RESI Reading Group on AI Safety

Background

Modern cryptography took shape in the 1970s and 1980s through a combination of new constructions and new definitions. Public-key cryptography challenged the assumption that secure communication required a previously shared secret, while semantic security and zero knowledge gave precise meaning to what an adversary could learn. These developments shifted attention from designing schemes that resisted known attacks toward specifying security goals and proving guarantees under explicit computational assumptions. The definitions themselves provided foundations for an entire surge of results, ideas, and concepts revealing both unexpected possibilities and fundamental limitations.

While reading, consider these guiding questions

• What problems motivated the definitions? How did the new definitions address them?
• One of the reasons the definitional activity of the early 80s was so successful is that the early definitions were not just good in their own right, but also offered a methodology for coming up with new definitions and new ideas. What are the key ideas, in your opinion, that allowed this surge?
• Given knowledge of modern crypto, how has the way we think and conceptualize the problems changed?
• What are the similarities and differences between the definitional crisis of AI nowadays and the definitional crisis of crypto in the 70s?

Reading guidelines

Read as much as you find interesting; we will also highlight certain paragraphs and discuss them during the session.

Readings

• The First Ten Years of Public-Key Cryptography — a retrospective account by Whitfield Diffie, one of the pioneers of modern cryptography.
• Modern Cryptography, Probabilistic, Proofs and Pseudorandomness — read the Preface and Chapter 1.

Optional readings

• Historical account of early and ancient cryptography (The Codebreakers).
• New Directions in Cryptography (1976).
• Elementary Cryptanalysis (1939).

While reading, consider these guiding questions

• What justifications were given for efficacy of these defenses when they were initially proposed?
• Why were these justifications insufficient?
• Think about how you might come up with a rigorous security definition for any of these classes of defenses. (This may be difficult).
• Can you think of other examples where heuristic methods for AI safety have failed, or seem vulnerable?

Reading guidelines

Read as much as you find interesting; we will also highlight certain paragraphs and discuss them during the session.

Readings

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections
• MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents