Full post to be found on MIRI TGT’s website
Summary
In the future, the world might want international agreements to govern AI development. Such agreements are likely to include provisions about what AI chips can and cannot be used for (e.g. no undeclared models are in deployment), and verification mechanisms to ensure every side is following the rules. One proposed method for this chip use verification is network taps. These are devices that intercept traffic between the AI accelerators and any of their users, or traffic between servers, to help detect malicious data transfer. For network taps to be effective, they must intercept all or almost all communication with the AI accelerators.
I surveyed the literature on side-channels and possible mitigations to find out if—under the scenario named above—air-gapping can be made secure enough that evasion would likely be caught. The setup is a prover owning the facility and a verifier installing monitors (e.g., network taps) and sending inspectors. This prover is assumed to be a “covert adversary”1 who agrees to monitoring but will exploit any gaps they can without a high detection risk. It is the attacker who is defeated if they are caught cheating once, which reverses the “defender’s dilemma” of traditional cybersecurity, where one successful breach means defeat for the defender.
Tolerating single-digit kilobits per second of physically possible covert bandwidth substantially reduces the cost and complexity of the defenses needed. With this requirement, my expectation (based on a three-week research sprint) is that defense-dominance is achievable in guarded facilities (personnel, cameras, fences etc.).
I present an example of a defense architecture towards the end of this post. It leverages a synergy of cheap enclosures, sensors, jamming, unannounced hardware inspections and physical security to achieve defense-dominance at an estimated Bill-of-Materials (BOM) below 1% of the cost of the monitored cluster.