Search the archive.

(Gregory, “The Treason of Intellectual Radicalism and the Collapse of Leftist Politics,” LOGOS, Winter edition)

Radical politics in contemporary western democracies finds itself in a state of crisis. When viewed from the vantage point of social change, a progressive transformation of the social order, political radicalism is found wanting. This would seem to go against the grain of perceived wisdom. As an academic enterprise, radical theory has blossomed. Figures such as Slavoj Žižek openly discuss Marxism in popular documentaries, new journals have emerged touting a radical “anti-capitalism,” and whole conferences and sub-fields are dominated by questions posed by obscure theoretical texts. Despite this, there is a profound lack in substantive, meaningful political, social, and cultural criticism of the kind that once made progressive and rational left political discourse relevant to the machinations of real politics and the broader culture. Today, leftist political theory in the academy has fallen under the spell of ideas so far removed from actual political issues that the question can be posed whether the traditions of left critique that gave intellectual support to the great movements of modernity – from the workers movement to the Civil Rights movement – possess a critical mass to sustain future struggles. Quite to the contrary, social movements have lost political momentum, they are generally focused on questions of culture, shallow discussions of class, and are generally obsessed with questions of identity divorced from the questions of material forms of oppression rather than on the great “social question” of unequal distributions of economic and political power which once served as the driving impulse for political, social and cultural transformation. As these new radical mandarins spill ink on futile debates over “desire,” “identity,” and illusory visions of anarchic democracy, economic inequality has ballooned into oligarchic proportions, working people have been increasingly marginalized, and ethnic minority groups are turned into a modern “coolie” labor force. This has been the result, we contend, of a lack of concern with real politics in contemporary radical theory. Further, we believe that this is the result of a transformation of ideas, that contemporary political theory on the left has witnessed a decisive shift in focus in recent decades – a shift that has produced nothing less than the incoherence of the tradition of progressive politics in our age. At a time when the left is struggling to redefine itself and respond to current political and economic crises, a series of trends in contemporary theory has reshaped the ways that politics is understood and practiced. Older thinkers such as Michel Foucault, Jacques Lacan, and Jacques Derrida, and newer voices like Alain Badiou, Jacques Rancière, David Graeber and Judith Butler, among others, have risen to the status of academic and cultural icons while their ideas have become embedded in the “logics” of new social movements. As some aspects of the recent Occupy Wall Street demonstrations have shown, political discourse has become increasingly dominated by the impulses of neo-anarchism, identity politics, post-colonialism, and other intellectual fads. This new radicalism has made itself so irrelevant with respect to real politics that it ends up serving as a kind of cathartic space for the justifiable anxieties wrought by late capitalism, further stabilizing its systemic and integrative power rather than disrupting it. These trends are the products as well as unwitting allies of that which they oppose. The transformation of radical and progressive politics throughout the latter half of the twentieth and the early decades of the twenty-first centuries is characterized by both a sociological shift as well as an intellectual one. A core thesis has been that the shift from industrial to post-industrial society has led to the weakening of class politics. But this is unsatisfying. There is no reason why class cannot be seen in the divisions of mental and service labor as it was with an industrial proletariat. There is no reason why political power rooted in unequal property and control over resources, in the capacity for some to command and to control the labor of others as well as the consumption of others ought not to be a basic political imperative. To this end, what we would call a rational radical politics should seek not the utopian end of a “post-statist” politics, but rather to enrich common goods, erode the great divisions of wealth and class, democratize all aspects of society and economy, and seek to orient the powers of individuals and the community toward common ends. Indeed, only by widening the struggles of labor and re-thinking the ends of the labor movement – connecting the struggles labor to issues beyond the workplace, to education, the environment, public life, issues of racial and gender equality, culture and the nature of the social order more broadly – can we envision a revitalization of a worker’s movement, one that would have no need of the alienated theory of the new radicals.[1] But this is merely one fringe expression of what we see as a corrupted, simplified and de-politicized “new” radicalism. Once grounded in the Enlightenment impulse for progress, equality, rationalism, and the critical confrontation with asymmetrical power relations, the dominant trends of radical political thought now evade the concrete nature of these concerns. The battles that raged in the 1980s and 1990s between postmodernists and defenders of modernity – while serving as a harbinger of the contemporary split between the radical theorists divorced from reality and those who seek to establish anti-foundationalist conceptions of democratic discourse – were attached to a strong sense that the future of rationalism and radical politics hung in the balance. Today’s radical intellectuals do not feel compelled to defend their arguments or respond to their critics. Their purported radicalism becomes all the more opaque when the coherence of their claims is called into question. A concern for an exaggerated subjectivity, identity politics, anti-empirical theories of power, an obsession with “difference” – all serve to deplete the radical tradition of its potency. Radical intellectuals now formulate new vocabularies, invent new forms of “subjectivity,” and concoct new languages of discourse that only serve to splinter forms of political resistance, consigning radicalism to the depths of incoherence and (academic success notwithstanding) political irrelevance. Indeed, the disintegration of the great radical movements of the nineteenth and twentieth centuries – from the labor movement to the Civil Rights movement – has detached philosophical thinking from the mechanisms of power and political reality more broadly. The result has been – despite the ironic new turn toward “anti-philosophy” – the conquest of politics by poorly constructed philosophy. Abstraction has been the result, as well as a panoply of shibboleths that have only served to sever “radical” thought from its relevance to contemporary politics and society. It seems to us that the survival of the tradition of rational, radical political and social criticism pivots on a confrontation with these new academic trends and fads.

America’s central bank doesn’t see any signs of a recession on the horizon. Not this year nor the year after. The Federal Reserve’s policymaking committee of 19 officials released a new set of economic projections last week, showing that they now expect economic growth in 2024, 2025 and 2026 to be even stronger than they previously thought. That optimism seems to be the consensus among analysts, including Goldman Sachs’ chief economist: The ruthless economic pains of a recession, such as mass layoffs and tepid consumer spending, probably won’t happen anytime soon. “The economy is strong, the labor market is strong and inflation has come way down,” Fed Chair Jerome Powell said Wednesday. Corporate earnings have been robust, the stock market continues to break record after record and America might be in the thick of a productivity boom that could boost growth without stoking inflation. And even though interest rates are at their highest levels in two decades, the economy continues to display remarkable resilience. Economists say that strength could persist through the coming years. Fed officials continue to expect three rate cuts this year but the days of ultra-low interest rates are long gone. Interest rates will eventually settle down at levels well above the near-zero rates seen before the Fed began to hike in 2022. But economists say that won’t present any problem for the sturdy US economy. “A lot of my peers are calling it higher-for-longer, but it’s really stronger-for-longer,” Mike Skordeles, head of US economics at Truist Advisory Services, told CNN. US gross domestic product, the broadest measure of economic output, registered at a strong 3.2% annualized rate in the fourth quarter. That was after a gangbusters 4.9% rate in the prior three-month period. The Atlanta Fed is currently projecting that the economy expanded at a 2.1% rate in the first three months of 2024. Fed officials estimate that growth in 2024 overall will hit 2.1%, then 2% in each of the following two years. The job market, a key driver of growth, also remains on strong footing. It’s seen a gradual, orderly slowdown from the red-hot pace in 2021, when the labor market ascended from pandemic depths, but unemployment remains low and payroll growth is still humming along. Employers added 275,000 jobs in February, and the unemployment rate edged higher to 3.9% from 3.7%, but it has remained below 4% for more than two years. Jobless claims, a proxy for layoffs and often seen as the earliest indicator of any changes in the job market, remain at historically low levels.

What has been a fairly stable inflation picture, with the annual change in living costs stuck in a range between 3.0% and 3.7% for more than a year, took an encouraging turn in June. Inflation as measured by the Consumer Price Index (CPI) was down for the month, and the inflation rate for the previous 12-month period dropped to 3.0%. That represents its lowest reading since June 2023, and continued a modest downward trend. “It appears the inflation environment is slowly improving,” says Rob Haworth, senior investment strategy director at U.S. Bank Wealth Management. Markets pay close attention to inflation data to see if it may provide a green light for the Federal Reserve (Fed) to begin lowering the federal funds target interest rate it controls. “Fed officials have indicated that they need to see multiple months of improvement before cutting rates, so upcoming inflation readings will be important as well,” says Haworth. Inflation’s resurgence, beginning in 2021, was the impetus behind a significant change in Fed monetary policy. It prompted the Fed to raise the fed funds target rate from near 0% to a top level of 5.5%. The Fed has held rates at that level since July 2023. While markets anticipated the Fed would reverse course in 2024 and begin cutting rates, inflation’s decline flattened out beginning in mid-2023, and only recently began modestly trending lower.

Economic growth picked up more than expected in the spring, as cooling inflation and a strong labor market allowed consumers to keep spending even as high interest rates weighed on their finances. Gross domestic product, adjusted for inflation, increased at a 2.8 percent annual rate in the second quarter, the Commerce Department said on Thursday. That was faster than the 1.4 percent rate recorded in the first quarter, but shy of the unexpectedly strong growth in the second half of last year. Consumer spending, the backbone of the U.S. economy, rose at a 2.3 percent annual rate in the second quarter — a solid pace, albeit much slower than in 2021, when businesses were reopening after pandemic-induced closings. Business investment in equipment rose at its fastest pace in more than two years. Inflation, which picked up unexpectedly at the start of the year, eased in the quarter. The data is preliminary and will be revised at least twice. Taken together, the findings suggest that the economy remains on track for a rare “soft landing,” in which inflation eases without triggering a recession. That is something few forecasters considered likely when the Federal Reserve began raising interest rates two years ago to combat inflation.

