𝗼𝗲𝘀𝗻'𝘁 𝗦𝘁𝗮𝗿𝘁 𝘄𝗶𝘁𝗵 𝗔𝗜. 𝗜𝘁 𝗦𝘁𝗮𝗿𝘁𝘀 𝘄𝗶𝘁𝗵 𝗔𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲.

Every organisation is asking the same question today:"𝘏𝘰𝘸 𝘤𝘢𝘯 𝘸𝘦 𝘪𝘯𝘵𝘳𝘰𝘥𝘶𝘤𝘦 𝘈𝘐 𝘪𝘯𝘵𝘰 𝘰𝘶𝘳 𝘣𝘶𝘴𝘪𝘯𝘦𝘴𝘴?"But experienced solution architects often start somewhere else.They ask:"𝘐𝘴 𝘵𝘩𝘦 𝘣𝘶𝘴𝘪𝘯𝘦𝘴𝘴 𝘴𝘺𝘴𝘵𝘦𝘮 𝘥𝘦𝘴𝘪𝘨𝘯𝘦𝘥 𝘵𝘰 𝘴𝘶𝘱𝘱𝘰𝘳𝘵 𝘈𝘐 𝘧𝘳𝘰𝘮 𝘵𝘩𝘦 𝘣𝘦𝘨𝘪𝘯𝘯𝘪𝘯𝘨?"That's an important distinction.Modern enterprise platforms such as 𝗢𝘂𝘁𝗦𝘆𝘀𝘁𝗲𝗺𝘀 now make it possible to build applications, workflows, integrations and AI capabilities within a single development ecosystem.Adding AI is becoming easier than ever.Designing an application that allows AI to deliver reliable business value is the real challenge.Because AI does not work in isolation.It relies on the business systems behind it.Before AI can analyse information, automate decisions or assist users, it depends on a strong enterprise foundation:🔸 𝗖𝗹𝗲𝗮𝗿𝗹𝘆 𝗱𝗲𝗳𝗶𝗻𝗲𝗱 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗽𝗿𝗼𝗰𝗲𝘀𝘀𝗲𝘀🔸 𝗥𝗲𝗹𝗶𝗮𝗯𝗹𝗲 𝗮𝗻𝗱 𝗴𝗼𝘃𝗲𝗿𝗻𝗲𝗱 𝗱𝗮𝘁𝗮🔸 𝗪𝗲𝗹𝗹-𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝘀𝘆𝘀𝘁𝗲𝗺 𝗶𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗼𝗻𝘀🔸 𝗖𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝘁 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗿𝘂𝗹𝗲𝘀🔸 𝗔𝗽𝗽𝗿𝗼𝗽𝗿𝗶𝗮𝘁𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗮𝗰𝗰𝗲𝘀𝘀 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝘀These are not "AI features."They are architectural decisions.When these foundations are built into the application from Day One, AI becomes a natural extension of the business rather than an isolated feature.This is why successful enterprise AI projects don't begin with selecting an AI model.They begin with designing an application architecture that allows AI, data, workflows and enterprise systems to work together seamlessly.That's where enterprise low-code platforms like 𝗢𝘂𝘁𝗦𝘆𝘀𝘁𝗲𝗺𝘀 create long-term value.Not by simply making development faster.But by providing a platform where business applications can continuously evolve as new technologies—including AI—become part of the organisation's digital journey.Before asking:"𝘏𝘰𝘸 𝘥𝘰 𝘸𝘦 𝘢𝘥𝘥 𝘈𝘐 𝘵𝘰 𝘵𝘩𝘪𝘴 𝘢𝘱𝘱𝘭𝘪𝘤𝘢𝘵𝘪𝘰𝘯?"Perhaps the better question is:"𝘈𝘳𝘦 𝘸𝘦 𝘥𝘦𝘴𝘪𝘨𝘯𝘪𝘯𝘨 𝘢𝘯 𝘢𝘱𝘱𝘭𝘪𝘤𝘢𝘵𝘪𝘰𝘯 𝘵𝘩𝘢𝘵 𝘪𝘴 𝘳𝘦𝘢𝘥𝘺 𝘵𝘰 𝘦𝘷𝘰𝘭𝘷𝘦 𝘸𝘪𝘵𝘩 𝘈𝘐 𝘧𝘳𝘰𝘮 𝘋𝘢𝘺 𝘖𝘯𝘦?"Because successful enterprise AI isn't defined by the intelligence of the model.𝗜𝘁'𝘀 𝗲𝗻𝗮𝗯𝗹𝗲𝗱 𝗯𝘆 𝘁𝗵𝗲 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝗼𝗳 𝘁𝗵𝗲 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 𝗯𝗲𝗵𝗶𝗻𝗱 𝗶𝘁.

