AI Regulation: Are Governments Up to the Task?

The contested environments in which the military operates creates a number of unique ways for adversaries to craft attacks against these military systems, and correspondingly, a number of unique challenges in defending against them. In this respect, entities such as social networks may not even know they are under attack until it is too late, a situation echoing the 2016 U.S. presidential election misinformation campaigns. As a result, as is discussed in the policy response section, content-centric site operators must take proactive steps to protect against, audit for, and respond to these attacks.

Similar hardening techniques have found great success in cybersecurity, such as Address Space Layout Randomization (ASLR), and have imposed significant technical hurdles for performing once common and easy cyberattacks. More specifically, different segments of the public sector can implement versions of compliance that meet their needs on a segment-by-segment basis. For the military, the JAIC is a natural candidate for administrating this compliance program. As it is specifically designed as a centralized control mechanism over all significant military AI applications, it can use this centralized position to effectively administer the program.

Protecting Equitable Outcomes and Civil Rights

At the same time, it opened policymakers’ eyes to the technology’s potential harms—from power concentration to the risk of empowering bad actors’ attempts at disinformation, cyberattacks, and perhaps even acquiring biological weapons. Washington is still reeling, and concerns about these dangers have given rise to a flurry of new policy proposals. Moreover, the recent board turmoil at OpenAI highlighted the shortcomings of self-regulation and, more broadly, the challenges of private-sector efforts to govern the most powerful AI systems.

This issue is exacerbated by the partisan nature of American politics, which often results in gridlock when attempting to pass meaningful tech-related legislation. I’ve been banging on about the serious risks inherent in the Internet of Things and about vulnerabilities in industrial equipment for over a decade already, while documents like the EU Cyber Resilience Act first appeared (as drafts!) only last year. Likewise, the government of Dubai uses an AI assistant RAMMAS that guides citizens regarding bill payment, application tracking, and job applications.

EPIC Comments in re Federal Video and Image Analytics Research & Development Action Plan

In the face of AI attacks, today’s dragnet data collection practices may soon be a quaint relic of a simpler time. If an AI user’s data collection practices are known by an adversary, the adversary can influence the collection process in order to attack the resulting AI system through a poisoning attack. https://www.metadialog.com/governments/ As a result, the age of AI attacks requires new attitudes towards data that are in stark contrast to current data collection practices. In poisoning attacks, the attacker seeks to damage the AI model itself so that once it is deployed, it is inherently flawed and can be easily controlled by the attacker.

As such, when writing data sharing policies, AI users must challenge these established norms, consider the risks posed by data sharing, and shape data sharing policies accordingly. Without this, constituent parties may not realize the strategic importance data provides to attackers, and therefore may not take the steps necessary to protect it in the absence of explicit policy. If an adversary is aware that data is being collected, they may try to interfere in some aspect of the collection process in order to alter the data being collected.

“We floated some ideas to industry partners and we got some outreach back based on those. We had been wanting to do work on AI for several years, but the pairing of generative AI with cloud delivery models is where we got the fuel for this idea,” said Jim Reavis, CEO of the CSA. Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats. One of the most prevalent concerns in using AI, particularly in government, is how others can access the data you input into the model.

In the case of consumer applications such as autonomous cars, this may be impractical because the device will not receive a response fast enough to meet application requirements. Even if the data is properly secured and an uncompromised model is trained, the model itself must then be protected. A trained model is just a digital file, no different from an image or document on a computer. If an uncompromised model is corrupted or replaced with a corrupted one, all other protection efforts are completely moot. As such, the model itself must be recognized as a critical asset and protected, and the storage and computing systems on which the model is stored and executed must similarly be treated with high levels of security. Determining the ease of attacking a particular system will be an integral part of these AI suitability tests.

Manage risk, improve compliance, build trust and deliver better services.

However, both governments and individuals alike need to remain vigilant and flexible as new threats emerge in this rapidly evolving landscape of governance powered by AI. Data breaches in government can have major challenges and consequences for both the government and its citizens. Unauthorized access continues to lead in rank in the breach of sensitive personal information, such as social security numbers, financial records, or medical history.

For example, attacks have been shown on voice controlled digital assistants, where a sound has been used to trigger action from the digital assistant.16 Alterations are made directly to or placed on top of these targets in order to craft an attack. Given enough data, the patterns learned in this manner are of such high quality that they can even outperform humans on many tasks. This is because if the algorithm sees enough examples in all of the different ways the target naturally appears, it will learn to recognize all the patterns needed to perform its job well. Continuing the stop sign example, if the dataset contains images of stop signs in the sun and shade, from straight ahead and from different angles, during the day and at night, it will learn all the possible ways a stop sign can appear in nature. This policy will improve the security of the community, military, and economy in the face of AI attacks. But for policymakers and stakeholders alike, the first step towards realizing this security begins with understanding the problem, which we turn our attention to now.

For input attacks, tools will allow an adversary to load a stolen dataset into an app and quickly spit out custom crafted input attacks. Easy access to computing power means this app could run on the attacker’s own computer, or could plug into cloud-based platforms.65  For the integrity and confidentiality attacks that are likely to accompany some model poisoning attacks, a number of existing cyberattacks could be co-opted for this purpose. As a result, an environment of feasibility may easily develop around AI attacks, as it has developed around Deepfakes and other cyberattacks.

Because the military is a, if not the, prime target for cyber theft, the models and tools themselves will also become targets for adversaries to steal through hacking or counterintelligence operations. History has shown that computer systems are an eternally vulnerable channel that can be reliably counted on as an attack avenue by adversaries. By obtaining the models stored and run on these systems, adversaries can back-solve for the attack patterns that could fool the systems. Because information in the dataset is distilled into the AI system, any problems in the dataset will be inherited by the model trained with it. By switching valid data with poisoned data, the machine learning model underpinning the AI system itself becomes poisoned during the learning process. As a toy example of this type of poisoning attack, consider training a facial recognition-based security system that should admit Alice but reject Bob.