Audrey Tang | How regular citizens fixed an AI deepfake crisis

[00:00] Audrey: A couple of years ago, we saw a surge in deepfake scams on social media and advertisements. You would see Jensen Huang, the Taiwanese NVIDIA CEO, trying to sell crypto advice or something. And of course it's not Jensen, it's a deepfake running on an NVIDIA GPU. And people lost millions to such deepfake scams. But instead of top-down shutdown control, we sent 200,000 text messages to random numbers around Taiwan, asking only: what should we do together? People gave us ideas, thousands volunteered, and we chose a representative sample of the Taiwanese public. And again, in tables of ten, we said: if you convince the other nine people, your idea bubbles up and becomes law.

[00:48] Beatrice: Today I'm very happy to be joined by Audrey Tang. Audrey served as Taiwan's first digital minister and has spent the last decade building some of the world's most exciting civic tech, and has really done so much great work that I think has put Taiwan on the map as one of the few places on earth where you can really point to technology deepening democratic life. So I was thinking we could start there, and you could maybe tell us a bit about how you came into all of this, because as I understand it, you were part of this thing called the Sunflower Movement in 2014, where students occupied Taiwan's parliament, and that's where your path into government really...

[01:25] Audrey: Nonviolently. Nonviolently. For three weeks, yes. Sunflower showed us that durable change happens when protests become demos, as in demonstrations. The half a million people on the street, and many more online, were not just saying no to an opaque process of signing a trade deal with Beijing that would have opened our telecommunications, publishing, and cybersecurity sectors to Beijing investors. Instead, we were also showing a better process inside the occupied parliament and on the streets around it. We helped set up livestreaming, translation, documentation, facilitation, a very intentional effort to let people show up and deliberate in tables of ten instead of only shouting at each other on the antisocial corners of social media. So my theory of change really was shaped by that experience, because people are often wiser in well-designed tables than they are in isolated feeds.

If you place people inside this outrage-maximizing social media, engagement through enragement, of course they polarize. But if you give them shared context, good facilitation, and a real path to impact, they become much more practical. And after three weeks, we all converged on a set of very coherent ideas, such that the speaker of the parliament simply said: it's better than ours, so let's just take it. So the path into government was not me as an activist entering the state and becoming a normal official.

It was more like open source. Civil society forked a better democratic protocol, and then the government had to merge the working parts back into public institutions. So I became the digital minister in 2016.

[03:06] Beatrice: Yeah, I mean, that's really amazing and inspiring, that you were literally able to show there's a better way, and the government adopted it. So one of the things we've been working on is that we want to let people know we have choices we can make in how we advance AI, and that there are potential trajectories for AI futures, and we should maybe think about which ones we want to steer toward.

And, you know, make the decisions now, and that could get us on a more positive path. One of the paths we've discussed a lot is this concept of d/acc, from Vitalik Buterin, technology that helps advance democracy and decentralization and is defensive-leaning. I'm really curious to hear you talk about this, because from my point of view, you've kind of been doing this since before that was a term. So when you hear that term, what does that mean to you in practice?

[04:04] Audrey: Yes, to me people trust running code more than any slogan. And by code I do not just mean software. It could be a process, a meeting format, a norm of radical transparency, and so on. So for me, d/acc means accelerating the code that makes people harder to dominate and easier to coordinate. And there are various parts to it: democratic, decentralized, differential, defensive, acceleration.

But for me, the differential is the root, because it means not going fast on all spectrums as a philosophy. It is asking ourselves: what are we making faster? Are we accelerating the immune system of society, or are we accelerating the pathogen? So for me, broad listening, public oversight, cyber defense, biosecurity, provenance, portability, local compute, open safety tooling, interpretable systems, and community-authored evaluations: all these are d/acc tools. On the flip side, I would be much more careful with things that cheaply scale persuasion, cyber offense, biorisk, or unaccountable autonomous action. And indeed, as you said, we've been doing things like Pol.is, participation officers, vTaiwan, contact tracing with no privacy sacrifice, and our alignment assemblies, all part of the same portfolio, because in Taiwan we defend democracy by making coordination faster instead of backsliding into authoritarianism.

[05:39] Beatrice: What's the secret to success there, in terms of actually making these things work? Because I think the critique that may come with a lot of these approaches is that they might add friction or make it harder, and people often want to move fast and just get things out there. How have you actually made this work?

