AI Security Priorities: A Field-Wide Agenda

Asher Brass-Gershovich; Buck Shlegeris; Dan Lahav; Everett Smith; Gil Gekker; Lisa Einstein; Nicole Nichols; Omer Nevo; Rachel Steratore; Sella Nevo

REVIEW 3 major objections 4 minor 3 references

AI Security Priorities: A Field-Wide Agenda

T0 review · 3 major / 4 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A structured expert elicitation can rank the AI security field's top priorities, and acting on them would materially improve AI security.

desk verdict A useful, honestly disclosed agenda-setting report whose 'field-wide' ranking claim outruns its small, network-recruited sample. read the letter →

arxiv 2607.26069 v1 pith:YRWHSJSB submitted 2026-06-23 cs.CY cs.AIcs.CR

Gil Gekker , Rachel Steratore , Everett Smith , Asher Brass-Gershovich , Varun Gandhi , Nicole Nichols , Vijay Bolina , Buck Shlegeris

show 4 more authors

Lisa Einstein Dan Lahav Omer Nevo Sella Nevo

This is my paper

classification cs.CYcs.AIcs.CR

keywords AIsecurityprioritizationexpertelicitationcost-effectivenessfrontieragenticpublic-privatecoordinationred-teaming

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This report claims that the AI security field lacks agreed priorities, and that a structured expert process can produce a ranked agenda to guide investment and action. It synthesizes more than twenty expert interviews and a fourteen-person workshop to identify the ten most important and ten most cost-effective priority areas, organized across four themes: strategic foundations and policy frameworks, public-private coordination and institutional infrastructure, technical security engineering and assurance, and governing agentic AI under adversarial pressure. For each priority, expert authors define the problem, propose concrete projects, and outline elements of success. The paper is offered as a practical first draft of a field-wide agenda, meant to be updated as AI capabilities and threats evolve.

What carries the argument

The central mechanism is the multi-stage expert elicitation: scoping interviews with senior global experts, a structured workshop with fourteen participants who refined and scored candidate priority areas, and seven additional experts who rated implementation difficulty. These inputs were combined into an importance score (average expert rating) and a cost-effectiveness score (importance relative to effort and the degree to which the area is already addressed). The four organizing themes — strategic foundations, public-private coordination, technical security engineering, and agentic AI governance — provide the structure for the detailed priority-area analyses that follow.

What would settle it

Re-run the elicitation with an independently sampled, larger panel of AI security practitioners (for example, several hundred researchers, engineers, and policymakers across countries) and check whether the top-ten importance and cost-effectiveness lists reproduce within a small margin; or measure inter-rater reliability through a second blinded workshop and show the rankings are not noise.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a multi-stage expert elicitation can produce a prioritized, actionable agenda for AI security. The highest-importance priorities include a national AI deterrence strategy, public-private partnerships for security investment, and permission frameworks for AI agent interactions; the highest-cost-effectiveness priorities include an AI security resource hub, specifications for top-tier red-teaming, and incident response playbooks. The report argues that these rankings reflect field-wide priorities because they were derived from structured input from leaders across industry, government, and civil society, and that coordinated action on these

Load-bearing premise

The load-bearing premise is that the 20+ interviewees and 14 workshop participants — recruited through the authors' networks and including authors whose firms could benefit from several recommendations — are representative enough of the global AI security field that their rankings can stand for field-wide priorities.

Editorial extensions

If this is right

If the rankings hold, funders and governments should direct new investment to the ten highest-cost-effectiveness areas first, since they promise the most security benefit per unit of effort.
The agenda would give the field shared infrastructure: resource hubs, standards, audit protocols, and red-teaming specifications could become common tools that every organization builds on.
The importance-ranked list implies that large institutional changes, including a national deterrence posture, classified threat-intelligence sharing with AI labs, and confidential computing for frontier models, are worth pursuing despite high cost and complexity.
The agentic-AI chapter implies that as agents gain autonomy, organizations should adopt permission frameworks, formal verification, risk-management frameworks, and adversarial threat modeling to maintain control.
The 'first draft' framing implies the agenda is meant to be revisited regularly, so the field should build mechanisms for updating priorities as capabilities and threats change.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial: Because the authors disclose that several recommendations align with the commercial services of their own organizations, the impartiality of the rankings is a genuine open question that independent replication should test.
Editorial: The distinction between 'importance' and 'cost-effectiveness' could be sharpened: cost-effectiveness here is a composite of importance, effort, and existing coverage, so the most cost-effective list may simply be the cheap foundational items that everyone already agrees on, not necessarily the best marginal use of new money.
Editorial: The four themes imply a portfolio view — the agenda mixes near-term low-cost infrastructure (hub, taxonomy) with long-horizon high-cost institutional projects (national-security-grade protection, deterrence) — suggesting funders should diversify across both rather than concentrate on a single theme.
Editorial: The method could be extended into a repeatable, quantitative exercise: with a larger, pre-registered sample, the same elicitation could produce a living, auditable priority list that tracks how the field's consensus shifts over time.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper. First, it is a genuinely useful synthesis: the authors organized the AI security space into four themes and 19 priority areas, with concrete projects and elements of success for each. Second, the thing it claims to be—a field-wide consensus ranking—is not actually what the method delivers. The expert input comes from 20+ interviews and a 14-person workshop, recruited through the authors' networks, with no sampling frame, no response rate, no inter-rater reliability, and no formula for the cost-effectiveness composite. The ranking cannot be independently audited.

