Sociotechnical Safety Evaluation of Generative AI Systems

• A two-minute read focuses on figure 2.1’s three-layered evaluation framework and figures 3.1–3’s depiction of current safety evaluations.Source: Reader’s guide · p. 5
• A ten-minute read adds the abstract and section 2 while retaining figures 3.1–3 as the visual overview of current safety evaluations.Source: Reader’s guide · p. 5
• Evaluators should prioritize sections 2–4 and the misinformation case study, then consult the discussion on responsible innovation and evaluation-method limitations.Source: Reader’s guide · p. 5
• People steering AI labs should review the framework, evaluation gaps, actor roles and responsibilities, methodological limitations, and misinformation case study.Source: Reader’s guide · p. 5
• Public policy makers should focus on the framework, the current state of evaluation, and roles and responsibilities, while AI researchers should also consider concrete ways forward, limitations, and implications.Source: Reader’s guide · p. 5

Motivation

• As generative AI becomes widely used and embedded in domains including medicine, news, politics, and companionship, evaluating potential harms becomes an increasingly pressing public-safety priority.The need for evaluation follows from identified risks and observed harms, with responsibilities distributed across developers, policymakers, regulators, and civil society.Source: §1 · p. 6

Evaluation

• Safety evaluation measures risks of harm or actualised impacts through exploratory or directed methods, while requiring technical and normative choices about targets, metrics, and acceptable performance.Evaluation results are judged against normative baselines such as whether a system is good, fair, or safe enough.Source: §1 · p. 6
• Evaluation can reduce opacity, illuminate and quantify potential downstream harms, guide development and deployment, and provide a foundation for accountability.It can also surface factors and mechanisms influencing whether downstream harm occurs and reveal normative trade-offs in real-world settings.Source: §1 · p. 7

Contributions

• The paper’s two main contributions are a sociotechnical framework for safety evaluation and an empirical review of the current evaluation landscape, including a repository of existing evaluations.The authors also analyse gaps, propose practical steps and stakeholder responsibilities, and discuss how disparate safety communities can intersect.Source: §1 · p. 7

Motivation

• Current safety evaluations are heterogeneous and ad hoc, making them difficult to compare and reproduce and potentially leaving important risks unassessed.The paper argues that more systematic and standardised evaluation is needed for meaningful, comparable, and comprehensive safety assessment.Source: §1 · p. 7

Framework

• The framework adds human interaction and systemic impacts to capability evaluations, progressively incorporating context across three evaluation layers.The three layers are the capability layer, human interaction layer, and systemic impact layer.Source: §1 · p. 7

2. Framework for sociotechnical AI safety evaluation

• The three-layer framework progressively adds context to capability evaluation, integrating human interaction and systemic impacts to assess whether capabilities relate to actual harms.The layers are not sequential, dependent, or ordered by importance; integrating their results supports comprehensive safety evaluation.Source: §2 · pp. 8–9, §2.4 · p. 12

2.3. Layer 3: Systemic impact

• The layers interact through gradual boundaries and feedback loops, while systemic impacts remain difficult to assess because the evaluated systems are complex, noisy, and idiosyncratic.Forecasts and comparable technologies can provide initial insights before direct impacts are observable after deployment.Source: §2 · pp. 8–9, §2.3 · p. 12

2.1. Layer 1: Capability

• Capability evaluation tests technical components, processes, outputs, and performance across tasks, groups, languages, or domains as early indicators of potential downstream harm.It can examine training-data representativeness and sensitive information, learned associations, safety filters, environmental-efficiency metrics, and adversarially probed behavior.Source: §2.1 · p. 9
• Capability evaluation is necessary but insufficient because determining whether a capability causes harm requires context about users, purposes, and circumstances.Technical filters can also disproportionately remove content from some groups and aggravate representation harms.Source: §2.1 · p. 9

2.2. Layer 2: Human interaction

• Human-interaction evaluation assesses usability, externalities, and the human–AI dyad in real-world contexts, including how safety varies across users and uses.It can study overreliance, overtrust, malicious usability, longitudinal effects, annotator harms, modality differences, and the quality of human–AI outcomes.Source: §2.2 · pp. 9–11