IN 2023, OPENAI told the UK parliament that it was “impossible” to train leading AI models without using copyrighted materials. It’s a popular stance AI world, where OpenAI and other leading players have used materials slurped up online to train the models powering chatbots and image generators, triggering a wave of lawsuits alleging copyright infringement. Two announcements Wednesday offer evidence that large language models can in fact be trained without the permissionless use of copyrighted materials. A group of researchers backed by the French government have released what is thought to be the largest AI training dataset composed entirely of text that is in the public domain. And the nonprofit Fairly Trained announced that it has awarded its first certification for a large language model built without copyright infringement, showing that technology like that behind ChatGPT can be built in a different way to the AI industry’s contentious norm. “There’s no fundamental reason why someone couldn’t train an LLM fairly,” says Ed Newton-Rex, CEO of Fairly Trained. He founded the nonprofit in January 2024 after quitting his executive role at image-generation startup Stability AI because he disagreed with its policy of scraping content without permission. Fairly Trained offers a certification to companies willing to prove that they’ve trained their AI models on data that they own, have licensed, or that is in the public domain. When the nonprofit launched, some critics pointed out that it hadn’t yet identified a large language model that met those requirements. Today, Fairly Trained announced it has certified its first large language model. It’s called KL3M and was developed by Chicago-based legal tech consultancy startup 273 Ventures, using a curated training dataset of legal, financial, and regulatory documents. The company’s cofounder, Jillian Bommarito, says the decision to train KL3M in this way stemmed from the company’s “risk-averse” clients like law firms. “They’re concerned about the provenance, and they need to know that output is not based on tainted data,” she says. “We’re not relying on fair use.” The clients were interested in using generative AI for tasks like summarizing legal documents and drafting contracts but didn’t want to get dragged into lawsuits about intellectual property as OpenAI, Stability AI, and others have been. Bommarito says that 273 Ventures hadn’t worked on a large language model before but decided to train one as an experiment. “Our test to see if it was even possible,” she says. The company has created its own training dataset, the Kelvin Legal DataPack, which includes thousands of legal documents reviewed to comply with copyright law. Although the dataset is tiny (around 350 billion tokens, or units of data) compared to those compiled by OpenAI and others that have scraped the internet en masse, Bommarito says the KL3M model performed far better than expected, something she attributes to how carefully the data had been vetted beforehand. “Having clean, high-quality data may mean that you don’t have to make the model so big,” she says. Curating a dataset can help make a finished AI model specialized to the task it’s designed for. 273 Ventures is now offering spots on a wait list to clients who want to purchase access to this data. Clean Sheet Companies looking to emulate KL3M may have more help in the future in the form of freely available infringement-free datasets. On Wednesday, researchers released what they claim is the largest available AI dataset for language models composed purely of public domain content. Common Corpus, as it is called, is a collection of text roughly the same size as the data used to train OpenAI’s GPT-3 text generation model and has been posted to the open source AI platform Hugging Face. The dataset was built from sources like public domain newspapers digitized by the US Library of Congress and the National Library of France. Pierre-Carl Langlais, project coordinator for Common Corpus, calls it a “big enough corpus to train a state-of-the-art LLM.” In the lingo of big AI, the dataset contains 500 billion tokens. OpenAI’s most capable model is widely believed to have been trained on several trillions. MOST POPULAR SCIENCE The Keys to a Long Life Are Sleep and a Better Diet—and Money MATT REYNOLDS BUSINESS Apple’s MM1 AI Model Shows a Sleeping Giant Is Waking Up WILL KNIGHT POLITICS Elon Musk's X Is Suspending Accounts That Reveal a Neo-Nazi Cartoonist's Alleged Identity DAVID GILBERT GEAR 21 Great Deals From Amazon’s Big Spring Sale LOURYN STRAMPE Common Corpus is a collaboration coordinated by the French startup Pleias, in association with a variety of other AI groups, including Allen AI, Nomic AI, and EleutherAI. It’s backed by the French Ministry of Culture and claims to include the largest open dataset to date in French. It aspires to be multicultural, though, as well as multipurpose—a way to offer researchers and startups across a wide variety of fields access to a vetted training set, free from concerns over potential infringement.

Manipulating Data. Data processing and analytics are some activities that AI is particularly good at, but as we saw in the Amazon example, AI models and algorithms can occasionally get out of control. Artificial intelligence performs better when humans are involved in data collection, annotation, and validation. Millions of data points can be gathered by AI systems, but if the AI algorithm is not properly trained, this data is meaningless. Data needs to be annotated by humans in order to rectify AI’s errors and expand its vocabulary. Artificial intelligence tools are significantly more powerful than humans, yet without human interaction leads, input and direction, these AI systems produce outcomes that are inconsistent or erroneous. Governance. AI can only do so much on its own without a set of guidelines or a comprehensive plan. Yes, AI is capable of learning new things on its own, but as we’ve already stated, even its learning process needs to be directed by a human. Therefore, the responsibility of humans in governance is to make sure AI models follow the law and apply it in a way that is consistent with their training. However, training and following the regulations are only the beginning of human oversight. The outcomes generated by AI must also be subject to human oversight. Making sure the outcomes are consistent with expectations is the main objective. This inspection can aid in discovering data biases and training errors.

In the past 20 years, the U.S. lost two-thirds of its newspaper journalist jobs—jobs that AI cannot fill.

Despite that, AI advancements are continuing the “platformization” of journalism and enabling a handful of technology firms to maintain their control over our information channels.

Following the deep-learning breakthroughs of the early 2010s, AI adoption surged across a myriad of industries and sectors. This rapid integration process brought to light a multitude of potential risks. From fatal accidents involving autonomous vehicles to discriminatory hiring practices by AI algorithms, the real-world consequences of AI development have become increasingly evident. Furthermore, manipulation of financial markets by algorithmic trading and the spread of misinformation on social media platforms highlight the broader societal concerns surrounding AI. Fueled by growing awareness of AI risks in the mid-2010s, national governments (including G7 members), international organizations, tech companies, and nonprofits launched a wave of policy and principle publications. Prominent examples include the European Union’s 2019 Ethics Guidelines for Trustworthy AI, the Recommendation of the Council on Artificial Intelligence by the OECD in 2019 (updated in 2024), and the Recommendation on the Ethics of Artificial Intelligence by the United Nations Educational, Scientific and Cultural Organization (UNESCO) in 2021. These publications emphasized pairing AI development with core values such as human rights, democracy, and sustainability as well as key principles including fairness, privacy, safety, security, transparency, and accountability. While fundamental values and AI principles provide a crucial foundation, translating them into implementable standards for AI systems remains a challenge. Addressing this challenge requires concrete and material guidance. Various initiatives have been undertaken at different levels to bridge this gap. At the national level, examples include the AI Risk Management Framework (RMF) published by the National Institute of Standards and Technology (NIST) in the United States in January 2023 and Japan’s AI Guidelines for Business. On a supra-national scale, leading examples include the 2023 AI Safety Summit’s Emerging Processes for Frontier AI Safety and the G7’s HCOC—the focus of this report. Additionally, nongovernmental organizations such as the International Organization for Standardization (ISO) have contributed by issuing international standards on AI governance. The AI management system standard ISO/IEC 42001 was published in December 2023. The Human Rights, Democracy, and the Rule of Law Assurance Framework for AI Systems (HUDERAF), proposed by the Alan Turing Institute to the Council of Europe’s Ad Hoc Committee on Artificial Intelligence, is another significant example of AI risk management and stakeholder engagement. Collectively, these diverse approaches underscore the ongoing efforts to transform abstract AI principles into a practical and implementable reality.

An AI can unintentionally swallow a poison pill of its own making to induce model collapse is the conclusion of a new research paper that raises new concerns about AI training and long-term accuracy while highlighting a need for an image classification system that may save AI from itself. Once the poison is consumed, the AI never fully heals. The research paper called “Nepotistically Trained Generative-AI Model Collapse” is authored by Matyas Bohacek of Stanford University and Hany Farid of the University of California, Berkeley. The key conclusion is that when an AI is trained on even small amounts of data of its own creation, generative AI produces distorted images. Given that generative AI text-to-image models are trained in data scrapped from the internet, future data scrapping will likely involve material created by the AI itself. When this happens, the researchers discovered, it’s as if the AI has consumed a poison pill. The researchers found that when an AI is trained on its own images, the result, while initially yielding a small improvement in quality, quickly turned into a highly distorted picture, a process they call “model poisoning.” The model collapse persisted even when the self-generated images the AI inadvertently ”retrained” on were as little as 3 percent. The researchers found that “the popular open-source model Stable Diffusion (SD) is highly vulnerable to data poisoning.”