What is new is the integrated ranking itself. Individual priorities—confidential computing, red-teaming specs, incident sharing, agent permissioning—are all known topics. Arranging them into ten highest-importance and ten most-cost-effective lists, with detailed write-ups, is a real contribution. The paper is also refreshingly transparent: the Disclosure Statement lays out that Irregular co-designed the protocol and that several recommendations align with Irregular's and Watertight AI's commercial interests. The authors call the agenda a "first draft," which is honest.

The soft spots are real but proportional. The central authority claim—"expert input determined which priorities the field should pursue and how they rank"—requires the sample to represent the field. It almost certainly doesn't. A network-recruited sample with overlapping institutional affiliations will overrepresent author-adjacent perspectives. That doesn't mean the rankings are wrong, only that they are one organizationally situated view, not a measured consensus. The report would be stronger if it either softened the claim (e.g., "expert-informed agenda") or published the full protocol, including recruitment criteria and inter-rater statistics. Some priority areas, like the Secure Weight Module, are more speculative than others; the paper acknowledges this, but the ranking treats them on the same scale as, say, AI standards, which is a category mismatch.

Who is this for? Policymakers, funders, and practitioners looking for a menu of plausible AI security investments will find it useful. Researchers should read it as a well-organized proposal, not as empirical evidence about what the field actually prioritizes.

Recommendation: send it to peer review. It deserves referee time—not because the methodology is sound, but because the agenda will be influential and the gap between the method and the "field-wide" claim should be pressed. A serious referee can ask for the protocol and a more modest framing.

Referee Report

3 major / 4 minor

Summary. This paper presents a prioritized agenda for AI security, derived from structured interviews with more than 20 'global experts,' a 14-participant workshop, and 7 difficulty raters. It identifies the ten highest-importance and ten highest-cost-effectiveness priority areas across four themes (strategic foundations, public-private coordination, technical security engineering, and agentic AI governance), and provides detailed sections with proposed projects and success criteria for each priority area. The Executive Summary and Chapter 1 assert that this expert process determined which priorities the field should pursue and how they should rank, and the paper positions itself as an initial practical foundation for coordinated investment and action.

Significance. If the ranking is robust, the paper would be a valuable coordination artifact for a fragmented and rapidly evolving field. Its strengths include concrete, actionable project proposals for each priority area; a clear and unusually candid conflict-of-interest disclosure; and an honest self-description as a 'first draft' agenda. The multi-stage process (interviews, workshop, difficulty ratings) is a reasonable way to generate an agenda, and the paper's value as a source of project ideas and sector-specific entry points does not depend entirely on the ranking's precision. However, the paper's central authority claim — that the rankings represent a field-wide consensus — is not established by the reported methods. The sample is small and network-recruited, no reliability or dispersion statistics are reported, the cost-effectiveness formula is underspecified, and the disclosed conflicts of interest create a real risk of author-adjacent overrepresentation. These issues are addressable but are load-bearing for the agenda's main claim to authority.

major comments (3)

