U.S. Must Develop Counter Measures Against Chinese AI

This week the Department of Justice announced that it had broken up a wave of Chinese hacking attempts against a host of U.S. agencies.

Yet the DOJ refers to it as “Malicious Hacking” because it happens in the virtual world, even though millions upon millions of dollars’ worth of data has been stolen, and billions of dollars of systems have been corrupted or left under threat of gross compromise.

If these sorts of events happened in the physical world, they would be called “Acts of War.”

Thus, the United States has discovered the hard way that China has developed a new critical infrastructure cyberattack methodology which uses Artificial Intelligence (AI) to continuously observe and disrupt U.S. computer-driven systems essential for day to day American life.

According to Anthropic, a San Francisco-based AI company, China “...used AI ‘agentic’ capabilities...not just as an advisor, but to execute the cyberattacks themselves.”    

While it is crucial to stay ahead of the Chinese in both technological advancement and in the fielding of improved weapons systems, it also is crucial to create a doctrine of Artificial Intelligence Counter Measures (AICM) to blunt all manner of Chinese AI Systems.

Such a doctrine should take shape along four approaches:

1. Polluting Large Language Models for Negative Effects

2. Using Conway’s Law for Guidance to Exploitable Flaws

3. Exploiting Bias of Adversary Leadership to Degrade AI Systems

4. Using RF Weapons to Cascade AI Supporting Computer Hardware

Such systems might seem on their face to be insurmountable... well, maybe not.  As Mark Twain said: “History doesn’t repeat itself, but it does rhyme.”  Thus, perhaps a look into the past will help envision the future.

Polluting Large Language Models to Create Negative Effects

Generative AI can be expressed as the extraction of statistical patterns from an extremely large data set. It is important to understand that an LLM developed from such an enormous data set using “Transformer” technology allows a user to access it via a “prompt.”  A prompt, in turn, is a natural language text that describes the function which the AI must perform. The end result is a Generative Pre-Trained (GPT) Large Language Model.

Thus, there are at least two approaches to degrade such an AI system: Pollute the data or attack the “Prompt Engineering.”  Prompt Engineering is a term of art within the AI community that describes the process of structuring instructions that can be understood by the generative AI system.  A programming error, as noted below, will cause the AI LLM system, in another AI term of art, to "Hallucinate.”

Regarding the polluting of the data set, an historical analogy from World War II validates the crucial importance of countermeasures when an enemy has unilateral access to information about the battlespace. 

 The development of RADAR (Radio Azimuth Detecting and Ranging) was, in itself, a method of extracting patterns from an extremely large database. In the vastness of the sky, an echo from a radio pulse gave an accurate range and bearing of an unseen aircraft. 

To defeat it, as described by R.V. Jones in Most Secret War, it was necessary to put information into the German radar system, thus causing gross ambiguity. Jones turned to a physicist at the Technical Research Establishment, Joan Curran, who developed the optimum size and shape of aluminum foil strips (called “Window” by the Brits and “Chaff” by the Americans) used to create thousands of reflections which, in turn, overloaded and blinded the German radars.

In much the same way, the U.S. military and intelligence communities can create ambiguities and obscurations within generative AI systems, especially when trying to deny access to information about weapons and tactics.

This can be done by assigning names to said weapons and tactics, designed to be both ambiguous and non sequitur.  Such “naturally occurring” search ambiguities include the following: 

A search for “Flying Prostitute” will immediately reveal data about the B-26 Marauder medium bomber of World War II.

A search for “Gilda” and “Atoll” will retrieve a photo of the Mark III nuclear bomb that was dropped on Bikini Atoll in 1946 upon which was pasted a photo of  Rita Hayworth.

A search of “Tonopah” and “Goatsucker” retrieves the F-117 stealth fighter.

Since a contemporary computer search is easily fooled by such accidental ambiguities, it would be possible to grossly skew results of an LLM function by deliberately using nomenclature which occurs in very large iterations and is extremely ambiguous.

