Re: [MAINTAINERS SUMMIT] Annotating patches containing AI-assisted code

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Tue, 2025-09-16 at 11:39 +0200, Jiri Kosina wrote:
> On Mon, 15 Sep 2025, Kees Cook wrote:
> 
> > So, what I mean to say is it's certainly useful to declare "I used
> > a chisel", but that for long running sessions it becomes kind of
> > pointless to include much more than a general gist of what the
> > process was. This immediately gets at the "trust" part of this
> > thread making the mentioned "human understanding the generated
> > code" a central issue. How should that be expressed? Our existing
> > commit logs don't do a lot of "show your work" right now, but
> > rather focus on the why/what of a change, and less "how did
> > I write this". It's not strictly absent (some commit logs discuss
> > what alternatives were tried and eliminated, for example), but
> > we've tended to look only at final results and instead use trust in
> > contributors as a stand-in for "prove to me you understand what
> > you've changed".
> 
> Thanks, I understand your point.
> 
> I, however, don't think I as a maintainer care at all whether the
> patch has been "assisted by" some LLM when it comes to proposing
> testing scanarios and testcases, managing the testing results, yada
> yada yada.

I think historians might care to have this record, so from that point
of view it might be useful to preserve but ...

> If the patch author wishes to express that in one way or the other,
> just a freetext form in the commit log is completely fine for me.
> 
> I don't think we care about that aspect direcly neither from
> "maintainer workflow" nor legal perspectives (IANAL, of course).

From the legal point of view we have to remember that copyright only
protects expression, not ideas.  So if AI gave you the idea, in the
same way as going to a conference or reading about it in a paper, but
you wrote the code, the copyright is all yours and nothing needs
recording in the signoff chain.  It's only if some of the actual
expression the AI gave made its way into the commit that we'd need it
documenting in the signoff chain.

> But we do (or should, I believe) care about the actual submitted code
> having been produced by it, for both of the the reasons above.

I agree with you in principle (as outlined above).  However, in
practice there is a legal grey area over what constitutes original
expression vs copying.  For example, if you're asking AI about finding
say a memory region and it advises you to use a sort and recommends
quicksort, that's not copying because it never produced any code
(expression) and only contributed ideas.  However, if as part of this
back and forth AI produced quicksort code which you implemented in a
substantially similar way in the kernel several weeks later, there
would be an argument to be made that it was copying not original
expression.  In that latter case it would be helpful later to have a
contemporaneous record that AI produced some code which the patch
author looked at but then implemented their own separate version. 
Putting this in the commit log would seem to be an ideal place to
preserve it.

Regards,

James