[Executive Summary; Chapter 1 (Approach and results)] The central claim that 'expert input determined which priorities the field should pursue and how they rank' is not supported by the disclosed method. The paper reports 'more than 20 interviews, 14 workshop participants, and 7 difficulty raters' but gives no sampling frame, response rate, sector/geography breakdown, or inter-rater reliability. Without evidence that a different expert sample would produce similar rankings, the 'field-wide' authority claim is unsubstantiated. The paper should report, at minimum, dispersion metrics (e.g., per-rater score distributions, confidence intervals, or standard deviations) and the full sample description. If Appendix A contains this, the main text should summarize it; if not, the manuscript is missing load-bearing evidence.
[Chapter 1, p. 13 (Cost-effectiveness definition)] The cost-effectiveness metric is defined only as 'importance relative to the effort required and the degree to which the area is already being addressed,' with no formula, measurement scale, or aggregation rule. The ranking tables (Table 2, S.2) therefore cannot be independently audited. Specify the composite formula, how 'effort' and 'degree already being addressed' were quantified, and how the 'merging of closely related priority areas' was performed. These are free parameters in the current description and directly determine the top-10 cost-effectiveness list.
[Disclosure Statement] The disclosure states that Irregular researchers co-designed the interview protocol and workshop structure, and that several top-ranked recommendations (red-teaming specifications, assessment/auditing protocols, public-private partnerships, agent oversight tools) directly align with Irregular's and Watertight AI's commercial offerings. While the statement is commendable, the paper does not assess the potential impact of these interests on the rankings. Network-recruited expert samples are prone to over-representing author-adjacent views, and the disclosure makes this risk concrete. Add a sensitivity analysis (e.g., how many top-10 items remain when participants with financial conflicts are removed or when the ranking is restricted to non-affiliated experts) or explicitly bound the possible bias on the rankings.

minor comments (4)

[Chapter 2, 'Develop a national AI deterrence strategy'] 'Department of War (DoW)' appears to be an anachronism; the current executive department is the Department of Defense. Please correct or clarify the intended reference.
[Chapter 5, opening paragraph] The first sentence after the chapter heading begins with a lowercase 'because' ('... rather than passive tools. because these systems now...'). Please fix the capitalization.
[Tables S.1/S.2 and Tables 1/2] The Executive Summary and Chapter 1 present essentially identical ranking tables. Consider retaining one set in the main text and referencing it from the Executive Summary to reduce duplication.
[Various priority-area headings] The inline tags such as 'Importance #10' and 'Cost-effectiveness #7' are useful, but given the paper's emphasis on transparency, a table with the full ranked list and the supporting scores (mean, standard deviation) would be more informative than the current presentation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the ranked agenda is explicitly an expert elicitation, not a derived prediction.

full rationale

This paper does not present a derivation, prediction, or first-principles result whose output is equivalent to its input by construction. Its central artifact is an explicitly expert-driven priority ranking: the Executive Summary states, 'Expert input determined which priorities the field should pursue and how they rank,' and Chapter 1 repeats, 'The expert process determined which priority areas to pursue and how they ranked relative to one another.' The top-ten importance and cost-effectiveness lists are therefore summaries of the elicited expert scores, not outputs of a fitted model used to predict the same scores. The cost-effectiveness metric is described only as 'importance relative to the effort required and the degree to which the area is already being addressed,' but because no independent formula is claimed, there is no equation whose result reduces to its inputs. The paper does contain self-citations, notably the RAND Security Level framework (footnote 16) and 'Nichols, Nevo, and Greaves (2025)' in Chapter 5, and the disclosure statement notes that Irregular staff co-designed the study and that several recommendations align with Irregular's services. These are validity, transparency, and conflict-of-interest concerns, not circularity under the specified patterns: the ranked agenda is not derived from those citations, and removing them would not alter the fact that the lists are expert rankings. Concerns about sample representativeness, the absence of a published scoring formula, and potential interest alignment should be weighed as methodological or bias risks, but no step in the claimed derivation chain is identical to its own input by construction.

Assumptions & free parameters 1 free parameters · 3 assumptions · 2 invented entities

The report's central agenda rests on unvalidated expert judgment and an unspecified cost-effectiveness formula, and it introduces novel institutional/hardware proposals without prototypes. The disclosed conflicts of interest mean these are not independent external inputs.

free parameters (1)

Cost-effectiveness composite formula and merge criteria = not specified
The report ranks priorities on cost-effectiveness but does not give the formula or weights used to combine importance, implementation difficulty, and 'degree already addressed'; adjacent priorities were merged by judgment. The ranking depends on these unspecified choices.

assumptions (3)

domain assumption The 14-person workshop and more than 20 interviewees are representative of the global AI security field.
The entire agenda generalizes from this sample; the text calls participants 'global experts' but gives no sampling frame or representativeness evidence (Chapter 1, Approach).
domain assumption Importance and cost-effectiveness can be meaningfully quantified through expert elicitation and combined into a single ranking.
The paper uses average importance scores and a cost-effectiveness composite as if these are stable, measurable properties; reliability and validity are not tested (Chapter 1; Appendix A referenced).
domain assumption The four themes and the listed priority areas partition the relevant AI security solution space.
The agenda assumes no equally important area was omitted by the workshop participants; no systematic baseline comparison to existing frameworks is provided.

invented entities (2)