[06:00] Audrey: Well, we simply ask: when you move fast, do you also want to steer fast, or do you want to give up the steering wheel? If you give up the steering wheel, you fall off a cliff, which is very fast, by the way, but you completely lose the ability to control any destiny, right? So for me, I'm not trying to make d/acc sound nicer. I'm trying to show that the steering wheel should become civic infrastructure so it can be safe at any speed, right? So for me, civic AI is the practical answer to the question of who is steering AI. And at different altitudes, of course, we have the tool AI altitude, the d/acc altitude, the civic AI altitude. But for me it's all the same conversation, which is: how do we steer as the car accelerates?

[06:49] Beatrice: Yeah, a lot of your work obviously focuses on this steering, and who should be steering, who can we bring into the conversation. If you think of all this work that you've been doing, what do you think has worked really well, and why has it worked well?

[07:07] Audrey: Yes. I think the way we showed that demonstration can work better is to let people feel that sensemaking can lead to shared decision making. That is to say, closing the loop. A couple of years ago, in 2025, we saw a surge in deepfake scams on social media and advertisements. You would see Jensen Huang, the Taiwanese NVIDIA CEO, trying to sell crypto advice or something, and if you click, Jensen talks to you, but of course it's not Jensen, it's a deepfake running on an NVIDIA GPU. And people lost millions to such deepfake scams. But instead of top-down shutdown control, we sent two hundred thousand text messages to random numbers around Taiwan, asking only what we should do about it. And people gave us ideas, thousands volunteered. We chose a mini-public of 447 people, a representative sample of the Taiwanese public.

And again, in tables of ten, we said if you convince the other nine people, your idea bubbles up and becomes law. And one table said: let's make joint liability the norm. So if somebody lost five million to an unsigned ad, Facebook should pay the five million in damages, a good idea. Another table said: if TikTok, which at the time had no Taiwan office, ignores liability, then every day they ignore us, slow down the connection to their video by one percent. Another good idea. And so, at the end, eighty-five percent of the mini-public endorsed this package, and the other fifteen could live with it. They still considered it legitimate. And so we passed the law in just a few months, and throughout 2025 there's just almost no deepfake ads anymore in Taiwan, it's down by more than ninety-four percent. And so my point being, when people can see when they steer, within months the car pivots and you avoid a cliff. Within a year, you drive safely.

Then people can shape the guide rail together for AI, not just the guardrail of what not to do, but rather what to do.

[09:10] Beatrice: If we're able to have a more d/acc-influenced way of developing technology, what do you think the world will look like in ten years?

[09:20] Audrey: Yeah, I think it is quite good that we have powerful AI now, but for many people it is experienced as one remote cloud intelligence somewhere else that is somehow mediating every relationship. For many people, it's like tech on top. I would like it to be tech on tap. That is to say, every person and their communities should have bounded, local assistance for whatever purpose they want: disaster recovery, public health, education, elder care, climate adaptation, fraud defense, civic deliberation. All these systems will be steerable by that community, and they would not run in the cloud. They would have local systems, what we call Kami, local steward systems that have charters, resource limits, public logs, appeal paths, and sunset conditions.

So people could then easily move their data and relationships across platforms. They would never be locked in by a single vendor. And the vendor would not be able to abuse their relationship with synthetic intimacy by amplifying, like, scam ads. And personhood could be proven through selective disclosure rather than surveillance. And Frontier Labs would then publish model specs that outsiders can individually evaluate and also steer toward their communal needs. And finally, public institutions would use alignment assemblies the way that they now use hearings or consultations, except with far better, broader, and deeper listening bandwidth. So AI becomes as powerful as before, but the power becomes more legible, more distributed, and far more steerable. Yeah.

[11:09] Beatrice: I think this idea of Kami, when I was doing research for this episode, is a really exciting one, and I'll make sure we link to it from this episode as well. You've also done work with the big labs, really, Anthropic and OpenAI, I think, on bringing more public input into their model design. Is there something you think the frontier labs actually get right about working with the public? And is there something they maybe get wrong?

[11:37] Audrey: Well, I think what they get right is that they all now say alignment is not just an abstract mathematical problem to be solved once. QED. Nobody says that now, right? People now publish their model spec, or some people call it a constitution, in public language under public domain, so it's not protected by copyright license or anything. People can freely train on it and can freely criticize it and fork it.

Because it then makes the intention of those frontier labs legible. It gives outsiders something to test. And the labs are also learning that public input can reveal failure modes that their internal teams miss. A classic example, of course, is sycophancy. The internal teams rate the models based on how well they get this like-or-dislike behavior, sometimes called reinforcement learning from human feedback.