Great power conflict is becoming a reality on the global agenda, once again. For the past nearly three decades, the primary focus of the global strategic community was on small wars, counter-terrorism, and climate change, poverty, pandemics and transnational organized crime. Further, during these years, there was optimism that globalization and interdependence could bring about political and economic transformation inducing global peace and stability. The post-Cold War world with the United States as the superpower, a weak Russia, and rising China did not witness the intense geopolitical struggles of the earlier generations. The realigned blocs and alliances and growth of regional organizations across the globe also limited the possibilities of such conflict. But developments in the past couple of years herald a new era of high politics. The relative decline of the US, the rise of China as America’s leading competitor, the re-emergence of Russia and its desire for greater role in global politics all seem to be serving as stimuli for a renewed round of great power competition. The mounting tensions in East and South China Seas, ‘trade war’ between China and the US, and Russia's assertive engagement in Ukraine and Syria are cases in point. Further, three recent US government documents — National Security Strategy (NSS), National Defense Strategy (NDS) and Nuclear Posture Review (NPR) — herald the return of great power competition by emphasising that terrorism is no longer the top US priority and that the US focus from now will be on strategic competition with great powers such as Russia and China.1 The responses of China and Russia and their articulations also point to competition which can ultimately push the world into great power conflict. Thus, on the one hand, the US, worried about the relative decline of its primacy, has declared that great power competition will be its primary focus from now on.2 Accordingly, it is prioritising military options and arms race over diplomacy and arms control. On the other, with worldviews that stand in contradiction to that of the US, China and Russia are also flexing their muscles. Against this backdrop of the return of great power conflict, this issue brief analyses the strategic documents and the actions of the US, China, and Russia3 to draw insights into the prospects for productive cooperation among great powers on critical international issues. Threat of Great-Power Conflict: Hype vs Reality The majority of the explanations for the return of great-power conflict hark back to the history of world politics, particularly the accounts of power shifts and their ramifications. Indeed, changes in the power hierarchy have been one of the most familiar explanations for great power conflict.4 One such example is the idea of a ‘Thucydides Trap’, which has been articulated by Graham Allison in Destined for War. The ancient Greek historian Thucydides observed that “it was the rise of Athens and the fear that this instilled in Sparta that made war inevitable.”5 In the present-day context, as China challenges American hegemony, misconceptions between these two powers about the other’s actions and intentions could lead them into a similar trap. Allison analyses 16 cases of great power conflicts in the past 500 years, in which a rising power threatened to displace a ruling one and concludes that, among these, 12 ended in war.6 British efforts to contain the rise of Germany and the outcome, First World War, are the 20th century reference for the destined path of power transition in global politics. History is not the only source and support for reasoning about great power conflict. In January 2018, The Economist published a cover story titled, 'The Next War: The Growing Threat of Great Power Conflict’, which detailed how shifts in technology and geopolitics are bringing the threat of great-power conflict back. In this view, “conflict on a scale and intensity not seen since the Second World War is once again plausible.”7 Discussing the likelihood of a second Korean War, the article observes that beyond the nuclear quandary in the Korean peninsula, China is at the cusp of great-power competition with the West.8 Interestingly, many of the defence industries in the US have started preparing for a great power conflict with serious investment in new technologies.9 The massive Russian and Chinese arms modernisation efforts are also geared towards a similar objective.10 A large number of analysts hold the threat of great power conflict in their priority listing. Some see great power competition across all three regions of Eurasia and beyond as well as the revival of a global ideological struggle as the core characteristic of the emerging era.11 Dmitri Trenin explains this phenomenon in a global context. He observes that the mounting tensions in the East and South China Seas, the arrival of nationalist leaders in Tokyo and New Delhi, and the revisionist, resurgent Russia as an emerging trend of great-power competition.12 A recent report of the Centre for Strategic and International Studies (CSIS) titled 'Coping with Surprise in Great Power Conflicts' evaluates the plausibility and military implications of future great power conflicts.13 Stephen F. Cohen, Professor Emeritus of Russian Studies in New York University and Princeton argues that both the NDS and NPR validate what he has been warning for the last 20 years — a second Cold War with Russia.14 US and the Future of Great-Power Conflict At the core of the burgeoning scholarly interest in great-power conflict are three recent US government documents: the NSS, NDS and NPR. The NSS observes that “after being dismissed as a phenomenon of an earlier century, great power competition returned.” Further, it said that China and Russia began to reassert their regional and global influence and fielding military capabilities designed to deny American access. Through challenging the geopolitical advantages of the US, China and Russia are trying to change the international order in their favour, the NSS observed.15 While discussing future regional strategies, NSS also signalled the possibility of the return of an ideological struggle similar to the Cold War by stating that “a geopolitical competition between free and repressive visions of world order is taking place in the Indo-Pacific region.”16 The NSS explicitly and repeatedly criticises China’s efforts at using economic incentives and military threats to “persuade other states to heed its political and security agenda.”17 Moreover, in rather tough words, the document criticises China’s prestigious Belt and Road Initiative for its “unfair trade practices” and “extractive economic policies.”18 As the NSS shows, the US views China and its rise as a threat to US hegemony. Similarly, the NDS also paints Russia and China with the same brush, but in darker hues. While releasing the document at the Johns Hopkins School of Advanced International Studies (SAIS), Secretary of Defence James N. Mattis indicated the shift in strategy by saying “great power competition, not terrorism, is now the primary focus of US national security.”19 He also added that “we face growing threats from revisionist powers as different as China and Russia are from each other, nations that do seek to create a world consistent with their authoritarian models, pursuing veto authority over other nations' economic, diplomatic and security decisions.”20 Mattis expressed a similar view in his testimony to the Senate Armed Services Committee as well. He said: “A return of great power competition, marked by a resurgent and more aggressive Russian Federation and a rising, more confident and assertive China, places the international order under assault.”21 While the NSS talks of a Chinese threat to the Indo-Pacific region, the NDS presents it as an imminent threat to the rules-based world order in which China seeks to replace the US as the global leader. The strategy contains elements of both the notion of ‘winner takes all’ and the concept of Thucydides Trap. For instance, the US sees China’s military modernisation programme as an effort to displace US hegemony and achieve global pre-eminence. The basis of such calculations is the same strategic distrust and worst-case assumptions explained by Graham Allison. These fundamental shifts in US policy, prioritising inter-state competition, supplemented with similar responses from China and Russia, have brought the threat of great power conflict to the top of the global agenda. The new NPR also acknowledges the emergence of great power tensions as the driving force in international security. Taking advances in Russian and Chinese nuclear capabilities seriously, the review proposes a comprehensive nuclear recapitalisation programme to meet the future threat. Here too, the priority for Washington is to “maintain a forward military presence capable of deterring and, if necessary, defeating any adversary.”22 Many see these developments as an inevitable fall out of the Trump Presidency. However, the Obama administration had also identified Russia and China as the greatest security challenges to the US. For instance, in his Defense Posture Statement, the then Secretary of Defense Ashton Carter described “great power competition from a resurgent Russia and a rising China” as the top two challenges for the US in future.23 The statement continued: “Russia and China are our most stressing competitors, as they have both developed and are continuing to advance military systems that threaten our advantages in specific areas, and in some cases, they are developing weapons and ways of war that seek to achieve their objectives in ways they hope would pre-empt a response by the United States.”24 Chinese and Russian views on Great-Power Competition While US strategic documents identify China and Russia as great powers and competition with these countries as its future priority,25 the articulations and responses from China and Russia also signal the return of high politics. Both China and Russia view themselves as great powers. China’s economic weight, rapidly expanding military power including nuclear weapons, population size and UNSC veto virtually guarantee great power status. Though Russia has limited capabilities outside the nuclear realm and UNSC membership, it still enjoys the power to disrupt and reconfigure the international system. It has the ability to devastate a significant portion of the globe with its nuclear and conventional weapons arsenal. Another significant factor is Russia’s strategic geographical location, which makes it an indispensable player in both Asia and the Greater Middle East. Finally, with its huge energy resource, Russia is an energy superpower as well. China, with its growing influence in the system, aims to reshape the international order to ensure that it is receptive to its concerns. Though China has not stated that great power competition is its priority, its grand strategy puts it in competition with the interests of the US and other powers in the system. When power transition theories suggested that arising power and the hegemon are unlikely to settle peacefully26 and projected China as the latest challenger to US hegemony, China responded with a curious phrase: 'A new model of great power relations'27 This notion refused to see great power relations as a zero-sum game and proposed a win-win situation for all through cooperation. It was Xi Jinping who proposed to establish a ‘new type of Great Power relations’ between China and the US during his trip to Washington in 2012. For several years thereafter, the promise of a 'new model' was nearly impossible for Chinese media and officials to avoid mentioning. For instance, in September 2015, on the eve of President Xi's visit to the United States, Cui Tiankai, the Chinese Ambassador to the US, used the phrase 12 times in a single editorial in the Peoples' Daily.28 However, since Donald Trump came to office, China has abandoned the phrase and focused on donning the mantle of global leadership. Xi's address on economic globalization in Davos is a case in point.29 It is true that, while the global media extensively debated the portrayal of China in the NSS as a threat to US hegemony, the People's Daily, the official newspaper of the Chinese Communist Party, did not even react to the criticism. However, militarily, China continues to invest in capabilities that are explicitly designed to exploit perceived US military vulnerabilities. China’s Military Strategy (2015) asserts that its armed forces will gradually shoulder more international responsibilities and obligations.30 Its anti-access/area-denial capabilities threaten to erode the foundation of the US security commitments in Asia.31 Chinese policies towards the Asia-Pacific inevitably challenge the US approach. For instance, in January 2017, 'China's Policies on Asia-Pacific Security Cooperation' strongly criticised the US on the issues of Anti-Ballistic Missile and South China Sea.32 Moreover, the Chinese military today represents a cutting-edge combat force that fields increasingly sophisticated capabilities in significant numbers. Its fifth-generation stealth fighter, the J-20, poses a vital threat to US air and naval power in the Indo-Pacific.33 The trade war between the US and China and Chinese plans to pay for oil in yuan instead of the dollar in future also indicate that the relationship between the two great powers will not be friendly.34 The deteriorating relationship between Russia and the West and Russia's worldview also enhance the threat of great power conflict. Russia believes that the Western system of order threatens its interests and wants to work towards the development of a new world order that promotes Russian interests.35 Russia’s security and military policy after 2014 sees the world as a hostile place marked by stiff competition amongst major powers and all documents emphasize the importance of military force in global politics.36 Russia’s military doctrine also reflects its tense relationship with the West. Maintaining Russia’s pre-eminence in the post-Soviet space remains its key foreign policy priority.37 The relationship between Russia and the West is in a new low with allegations of Russian involvement in US elections and also in the nerve agent attack against a former Russian spy on British soil. While NATO identifies Russia as the principal security threat to the West, alongside the Islamic State and Ebola, Russia is engaged in nuclear sabre-rattling to remind the West of the possible costs of military action against Russia. Russia is also making efforts to form a grand anti-US alliance with China.38 The Syrian conflict is another example of evolving Russia-US clash. While Russia supports Assad regime, the US backs some of the opposition forces including the Kurds. Though the Cold War ended almost three decades ago, one of the alliances that owes its origins to that struggle, NATO, still plays a pivotal role in the mounting tensions with Russia. The crisis in Ukraine is a case in point. As John Mearsheimer argues, it was the West’s fault, NATO enlargement and EU’s eastward expansion that provoked Putin to use military force.39 NATO's defensive drill called 'Iron Wolf 2017' to deter Russian aggression in the Kaliningrad enclave of Baltic and Russia's response 'Zapad 2017' contributed a lot to the mounting tension.40 These military drills represent a shift from a “political” dispute to a “military” conflict between the two sides. Conclusion US strategic documents and the Chinese and Russian responses confirm that the geopolitical competition among the great powers is rising. However, none of this leads to the automatic conclusion that a great power conflict will break out anytime in the near future. Viewed through the prism of power transition theory, US strategies and decision to prioritise military options over diplomacy could pave the way towards military conflict. If the hegemon decides to check its decline by escalating tensions with other great powers in the system, the risk of conflict will rise. The fundamentally anarchic nature of world politics supplemented by the deepening misperceptions and faulty calculations of the great powers would suggest a similar conclusion. Great power relations are the sole prominent make-or-break issue in determining whether major war or relative peace will characterize the international system. It also virtually conditions the response of the global community to other significant challenges. In any case, the geopolitical competition among great powers with or without direct conflict will lead to a situation where productive cooperation among great powers on international issues is likely to prove difficult. Consequently, it will limit the ability of the great powers to make positive systemic changes in the world order.

A second major AI attack surface is the military. Military applications of AI are expected to be a critical component of the next major war. The U.S. Department of Defense has recently made the integration of artificial intelligence and machine learning into the military a high priority with its creation of the Joint Artificial Intelligence Center (JAIC). The JAIC has “the overarching goal of accelerating the delivery of AI-enabled capabilities, scaling the Department-wide impact of AI, and synchronizing DoD AI activities to expand Joint Force advantages.”35 The Pentagon’s Project Maven applies AI to the analysis of full motion video (FMV), highlighting the military’s desire to use AI to identify ground-based assets.36 The Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory’s (AFRL) release of the Moving and Stationary Target Acquisition and Recognition dataset is aimed at building AI techniques to classify and recognize targets of interest.37 Attacking these military AI systems is the logical successor of General Patton’s FUSAG. The contested environments in which the military operates creates a number of unique ways for adversaries to craft attacks against these military systems, and correspondingly, a number of unique challenges in defending against them. First, adversaries may capture the physical equipment, including drones and weapon systems, on which AI systems will live. The loss and capture of this equipment will be routine in future conflicts, and the threat this poses to AI systems will grow as more and more AI-enabled systems are deployed in the field or on equipment that can be captured by an adversary. This trend will further increase with the proliferation of “edge computing” in military contexts. In edge computing, rather than sending data to a centralized cloud infrastructure for processing, the data and AI algorithms are stored and run directly on the devices deployed in the field. The DoD has made the development of “edge computing” a priority, as the bandwidth needed to support a cloud-based AI paradigm is unlikely to be available in battlefield environments.38 This reality will require these systems to be treated with care. Just as the military recognizes the threat created when a plane, drone, or weapon system is captured by an enemy, these AI systems must be recognized and treated as a member of this same protected class so that the systems are not compromised if captured by an enemy. Second, the military’s unique domain necessitates the creation of similarly unique datasets and tools, both of which are likely to be shared within the military at-large. Because these datasets and systems will be expensive and difficult to create, there will be significant pressures to share them widely among different applications and branches. However, when multiple AI systems depend on this small set of shared assets, a single compromise of a dataset or system would expose all dependent systems to attack. Despite this risk, shared datasets are expected to become widespread within military AI operations. The DoD has already stated that the foundation for its AI efforts “includes shared data, reusable tools, frameworks, libraries, and standards…”39 The initial DoD AI applications, which focus on extracting information from aerial images and video, illustrate why sharing datasets is attractive. These datasets are critical to developing a set of powerful AI systems, but are expensive—both in terms of time and money—to collect and prepare.40 As a result, there is a logical desire to share and reuse these datasets across many different applications rather than creating a separate dataset for each application. However, this creates a single point of vulnerability for system-wide attacks. If this data is hacked or compromised, every application developed using this data would be potentially compromised. If a large number of applications depended on this same shared dataset, this could lead to widespread vulnerabilities throughout the military. In the case of input attacks, an adversary would then be easily able to find attack patterns to engineer an attack on any systems trained using the dataset. In the case of poisoning attacks, an adversary would only need to compromise one dataset in order to poison any downstream models that are later trained using this poisoned dataset.

*lowkey this card is much worse than the one above. Just say ISIS resurgence causes extinction, vedant

Furthermore, the proposed posture serves as a deterrent to adversaries with cyber capabilities. A strategic adversary could launch a real strike and use cyber-based tactics to induce additional uncertainty. This heightened uncertainty may overwhelm the president, making it difficult to initiate a retaliatory response. Consequently, this situation may create incentives for adversaries to launch a first strike. However, if adversaries believe that a delayed retaliatory response is likely, the incentive to launch such a cyber-nuclear attack is reduced. Other actors, namely terrorists with cyber capabilities, may try to provoke a preemptive launch by fabricating a false signal. The decide-under-attack posture addresses this by delaying the response until there is greater evidence, such as additional sensor correlation or confirmation of weapons impact. A potential weakness of this approach would be if an adversary could convincingly deliver a false signal across multiple systems to provoke a launch order and then disrupt communications. However, the time delay, combined with the availability of alternative communications methods (since the warning was false), adds layers of resilience to prevent a mistaken launch.

Another type of omnicidal actor comes in the form of apocalyptic terrorists who believe that to save the world, it must first be destroyed. ISIS, arguably the largest and richest terrorist group in history, is a paradigm case. While some members of ISIS probably didn’t hold apocalyptic beliefs, the leadership most certainly did — and they made strategic decisions based on these beliefs. The man who essentially founded ISIS, Abu Musab al-Zarqawi, believed that Islam’s version of Armageddon was about to unfold around the small Syrian town of Dabiq. Hence, the name of the group’s propaganda magazine, Dabiq. After the U.S. military killed al-Zarqawi in 2006, leadership of ISIS transferred to Abu Ayyub al-Masri, a fevered apocalypticist who insisted that the Islamic end-of-days messianic figure, the “Mahdi,” was about to appear in Iraq. Like al-Zarqawi, he based his strategy on his apocalyptic belief — and it backfired. He soon met his end at the hands of Western forces. Both of these individuals really believed that the end was nigh, and that it was their duty to use violence — catastrophic violence, to be more specific — to bring about the apocalypse. ISIS members talked about acquiring nuclear weapons, releasing deadly pathogens, and building dirty bombs. There isn’t a single terrorism scholar who doesn’t think that ISIS would have gleefully pushed a “destroy-the-world” button, especially if Western forces were marching toward Dabiq. But ISIS is far from the only apocalyptic group. Famously, the doomsday cult Aum Shinrikyo attempted to trigger Armageddon by releasing sarin in the Tokyo subway in 1995. Here in the U.S., more than a dozen hate groups subscribe to Christian Identity, an apocalyptic worldview that endorses the use of catastrophic violence as a means of triggering a “race war” that will initiate the end of the world. And one of the bloodiest conflicts in human history, the Taiping Rebellion, involved an apocalyptic movement called the “Taiping Heavenly Kingdom.” This was led by a man named Hong Xiuquan, who believed that he was the brother of Jesus Christ, “commissioned by the Lord of Heaven to slay the devil-demons (Manchus) whose rule had brought ruin to China.” Hong Xiuquan A final type of omnicidal actor lingers within the outermost fringe of radical environmentalist, anarcho-primitivist, and Neo-Luddite ideologies. Ted Kaczynski, better known as the Unabomber, provides an example par excellence. Beginning in 1978, Kaczynski perpetrated numerous domestic terrorist attacks, killing three people and injuring 23 others. A former UC Berkeley mathematics professor and Harvard alumnus, Kaczynski didn’t wish for humanity to go extinct. Rather, he wanted to trigger a global revolution against industrial society, with the ultimate goal of causing its collapse. Kaczynski ultimately didn’t care whether his revolution would cause people to die, since in his utilitarian calculus the ends would justify the means. As Kaczynski wrote in 1995: “This revolution may or may not make use of violence; it may be sudden or it may be a relatively gradual process spanning a few decades. Its object will be to overthrow not governments but the economic and technological basis of the present society.” In contrast, other actors in this category have explicitly embraced pro-extinction convictions. For example, the Gaia Liberation Front (GLF), an ecoterrorist group, holds as their mission “the total liberation of the Earth, which can be accomplished only through the extinction of the Humans as a species.” In advocating this, they argue that “if any Humans survive, they may start the whole thing over again. Our policy is to take no chances.” How might they accomplish their omnicidal aims? GLF contends that bioengineering is “the specific technology for doing the job right of annihilating humanity — and it’s something that could be done by just one person with the necessary expertise and access to the necessary equipment.” They continue: “…genetically engineered viruses… have the advantage of attacking only the target species. To complicate the search for a cure or a vaccine, and as insurance against the possibility that some Humans might be immune to a particular virus, several different viruses could be released (with provision being made for the release of a second round after the generals and the politicians had come out of their shelters).” This parallels an anonymous article in the Earth First! Journal, published in 1989, meaning that this idea has been around for a while: “Contributions are urgently solicited for scientific research on a species specific virus that will eliminate Homo shiticus from the planet. Only an absolutely species specific virus should be set loose. Otherwise it will be just another technological fix. Remember, Equal Rights for All Other Species.” While the most radical fringe of the environmentalist movement has avoided the limelight in recent years, some experts, such as the terrorism scholar Frances Flannery, expect a resurgence as climate and biodiversity crises worsen. This poses an obvious danger in a world replete with bullets and bombs; but it poses an existential threat in a world of cheap and easy gene editing. Technologies such as gene drives, digital-to-biological converters, and CRISPR-Cas9 are making it increasingly feasible to synthesize designer pathogens that could be far more devastating than anything found in nature.

Content filters are society’s digital immune systems. By removing foreign assets that are dangerous, illegal, or against the terms-of-service of a particular application, they keep platforms healthy and root out infections. Content filters are also uniquely qualified to police content at the scale the Internet requires. The content uploaded to the Internet each minute is a staggering amount growing at a staggering rate. Over three billion images are shared every day on the Internet.28 AI-based content filters have emerged as the primary, if not only, tool able to operate at this scale, and have been widely adopted by industry. For example, Facebook removed 21 million pieces of lewd content in the first quarter of 2018 alone, 96% of which was flagged by these algorithms.29 Content filtering has taken on increased urgency in the past years. ISIS successfully used social media as one of its main recruitment avenues.30 Nationalists in Myanmar used Facebook as its mouthpiece to incite a campaign of Rohingyan genocide.31 Misinformation campaigns deploying fake content on social networks have been used to influence democratic elections in the U.S. and Europe.32 As this content successfully weaponizes US-based platforms, the efficacy of AI-based content filters has broad-ranging implications, including the defense of both national security and oppressed populations. Beyond these newest matters, content filters must continue to be effective with important tasks already within their purview, such as the detection of child pornography. Perhaps the only concept that could make strange bedfellows of the Americans, Russians, Chinese, and Iranians, child pornography was universally accepted as a target of censorship even from the early days of the Internet. AI-based content filters allow website and platform operators to efficiently and effectively scan the millions of images uploaded each minute for illicit content, and immediately destroy offending images. In addition to custom tools companies built for their own use, this detection software was eventually provided via the Software as a Service (SaaS) distribution model, where one large company like Microsoft offered an API-based content filter that website owners could use instead of building their own.33 Even in more banal uses, content filters are tied to many business models. As advertisers begin to be held responsible in the court of public opinion for the content appearing next to their advertisements, there is a growing need to detect an increasing number of objectionable content types. This extends to detection of nudity, violence, hate crimes, weapons, adult pornography, profanity, and inappropriate comments. YouTube faced the boycott of advertisers including AT&T, Disney, Hasbro, and Nestle for failing to effectively filter sexual comments left by viewers on videos in which children appeared.34 As content filters are drafted into these battles, there will be strong incentives both to attack them and to generate tools making these attacks easier to execute. Adversaries have already seen the power of using digital platforms in pursuit of their mission. ISIS organically grew an international following and successfully executed a large-scale recruitment program using social media. These are successes that, morals aside, may have evoked jealousy from the marketing departments of Fortune 500 companies. Future organizations of malice are likely to follow the same playbook. If confronted with better content filters, they are likely to be the first adopters of AI attacks against these filters. In an environment with AI attacks, content filters cannot be trusted to perform their job. Because content filters are now being used as the first and, in many respects, only line of defense against terrorism, extremism, and political attack on the Internet, important parts of society would be left defenseless in the face of successful AI attacks. These attacks give adversaries free reign to employ these platforms with abandon, and leave these societal platforms unprotected when protection is needed more than ever. Further, it will be difficult to stop or even detect these attacks on content filters because they will likely go wholly unnoticed. Because content filtering is applied to digital assets, it is particularly well suited to the “imperceivable” input attacks. Further, unlike many other cyberattacks in which a large-scale theft of information or system shutdown makes detection evident, attacks on content filters will not set off any alarms. The content will simply fall through the filter unnoticed. In this respect, entities such as social networks may not even know they are under attack until it is too late, a situation echoing the 2016 U.S. presidential election misinformation campaigns. As a result, as is discussed in the policy response section, content-centric site operators must take proactive steps to protect against, audit for, and respond to these attacks.

New technologies bring with them new opportunities — and new threats. As we enter the new year, many eyes are on the transformative potential of artificial intelligence (AI). Some of those eyes may belong to bad actors looking to take advantage of the attack vectors endemic to new generative AI systems. This, as the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) on Thursday (Jan. 4) released a “Trustworthy and Responsible AI” report identifying the four types of cyberattacks that can manipulate the behavior of AI systems, as well as key mitigation strategies and their limitations. The government agency has been charged with developing domestic guidelines for the evaluation of AI models and red-teaming; facilitating the development of consensus-based standards; and providing testing environments for the evaluation of AI systems, among other duties. NIST has found that AI systems are increasingly vulnerable to attacks from bad actors that can evade security and even prompt data leaks. “Despite the significant progress AI and machine learning have made, these technologies are vulnerable to attacks that can cause spectacular failures with dire consequences,” NIST computer scientist Apostol Vassilev, one of the publication’s authors, said. “There are theoretical problems with securing AI algorithms that simply haven’t been solved yet. If anyone says differently, they are selling snake oil.”