Given that a website like Pornhub gets something in excess of 115 million hits per day, perhaps the Next Generation Air Dominance (NGAD) fighter should be renamed “Stormy Daniels.”  For code names of secret projects, instead of “Rapid Dragon” try “Jenna Jameson.”

Such an effort in prestidigitation would be useful in both operations security (OPSEC) and communications security (COMSEC) by confusing adversaries seeking open intelligence data.

For example, one can easily imagine the consternation that Chinese officers and NCOs would experience when their young soldiers expended valuable time meticulously examining every single image of Stormy Daniels to ensure that she was not the newest Yankee fighter plane. 

Even “Air Gapped” systems like the ones being used by U.S. intelligence agencies can be affected when the systems update information from Internet sources.

Note that such an effort must actively and continuously pollute the data sets, much like chaff confusing a RADAR system by generating content that would populate the model and force the adversary to consume it.

A more sophisticated approach would use key words like “eBay” or “Amazon” or “Alibaba” as a predicate, and then very common words like “Tire” or “Bicycle” or “Shoe.”

Then, contracting with a commercial media agency to do lots of promotion of the “items” across traditional and social media would tend to clog a Large Language Model.

Using Conway’s Law tor Guidance to Exploitable Flaws

Melvin Conway is an American computer scientist who in the 1960’s conceived the eponymous rule stating: “Organizations which design systems are constrained to produce designs which are copies of the communication structures of these organizations.”

In response, de Caro’s Corollary states: “The more dogmatic the design team, the greater the opportunity to sabotage the whole design.”

Consider the Google Gemini Disaster. The February 2024 launch of Gemini, Google’s would-be answer to ChatGPT, was an unmitigated disaster which dumped Google’s share price and left the company a laughingstock. As the Gemini launch went forward, its image generator "Hallucinated". It created images of black Nazi soldiers and female Asian Popes. 

In retrospect, the event was the most egregious example of what happens when Conway’s Law collides with organizational dogma. The then DEI-crazed Google upper management mandated that young and historically ignorant programmers follow the rigid corporate “Woke” dicta and launch their company into a debacle. Think Digital Bud Light.

But, for those interested in confounding China’s AI systems, the Gemini disaster is an epiphany!

This begs the question: If the extremely well paid, self-described- DEI-oriented Google upper management at the “Googleplex” campus in Mountain View, California can screw up so immensely, what kind of swirling vortex of programming snafu is being created by the People’s Liberation Army’s general officers upon their highly regimented, ill-paid, constantly indoctrinated yo0ung soldiers who work on AI?

A solution to beating China’s AI systems may be an epistemologist who specializes in the cultural communication of the PLA. By using the aforementioned de Caro’s Corollary — “The more dogmatic the design team, the greater the opportunity to sabotage the whole design” — such an expert could lead a team of computer scientists to replicate the Chinese communication norms and find the weaknesses in their system—leaving it open to spoofing or outright collapse.

It also should be noted that when a technology creates an existential threat, the individual developers of that technology become strategic targets. For example, in 1943, Operation Hydra utilized the entirety of the RAF British Bomber Command of 596 bombers, with the stated mission of killing all the German rocket scientists at Peenemunde. The RAF had marginal success and was followed by three US 8^th Air Force raids in July and August of 1944.  

In 1944, the Office of Strategic Services (OSS) dispatched multi-lingual agent and polymath Mo Berg to assassinate German scientist Werner Heisenberg, if Heisenberg seemed to be on the right path to build an atomic bomb. Berg decided (correctly) that the German was off track, and letting him live would keep the Nazis from any success.

It is no secret that five Iranian nuclear scientists have been assassinated (allegedly) by the Israelis in the last decade.

Advances in AI which could become existential threats could be dealt with in similar fashion. Bullets are cheap. So is C-4. 