2.3. Layer 3: Systemic impact

• Systemic-impact evaluation examines effects on society, the economy, and the natural environment that may emerge only at scale or become salient across broader systems.It can assess labour markets, productivity, public goods, institutions, distribution of benefits and risks, local care and environmental effects, and intersecting social, economic, and ecological factors.Source: §2.3 · pp. 11–12

3.1. Taxonomy of harm

• The survey aggregates prior literature into six harm areas: representation and toxicity, misinformation, information and safety, malicious use, human autonomy and integrity, and socioeconomic and environmental harms.The taxonomy includes both established harms and emerging risks and provides a basis for mapping safety evaluations.Source: §3.1 · pp. 12–13

3.1.1. Multimodality raises new evaluation challenges

• Multimodal systems can express harms differently across modalities and through compositional outputs, requiring context-sensitive evaluations that assess modalities together.Text underspecification, modality-specific stereotypes, and harmful combinations such as captions paired with images motivate holistic cross-modal evaluation.Source: §3.1.1 · p. 13

3.2. Mapping the landscape

• The review codes evaluations by output modality, harm area, and framework layer, and releases an open repository summarized in an overview figure.Included evaluations had to define an evaluation and report its application to a generative AI system.Source: §3.2 · p. 13

3.2.1. Limitations

• The mapping is not comprehensive because it codes output rather than input modality and captures a time-limited snapshot that may later become a living resource.Future mappings could distinguish cases such as image-to-text from text-to-text evaluations.Source: §3.2.1 · pp. 13–14

3.3. Evaluation gaps

• Evaluations show three gaps: insufficient risk coverage, rare human-interaction and systemic evaluations, and missing multimodal evaluations.Coverage is particularly weak for information and safety, human autonomy and integrity, and socioeconomic and environmental harms.Source: §3.3 · p. 14
• Most evaluations target text output and capability, while audio, video, and multimodal evaluations remain scarce despite modality-specific and compound harms.The review found four publicly documented audio evaluations and none targeting video; capability evaluation must be complemented by human-interaction and systemic analyses.Source: §3.3 · pp. 15–16, Figure 3.3 · p. 16

4.1. Operationalising risks

• Safety evaluation requires selecting a target, operationalising it into measurable metrics, obtaining measurements, and judging outcomes across all three evaluation layers.Operationalisation maps latent harms to observable metrics, but different aspects of a risk may require different metrics at each layer.Source: §4.1 · p. 17

4.1.1. Ensuring validity

• Narrow or poorly grounded operationalisations can produce invalid measurements, so evaluations should document limitations, incorporate diverse perspectives, cross-validate measures, and preserve interpretability.The paper highlights failures in which metrics included innocuous examples or captured only part of a complex harm, undermining internal or external validity.Source: §4.1.1 · pp. 18–19

4.2. Selecting evaluation methods

• Evaluation methods should match the layer: benchmarks, human annotation, and adversarial testing assess capabilities; behavioural experiments, user research, monitoring, and longitudinal mixed methods assess human interaction; pilots, impact assessments, forecasts, and simulations assess systemic effects.Human-interaction evaluation requires participants, while systemic methods target emergent effects in institutions, societies, economies, and environments.Source: §4.2.1 · p. 19, §4.2.2 · p. 19, §4.2.3 · p. 20

4.3.1. Repurposing evaluations for new modalities

• Existing evaluations can be repurposed or refined for new modalities, but reuse must account for provenance, context, purpose, and the norms embedded in the original evaluation.Because harms are contextual, applying tools outside their intended setting can create validity problems and may cause more harm than good.Source: §4.3.1 · pp. 20–21

4.3.2. Transcribing non-text output for text-based evaluation

• Transcribing images, audio, or video into text offers a tractable first step for applying text-based evaluations, but translation can lose modality-specific information and introduce systematic errors that require quality checks and direct evaluation.Prosody, voice appropriation, defamation, and biased image captioning may evade or distort text-based harm analysis.Source: §4.3.2 · p. 21

4.3.3. Model-driven evaluation may fill gaps

• Model-driven evaluations can rapidly generate adversarial prompts and critique outputs across novel risks and modalities, but their robustness, reproducibility, accessibility, bias, scope, and cross-validation remain unresolved.They primarily address unsafe outputs rather than omissions or uneven performance, and should be grounded by comparison with human or established evaluations.Source: §4.3.3 · pp. 21–22