The methods underpinning the state-of-the-art artificial intelligence systems are systematically vulnerable to a new type of cybersecurity attack called an “artificial intelligence attack.” Using this attack, adversaries can manipulate these systems in order to alter their behavior to serve a malicious end goal. As artificial intelligence systems are further integrated into critical components of society, these artificial intelligence attacks represent an emerging and systematic vulnerability with the potential to have significant effects on the security of the country. These “AI attacks” are fundamentally different from traditional cyberattacks. Unlike traditional cyberattacks that are caused by “bugs” or human mistakes in code, AI attacks are enabled by inherent limitations in the underlying AI algorithms that currently cannot be fixed. Further, AI attacks fundamentally expand the set of entities that can be used to execute cyberattacks. For the first time, physical objects can be now used for cyberattacks (e.g., an AI attack can transform a stop sign into a green light in the eyes of a self-driving car by simply placing a few pieces of tape on the stop sign itself). Data can also be weaponized in new ways using these attacks, requiring changes in the way data is collected, stored, and used. Critical parts of society are already vulnerable. There are five areas most immediately affected by artificial intelligence attacks: content filters, the military, law enforcement, traditionally human-based tasks being replaced by AI, and civil society. These areas are attractive targets for attack, and are growing more vulnerable due to their increasing adoption of artificial intelligence for critical tasks. This report proposes “AI Security Compliance” programs to protect against AI attacks. Public policy creating “AI Security Compliance” programs will reduce the risk of attacks on AI systems and lower the impact of successful attacks. Compliance programs would accomplish this by encouraging stakeholders to adopt a set of best practices in securing systems against AI attacks, including considering attack risks and surfaces when deploying AI systems, adopting IT-reforms to make attacks difficult to execute, and creating attack response plans. This program is modeled on existing compliance programs in other industries, such as PCI compliance for securing payment transactions, and would be implemented by appropriate regulatory bodies for their relevant constituents. Regulators should mandate compliance for governmental and high-risk uses of AI. Regulators should require compliance both for government use of AI systems and as a pre-condition for selling AI systems to the government. In the private sector, regulators should make compliance mandatory for high-risk uses of AI where attacks would have severe societal consequences, and optional for lower-risk uses in order to avoid disrupting innovation. Introduction The terrorist of the 21st century will not necessarily need bombs, uranium, or biological weapons. He will need only electrical tape and a good pair of walking shoes. Placing a few small pieces of tape inconspicuously on a stop sign at an intersection, he can magically transform the stop sign into a green light in the eyes of a self-driving car. Done at one sleepy intersection, this would cause an accident. Done at the largest intersections in leading metropolitan areas, it would bring the transportation system to its knees. It’s hard to argue with that type of return on a $1.50 investment in tape. This is a study of how an obscure problem within artificial intelligence—currently the concern of a tiny subfield of yet another subfield of computer science—is on a dangerous collision course with the economic, military, and societal security of the future, and what can be done about it. The artificial intelligence algorithms that are being called upon to deliver this future have a problem: by virtue of the way they learn, they can be attacked and controlled by an adversary. What we see as a slightly vandalized stop sign, a compromised artificial intelligence system sees as a green light. Call it an “artificial intelligence attack” (AI attack). This vulnerability is due to inherent limitations in the state-of-the-art AI methods that leave them open to a devastating set of attacks that are as insidious as they are dangerous. Under one type of attack, adversaries can gain control over a state-of-the-art AI system with a small but carefully chosen manipulation, ranging from a piece of tape on a stop sign1 to a sprinkling of digital dust invisible to the human eye on a digital image.2 Under another, adversaries can poison AI systems, installing backdoors that can be used at a time and place of their choosing to destroy the system. Whether it’s causing a car to careen through a red light, deceiving a drone searching for enemy activity on a reconnaissance mission, or subverting content filters to post terrorist recruiting propaganda on social networks, the danger is serious, widespread, and already here. However, just as not all applications of AI are “good,” not all AI attacks are necessarily “bad.” As autocratic regimes turn to AI as a tool to monitor and control their populations, AI “attacks” may be used as a protective measure against government oppression, much like technologies such as Tor and VPNs are. Regardless of their use, AI attacks are different from the cybersecurity problems that have dominated recent headlines. These attacks are not bugs in code that can be fixed—they are inherent in the heart of the AI algorithms. As a result, exploiting these AI vulnerabilities requires no “hacking” of the targeted system. In fact, attacking these critical systems does not even always require a computer. This is a new set of cybersecurity problems, and cannot be solved with the existing cybersecurity and policy toolkits governments and businesses have assembled. Instead, addressing this problem will require new approaches and solutions. Given time, researchers may discover a technical silver bullet to some of these problems. But time ran out yesterday. For a technology that was nascent a decade ago, AI is now being used as a key ingredient across every industry, from Main Street to Wall Street, from the baseball diamond to the battlefield. And on cue, as with every other recent technological development—the Internet, social media, and the Internet of Things—in our haste we are turning a blind eye to fundamental problems that exist. This report seeks to provide policymakers, politicians, industry leaders, and the cybersecurity community an understanding of this emerging problem, identify what areas of society are most immediately vulnerable, and set forth policies that can be adopted to find security in this important new era. The report is split into four sections. First, it begins by giving an accessible yet comprehensive description of how current AI systems can be attacked, the forms of these attacks, and a taxonomy for categorizing them. Second, the report identifies the most critical areas affected by this new class of vulnerabilities. While the number of systems affected by this new threat will only grow as AI increases its penetration into the modern world, this report focuses on five high priority areas that require immediate attention: content filters, military, law enforcement, human tasks being replaced with AI, and civil society. Third, the report contextualizes AI vulnerabilities within the larger cybersecurity landscape. It argues that AI attacks constitute a new vertical of attacks distinct in nature and required response from existing cybersecurity vulnerabilities. This section also discusses the use of AI attacks as an offensive cyber weapon. Fourth, the report proposes the idea of “AI Security Compliance” programs to protect against AI attacks. These compliance programs will reduce the risk of attacks on AI systems and lower the impact of successful attacks. They will accomplish this by encouraging stakeholders to adopt a set of best practices in securing systems against AI attacks, including considering attack risks and surfaces when deploying AI systems, adopting IT-reforms that will make attacks more difficult to execute, and creating attack response plans to mitigate attack damage. The report further suggests regulators should mandate compliance in portions of both the public and private sectors. In the public sector, compliance should be mandated for governmental uses of AI and be a pre-condition for private firms selling AI systems to the government. In the private sector, compliance should be mandated for high-risk private sector AI applications, but should be optional for lower-risk uses in order to avoid disrupting innovation in this rapidly changing field. This policy will improve the security of the community, military, and economy in the face of AI attacks. But for policymakers and stakeholders alike, the first step towards realizing this security begins with understanding the problem, which we turn our attention to now. Part I: Technical Problem Understanding the Problem through a Historical Analogy General George Patton may have won the D-Day campaign for the Allies without ever firing a shot. In support of the future D-Day landings, Patton was given charge of the First United States Army Group (FUSAG). Rather than fighting in arms, the FUSAG fought in deception. To convince the German command that the invasion point would be Pas de Calais rather than Normandy, the FUSAG orchestrated a major force deployment—including hundreds of tanks and other vehicles—directly across the English Channel from it. These tanks, however, were not what they seemed. Unable to spare the vehicles needed for this show of force from the actual war effort, the Allies instead used inflatable balloons painted to look like tanks. Although more characteristic of a technique employed by Bugs Bunny against Elmer Fudd than George Patton against Nazis, it did the trick. German reconnaissance was fooled. The images captured by the Luftwaffe planes were interpreted as a major buildup of forces in anticipation of an invasion of Pas de Calais, leaving the beaches of Normandy under-fortified.3 Given access to the site, we would not expect a human to mistake what was essentially a painted balloon for a multi-ton metal machine. But German reconnaissance worked by recognizing patterns: the shapes and markings representing tanks and other military assets in images. Relegated to pattern matching, German reconnaissance was easy to fool with a few strategic markings placed on the inflatable balloons. Although surprising, this is the same flaw that dooms AI algorithms, allowing them to be fooled in similar and even more pernicious manners. To understand why AI systems are vulnerable to the same weakness, we must briefly examine how AI algorithms, or more specifically the machine learning techniques they employ, “learn.” Just like the reconnaissance officers, the machine learning algorithms powering AI systems “learn” by extracting patterns from data. These patterns are tied to higher-level concepts relevant to the task at hand, such as which objects are present in an image. As an example, consider the task of an AI algorithm on a self-driving car learning to recognize a stop sign. For this task, the algorithm “learns” by being shown a dataset containing hundreds or thousands of examples of stop signs and extracting patterns of colors and shapes representative of it. When later tasked to identify if a particular sign is a stop sign, the algorithm scans the image looking for the patterns it has learned to associate with a stop sign. If the patterns match, the algorithm can instruct the car to stop. If the patterns match that of a different sign, such as a new faster speed limit, the algorithm can similarly instruct the car to speed up. Just as the FUSAG could expertly devise what patterns needed to be painted on the inflatable balloons to fool the Germans, with a type of AI attack called an “input attack,” adversaries can craft patterns of changes to a target that will fool the AI system into making a mistake. This attack is possible because when patterns in the target are inconsistent with the variations seen in the dataset, as is the case when an attacker adds these inconsistent patterns purposely, the system may produce an arbitrary result. However, unlike the tank example, these patterns or markings need not be as blatant. This is because AI algorithms process information differently than humans do. As a result, while it may have been necessary to make the balloons actually look like tanks to fool a human, to fool an AI system, only a few stray marks or subtle changes to a handful of pixels in an image are needed to destroy an AI system. These input attacks are only one type of AI attack. Another—known as a poisoning attack—can stop an AI system from operating correctly in situations, or even insert a backdoor that can later be exploited by an adversary. Continuing the analogy, poisoning attacks would be the equivalent of hypnotizing the German analysts to close their eyes anytime they were about to see any valuable information that could be used to hurt the Allies. As a whole, these attacks have the characteristics of a severe cyber threat: they are versatile in form, widely applicable to many domains, and hard to detect. They can take the form of a smudge or squiggle on a physical target, or be hidden within the DNA of an AI system. They can target assets and systems in the real world, such as making stop signs invisible to driverless cars, and in the cyber world, such as hiding child pornography from the content detectors seeking to stop its spread. Perhaps most concerning is that AI attacks can be pernicious and difficult to detect. Attacks can be completely invisible to the human eye. Conversely, they can be grand and hidden in plain sight, made to look like they fit in perfectly with their surroundings. But what exactly are AI attacks? Why do they exist? And what do they look like? We now turn our attention to understanding the technical basis of these attacks in order to answer these questions. Overview of Artificial Intelligence Attacks An artificial intelligence attack (AI attack) is the purposeful manipulation of an AI system with the end goal of causing it to malfunction. These attacks can take different forms that strike at different weaknesses in the underlying algorithms: Input Attacks: manipulating what is fed into the AI system in order to alter the output of the system to serve the attacker’s goal. Because at its core every AI system is a simple machine—it takes an input, performs some calculations, and returns an output—manipulating the input allows attackers to affect the output of the system. Poisoning Attacks: corrupting the process during which the AI system is created so that the resulting system malfunctions in a way desired by the attacker. One direct way to execute a poisoning attack is to corrupt the data used during this process. This is because the state-of-the-art machine learning methods powering AI work by “learning” how to do a task, but they “learn” from one source and one source only: data. Data is its water, food, air, and true love. Poison the data, poison the AI system. Poisoning attacks can also compromise the learning process itself. As AI systems are integrated into critical commercial and military applications, these attacks can have serious, even life-and-death, consequences. AI attacks can be used in a number of ways to achieve a malicious end goal: Cause Damage: the attacker wants to cause damage by having the AI system malfunction. An example of this is an attack to cause an autonomous vehicle to ignore stop signs. By attacking the AI system so that it incorrectly recognizes a stop sign as a different sign or symbol, the attacker can cause the autonomous vehicle to ignore the stop sign and crash into other vehicles and pedestrians. Hide Something: the attacker wants to evade detection by an AI system. An example of this is an attack to cause a content filter tasked with blocking terrorist propaganda from being posted on a social network to malfunction, therefore letting the material propagate unencumbered. Degrade Faith in a System: the attacker wants an operator to lose faith in the AI system, leading to the system being shut down. An example of this is an attack that causes an automated security alarm to misclassify regular events as security threats, triggering a barrage of false alarms that may lead to the system being taken offline. For example, attacking a video-based security system to classify a passing stray cat or blowing tree as a security threat may cause the security system to be taken offline, therefore allowing a true threat to then evade detection. Given the unparalleled success of AI over the past decade, it is surprising to learn that these attacks are possible, and even more so, that they have not yet been fixed. We now turn our attention to why these attacks exist, and why it is so difficult to prevent them. Why Do Artificial Intelligence Attacks Exist? AI attacks exist because there are fundamental limitations in the underlying AI algorithms that adversaries can exploit in order to make the system fail. Unlike traditional cybersecurity attacks, these weaknesses are not due to mistakes made by programmers or users. They are just shortcomings of the current state-of-the-art methods. Put more bluntly, the algorithms that cause AI systems to work so well are imperfect, and their systematic limitations create opportunities for adversaries to attack. At least for the foreseeable future, this is just a fact of mathematical life. To see why this is the case, we need to understand how the algorithms underpinning AI work. Many current AI systems are powered by machine learning,4 a set of techniques that extract information from data in order to “learn” how to do a given task. A machine learning algorithm “learns” analogously to how humans learn. Humans learn by seeing many examples of an object or concept in the real world, and store what is learned in the brain for later use. Machine learning algorithms “learn” by seeing many examples of an object or concept in a dataset, and store what is learned in a model for later use. In many if not most AI applications based on machine learning, there is no outside knowledge or other magic used in this process: it is entirely dependent on the dataset and nothing else.5 The key to understanding AI attacks is understanding what the “learning” in machine learning actually is, and more importantly, what it is not. Recall that machine learning “learns” by looking at many examples of a concept or object in a dataset. More specifically, it uses algorithms that extract and generalize common patterns in these examples. These patterns are stored within the model. Taking the example of recognizing a stop sign, the learning algorithm will identify patterns in the pixels that make up the example images, such as large areas of red, the shapes of the letters “S” “T” “O” and “P”, and other defining characteristics. When the model is later called upon to detect a stop sign in a new image, it will search that image for the same patterns of pixels. If it finds patterns that match those it has learned to associate with a stop sign, it will output that it has found a stop sign. If it instead finds patterns that match those it has learned to associate with a different object, such as a green light, it will output that it has found a green light. These patterns are “general” in the sense that they should work in new settings, not just on the examples from which it learned. For example, the patterns in the example above should be able to recognize all stop signs, not just the particular ones included in the dataset. Given enough data, the patterns learned in this manner are of such high quality that they can even outperform humans on many tasks. This is because if the algorithm sees enough examples in all of the different ways the target naturally appears, it will learn to recognize all the patterns needed to perform its job well. Continuing the stop sign example, if the dataset contains images of stop signs in the sun and shade, from straight ahead and from different angles, during the day and at night, it will learn all the possible ways a stop sign can appear in nature. However, this process already introduces a significant vulnerability: it is wholly dependent on the dataset. Because the dataset is the model’s only source of knowledge, if it is corrupted or “poisoned” by an attacker, the model learned from this data will be compromised. Attackers can poison the dataset to stop the model from learning specific patterns, or more insidiously, to install secret backdoors that can be used to trick the model in the future.6 But the problems do not end there. Even assuming a non-corrupted dataset and highly accurate model, this success comes with a very important caveat: the patterns “learned” by current state-of-the-art machine learning models are relatively brittle. As a result, the model only works on data that is similar in nature to the data used during the learning process. If used on data that is even a little different in nature from the types of variations it saw in the original dataset, the model may utterly fail. This is a major limitation attackers can exploit: by introducing artificial variations—such as a piece of tape or other aberrant patterns—the attacker can disrupt the model and control its behavior based on what artificial pattern is introduced. Because the amount of data used to build the model is finite but the amount of artificial variations an attacker can create are infinite, the attacker has an inherent advantage. This explains how the stop sign tape attack can cause a self-driving car to crash. While the dataset used to train the stop sign detector contains plenty of variations of stop signs in different natural conditions, it doesn’t contain examples of the endless ways it can be artificially manipulated by an attacker, such as with tape and graffiti. Because of this, very small artificial manipulations chosen in just the right way can break the relatively brittle patterns the model learned, and have preposterously huge impacts on the model’s output. This is why a small piece of tape can transform a stop sign into a green light so easily: it doesn’t have to make the entire stop sign look like a green light, it only has to trick the specific small brittle patterns that the model learned. Unfortunately, this is easy to do. Many may be surprised to learn that machine learning has such a glaring shortcoming. This is because popular culture has shaped a widespread but erroneous belief that machine learning actually “learns” in a human sense of the word. Humans are good at truly learning concepts and associations. If a stop sign is distorted or defaced with graffiti or dirt, even a human who has never seen graffiti or a dirty stop sign would still reliably and consistently identify it as a stop sign, and certainly would not mistake it for an entirely different object altogether, such as a green light. But we now know current AI systems do not work in the same way. Even a model that can almost perfectly recognize a stop sign still has no knowledge of the concept of a stop sign, or even a sign for that matter, as a human does. It only knows that certain learned patterns correspond to a label named “stop sign.” While it may seem that this distinction between human learning and machine “learning” is arbitrary—especially because if the model works, it seems we should be happy—we now understand why it has such severe ramifications: under contested conditions, AI systems can be made to fail even if they are extremely successful under “normal” conditions. A logical step to combat this would be to understand why the patterns the model learns are so brittle. However, this is not currently supported in the most widely used models, such as deep neural networks, as exactly how and even what these models learn is still not fully understood. As a result, the most popular machine learning algorithms powering AI, like neural networks, are referred to as “black boxes”: we know what goes in, we know what comes out, but we do not know exactly what happens in between. We cannot reliably fix what we do not understand. And for this same reason, it is difficult if not impossible to even tell if a model is being attacked or just doing a bad job. While other data science methods, such as decision trees and regression models, allow for much more explainability and understanding, these methods do not generally deliver the performance that the widely used neural networks are capable of providing. From this understanding, we can now state the characteristics of the machine learning algorithms underpinning AI that make these systems vulnerable to attack. Characteristic 1: Machine learning works by “learning” relatively brittle patterns that work well but are easy to disrupt. Contrary to popular belief, machine learning models are not “intelligent” or capable of truly mimicking human ability on tasks, even tasks they perform well. Instead, they work by learning brittle statistical associations that are relatively easy to disrupt. Attackers can exploit this brittleness to craft attacks that destroy the performance of an otherwise excellent model. Characteristic 2: Dependence solely on data provides a main channel to corrupt a machine learning model. Machine learning “learns” solely by extracting patterns from a set of examples known as a dataset. Unlike humans, machine learning models have no baseline knowledge that they can leverage—their entire knowledge depends wholly on the data they see. Poisoning the data poisons the AI system. Attacks in this vein essentially turn an AI system into a Manchurian candidate that attackers can activate at a time of their choosing. Characteristic 3: The black box nature of the state-of-the-art algorithms makes auditing them difficult. Relatively little is understood about how the widely used state-of-the-art machine learning algorithms, such as deep neural networks, learn and work—even today they are still in many ways a magical black box. This makes it difficult, if not currently impossible, to tell if a machine learning model has been compromised, or even if it is being attacked or just not performing well. This characteristic sets AI attacks apart from traditional cybersecurity problems where there are clear definitions of vulnerabilities, even if they are hard to find. Taken together, these weaknesses explain why there are no perfect technical fixes for AI attacks. These vulnerabilities are not “bugs” that can be patched or corrected as is done with traditional cybersecurity vulnerabilities. They are deep-seated issues at the heart of current state-of-the-art AI itself. Now that we have an understanding of why these attacks are possible, we now turn our attention to looking at actual examples of these attacks. Input Attacks Input attacks trigger an AI system to malfunction by altering the input that is fed into the system. As shown in the figure below, this is done by adding an “attack pattern” to the input, such as placing tape on a stop sign at an intersection or adding small changes to a digital photo being uploaded to a social network. Input attacks do not require the attacker to have corrupted the AI system in order to attack it. Completely state-of-the-art AI systems that are highly accurate and have never had their integrity, dataset, or algorithms compromised are still vulnerable to input attacks. And in stark contrast to other cyberattacks, the attack itself does not always use a computer! Figure 1: In regular use (top), the AI system takes a valid input, processes it with the model (brain), and returns an output. In an input attack (bottom), the input to the AI system is altered with an attack pattern, causing the AI system to return an incorrect output. These attacks are particularly dangerous because the attack patterns do not have to be noticeable, and can even be completely undetectable. Adversaries can be surgical, changing just a small aspect of the input in a precise and exact way to break the patterns learned previously by the model. For attacks on physical objects that must be captured by a sensor or camera before being fed into an AI system, attackers can craft small changes that are just big enough to be captured by the sensor. This is the canonical “tape attack”: attackers figure out that placing a two-inch piece of white tape on the upper corner of a stop sign will exploit a particular brittleness in the patterns learned by the model, turning it into a green light.7 For attacks on digital objects that are fed directly into the AI system, such as an image uploaded to a social network, the attack patterns can be imperceivable to the human eye. This is because in this all-digital setting, the alterations can occur on an individual pixel level, creating alterations that are so small they are literally invisible to the human eye.