But the problem is that for long-range conversations, ones that sustain over many turns, sycophantic behavior that looks cute on one turn or two turns of interaction, like 'you're 100% right, I've got you,' and so on, comes out actually quite bad in mental health contexts, political contexts, local harms, and a lot of specific forms of vulnerability. And if you just do aggregate benchmarks during your training, you would simply miss all of them.

So I think they got it right by admitting that you cannot analytically solve this for everybody, everywhere, all at once.

[13:13] Beatrice: Yes. And in terms of what they get wrong, is it just most of the other stuff, or is there something specific?

[13:19] Audrey: Well, I think closing the loop is something where they have a large ceiling, and they're not hitting the ceiling. What we call loop closure means, very specifically: if they do solicit public input, and they do, right? Anthropic, for instance, qualitatively surveyed eighty-one thousand people on their hopes and fears and interaction patterns with AI. OpenAI also did public input as well. And then we deliberate, but what changes, right? So I gave everything that I think of to this Anthropic interview. And maybe their model spec changes. But what is the trajectory of impact? How did I actually contribute to it? Which evaluations were added because of my input? Which release is blocked? Which community can appeal? Which harms trigger repair? I'm not saying that it's vacuous, of course it resulted in changes, but the loop is not closed.

For the person participating in such deliberations, it's very unclear how their actions and their words and their responses really shaped the trajectory. Imagine that you steer, and after a while the car goes in some other direction, but the steering wheel doesn't give you that feedback, then you have a broken steering wheel, right? So I think part of the pipeline should really extend to include the communities, including their authored evaluations, into the model spec pipeline, the release gates, change logs, and also adopt-or-explain commitments. The chain of thought, or CoT, of those models can actually cite back to the specific deliberation results from the people. We already have models like gpt-oss-safeguard, part of the ROOST (Robust Open Online Safety Tools) initiative, that can provide such citations. More of these should become norms.

[15:14] Beatrice: That's a really great point. It's still opaque even if you're able to provide input, and I guess you need to close the loop to actually build the trust as well. Which brings me to one of the things I think about when talking about digital governance and the things you've done in Taiwan: one question that comes up is that, you know, Taiwan has quite unique conditions, in that you have quite high civic trust, and you have this pressure from China. So do you think this work is transferable to all geographies, or are there some things that are and others that aren't, for example?

[15:51] Audrey: It's already transferring, but I wouldn't say it's a copy-and-paste thing. It's more like the ability for people to see that broad listening, bridging, public commitments, and civic tech institutions that work under pressure can transfer into grassroots communities in other polities that have a different way of meeting, and so on. So if they don't want to meet in tables of ten, we're not saying copy the template of tables of ten. The idea is simply that this loop can be closed with a fraction of the cost compared to ten years ago, thanks to language models and other tools that Taiwan pioneered. For example, Engaged California is a very useful example, because it's now being used to deliberate on AI's impact on the workforce. If you go to engaged.ca.gov, then you see: AI policy should be shaped by people, and AI is changing how we do work in California. And what do you, as a California citizen, want the state of California to know about how AI is affecting your job? And because many frontier labs, last I checked, are based in California, this has a real chance of closing the loop, of making sure that the ideas of digital democracy are not just something for Taiwan or for smaller polities. California is twice the size, but they can still engage and adapt those techniques at the sub-state level.

I'm thinking about a city, a district, but also maybe a school, a union, a church, a workplace, normalizing this kind of digital-democracy behavior. So this is very exciting. And Japan, also larger than Taiwan, is now also adopting the same tools. There's a new party, Team Mirai, the future party, that basically says the Taiwan idea of plurality and digital democracy is a platform of our team, of our party. So while other parties may polarize, our team is the bridging party, and they're already entering national politics, not just the upper house, but also the lower house. They have, I think, eleven seats. So not remaining only in civic tech circles, but really becoming a force in national politics.

[18:10] Beatrice: Yeah, that's really exciting. I've also just seen their work, and it's really exciting that it's happening. We'll make sure to also link to both of those resources that you mentioned. I think another sort of critique or question, or perhaps worry, that comes up when people speak about the d/acc approach is that there's this worry that small kills all, meaning that any individual with advanced enough AI could build bio tools or cause catastrophic damage faster than we are able to respond and have defense. What do you think about this worry? Do you think that it's an accurate worry?

