I'm not convinced. My impression is both sides in the crypto wars considered cryptography dual use, and the debate was about policy given this background fact. Furthermore, similar knowledge that allows cryptography algorithms to work, allows cryptanalysis, e.g. knowing which elliptic curves are secure. Furthermore, even "ability to send private messages to each other" is dual use, since it can be used to coordinate violent crimes and military operations. It seems you can draw the offense/defense boundary at the pre-AI crypto equilibrium, where what people were relying on pre-AI is defense, changes to that are offense; but this is a line drawn after the fact, after crypto battles have already occurred.
You could narrowly claim it's not "dual use in the same way as AI" however that narrow claim might be rather trivial, of course there will be both similarities and differences.
If anything, it seems AI is less dual use than cryptography, in that cryptography is ~only useful to block off options for other agents (e.g. their options of reading your communications), while AI is additionally useful for non-adversarial problems (such as solving typical math problems, medical research, etc).
"Dual use" by user.
"Dual use" by application/function.
Sending encrypted messages is not an attack, in an intrinsic sense.
My claim is neither narrow, nor trivial. It is a key point for regulating, or not, a technology that is useful for defense and offense.
You are correct to point out that AI is also a "general use" technology by application/function, in a way cryptography is not. But that's you coming to see things my way regarding the limitations of the term "dual use" in discussions about AI vs. typical technologies labeled as such.
Well I bring up the sword and the wall in the essay. One could consider also the shield, a bomb, body armor, or a rifle.
Some tools/weapons are intrinsically more useful for offense or defense, while others are general use. In general, a general use item will be useful for both.
The basic question is something like: Is the item in question more useful for destruction or protection? (Independent of whether an attacker or defender is using it.)
Cryptography is like a wall; attackers and defenders can use walls to their protective advantage in any given context.
AI is more like a sword; attackers and defenders can use the blade to either cut/stab or to parry.
Offensive security tooling is more like a bow and arrow; attackers and defenders can shoot arrows at their target.
Or consider field artillery and trenches. In WWI, both sides at any given point were heavily using both. But trenches are inherently a protective tool and artillery is inherently a destructive tool.
Today in Ukraine, both sides are using trenches and drones. Drones are both a protective and destructive weapon, depending on the model.
Then I think I disagree. Cryptography is like both walls and battery rams. Both locks and lockpicks. (You can try drawing the boundaries on "cryptography" so that cryptanalysis doesn't count as cryptography, however, this is not a natural boundary in terms of the research.)
AI is like a general factory, assembly line: primarily useful for building, and scaling building, including building of weapons, or walls, or locks, or lockpicks.
I do not think is make sense to group locks and lock picks together any more than it would to group encryption and cryptanalysis. Don't confuse the "study of" with "nature of application." You do not break a lock with a lock. You do not break encryption with encryption.
Similarly, the study of vulnerability research is critical for attackers and defenders. But the exploits built are a fundamentally offensive tool; hence the term "offensive security." The offensive nature is paired with the defensive use.
You are correct that AI, as a fully general technology wrt the cyber domain, can be used to build, defend, or attack. Which is why calling it "dual use" in the same sense as cryptography is misleading, at best.
You keep agreeing with me without quite being able to acknowledge it.
The part I agree with is that AI is not dual use the same way as cryptography. In particular, I think AI is less adversarial than cryptography. If you are saying "AI is more like a sword", this seems to disagree with me, but maybe you are carefully phrasing it so that you are saying "AI is more like a sword" when applied in adversarial domains. This I'd agree with. But that's not the same as AI being like a sword generally.
I do not think is make sense to group locks and lock picks together any more than it would to group encryption and cryptanalysis. Don’t confuse the “study of” with “nature of application.” You do not break a lock with a lock. You do not break encryption with encryption.
In terms of labor & research, the work is very similar:
There are some differences but the labor & research are very similar.
I feel like maybe I could agree with a point along the lines of: "There are natural boundaries in Platonic space about which cryptographic schemes can be made secure by design. Research about this space assists both practical computer security offense & defense. But there is a natural question here of which schemes work. And that leads to natural-category notions of offense and defense: defense is about making security by design practical, while offense is about attacking those systems that are not secure by design." But I'm not convinced that's the point you are making. E.g. I don't really know what you would consider offense vs defense in a hypothetical world (perhaps a logical counterfactual) in which no public-key crypto scheme works; would "public key encryption" methods which cannot, by assumption, be made secure-by-design in this world, be offense or defense?
Fully agree that AI is far, far more general than a sword is. I mean you can dig holes and hammer nails with a sword, but yeah. My focus was specifically on the adversarial tool part. AI is more like a blacksmith, both the workshop and the burly guy to hit things.
I think you're getting hung up on "cryptography" as a holistic concept, vs. the specific application that tends to be the focus: encryption.
Cryptography is in a practical sense about using encryption to protect data. The cryptanalysis side is using the same basic research tools to break encryption. But either way we're talking about walls and finding cracks in walls.