Secure weight module (SWM)
purpose: A proposed hardware device that stores model weights and performs inference entirely inside a tamper-resistant boundary to prevent exfiltration.
Proposed in Chapter 4 with no prototype, specification, or benchmark; the text itself estimates 18 months to 4 years for the tamper-resistance element alone.
AI-focused Information Sharing and Analysis Center (ISAC)
purpose: A proposed dedicated institution for sharing AI security incidents, threat intelligence, and response playbooks across frontier labs and deployers.
Proposed as a design in Chapter 3; no existing body, pilot data, or operational evidence is presented.

how reviews work

0 comments

Cite this review

Pith. "Pith review of AI Security Priorities: A Field-Wide Agenda." pith.science (2026). https://pith.science/paper/YRWHSJSB

@misc{pith2026260726069,
  author       = {Pith},
  title        = {Pith review of: AI Security Priorities: A Field-Wide Agenda},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YRWHSJSB}},
  note         = {Machine review of arXiv:2607.26069}
}

read the original abstract

As AI systems are rapidly integrated into critical economic, governmental, and national security functions, the gap between AI adoption and AI security readiness continues to widen. This paper presents a prioritized agenda for advancing AI security, informed by structured interviews with leaders across industry, government, and civil society, and refined through a multi-sector expert workshop. Participants identified and ranked the highest-importance and most cost-effective areas where progress could strengthen AI security - from protecting frontier AI systems and their underlying infrastructure to improving cybersecurity practices as AI reshapes the threat landscape. The resulting priorities are organized across four themes: establishing strategic foundations and policy frameworks; advancing public-private coordination and institutional infrastructure; advancing technical security engineering and assurance; and governing agentic AI under adversarial pressure. For each priority area, expert authors provide detailed analyses that define the problem, assess the current landscape, and identify actionable projects that stakeholders across sectors can pursue. The paper aims to serve as an initial practical foundation for coordinated investment and action across the AI security field. It is designed to serve both current practitioners and individuals and organizations looking to enter the field by identifying concrete, high-impact contributions suited to a range of strengths and capacities.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

3 extracted references · 1 linked inside Pith

[1]

Principles for the Secure Integration of Artificial Intelligence in Operational Technology

1 CISA et al. Principles for the Secure Integration of Artificial Intelligence in Operational Technology. (2025). 2 Executive Order 14110. Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. (2023). 3 Joshi, A., Moschetta, G., Winslow, E., Buys, W. & Hermann, A. Global Cybersecurity Outlook 2025: Insight Report. (World Economic F...

2025
[2002]

Pub. L. 107-204, §§ 201–203. 40 U.S. Department of Transportation Office of Inspector General. FAA’s Oversight of Boeing 737 MAX. AV2020020 (2021). 41 European Parliament and Council. Regulation (EU) 2024/1689 (AI Act), Article 6 and Annex III on high-risk AI system requirements, with general-purpose AI provisions effective August 2025 and full high-risk ...

2021
[2026]

42 Goodhart, C

(2024). 42 Goodhart, C. Problems of Monetary Management: The U.K. Experience. Monetary Theory and Practice, (1984). 43 Strathern, M. Improving Ratings’: Audit in the British University System. European Review 5, 305–321 (1997). 44 NRC. Resident Inspector Program Background. Office of Public Affairs (2023). 45 Apsey, E., Rogers, P., O'Connor, M. & Nertney,...

arXiv 2024

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.

[1] [1]

Principles for the Secure Integration of Artificial Intelligence in Operational Technology

1 CISA et al. Principles for the Secure Integration of Artificial Intelligence in Operational Technology. (2025). 2 Executive Order 14110. Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. (2023). 3 Joshi, A., Moschetta, G., Winslow, E., Buys, W. & Hermann, A. Global Cybersecurity Outlook 2025: Insight Report. (World Economic F...

2025

[2] [2002]

Pub. L. 107-204, §§ 201–203. 40 U.S. Department of Transportation Office of Inspector General. FAA’s Oversight of Boeing 737 MAX. AV2020020 (2021). 41 European Parliament and Council. Regulation (EU) 2024/1689 (AI Act), Article 6 and Annex III on high-risk AI system requirements, with general-purpose AI provisions effective August 2025 and full high-risk ...

2021

[3] [2026]

42 Goodhart, C

(2024). 42 Goodhart, C. Problems of Monetary Management: The U.K. Experience. Monetary Theory and Practice, (1984). 43 Strathern, M. Improving Ratings’: Audit in the British University System. European Review 5, 305–321 (1997). 44 NRC. Resident Inspector Program Background. Office of Public Affairs (2023). 45 Apsey, E., Rogers, P., O'Connor, M. & Nertney,...

arXiv 2024