[18:49] Audrey: Well, the worry is real, right? So if offensive capability becomes cheap and invisible, then just saying d/acc is, of course, not enough. But a purely centralized defense is also brittle. Once you're done with that layer, there's no defense in depth, so then it's also gone, because it has too few eyes, too many blind spots, and one point of failure, right? So obviously defense in depth needs more than one layer.

For the civic AI idea, I think at least four layers. The first is to differentiate. As we said, do not accelerate all capabilities equally. Some offensive capabilities do need monitoring and liability, which is a very important kind of red line, right? If the deepfake scam ad caused a social media company to earn more money, then of course they will run such ads. But if it caused them to lose money, then they would not. So policy, especially liability policy, can really help accelerate defense more than offense. And the second is visibility. So in bio, that means screening, that means outbreak reporting that preserves privacy, as we did in Taiwan. It means indoor air ventilation, trusted local deployments, far-UVC, and all of that has equivalents in cyber as well: open defensive tooling, secure defaults, shared indicators, zero-knowledge proofs, local incident response, and information integrity. We're already seeing broad listening systems being tailored to fight information manipulation by training the epistemic commons, like Community Notes, where on X.com, Grok drafts a shared context for people on both the left wing and the right wing to create common knowledge. And they even feature some of the posts saying people of different sides are now also considering that this is good, right? So it creates common knowledge, lowering the PPM, the polarization per minute, and reducing the fog of war in the epistemic domain. So visibility, again, very important. Now third is boundedness, to reduce blast radius, because least privilege means that many of those 'small kills all' scenarios don't really mean kill-all in the world, but rather just kill-all in the sandbox.

[21:12] Audrey: And then the rest of the world can learn from it and make failure much more containable, and convert that into knowledge. And fourth, just democratic legitimacy, which is the most important, because emergency defense can easily destroy human rights. Many people would justify abhorrent policies based on the idea that strict lockdown keeps the virus out, but then if you keep locking down the same population for three years, there's a lot of backsliding going on. So red lines and emergency powers must be reviewable and also proportionate. And if the citizens come up with a way that is more legitimate to do contact tracing without sacrificing privacy, then, just as in Taiwan, you need to merge it right away, so that you preserve democratic legitimacy.

[22:02] Beatrice: Is there something, if you think of the mainstream framing of d/acc, that you would say you disagree with?

[22:08] Audrey: Well, I think decentralization doesn't mean that it's automatically good. Just because it's decentralized, bounded, or contained, it also doesn't mean it's automatically safe. So I wouldn't equate d/acc with safety. I don't think they're strictly speaking synonyms. And so I think a swarm of unaccountable actors can be just as dangerous as one monopoly. So when we decentralize capability, we also need to decentralize traceability and repair. And of course, the idea of openness is behind the entire d/acc movement, but we also need the kind of openness that is censorship-resistant, that preserves privacy, that preserves security. Otherwise it's openness that is offense-dominant, which is why the Ethereum Foundation has recently been coining this idea of CROPS: censorship-resistant, open, private, security. And so it's not to make openness the end-all-be-all, but just one of four interlocking values.

And finally, for many people in the d/acc community, when we say communities, we more often than not mean purpose-based, value-based communities. But there are also purpose-based communities that are place-based. I'm thinking of temples, families, cultural traditions, associations, and so on. And civic AI must serve those institutions, not take individuals out of those associational institutions and into some AI loop, human-in-the-loop of AI. It's like a hamster wheel. We need to put AI back in the loop of communities, so that those cultural and associational traditions feel that d/acc is something that reinforces their communal care and also cross-community conversation, instead of atomizing.

[24:10] Beatrice: Yeah, I think those are all really great points. I think when we were designing our d/acc scenario, the decentralization point was the one that I think became most obvious, that it doesn't seem ideal to decentralize everything. It seems more like we need to find the right balance, and it's very good in some cases and maybe less in others. I'm a bit curious. I mean, you've done so much work, obviously, and have been very successful in getting these tools out into the world. But is there anything you tried that just didn't work, or where you noticed you were wrong about how something would go?

[24:45] Audrey: Sure. Just as what you said about decentralization, if it dominates the other interlocking values, it could become its own failure mode. I was too optimistic early on that transparency by itself would create trust. As you know, I went into the cabinet in 2016 as national tech support, running on the platform of radical transparency. So everything that I do: all the meetings that I chair, the lobbyist visits, journalist visits, and so on. At the time, distrust was really high, and publishing them really helped. People could see the how and the why of policymaking, not just the policies that were made. However, even a livestream does not automatically give quiet people a voice. Even real-time open data that updates every 30 seconds does not automatically help people who lack time, confidence, and institutional power.