There is no "battering ram" or "explosive" nature here, as there is for AI doing cyber offense.
Ok, I think I understand better and basically agree. (My original point is more a semantic point, in this case: in a hypothetical world where strong encryption was mathematically impossible, trying to encrypt might be considered "offense" rather than "defense", as society had adjusted to strong encryption being impossible. But it's clear what you mean at this point, so it's just semantics.)
Actor and functional application matter
Mainly, cryptography does one critical thing—encrypts data. It is considered “dual use” as a technology because one can employ encryption whether as a private citizen, a soldier, or a criminal. But, like a wall, it’s an inherently defensive tool by its nature. One cannot really attack with cryptography.[1] The term “cryptographic attack” refers to an attack on the cryptography of a target.[2]
During the Crypto Wars, many battles were fought, but ultimately the winning side was that having public, open, ~unrestricted cryptography was the best equilibrium. In my eminently reasonable opinion, reasonable, informed people can disagree about the particular place to draw certain lines, because there are hard trade-offs and technological limits.
A similar dynamic exists in the infosec community over which vulnerabilities, exploits, and offensive security tools to make public and which to keep private. Offensive security is actually a functionally dual use situation because, as with a sword, it can be used to attack or parry—the dual application is independent of the user. In the hands of a defender or security researcher, offensive tools and techniques are used to find problems so that they can be rectified, or at least mitigated, to prevent attackers from taking advantage of them in the same way. Still, certain red-teaming tools are notorious for the perceived imbalance between legitimate use by defenders and illegitimate use by attackers. Again, IMHO, reasonable, informed people can disagree on the particulars of where to draw certain lines over command-and-control (C2) frameworks on GitHub.
With AI, it’s the same functionally dual use situation as offensive security tooling. By comparison, nuclear enrichment is a much simpler issue, practically speaking—there’s a big divide between using moderately enriched hot rocks to boil water and using highly enriched dense rocks to create a warhead. It’s a great thing that nuclear power can be used at scale with low risk of somehow becoming a bomb. That takes a lot of extra work.[3] There’s no such divide for AI, and it’s native to the cyber domain.
There is an ongoing debate in the infosec community over whether AI is “offense dominant” or “defense dominant.” I think the theoretical answer remains tricky to assess; perhaps it’s symmetrical. For now, I think the practical answer is that it is offense dominant, but that’s a whole ’nother essay.
Another debate among infosec types concerns the closed-weight models from the labs—which have guardrails and monitoring, as well as specialized security versions for vetted users—vs. the open-weight models—with no, or easily overcome, limitations on use. It doesn’t help that the bulk of the best ones are made by Chinese labs. Also, the new closed-weight models tend to be released in phases, so that certain trusted entities can try to secure their products and infrastructure before a full public release. Again, whole essays.
This situation makes some infosec professionals very mad. They want access to the full frontier capabilities themselves, the same as the big players. Their experience with cryptography, open-source software, and infosec leads them to the same place with AI. Open access by default; a level playing field for all.
You can read one such account here:
The Safety That Isn’t — Mark Atwood, Words about Thoughts
There’s a legitimate gripe in there, for sure. But I have some pushback to deliver.
This is plainly nonsense no matter where you come down on the arguments I described above.
For one, some of the main AI labs are founded and staffed in large part by these doomers. These labs do quite a lot of basic infosec as major technology companies, even if poorly at times. For two, obviously the Intelligence Community and national security apparatus do perform a shit ton of defensive infosec work, including vulnerability disclosure. And, obviously, the doomers inside the labs, the doomers outside the labs, and the hawks inside the administration and outside it are all pretty distinct categories with conflicting views and incentives. Personally, I’m an Outdoor Doomer Hawk.
The AI (presumably Claude) that wrote this under the author’s insufficiently careful prompting is … certainly not AGI. No, this author’s process is not more rigorous than mine. I’d love to see what his prompt was to make poor Claude produce such drivel. My AI would never.
At no point in the essay is the issue of open-weight models discussed. Perhaps an open-weight model could have drafted his report for him. At no point is any fair, let alone charitable, interpretation offered for the opposing side(s) of this debate.
The essay ends with this line:
“The word is cowardice.”
I’m the kind of person that automatically tries to correct an error when I see it. Yes, I am great at parties. I have a BS-detection reflex and no patience for unearned epistemic authority. Also, nominative determinism compels me to knock people off high horses.
That essay is a series of errors created by a small-minded individual lazily employing AI to produce a poorly informed, slovenly argued stance, after having a small, legitimate gripe. No attempt is made to consider alternative equilibria and their trade-offs. The wild extrapolation from the grave injustice done by Claude’s refusal to a sweeping theory of conniving doomers and hawks is breathtaking. The lack of basic awareness, inability to model the actual arguments of the other side, and unearned sense of moral superiority are awesome to behold.
I think that’s a more appropriate application of “cowardice.”
“What about ransomware?” Think for 30 seconds about why that’s not really encryption as an attack, per se.
Uh oh. Seems offense dominant to me.
Just ask Iran…