Schneier on Security

Clive Robinson • February 24, 2025 8:16 AM

@ Bruce,

We know,

1, Sufficiently motivated humans cheat when possible.
2, Most humans cheat only when they think they can get away with it.
3, Only a few humans have no concern about the consequences of being caught.

In the past it’s been suggested that the fear is either,

4, Fear of punishment
5, Loss of status

That raises the level of inhibition against cheating.

We know that current AI LLM and ML systems do not have “concerns” the actions they take are based on the statistics of the input corpus and the rules given for the current task.

So current AI LLM and ML systems have no concern about cheating as they have no inherent fear of punishment or loss of status or in fact a notion of cheating. Unless it’s already built in to the weights of the DNN from the input corpus or it’s been added as part of the rules given for the task.

If we assume all the AI output gets fed back into the input corpus and so adjusts the weights. We can make the likely correct assumption that the weights will move the DNN statistically more and more toward cheating behaviour unless some inhibitory counter balance is added.

Thus a question arises about,

“Does ‘cheating the little things’ makes ‘cheating the big things’ more likely?”

To which I would suggest the answer is probably yes as the LLM is not aware of the difference.

This suggests a route of little “white lies” is the start to the route of “black perfidy”.

Thus a “gateway” attack vector.

Clive Robinson • February 24, 2025 5:48 PM

@ Lars Skovlund

With regards,

“The IT security community has been moving towards compartmentalizing these things for decades.”

Yup, and where has it actually got us?

Especially when the “leader” of the company espouses,

“Run fast and break things”

As a design / implementation preferred methodology.

As a rule of thumb these days, a boss does not want “options” he wants “solutions”. Because if you can not deliver it’s your fault, you ask him to make a choice and that is way to much personal risk for way to little reward for him.

I could go on about “Marketing wants” and “time to market” but that’s not really changed much since last century. And the wave of technical debt goes well beyond tsunami and even crests over Everest. The solution being “new product” rather than “fix the issues” mostly because it costs less and appears in some eyes to increase “shareholder value”.

I could go on but the simple fact is security is seen as,

“Not bringing the bacon home.”

By either management or most customers… OK somebody crawls through your firewall and dances off with all the Company Emails, and source code, and bug lists etc.

But,

“What effect does that actually have on the “bottom line?”

Actually these days it’s seen as “hardly any effect” at all, and the cost compared to the high ongoing cost of security…

Yup “no brainer, you don’t spend on security, because your competitors are not spending on it”

So spend it else where… And just “outsource units of work resource” if money is not rolling in fast enough for the shareholders…

The only time most in the industry actually do anything about security is to “minimise legislatory and regulatory” effects and costs.

At the end of the day the answer to the question of,

“Why can we not have nice things?”

Is,

“Without strong legislation and regulation with real teeth, the industry will carry on down the ‘enshitification’ path.”

It’s why we do not have any real AI legislation or regulation, because certain people spend a lot of money to stop it happening. Because at the end of the day, those stacks of cash and other benefits they hand to legislators one way or another, are in reality a tiny fraction of the cost of doing things properly…

Clive Robinson • February 26, 2025 10:24 PM

@ Bruce,

You might find this of interest,

“The FFT Strikes Back: An Efficient Alternative to Self-Attention”

https://arxiv.org/pdf/2502.18394

“Conventional selfattention mechanisms capture global interactions through explicit pairwise computations, which results in a quadratic computational complexity that can be prohibitive for long sequences. In contrast, our work introduces an adaptive spectral filtering framework that leverages the Fast Fourier Transform (FFT) to perform global token mixing with a mathematically elegant and scalable approach.

Our method begins by transforming the input sequence into the frequency domain, where orthogonal frequency components naturally encode long-range dependencies. This not only reduces the computational complexity to O(n log n) but also preserves the energy of the original signal, as ensured by Parseval’s theorem.

Such a transformation facilitates efficient global interactions without the need for exhaustive pairwise comparisons.”

The use of FFTs v Matrix is something that “might” increase performance, but it will almost certainly result in power savings.

Also the FFT is well supported in lower cost hardware.

Clive Robinson • February 27, 2025 2:55 AM

@ ResearcherZero,

With regards,

“A different kind of rule breaking.”

What is missing is the reference to the fact that the countries have political systems that have three things in common,

1, They are actually “autocratic”.
2, They are basically run by corruption.
3, The average income is low or very low than that in the “Wealthy West”.

Such an “environment” whilst potentially subject to political upheaval is actually very “stable” for corporates to work with.

And as we know some corporates quite deliberately foment civil unrest to keep costs down thus profits up.

Of course,

“All in our name (as long as we are shareholders).”

This has been going on since the end of WWII one way or another and subsequent wars such as those in China, Korean and Vietnam were as much to do with “profit” as it was “ideology and politics”.

George Orwell saw much of this coming whilst working at the BBC during WWII. And wrote about it in quite a bit of his works, most famously the books “Animal Farm” and “1984” (both of which should be mandatory reading for adolescents/adults).

As I point out from time to time Japan that had greater stability took it further and destroyed the then thriving “Television Manufacturing” industry in the West and later radios, motor bikes, cars, ships and much more by forming it’s own “Corporate Conglomerates”. Taiwan went on to do similar, as did South Korea and now China. With India and Brazil trying to emulate them.

The fact is “short term neo-con thinking” has done great things for those nations economies at great expense to the economies of the West especially that of the US.

And the people always hurt are the “voting citizens” who’s politicians are “all bought and payed for”.

I could say fairly easily how this is going to end up, it’s not exactly difficult to predict from history and common sense (as I have done in the past)… But this would be quite unpopular and cause disruptive comment, so I won’t. But I suspect you already know the answers yourself.