Exploiting Bias of Adversary Leadership to Degrade AI Systems

Often, the entities funding research and development skew the results because of their bias. For example, aforementioned German scientist Werner Heisenberg was limited in the paths he might follow toward a Nazi A-Bomb because of Hitler’s perverse hatred of “Jewish Physics.”  This attitude was aided and abetted by two prominent and antisemitic German scientists, Phillip Lenard and Johannes Stark, both Nobel Prize winners who reinforced the myth of “Aryan Science.” The end result effectively prevented a successful German nuclear program.

Returning to the Google Gemini Disaster, one only needs to look at the attitude of Google leadership to see the roots of the debacle. Google CEO Sundar Pichai is a naturalized U.S. citizen whose undergraduate degree was earned in India, before emigrating to the Unites States. His ties to India remain close, as he was awarded the Padma Bhushan, India’s third highest civilian award in 2022.

In Congressional hearings in 2018, Pichai seemed to avoid giving direct answers to explicit questions, a trait he demonstrated again in 2020 and still again in antitrust court in 2023.

His internal memo after the 2024 Gemini disaster mentioned nothing about who selected the people in charge of the prompt engineering, who supervised those people, or who, if anyone, got fired for the fiasco. More importantly, there is no mention in the memo of the internal communications functions that caused the apparently unsupervised Gemini train wreck to occur in the first place.

Again, there is epiphany here: Bias from the top affects outcomes.

As Xi Jinping continues his move toward authoritarian rule under himself, he brings his biases with him. This eventually will affect, or more precisely infect, Chinese military power.

In 2023,  Xi detailed the need for China to meet world class military standards by 2027, the 100^th anniversary of the People’s Liberation Army. Xi also spoke of “informatization” (read AI) to accelerate building “a strong system of strong strategic forces, raise the presence of combat forces in new domains and of new qualities and promote combat oriented military training.”

It seems that Xi’s need for speed, especially in “informatization,” might be the bias that indicates a weakness that can be exploited.

Using Gyrotrons to Cascade Chips in Computers Supporting AI

Artificial Intelligence is dependent on extremely fast computer chips whose capacities are approaching their physical limits. They are more and more vulnerable to lack of cooling and electromagnetic pulse.

In the case of large, Cloud-based data centers, cooling is an absolute necessity. Water cooling is the most economical and therefore the most prevalent; but pumps, backup pumps and inlet valves usually are not hardened, and thus are extremely vulnerable. No pumps, no water. No water, no cooling. No cooling, no Cloud.

The same for primary and secondary electrical power. No power, no Cloud. No generators, no Cloud. No fuel, no Cloud.

AI robots in the form of autonomous airborne drones, or ground mobile vehicles, are moving targets -- small and hard to hit. However, their chips are vulnerable to electromagnetic pulse. We now know that a lightning bolt with gigawatts of power isn’t the only way to knock out an AI robot. High-Power Microwave Systems such as Epirus, Leonidas and Thor can burn out AI systems at a range of about three miles.

An interesting technology not yet fielded is the gyrotron. It is a Cold War era Soviet-developed high-power microwave source, halfway between a klystron and a free electron laser. It creates a cyclotron resonance in a strong magnetic field that can produce a customized energy bolt with a specific pulse width and specific amplitude. Theoretically, it could reach out and disable a specific kind of chip, at greater ranges than the “You fly ‘em, We fry ‘em” high power microwave weapon now in early test stage.

Obviously, without functioning chips, AI doesn’t work.

Conclusion

The headlong Chinese AI development initiative could provide the PLA with an extraordinary military advantage in terms of the speed and sophistication of a future attack upon the homeland of the United States.

Thus, the need to develop AI counter measures--now--is absolutely paramount.

In World War I, the great Italian progenitor of airpower, General Giulio Douhet, very wisely stated:

“Victory smiles upon those who anticipate the changes in the character of war, not upon those who wait to adapt themselves after the changes occur.”

In terms of the threat posed by Artificial Intelligence as it applies to warfare, Douhet’s words could not be truer today. 

Chuck de Caro is an American strategist and futurist who originated the term SOFTWAR which is defined as: “The hostile use of global visual media to shape another society’s will by changing its view of reality.”