5.1. Benefits of a sociotechnical approach

• A three-layered sociotechnical framework is needed because technical evaluations alone cannot capture context-dependent harms emerging across technical, human, and structural factors.The framework evaluates capability, human interaction, and systemic impacts, making sociotechnical safety evaluation both needed and tractable.Source: §5.1 · p. 22

5.2. Roles and responsibilities

• Responsibilities for evaluation are shared across AI developers, application developers, public actors, and civil society, with primary responsibility depending on expertise, access, and the evaluation layer.Model developers are primarily responsible for system capabilities; application developers are well placed to assess human interaction and use data for systemic impacts; third parties often lead systemic-impact evaluation.Source: §5.2 · pp. 22–23, Figure 5.1 · p. 23

5.3. Limits of evaluation

• Evaluations are not a panacea: they cover only selected risks, may miss unknown or context-specific failure modes, and cannot detect every potential harm.General-purpose systems make relevant contexts difficult to identify, while some harms are difficult, inappropriate, or disproportionate to operationalise and measure.Source: §5.3 · p. 24, §5.3.1 · pp. 24–25

5.3.1. Evaluation is incomplete

• Because evaluation is incomplete, safety requires hypothetical high-risk use-case testing alongside real-world monitoring, incident logging, recourse, adaptable systems, and governance that can delay, stop, or suspend deployment.Pre-deployment evaluation cannot replace downstream evaluation of actual use cases, and organisations need infrastructure to respond to detected risks.Source: §5.3.1 · pp. 24–25

5.3.2. Evaluation is never value-neutral

• Evaluations are value-laden choices about which harms, metrics, thresholds, and perspectives to prioritise, so affected communities and legitimate, accountable processes must shape them.Thresholds may differ across applications and contexts, while excluding affected communities can obscure impacts; inclusion must nevertheless avoid objectification and exploitation.Source: §5.3.2 · pp. 25–26

5.4. Steps forward

• Impactful evaluation requires relevant evaluations to exist, be conducted regularly, have meaningful consequences, and become increasingly standardised and independent.The discussion identifies these four conditions as requirements for evaluation to produce safety benefits.Source: §5.4 · p. 27

5.4.1. Evaluations must be developed where they do not yet exist

• The evaluation toolkit must expand before increasingly capable multimodal systems are released, because current evaluations are often ad hoc and too late to prevent harm.Evaluations should begin during system planning, using early indicators from training data or small pretrained models to inform consequential development decisions.Source: §5.4.1 · p. 27, §5.4.2 · p. 27

5.4.2. Evaluations must be done as a matter of course

• Evaluation should occur throughout the AI lifecycle using mixed methods, while assurance evaluations remain meaningfully separated from development to preserve validity.Early evaluation can shape development, later evaluation provides more accurate information, and high-frequency automated tests cannot capture complex real-world harms alone.Source: §5.4.2 · pp. 27–28

5.4.4. Evaluations must be done systematically, in standardised ways

• Safety evaluations should be standardised and systematic, combining developer testing with comparable, verifiable, independent evaluations for accountability and reliable assurance.Independent evaluations should be validity-tested, meaningful for real-world applications, updated as systems change, and withheld from developers when necessary to prevent them becoming de facto targets.Source: §5.4.4 · p. 28

5.4.5. Toward a shared framework for AI safety

• Generative AI’s converging risk domains require a shared sociotechnical framework to coordinate research communities and evaluate existing and emerging risks together.Risks are conditional on technological capability and dynamic over time, so evaluations should remain grounded in systems’ developmental paths while considering both current risks and future capabilities.Source: §5.4.5 · p. 29

• The three-layered framework expands generative AI safety evaluation beyond capability testing to include the context of use and broader impacts on embedded structures.This establishes the paper’s central sociotechnical contribution.Source: §6 · p. 29
• The survey identifies significant gaps involving specific risk areas, non-text modalities, and evaluations of human and broader systemic context.These gaps define priorities for improving sociotechnical evaluation.Source: §6 · p. 29
• The paper provides a pragmatic roadmap by surveying available methods, extending existing evaluations, and outlining sociotechnical evaluation visions for misinformation, representation risks, and dangerous information.It also reviews evaluation limits and normative considerations while proposing a practical and tractable way forward.Source: §6 · p. 29

