Speculation on ideal AI legislation
NB: These are some notes inspired by a tweet from Zvi Mowshowitz, in which he said:
Agreed that finding a good plan \[for AI policy\] would be super valuable, since it is very clear no one has a good plan. When I ask "what would you do to reduce AI risk if you were the literal President of the United States and could pass laws too?" I still get sad shrugs so far.
I'm putting this in a doc because it seems like a better option than "nothing", but it's just personal speculation based on the scenario Zvi described. It is not intended for wide publication, or as any kind of official plan, since I haven't thoroughly analyzed political tactics or failure modes. I have some more essays on related topics in draft form, but didn't want to wait on all of them.
If you are the President and can pass laws, I think the biggest thing you want for AI risk is something like:
- The President shall get to appoint an AI Safety Advisory Board at his discretion. (You then appoint, say, Paul Christiano, Chris Olah and Evan Hubinger, or if that would seem too weird politically, appoint agents for them or put them on the staff, so that they effectively control everything. or find some other workaround.)
- Without Board approval, it shall be illegal to train an AI model with more than (say) 10^20 FLOPs of computing power, at a data center which is inside US territory, or which is owned or controlled by an American company. This will allow almost all routine commercial activity - note that current top models like PaLM aren't even intended for practical use, and are done for pure research/"scoreboard chasing" (although that might change in future). You can put a bunch of criteria for restricting AI in the bill, like eg. "would not create a danger to American national security", which sound reasonable but can be flexibly interpreted.
- This rule would automatically apply to DeepMind, because it's under Google's ownership, and a bunch of foreign AI stuff that uses American cloud infrastructure.
- It shall be illegal to export American-made data center AI chips to any country that does not follow a similar restriction. (AMD, nVidia, and Google have an effective triopoly here. A bunch of startups have been trying to crack it, but predictions of that haven't happened for a while now, and a bunch of the startups are American anyway. Graphcore is in the closely allied UK.)
- It shall be illegal for the US semiconductor supply chain to export tools to any fab that does not follow similar restrictions. This is how the US put pressure on TSMC, which is a Taiwanese company, to stop selling crap to China - see summary by CSET here.
- The AI Safety Advisory Board may, when they authorize a model train, require that the results not be published or be appropriately redacted. However, they may release the information to relevant parties at their discretion. (If you discover some big new capabilities breakthrough, you don't want to publish it and let everyone else catch up, which is the default state of things right now.)
- All AI data centers are now legally required to follow a list of industry-standard security best practices. This includes having security staff on site, having hardware tripwires installed, automatic kill switches, hardware limited outbound bandwidth, regular drills, mandatory red teaming and so on. Funding shall be appropriated by Congress to enable all data centers to be upgraded ASAP. Any usual requirements for government contracting are waived. (See detailed discussions on AI data center security protocols here, here, here, and here. Traditionally NIST has been the agency charged with creating and enforcing security standards, although like most federal agencies it has a bunch of administrative and internal alignment problems.)
- The US government must have a remote AI data center kill switch, which allows them to stop any AI training run anywhere within ten minutes. This will be tested regularly.
- Any foreign company (in China, say) which is found to be doing AI training runs without following similar requirements will be placed on the designated entities list, barred from doing business with any US person or company and barred from the world financial system. The US will be open to negotiating reciprocal agreements with China and other major powers, who can appoint their own safety committees, such that training only goes forward if all committees agree. (Working out reasonable conditions for this would be complicated, but you want to signal that you actually do really care about safety, you're not just trying to unilaterally screw them over.)
- Data center AI chips made by American companies (right now, AMD, nVidia and Google) will be required to have protected modes installed in their drivers, such that they cannot run in large distributed clusters without outside authorization. (This is similar to what nVidia did for crypto mining, although eventually that was cracked. Defining "AI" here is tricky, but it should be straightforward to tell how many other chips your chip is running in parallel with. Big data centers use specialized technology like NVLink to coordinate training runs.)