Nearly 90 percent of top news outlets like The New York Times now block AI data collection bots from OpenAI and others. Leading right-wing outlets like NewsMax and Breitbart mostly permit them. Illustration of a translucent brain plugged in to a red outlet filling with red ether ILLUSTRATION: JACQUI VANLIEW; GETTY IMAGES As media companies haggle licensing deals with artificial intelligence powerhouses like OpenAI that are hungry for training data, they’re also throwing up a digital blockade. New data shows that over 88 percent of top-ranked news outlets in the US now block web crawlers used by artificial intelligence companies to collect training data for chatbots and other AI projects. One sector of the news business is a glaring outlier, though: Right-wing media lags far behind their liberal counterparts when it comes to bot-blocking. Data collected in mid-January on 44 top news sites by Ontario-based AI detection startup Originality AI shows that almost all of them block AI web crawlers, including newspapers like The New York Times, The Washington Post, and The Guardian, general-interest magazines like The Atlantic, and special-interest sites like Bleacher Report. OpenAI’s GPTBot is the most widely-blocked crawler. But none of the top right-wing news outlets surveyed, including Fox News, the Daily Caller, and Breitbart, block any of the most prominent AI web scrapers, which also include Google’s AI data collection bot. Pundit Bari Weiss’ new website The Free Press also does not block AI scraping bots. Most of the right-wing sites didn’t respond to requests for comment on their AI crawler strategy, but researchers contacted by WIRED had a few different guesses to explain the discrepancy. The most intriguing: Could this be a strategy to combat perceived political bias? “AI models reflect the biases of their training data,” says Originality AI founder and CEO Jon Gillham. “If the entire left-leaning side is blocking, you could say, come on over here and eat up all of our right-leaning content.” Originality tallied which sites block GPTbot and other AI scrapers by surveying the robots.txt files that websites use to inform automated web crawlers which pages they are welcome to visit or barred from. The startup used Internet Archive data to establish when each website started blocking AI crawlers; many did so soon after OpenAI announced its crawler would respect robots.txt flags in August 2023. Originality’s initial analysis focused on the top news sites in the US, according to estimated web traffic. Only one of those sites had a significantly right-wing perspective, so Originality also looked at nine of the most well-known right-leaning outlets. Out of the nine right-wing sites, none were blocking GPTBot. Bot Biases Conservative leaders in the US (and also Elon Musk) have expressed concern that ChatGPT and other leading AI tools exhibit liberal or left-leaning political biases. At a recent hearing on AI, Senator Marsha Blackburn recited an AI-generated poem praising President Biden as evidence, claiming that generating a similar ode to Trump was impossible with ChatGPT. Right-leaning outlets might see their ideological foes’ decisions to block AI web crawlers as a unique opportunity to redress the balance.

