Asymmetry by Design: Boosting Cyber Defenders with Differential Access to AI

TL;DR

This paper proposes a strategic framework called 'differential access' to enhance cybersecurity by controlling AI capability access, emphasizing defender preparedness and offering practical implementation guidance and examples.

Contribution

It introduces three approaches to differential access—Promote, Manage, and Deny by Default—and provides a process for AI developers to implement them effectively.

Findings

Differential access strategies can shift cybersecurity balance towards defenders.

A process helps developers choose suitable access approaches based on capabilities and defender maturity.

Example schemes illustrate practical applications and benefits of differential access.

Abstract

As AI-enabled cyber capabilities become more advanced, we propose "differential access" as a strategy to tilt the cybersecurity balance toward defense by shaping access to these capabilities. We introduce three possible approaches that form a continuum, becoming progressively more restrictive for higher-risk capabilities: Promote Access, Manage Access, and Deny by Default. However, a key principle across all approaches is the need to prioritize defender access, even in the most restrictive scenarios, so that defenders can prepare for adversaries gaining access to similar capabilities. This report provides a process to help frontier AI developers choose and implement one of the three differential access approaches, including considerations based on a model's cyber capabilities, a defender's maturity and role, and strategic and technical implementation details. We also present four example schemes for defenders to reference, demonstrating how differential access provides value across various capability and defender levels, and suggest directions for further research.