- There will be large-by-individual-standards bounties offered to anyone who brings the US government information about unauthorized AI training, like the terrorist bounty program. They also get to the front of the immigration line automatically.
- There will be a classified appropriation made to the NSA, so that anyone who doesn't play ball can be Stuxnet-ted.
Eventually, someone would inevitably bypass all of this, but if you could actually implement it, I think that would buy you a lot. You could bundle it with lots of other feel-good stuff about promoting American industry and avoiding racial bias and protecting us from China and so on. Yann LeCun and other AGI bulls will hate it, but he's not a large constituency so that shouldn't be critical, as long as he or someone else like him can't capture the institutions you've set up.
(Note: I have a draft essay where I plan to say more on this, but I think one factor people are underestimating is that faster hardware makes alignment work easier. Both by making it easier to run experiments and discover stuff, and by attracting more talent into the field. It doesn't help you on net, because it makes capabilities stronger at a faster rate than it makes alignment stronger. But in absolute terms, we're clearly making more annual alignment progress now than we were in eg. 2012, before the deep learning revolution kicked off. "We didn't make much alignment progress last year" doesn't necessarily mean that much for how useful a general delay would be; we should expect more progress in absolute terms, per year, closer to AGI than further from AGI.
Oh yes, and you would fund the heck out of EMP missile development programs so you can fry electronics at will, and then you write an international treaty guaranteeing access to every state actor, so any state can act independently.
The most obvious hole is that the infrastructure you set up will be controlled by Yann LeCun or someone else who Really Doesn't Get It. But if you're the President and control the executive branch, you don't have to worry about that, it's easy for you to arrange things so you get what you want. If you're not the President, it's a trickier call.
I think many average Joes will actually be more open to rules than a bunch of people in the industry, like LeCun or bias hawks like Timnit Gebru. Given the current state of things, IME, it's obvious even to totally random database designers I meet at parties that AI is getting more powerful dangerously fast and that it's a threat to humans. I don't think it's that hard to prove, especially if it's 2025 and we have another 3 years of progress under our belts. People like LeCun and Gebru have their entire careers riding on the ability to continue with AGI research unimpeded and publish it all openly; attempts at reasonable regulation will be a direct threat to their status and power. That's much less true for random politicos or voters.
Note that the President has broad authority over "stations for wire communication" under 47 USC 606, which could reasonably apply to data centers and the Internet generally.
Note that a lot of things can be done via rules on federal contractors, as most big companies are contractors or subcontractors at some level. This was how eg. affirmative action rules were implemented.
Note that even though Congress has long been gridlocked, various AI rules can be (and have been) implemented via the NDAA, which has always sailed through with big bipartisan majorities. (Rule 0 of politics: don't defund the army.)
See this thread for lists of various rules that you could implement around AI corrigiblity, although formalizing many of them would be tricky.
Some public comments by others that seem relevant:
- See detailed discussions on AI data center security protocols here, here, here, and here. I already linked this, but it's important so I'm linking it twice.
- Essay by Gwern on Slowing Down Moore's Law
- "Hiring away top chip engineers to work on solar seems like an obvious thing to do if $ weren't a constraint." - Ben Hoffman. (Problems: the jobs are fairly dissimilar, tricky to do in other countries, other states would fight you especially China, might incentivize more people to go into the industry to get payouts.)
- "Secretly commandeer major AI researchers into a Manhattan project, slow down foreign research stuxnet-style, fake positive results into research dead ends. Yes, there are flaws to that plan, but it is better than a sad shrug." - Arthur Breitman. (Problems: "secretly" on this scale would be impractical, China would fight you, tech companies would fight you for commercial reasons, there's a long tail of possible researchers.)
- Thread by Yo Shavit
- "Make thousands of clones of John von Neumann" while doing every possible to slow down the development of AI and computer chip tech." - James Miller. (Problems: politically controversial, very long lead time, new von Neumanns might also accelerate capabilities.)
- Possibly more research into high-altitude nuclear electromagnetic pulses, which could have a separate five-power MAD distinct from the usual full-scale nuclear war MAD (?)