Matthew Berman on OpenAI’s 2024 AI Infrastructure Security Proposals

In May 2024, Matthew Berman reviews an OpenAI post proposing ways to secure advanced AI infrastructure. He favors openly available model weights and argues that the post reflects a different approach. His objections are commentary on the proposal, not evidence of a universal GPU-tracking requirement.

The post describes sophisticated cyber threats and treats model weights as an asset that developers may want to protect. Berman disagrees with prioritizing secrecy of weights and contrasts it with his preference for open-weight models.

He explains the post’s account of model training: algorithms, curated data and compute produce weights stored as files. He emphasizes the costs of high-quality or proprietary data and large-scale computing, while offering his own view that algorithmic progress will be incremental.

The post identifies online service and research infrastructure as possible attack surfaces: weights must be available for models to be used or developed. Berman accepts the existence of security risks but disagrees with keeping weights private as a response.

Berman worries that voluntary security commitments could become mandatory standards and create burdens for smaller competitors. He describes this as a risk of regulatory capture. This is his concern and prediction; the fact that a company publishes security proposals does not itself establish that such rules exist.

The first proposed area is trusted computing for AI accelerators. The post describes cryptographic attestation of GPU authenticity and integrity, keeping weights encrypted until loaded, and encrypting weights or inference data for particular devices or groups.

Berman interprets device identity and authorization as potentially leading to outside control over hardware, and asks who would decide which devices are authorized. He says he is not a cryptography expert and may be misunderstanding the proposal. The described attestation and encryption mechanisms do not by themselves demonstrate a requirement to register or track all GPUs.

The second area is network and tenant isolation. Berman explains the idea of separating sensitive workloads from untrusted networks and accepts that isolation can make sense for sensitive systems. He objects to treating model weights themselves as confidential by default.

The third area is operational and physical security for data centers, including protection against insider threats. Berman agrees with protecting sensitive data and facilities, while maintaining his disagreement about whether weights should be kept private.

The fourth area is AI-specific audit and compliance. The post refers to existing security standards and anticipates that additional AI-specific requirements could develop. Berman supports security but worries about compliance expectations reinforcing closed access and disadvantaging smaller organizations.

The fifth area is AI for cyber defense. The post proposes using models to help security teams analyze signals and reduce manual work. Berman agrees with applying AI to defense, while again expressing concern about who can afford the resulting security practices.

Berman argues that widely available models would benefit defenders as well as attackers. His confidence rests on his beliefs about the relative resources of good and bad actors and the pace of AI progress; these are predictions rather than conclusions proven in the video.

The final area is resilience, redundancy and research. Berman agrees with testing controls, studying how they can be bypassed and using defense in depth, since no security system is flawless.

He closes by reaffirming his support for open weights and praising Meta’s open-model efforts at the time. The debate he raises is about the tradeoffs between protecting particular model deployments and distributing model weights broadly.