[Discuss] Guidance on AI-generated code

[andrross]

I would like to discuss the use of AI-generated code in the OpenSearch Project. The guidance from LF is quite general. ASF is a little more prescriptive. Both are linked below. Is there any project-specific guidance we should explore for the OpenSearch Software Foundation?

Linux Foundation Policy: https://www.linuxfoundation.org/legal/generative-ai
Apache Software Foundation: https://www.apache.org/legal/generative-tooling.html

[oberkem]

If any pre-existing copyrighted materials (including pre-existing open source code) authored or owned by third parties are included in the AI tool’s output, prior to contributing such output to the project, the Contributor should confirm that they have have permission from the third party owners–such as the form of an open source license

Having a contributor confirm/catch copyrighted materials or output that might have been taken from APGL license repository would be best intentions rather than a mechanism. Should we use ai code detectors in PR reviews to highlight such contributions?

[KarstenSchnitter]

We should be careful with documentation and Dashboards content. It is likely, that LLMs have been trained on Elasticsearch documentation and might add content from that sources. It would be nice to sensitise the maintainers about this topic.

[krisfreedain]

A few more examples from other projects that may be worth reading through / consideration:

https://github.com/chaoss/wg-ai-alignment/tree/main/moderation#project-ai-policies

[peterzhuamazon]

After discussing with LF POC the recommendations is to have TSC making a decision on this.

One approach I have seen is to follow something similar to @krisfreedain posting, while also let authors disclose their usage of AI by adding AI as co-author in commit msgs: Co-Authored-By: Claude <noreply@anthropic.com>.

We should also suggest users making PRs in parts, instead of dumping a huge chunk of low quality changes which will both consume a lot of time and energy from the maintainers. Thanks.

[andrross]

while also let authors disclose their usage of AI by adding AI as co-author in commit msgs: Co-Authored-By: Claude noreply@anthropic.com.

@peterzhuamazon My concern here is that this will just add more work on maintainers. The average contributor will probably not add this tag, so then if we want to enforce it the maintainers will have to make a judgment call and ask contributors if they should add this tag. Also, what if coderabbitai gives me a good suggestion? Do I then need to add this tag? Honestly I think AI-assisted code is probably already the norm.

We should also suggest users making PRs in parts, instead of dumping a huge chunk of low quality changes

This isn't a new problem, though maybe AI coding tools might make it worse. If I see a huge PR I will ask for it to be broken up without even reviewing all the code.

[krisfreedain]

Another example from Ghostty for the TSC to consider: ghostty-org/ghostty#10412
(the text of the PR is a little harsh sounding but the AI_Policy.md file has pieces to consider.

[epugh]

Instead of worrying about if the code was AI generated or not, is there anyway to score or other evaluate a PR for "Ability to review and merge it" that would help a contributor get a sense of if their contribution will make it in? AI generated or "here is my massive dump of internal code", they both have the same challenge of how does a busy maintainer digest it...

[peterzhuamazon]

Hi @epugh / @krisfreedain ,

We recently onboard the code-diff-analyzer to OS core (will later expand to other repos).

• Detect malicious code (live) with example here: [TEST ONLY] Update test and build.gradle to be better OpenSearch#20596
• Review PR (pending, to replace coderabbitai)

It already has a functionality to block PRs with large diff, therefore, effectively block a massive dump of AI slop for the time being. If needed, we can also add a potential third function to verify if the code is written solely by AI, similar to GPTzero or other AI detection tools.

However, we do need a clear rule regarding how we handle any changes involving AI, either by assisting, or completely relying on AI to write everything, such that:

• Either accept the changes if reasonable size/quality and author clearly state the use of AI
• Or Block the PR if diff too large, or AI detection percentage over a certain threshold.

Let me know what you think.

Thanks.

[peterzhuamazon]

Will also try to integrate this into code diff analyzer as well: https://github.com/peakoss/anti-slop

[getsaurabh02]

Great to see the integration kicking in @peterzhuamazon . Here is the PR with sample analysis: opensearch-project/OpenSearch#20695

@mishail also shared few ideas offline. Lets use this issue to brainstorm more and gather ideas.