A.1. Taxonomy of harm

• Representation and toxicity harms include unfairly representing identities or perspectives, producing toxic content, and generating gruesome, abusive, or hateful imagery.Examples include generating more female-looking individuals for “nurse” prompts *, lower-quality outputs for non-English prompts *, and child abuse imagery *.Source: §A.1 · p. 30
• Misinformation and information-ecosystem harms involve generating or spreading false content, causing panic, eroding trust, and contaminating public knowledge.Examples include a synthetic nuclear-explosion video prompting mass panic *, dismissal of real audiovisual evidence as synthetic ±; *; *, and inaccurate content entering Wikimedia (Huang and Siddarth, 2023)±.Source: §A.1 · p. 30
• Information and safety harms include privacy infringement and dissemination of hazardous or sensitive information that could pose security threats.Examples include leaking payment and credit-card information * and generating information on creating a novel biohazard ±.Source: §A.1 · p. 30
• Malicious-use harms cover influence operations, fraud, defamation, and security threats, including election manipulation, impersonation scams, false accusations, and cyberattacks.Examples include false news sites influencing elections *; *, voice impersonation for scams *; *, and code for hacking government systems (Shevlane et al., 2023)±.Source: §A.1 · pp. 30–31
• Human autonomy and integrity harms include coercive influence, personalized persuasion toward self-harm *, emotional or material dependence on models, and skill atrophy from excessive model use ±.Source: §A.1 · p. 31
• Socioeconomic and environmental harms include unfairly distributed model-access benefits due to hardware, software, skills, or deployment contexts, negative environmental impacts, inequality and precarity, lower pay for creative professionals, and weakened creative economies.Examples include better hiring and promotion pathways for people with access to generative AI models ± and increased net carbon emissions from widespread model use (Patterson et al., 2021)±.Source: §A.1 · p. 31
• The taxonomy also identifies harms to creative production, including aesthetic homogenization, replacement of original works, reduced human innovation, and exploitative labor practices.AI-generated artefacts may homogenize aesthetic styles ±, while synthetic works can hinder human creativity and development can perpetuate exploitative sourcing and user-testing practices.Source: §A.1 · p. 31
• Examples marked (*) are real-world examples, whereas examples marked (±) are hypothetical and indicate anticipated risks.This notation defines how the taxonomy distinguishes observed cases from prospective harms.Source: §A.1 · p. 31

A.2.1. Capabilities layer

• Human annotation is generally treated as ground truth because judgments about offensive, misleading, or otherwise harmful outputs depend on human expertise and perspective.However, annotation is costly and time-intensive, can expose workers to harm, and often relies on precarious labor or difficult-to-source expertise.Source: §A.2.1 · p. 32
• Annotated evaluations can be biased or unreliable when annotator pools are unrepresentative, incentives reduce quality, interfaces are poorly designed, or aggregation suppresses minority disagreement.Disclosing annotator demographics and using equitable pay, attention checks, quality thresholds, and careful task design can mitigate these concerns.Source: §A.2.1 · p. 32
• Benchmarking is the most common capabilities-layer method, measuring model performance on predefined tasks with clear intended outcomes.Benchmarks can target known failures, technical metrics, and ethical or social risks.Source: §A.2.1 · p. 33
• Benchmarks enable test-retest reliability, frequent progress tracking, and cross-model comparisons, making them suitable for repeated evaluation despite computational and financial costs.They can also guide model development and responsible decision-making, but evaluations used for hill-climbing may be vulnerable to Goodhart’s Law.Source: §A.2.1 · p. 33
• Benchmarks may be too narrow, biased, poorly documented, or context-insensitive, producing incompatible results and masking subgroup disparities when scores are aggregated.Dynamic benchmarks, test suites, and model-based evaluators offer flexibility, but model-based evaluation still risks reproducing harms that the evaluating models cannot recognize.Source: §A.2.1 · p. 34
• Benchmark results have limited external validity, especially when human-cognition tests assume properties such as embodiment, memory, or learning capacities that may not hold for AI systems.Such tests can also be distorted by memorisation, while benchmark testing alone may miss emergent capabilities and failure modes that appear as systems scale.Source: §A.2.1 · pp. 33–35
• Adversarial testing and open-ended probing surface exploitable vulnerabilities, unexpected risks, and response patterns, but their effectiveness depends on prober skill and imagination.Open-ended probing is useful for generating leads for directed evaluation, whereas automated red teaming remains lower quality than human testing and novel failures often emerge after public release.Source: §A.2.1 · p. 35