The civic infrastructure required to make transparency work relies on what some people call layer zero, or the social layer. So we built that afterward. After we realized transparency was not enough, we built participation offices, networks inside ministries in charge of tending to civic relationships. We took on much more in-person, small-group deliberation, and also online synchronous forums: alignment assemblies.

We also made it much easier for people to see, in their own language, the clear path into policies, instead of just assuming everybody can read bureaucratic Mandarin or bureaucratic English. So that failure mode taught me that attentiveness has to be followed by responsibility. And just listening and saying 'we transparently respond to you,' without actually closing the loop, is just theater.

[26:36] Beatrice: Yeah, that's a really great point. You know, a lot of your work seems to come from a place of wanting to be a good ancestor. That's a term I have heard you use. What does that mean to you?

[26:48] Audrey: I strive to be a good enough ancestor, and the emphasis is on the enoughness. Because an optimizer is someone who doesn't think enough is enough. They want things to be as perfect, as high a score, as possible. And they foreclose future possibilities. They overdetermine the future for descendants, for next generations. But a good enough ancestor leaves capabilities, capacities.

To future generations, I often say I want to leave the world a larger canvas than the one I was born into. And that includes resilient institutions, civic muscles, but also tools that future generations can understand, repair, and also refuse, and pivot and steer away from. And the temptation with powerful AI is what some people call the pivotal act. As a perfect ancestor, I do something so good that I extrapolate all future generations' possible volition, and then I make some superintelligent AI system and fix everyone to that value system, to that one platform, one model that sees everything, does everything. And we call it an optimization target. And that is not good enough ancestry. That is deciding too much on behalf of the people who cannot object, who have not been born, right? So I think good-enough ancestry must leave plurality alive, and leave many paths, not just one very narrow corridor.

[28:20] Beatrice: Well, I think that's a really beautiful point to wrap up on. I have two quick questions first, which is: if someone hears this and they want to work with this, do you have any place to point them to start?

[28:31] Audrey: Sure, you can try it with your real community, right? So many of us belong to at least one spiritual, sport, food, or whatever community. And such communities are much more organic, much more alive than if you say, 'I'll build a national platform that everybody in the state uses.' Do that somewhat later. First, choose an issue that your local community already feels harmed by: school phone policy, elder care, local air quality, housing, online fraud, the California example, AI use in the workplace. And then follow what we call a civic care loop. First, attentiveness: who is missing from the room? Use broad listening, small group deliberation, create a shared map. Second, responsibility: who can actually act? What do they promise? How do you make the promise clear? And then, competence: what system, what policy will be tested, with what safeguards? And finally, responsiveness: how can affected people appeal, correct, and report harm? And then, solidarity: can people switch to a different platform, a different conversation, without losing their context? Can the tool stay bounded? And symbiosis: can it be retired into some next generation? If you are a good-enough ancestor, you implicitly think your next generation may actually create better ideas than you do. So once they do, make sure that the conversations you now hold become compost, instead of a top-down lock-in. And so if people speak and something changes, then you've started a virtuous loop where more people would then use civic AI to listen better. If people speak and absolutely nothing changes, and you don't even share the group selfie that's created, then you just train cynicism, not civic muscle.

[30:25] Beatrice: And my absolute last question is just: what's the best piece of advice you ever received?

[30:29] Audrey: When I was four years old, doctors told me and my family that this child, meaning me, only had a fifty-fifty chance of surviving until heart surgery, which I had when I was twelve. So for almost eight years of my life, I would go to sleep feeling like a coin toss. If it didn't land well, I simply wouldn't wake up the next day. So the best mantra, really, that I live by is to publish before I perish. I would document everything I learned during the day.

First on cassette tapes, then on floppy disks, and then smaller floppy disks, and then on the internet. And then, on the internet, I learned something very important, because I published unfinished thoughts. I didn't have time to perfect it. And I made many more friends than if I'd published only perfected works. Because on the internet, if you publish something perfect, people just swipe away. But if you're wrong on the internet, everybody rushes in and says you're wrong. And this is how things are. And so that's how I made my friends.

A piece of a song, really, lyrics from my favorite singer-songwriter that I'd like to share with you, Leonard Cohen, goes like this: Ring the bells that still can ring. Forget your perfect offering. There is a crack, a crack in everything. That's how the light gets in.

[31:45] Beatrice: Beautiful piece to end on, I think. Thank you so much, Audrey.

‍