Cybersecurity Policy Report, Citing Cybersecurity, Commerce Dept. Seeks Reports From AI Developers, (Sep 10, 2024)
Developers of certain artificial intelligence systems that can be used for cybersecurity or other national security purposes would have to file quarterly reports with the Commerce Department under proposed rules due to be published in tomorrow’s Federal Register.
An executive order (EO) on “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence” issued by President Biden last October (CPR, Oct. 30, 2023) directs Commerce “to require companies developing, or demonstrating an intent to develop, potential dual-use foundation AI models to provide certain information to the Federal Government on an ongoing basis,” according to the Federal Register notice.
The EO defined a dual-use foundation model as “an AI model that is trained on broad data; generally uses self-supervision; contains at least tens of billions of parameters; is applicable across a wide range of contexts; and that exhibits, or could be easily modified to exhibit, high levels of performance at tasks that pose a serious risk to security, national economic security, national public health or safety, or any combination of those matters.”
The proposed rules were issued pursuant to the EO and the Defense Production Act and are designed to provide data to the government about AI systems that could be used for national defense or that have national security implications.
“AI models are quickly becoming integral to numerous U.S. industries that are essential to the national defense,” the proposed rules note, including “developers of cybersecurity software, which can be applied to protect a wide range of systems and infrastructure that are critical to the national defense.”
“Dual-use foundation models could increase the capabilities of these products and services to an even greater extent. Specifically, integrating dual-use foundation models into products like military equipment, signal intelligence devices, and cybersecurity software could enable those products to operate more effectively across a wider range of environments, to respond more effectively to unexpected signals, and to combat additional types of cyberattacks,” they explain.
“Accordingly, the U.S. Government must be ready to take actions that ensure dual-use foundation models produced by U.S. companies are available to the defense industrial base,” the proposed rules say.
“To do so, the U.S. Government needs information about how many U.S. companies are developing, have plans to develop, or have the computing hardware necessary to develop dual-use foundation models, as well as information about the characteristics of dual-use foundation models under development,” they add.
“For similar reasons, the U.S. Government must minimize the vulnerability of dual-use foundation models to cyberattacks. Dual-use foundation models can potentially be disabled or manipulated by hostile actors, and it will be difficult for the U.S. Government to rely on a particular model unless it can determine that the model is robust against such attacks,” they say.
“Accordingly, the U.S. Government needs information about the cybersecurity measures that companies developing dual-use foundation models use to protect those models, as well as information about those companies’ cybersecurity resources and practices,” they say.
The quarterly reports that would be required under the proposed rules should disclose, among other things, “any ongoing or planned activities related to training, developing, or producing dual-use foundation models, including the physical and cybersecurity protections taken to assure the integrity of that training process against sophisticated threats.”
Comments on the proposed rules will be due in docket BIS-2024-0047 within 30 days of their publication in the Federal Register.
“Today’s proposed rule requires developers of the most powerful AI models and computing clusters to provide detailed reporting to the federal government,” according to a Commerce Department news release.
“This includes reporting about developmental activities, cybersecurity measures, and outcomes from red-teaming efforts, which involve testing for dangerous capabilities like the ability to assist in cyberattacks or lower the barriers to entry for non-experts to develop chemical, biological, radiological, or nuclear weapons,” the department said.
“This proposed reporting requirement would help us understand the capabilities and security of our most advanced AI systems,” said Alan Estevez, Commerce’s undersecretary–industry and security. “It would build on BIS’s long history conducting defense industrial base surveys to inform the American government about emerging risks in the most important U.S. industries.”
News: FederalLegislation DataSecurity