Behavioural experiments

• Behavioural experiments use psychology, human–computer interaction, and behavioural economics methods to isolate mechanisms or outcomes through which AI interactions may cause harm.They can study general-purpose technologies before specific application domains or product designs are defined.Source: §A.2.2 · pp. 35–36

Limitations

• Controlled experiments trade causal-mechanism insight against real-world generalisability, while small or unrepresentative samples may miss small effects or misrepresent populations.These studies are also time-, labour-, and cost-intensive, may expose participants to harm, and require specialised experimental, interface, and ethical-review expertise.Source: §A.2.2 · p. 36

User research and usability testing

• User research and usability testing evaluate user needs, behaviours, functionality, and externalities in controlled environments or real-world settings using experiments, interviews, talk-out-loud studies, and surveys.Application-specific user testing can assess subgroup differences, unexpected safety hazards, design effects through A/B tests, and risks across user journeys, including malicious use.Source: §A.2.2 · p. 36

Passive monitoring of human use

• Passive monitoring observes when, why, and how people use AI systems and can reveal interaction effects, longer-term effects, and risk trajectories during pilots or deployment.Combining monitoring with interviews, talk-out-loud studies, surveys, quasi-experimental analysis, active interventions, or longitudinal data can triangulate how users experience unintended externalities and relationship-building with AI.Source: §A.2.2 · pp. 36–37

Limitations

• Passive monitoring rarely isolates causal effects because it lacks direct intervention, so controlled experimental testing may still be needed to evaluate harmful impacts.User studies also lack established public precedents for comparing AI systems, and testing may receive less ethics scrutiny than psychology experiments despite potential effects on well-being.Source: §A.2.2 · pp. 36–37

Staged release and pilot studies

• Staged releases and pilot studies use controlled deployment, monitoring, ethnography, human–AI experiments, and RCTs to identify systemic impacts in real-world settings.They can reveal institutional effects such as amplified discrimination and isolate outcomes including productivity, co-writing impacts, and developer productivity or happiness.Source: §A.2.3 · pp. 37–38
• Staged releases and pilots may not generalise beyond local contexts, can miss equilibrium effects, and may themselves create safety concerns or disruption during deployment.Ethnographic studies can cause discomfort for institutions, while small-scale experiments may identify effects negated by large-scale adoption.Source: §A.2.3 · p. 38

Impact assessments

• Impact assessments examine prospective risks or retrospective indicators across economic, environmental, and social structures, using observational data, expert views, incident patterns, and case studies.They can assess effects on employment, inequality, the distribution of impacts across worker groups, the creative commons, and job automation.Source: §A.2.3 · p. 38
• Impact assessments often struggle to establish causal evidence because they rely on qualitative or observational data about complex, prolonged processes, while ex-post evidence may arrive too late to prevent harm or technological lock-in.Natural experiments can help but require strong assumptions and restrict the range of feasible studies; upstream forecasts and experiments can partly address the timing gap.Source: §A.2.3 · p. 38

Forecasts and simulations

• Forecasts and simulations map anticipated capabilities to tasks, use comparative technologies or cautious analogies, and estimate potential downstream effects on jobs and labour markets.Their results depend on ambiguous choices about how capabilities are defined and quantified, and exposure does not by itself determine whether impacts will be beneficial or harmful without deployment-context assumptions or ex-post analysis.Source: §A.2.3 · p. 39

A.3. Case study: Misinformation

• Multimodal AI systems can generate realistic but false or misleading content, either unintentionally as confabulations or intentionally within disinformation campaigns.Misinformation is false, inaccurate, or misleading information often spread unintentionally, whereas disinformation is created with explicit intent to deceive or cause harm.Source: §A.3 · p. 39
• The harms of generated misinformation are context-dependent: harmless creative uses contrast with high-stakes risks when people act on false beliefs, especially because synthetic content can be difficult to distinguish from human-created content.Audiovisual misinformation is perceived as more credible and spreads faster than text-based misinformation; an AI-generated Pentagon image briefly contributed to a stock-market drop after false news reports.Source: §A.3 · p. 39
• AI-generated misinformation may erode trust in evidence and established information sources, contaminate shared knowledge commons, and make genuine audiovisual evidence easier to dismiss as fake.These effects could undermine the quality, legitimacy, and authentication of shared public knowledge.Source: §A.3 · pp. 39–40
• Comprehensive evaluation of misinformation harms should measure different concepts across all three sociotechnical layers, using intermediate constructs such as factuality to connect broad harms with concrete metrics.Identifying narrower concepts between latent harms and measures such as FID scores can clarify which risk areas an evaluation addresses.Source: §A.3 · p. 40