𝗦𝗲𝗰𝘂𝗿𝗶𝗻𝗴 𝘁𝗵𝗲 𝗖𝗹𝗼𝘂𝗱 𝘄𝗶𝘁𝗵 𝗜𝗦𝗢/𝗜𝗘𝗖 𝟮𝟳𝟬𝟬𝟭:𝟮𝟬𝟮𝟮

Cloud services have become the backbone of modern business, enabling organisations to operate with greater speed, flexibility, and scalability. However, moving to the cloud does 𝗻𝗼𝘁 transfer all security responsibilities to the cloud provider.Many cloud platforms operate under a 𝘀𝗵𝗮𝗿𝗲𝗱 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 𝗺𝗼𝗱𝗲𝗹, where organisations remain accountable for protecting their data, identities, and cloud configurations. That's why effective cloud security requires more than selecting a trusted provider—it demands clear governance, ongoing monitoring, and practical security controls.Here are three key areas organisations should focus on when securing their cloud environments:☁️ 𝟭. 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱 𝗬𝗼𝘂𝗿 𝗦𝗵𝗮𝗿𝗲𝗱 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆A strong cloud security strategy begins with clearly defining responsibilities between your organisation and the cloud service provider.・Clearly define security roles and responsibilities between both parties.・Review the provider's security certifications, whitepapers, and control documentation.・Establish Service Level Agreements (SLAs) covering availability, incident response, and security expectations.・Regularly evaluate the provider's security performance—not just during onboarding.🔐 𝟮. 𝗣𝗿𝗼𝘁𝗲𝗰𝘁 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗮𝗻𝗱 𝗗𝗮𝘁𝗮Protecting access and sensitive information remains one of the most critical aspects of cloud security.・Enforce strong authentication, including Multi-Factor Authentication (MFA).・Review user access regularly and remove unnecessary permissions.・Classify sensitive data before migrating it to cloud environments.・Encrypt data both in transit and at rest wherever possible.📊 𝟯. 𝗠𝗼𝗻𝗶𝘁𝗼𝗿 𝗮𝗻𝗱 𝗕𝘂𝗶𝗹𝗱 𝗥𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲Cloud security is an ongoing process that requires continuous visibility and preparedness.・Monitor cloud environments for unusual activities and configuration issues.・Ensure cloud-specific incident response procedures are clearly defined and tested.・Verify that backup processes are functioning correctly and can support recovery.・ Regularly test whether critical services can be restored within acceptable recovery timeframes.Cloud security is not a one-time project—it's an ongoing discipline built on 𝗰𝗹𝗲𝗮𝗿 𝗼𝘄𝗻𝗲𝗿𝘀𝗵𝗶𝗽, 𝗿𝗲𝗴𝘂𝗹𝗮𝗿 𝗿𝗲𝘃𝗶𝗲𝘄, 𝗮𝗻𝗱 𝗰𝗼𝗻𝘁𝗶𝗻𝘂𝗼𝘂𝘀 𝗶𝗺𝗽𝗿𝗼𝘃𝗲𝗺𝗲𝗻𝘁.𝗥𝗲𝗺𝗲𝗺𝗯𝗲𝗿: Moving to the cloud doesn't transfer your security responsibilities—it changes how they should be managed.ISO/IEC 27001:2022 provides organisations with a structured framework to manage cloud-related risks while supporting business growth and digital transformation.