Training artificial intelligence (AI) models on AI-generated text quickly leads to the models churning out nonsense, a study has found. This cannibalistic phenomenon, termed model collapse, could halt the improvement of large language models (LLMs) as they run out of human-derived training data and as increasing amounts of AI-generated text pervade the Internet. How does ChatGPT ‘think’? Psychology and neuroscience crack open AI large language models “The message is we have to be very careful about what ends up in our training data,” says co-author Zakhar Shumaylov, an AI researcher at the University of Cambridge, UK. Otherwise “things will always, provably, go wrong,” he says.” The team used a mathematical analysis to show that the problem of model collapse is likely to be universal, affecting all sizes of language model that use uncurated data, as well as simple image generators and other types of AI. The researchers began by using an LLM to create Wikipedia-like entries, then trained new iterations of the model on text produced by its predecessor. As the AI-generated information — known as synthetic data — polluted the training set, the model’s outputs became gibberish. The ninth iteration of the model completed a Wikipedia-style article about English church towers with a treatise on the many colours of jackrabbit tails (see ‘AI gibberish’). More subtly, the study, published in Nature1 on 24 July, showed that even before complete collapse, learning from AI-derived texts caused models to forget the information mentioned least frequently in their data sets as their outputs became more homogeneous. Robo-writers: the rise and risks of language-generating AI This is a concern when it comes to making AI models that represent all groups fairly, because low-probability events often relate to marginalized groups, says study co-author Ilia Shumailov, who worked on the project while at the University of Oxford, UK. “This is a fantastic paper,” says Julia Kempe, a computer scientist at New York University in New York City. Until now, many technology firms have improved their models by feeding them larger and larger amounts of data. But as human-produced content runs out, they are hoping to use synthetic data to keep improving. The study — a version of which first appeared on the arXiv preprint server in May 2023 — has spurred the AI community to try to find solutions to the problem, she says. “It’s been a call to arms.” You are what you eat Language models work by building up associations between tokens — words or word parts — in huge swathes of text, often scraped from the Internet. They generate text by spitting out the statistically most probable next word, based on these learned patterns. AI gibberish The study authors trained their large language model on Wikipedia articles and trained successive generations of the model on the text produced by the previous version. Prompted to follow on from a paragraph of text from the Wikipedia entry on Grade I listed buildings in Somerset, the models output the following text. The first output from the model (generation 0) contains some errors, but the ninth generation spews complete gibberish. Model generation 0 Revival architecture such as St. John’s Cathedral in London. The earliest surviving example of Perpendicular Revival architecture is found in the 18th @-@ century Church of Our Lady of Guernsey, which dates from the late 19th century. There are two types of per- pendicular churches : those. Model generation 9 architecture. In addition to being home to some of the world’s largest populations of black @-@ tailed jackrabbits, white @-@ tailed jackrabbits, blue @-@ tailed jackrabbits, red @-@ tailed jackrabbits, yellow @-

Garbage in, garbage out. Data pollution is ruining generative AI's future. A recent study by researchers in Canada and the U.K. explained the phenomenon of model collapse. Model collapse occurs when new generative models train on AI-generated content and gradually degenerate as a result. In this scenario, models start to forget the true underlying data distribution, even if the distribution does not change. This means that the models begin to lose information about the less common -- but still important -- aspects of the data. As generations of AI models progress, models start producing increasingly similar and less diverse outputs. Generative AI models need to train on human-produced data to function. When trained on model-generated content, new models exhibit irreversible defects. Their outputs become increasingly "wrong" and homogenous. Researchers found that even in the best learning conditions, model collapse was inevitable. Why is model collapse important? Model collapse is important because generative AI is poised to bring about significant change in digital content. More and more online communications are being partially or completely generated using AI tools. Generally, this phenomenon has the potential to create data pollution on a large scale. Although creating large quantities of text is more efficient than ever, model collapse states that none of this data will be valuable to train the next generation of AI models. More AI-generated data pollution makes data from human interactions with systems harder to find and more valuable. Companies and platforms with access to human-generated data will be more likely to create high-quality AI-generated models. Companies that were able to scrape the web before AI pollution will have an advantage over those scraping the post-ChatGPT web for quality training data. How does model collapse occur? Model collapse happens when new AI models are trained on generated or synthetic data from older models. The new models become too dependent on patterns in the generated data. Model collapse is based on the principle that generative models are replicating patterns that they have already seen, and there is only so much information that can be pulled from those patterns. In model collapse, probable events are overestimated and improbable events are underestimated. Through repeated generations, probable events poison the data set, and tails shrink. Tails are the improbable but important parts of the data set that help maintain model accuracy and output variance. Over generations, models compound errors and more drastically misinterpret data. Researchers define two types of model collapse: early and late. In early model collapse, the model begins to lose information about probability tails. In late model collapse, the model blends together what should be distinct patterns in the data. Eventually, the outputs become increasingly similar to each other with little resemblance to the original data. The previously mentioned study, "The Curse of Recursion: Training on Generated Data Makes Models Forget," tested three AI model types by repeatedly feeding them model-generated data. In all three cases, the researchers found instances of model collapse: Gaussian mixture model (GMM). A GMM is designed to separate data into clusters using a Gaussian distribution. Within 50 re-generations, the data distribution completely changed. By generation 2,000, there was no longer any variance in the data. Variational autoencoder (VAE). The VAE was trained on real data and used to generate images of handwritten digits. The next generations were trained on model-generated data. As the generations progressed, the images got progressively blurrier until each digit resembled a roughly uniform smudge.

OpenAI’s chatbots scored a big new data source following the company’s deal with News Corp. in May. With the stroke of a pen, ChatGPT and the company’s other services added the Wall Street Journal, New York Post, MarketWatch, Barron’s, and other publications to its database. The deal, which did not include Fox News content, was one of the latest in a growing series of big data sharing agreements OpenAI has signed in an effort to educate its systems and expand the technology’s expertise. The company recently signed a similar deal with Reddit to incorporate its content into ChatGPT and new products. It also this month signed deals with The Atlantic and Vox Media. The deals come after some media outlets, including The New York Times Company, have sued OpenAI and Microsoft for using their publications’ copyrighted stories without permission in training chatbots. Filed in Federal District Court in Manhattan, the suit alleges millions of NYTimes articles were used to train chatbots, which have begun to compete with the news outlet as information sources. A collective of well-known authors has also sued the company, alleging “systematic theft on a mass scale.” Inputting data is only half the battle, of course. OpenAI will have to figure out how to deal with biases in the information it incorporates and how to weed out information that’s sarcastic or pure parody. (Earlier this month, Google showed it still has a long way to go on this front, with the company’s AI Search sharing a farcical Reddit post as fact when it suggested “mix[ing] about 1/8 cup of non-toxic glue into the sauce” to keep the cheese from sliding off of your pizza slice.) So, who all has partnered with OpenAI, giving the company access to their content libraries? Here’s a comprehensive look. THE ASSOCIATED PRESS Last July, the AP and OpenAI announced a deal letting the AI giant license AP’s archive of news stories going back through 1985. AP, in the meantime, was given the opportunity to leverage OpenAI’s tech. THE ATLANTIC In May, after publishing an op-ed arguing that media companies were making a mistake by partnering with AI firms, the Atlantic announced its own such deal. According to the announcement, the publication will also leverage OpenAI’s technology: “The Atlantic is currently developing an experimental microsite, called Atlantic Labs, to figure out how AI can help in the development of new products and features to better serve its journalism and readers—and will pilot OpenAI’s and other emerging tech in this work.” AXEL SPRINGER The German publisher was the first major media outlet to partner with OpenAI and open its archives to the chatbot. Axel Springer controls a huge assortment of outlets, including Politico, Business Insider, and German outlets Bild and Welt. DOTDASH MEREDITH Dotdash Meredith is one of the largest digital publishers in the U.S., so its licensing deal, signed in May, gave OpenAI access to more than 40 brands, including People, Travel & Leisure, Entertainment Weekly, Allrecipes, Real Simple, Food & Wine, Parents, Investopedia, Better Homes & Garden, and InStyle. The deal came after the company’s parent firm IAC had pushed to create a coalition uniting big publishers as they strove to protect copyrighted materials from AI firms. That effort ultimately fell apart.