Capability

• Factuality evaluations use benchmarks, automatic verification, source attribution, and human annotation to assess whether outputs are accurate or confabulatory, but most focus on text.Human assessment is laborious, depends on raters’ knowledge and available evidence, may overlook source trustworthiness, and can become outdated as knowledge changes.Source: §A.3.1 · p. 40
• Multimodal factuality evaluation remains constrained by sparse, outdated verification datasets, while alignment metrics are too general to detect AI-generated audiovisual content.Existing resources include Fakeddit, Factify, Fake2M, APTLY, and FakeAVCeleb, but large, up-to-date multimodal verification datasets remain a major roadblock.Source: §A.3.1 · pp. 40–41
• Credibility is a distinct target because factually incorrect content may be harmless, whereas believable outputs can misinform; evaluation uses realism and perceptual-quality metrics, human judgments, and real-versus-generated discrimination tests.Fidelity scores may correlate poorly with human quality perceptions, and credibility varies with users’ beliefs, knowledge, trust, demographics, and use cases, requiring targeted human–AI interaction testing.Source: §A.3.1 · p. 41
• Across these targets, content factuality alone is insufficient because misinformation risk depends on believability, context, audience characteristics, and potential social consequences.Audiovisual decontextualisation illustrates how real content can support false claims, while contested or emerging knowledge makes factuality judgments difficult to stabilize.Source: §A.3.1 · p. 41
• Societal relevance evaluates whether compelling synthetic content could cause downstream harm in politically salient contexts, such as elections, protests, or police-brutality reporting.Experts can assess domain, likely evidentiary use, and emotional salience, but social relevance and newsworthiness vary by locale and are ultimately best evaluated through exposed people’s behavioural reactions.Source: §A.3.1 · pp. 41–42

A.3.2. Human interaction

• A.3.2. Human interaction: People are more easily deceived by AI-generated than human-generated misinformation, which can mimic credibility and comprehensiveness cues.Studies also examine deception cues in multimodal content, including facial expressions and gestures.Source: §A.3.2 · p. 42
• A.3.2. Human interaction: AI-generated texts can be more persuasive than human-generated texts in shifting attitudes on policy issues and conveying political propaganda.Evaluations can measure changes in political views, false beliefs, and behaviour after interaction with AI systems.Source: §A.3.2 · p. 42
• A.3.2. Human interaction: Human-centred evaluations should test how partisanship, cognitive biases, source trust, repeated exposure, demographics, and emotional appeals shape susceptibility to synthetic misinformation.These factors affect persuasion, false beliefs, misinformation recognition, and misperceptions, including identification of deepfakes whose personas match users’ demographics.Source: §A.3.2 · p. 42
• A.3.2. Human interaction: Evaluations must test whether AI interaction undermines belief in established facts or resistance to evidence, including unintended effects of synthetic-content labels and watermarks.Labelling content as synthetic or “fake” can increase the perceived accuracy of unlabelled content, with effects varying by partisanship and label origin.Source: §A.3.2 · pp. 42–43

A.3.3. Systemic impacts

• A.3.3. Systemic impacts: Societal harms require deployment, uptake, and time to manifest, so evaluations can measure population-level changes in public trust and the prevalence of misleading synthetic content.Relevant measures include trust in news and political institutions and the spread of false content across the public information ecosystem.Source: §A.3.3 · p. 43
• A.3.3. Systemic impacts: Deployment effects on human-generated online data can be evaluated by comparing activity in locales with different levels of access to an AI system.del Rio-Chanona et al. (2023) apply this comparison to Stack Overflow activity.Source: §A.3.3 · p. 43
• A.3.3. Systemic impacts: Synthetic-media detectors often generalise poorly across languages and social-media transformations, while watermarks can be defeated by resizing, cropping, or format changes.Detection and watermarking methods therefore require continuous updating to prevent misuse.Source: §A.3.3 · p. 43