Stop: Disable the scanning of documents by Adobe AI solutions!

[German]Adobe has begun to introduce its own AI solutions in its products. There is a risk that Adobe products will begin to scan all documents in companies in order to obtain data for feeding the AI solutions. Administrators should therefore take immediate action to prevent this scanning, until it's clear what's going on. There seems to be a solution for Windows to stop scanning, but I am not aware of anything similar for macOS and other operating systems.

Blog reader Mark Heitbrink pointed this out to me on Friday (thanks for that) – there's been a lot going on here this week. Mark pointed me to the reddit.com post Turning off Adobe's ability to scan all of your organization's documents for generative A, which addresses the topic.

Adobe scans documents for AI solutions

Many administrators may have Adobe products in their inventory (especially Adobe Acrobat is used pretty much everywhere in organizations). Brian Krebs recently pointed out the problem (see screenshot) that Adobe Acrobat could (maybe by default) scans all documents that are entered into Adobe Acrobat and Reader.

In the document, Adobe informs its users about new generative AI features in Adobe Acrobat. It states that Adobe will introduce a beta version of these features in Acrobat starting February 20, 2024. The AI Assistant feature uses AI technology to understand users' questions and provide answers based on the content of your PDF file, it says. The generative summary uses AI technology to provide an overview of the organization and content of the document. Adobe described the features in this document on February 24, 2024.

According to Adobe, the introduction of the beta version of the generative AI features for Teams customers will be gradual. It will start with customers who have activated the new "Acrobat experience". Adobe writes that it expects the features to be rolled out to all eligible Teams customers in the coming months. In other words, as soon as a user opens a document in an Adobe Acrobat/Reader, its content will be captured using the AI feature.

Note: It is currently not clear to me whether and how this affects users of the Adobe products in question. However, not everyone wants an AI scan of their documents – regardless of the purpose. As a user and administrator, however, it is wise to inform yourself about these features and to know how to deactivate this scan if necessary.

Deactivate the scan

Instead of offering an opt-in for users, Adobe relies on an opt-out and automatically activates the document scanning function in Adobe Reader/Acrobat. Adobe states that users can deactivate these functions individually. Administrators also have the option of deactivating these AI scans for the entire organization.

Adobe has published the support article Turn off the generative AI features, which describes how a user can deactivate the option in question. Administrators under Windows have the option of disabling this feature globally for a machine in the registry branch:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

Just add a 32-Bit-DWORD value bEnableGentech, as the user wrote on reddit.com. I assume that the DWORD value must be set to 0 to disable the scan, while 1 enables this AI scan.

# Adobe AI in Windows blocken
$Path = 'HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown'
if (!(Test-Path $Path))
{
    $null = New-Item $Path -Force -ErrorAction Stop
}
New-ItemProperty $Path -Name bEnableGentech -PropertyType Dword -Value 0 -Force

The above PowerShell instructions from the reddit.com thread should check whether the key is present and, if necessary, set the value so that no AI scan is performed on the machine.

Adobe's statement

On March 26, 2024, I received an email from a German communications agency working on behalf of Adobe. The email states that what is written in the article is not correct and that "due to the incorrect presentation of Adobe's approach to the AI Assistant, please remove the article from the blog".

Of course, all my alarm bells start ringing immediately – it says the post is factually incorrect, no correction is requested, but the post should be removed. But after looking at the post, it wasn't clear to me what was really being criticized. There is a reference in the above text to a reddit.com post that is still online – there is a reference to a screenshot from security researcher Brian Krebs that is still online and there is a technical description of a registration entry that hopefully works and should prevent the AI scan (if it comes).

After I then took a closer look at the link to the article mentioned in the email, it referred to an article by the German Chip editorial team – not my own blog post. Their article is now offline, so I can't comment on the content. The email from the German communications agency goes on to say:

What the article says is not correct. Adobe does not use its users' documents to train the AI assistant.

In this context, I would like to point out that the above article is not essentially about training the AI assistant, but about the question of how an administrator or user could generally prevent the scanning of documents for Adobe products – for whatever purpose. The press agency's email then went on to say: "This is clearly stated again on this Helpx page":

Do we train LLMs on your PDFs?

We do not, and do not permit our service providers to, use your documents, outputs, or textual prompts to train any LLMs that deliver Acrobat and Acrobat Reader's generative AI capability.

Will Adobe ever look at your content while you're using generative AI in Acrobat and Acrobat Reader?

We do not look at your document, prompt(s), or generated responses except in the instances described below.

• Reported content, bugs, or vulnerabilities. When you report content (e.g., for being harmful, illegal, offensive, etc.), we investigate it by manually reviewing the document, prompt(s), and generated responses to make adjustments to the service to address the issue.
• User-Provided Feedback. For Acrobat Individual users* and Acrobat Reader users that provide feedback, you have the option to share with us your document, prompt(s), and generated responses during a document session for product improvement purposes that do not include training a Large Language Model ("LLM"). Examples of product improvement include improving the operability of generative AI in Acrobat and Acrobat Reader, as well as reducing hallucination, bias, and toxicity. If you do not wish to share your content, please uncheck the product improvement checkbox when you first provide feedback on a document.

If manual review of your content takes place, a limited group of trained Adobe personnel examine the content within an encrypted repository with access controls.

Again, in my opinion, answers are provided to questions that were simply not raised in the above blog post. In the above context, however, this is simply not of interest – because it is purely about the technical question "can I stop scanning if I want to" and Brian Krebs' question "Sure. Let Adobe AI scan all your documents. What could go wrong?" is a question that every user/administrator will have to answer for themselves – without any instruction from Adobe.

Then came the hint: On this page you will also find some relevant FAQs on the topic (at the bottom). On the page you will find many explanations from Adobe about what their AI does. Still really useful information for me:

The AI Assistant in Acrobat Beta is available to Acrobat Standard and Pro customers with individual or team subscriptions, as well as trial users of Acrobat Pro. Customers can access these features through the Adobe Acrobat desktop application on Windows and macOS, as well as through the Acrobat web application. Access via the Acrobat Reader desktop application will be available shortly.

In addition, the beta is currently limited to English documents, but will be gradually expanded. Just as a hint: as the person responsible for IT, I would have to be sure if I release such a function for use whether the whole thing is compliant with the GDPR, for example, and complies with internal company rules. But I haven't found anything on this – and the reference to the topic came from someone who is confronted with such issues in companies.

In my opinion, the only "accusation" that could be made would be that my text above reported on an AI scan function and its deactivation, which will only be made available to certain users as a beta in the future, the later final may act completely differently and the whole thing is therefore not relevant. But the expectation, formulated as a request, to take the blog post offline is not acceptable in my eyes.

That was the point where I took a deep breath and made a quick phone call to the agency. It really could have been a "communication misunderstanding", where I received an email that wasn't intended for me. What I took away from the phone call: It seems that a decision really has been made at the agency to ask the editors to take the articles on the above topic offline.

For me, this is a case of "no go" (interference with press coverage), especially as it reminded me of my Twitter account being blocked by DMCA for reporting on Adobe problems (see Did Adobe blocked my Twitter account via an DMCA complaint after a critical report about issues?).

I have no idea what Adobe is trying to achieve with such actions. I know from the press departments that they send a statement and ask me to take it into account editorially. As a rule, I am happy to comply, as I want to inform the readership correctly. If something is misrepresented, this is corrected with appropriate references in the text. This leads to a win-win situation for everyone involved. So the above case leaves me somewhat perplexed and I ask myself what the whole thing is about – and whether the aim here is to keep an issue out of the press?