Big Tech AI auditors only see what they are shown

If White House compliance audits are to have any value, auditors should be able to choose what they test, writes Samuel Vance Love, director of research at the Center for Decentralization Research.

Last week, six of the world's most powerful artificial intelligence companies promised the White House they would allow outsiders to review their work.

On September 29, Nvidia, OpenAI, Anthropic, Google, Meta and xAI signed an agreement on state-of-the-art artificial intelligence models that US President Donald Trump called "morally binding." Each company has promised to "partner with an independent external auditor or evaluator" and independent board members to review the auditors' reports and ensure that problems are fixed.

External audits are a good idea, and I'm glad to see them there. But the agreement says nothing about who will select the auditors, what they can review or whether their findings will be made public. There is no penalty for ignoring it. As it stands, each company chooses its own auditor and decides what the auditor will look at.

In 2000, Enron paid accounting firm Arthur Andersen—once part of the so-called "Big Five" of international accounting firms, now after Arthur Andersen's fall to the "Big Four"—$25 million to audit its books and another $27 million for tax and consulting work. Within two years, both companies collapsed. Congress responded with the Sarbanes-Oxley Act, which took auditor selection away from management, prohibited auditors from overselling services to the companies they audited, and created a public board to inspect the auditors themselves.

Andersen failed not because of a lack of expertise, but because of the motivation to look after the customer who is paying $52 million. One year of voluntary commitments is not a good record in the AI industry either. In 2023, leading AI companies made a series of voluntary commitments to the White House, including allowing outside experts to test their systems before release. When researchers at Stanford, Harvard and Brown went back and scored 16 companies against these commitments, the average came to 53 percent. With the promise of helping outsiders find and report problems, eight out of 16 scored zero.

Even when external testing is done, the developer sets the conditions. METR, a non-profit organization that tests AI models, wrote that testing of the o3 OpenAI model before release took place "in just three weeks" with "limited access to information about the model" and no view of the model's step-by-step reasoning.

To be fair to OpenAI, it allowed testing in the first place. But it shows how well a company uses what it chooses to share.

A trained AI model is basically a very large file of numbers, often costing more than $100 million to produce, and anyone who has a copy of it owns the model. Delivering copies to outsiders is a security risk. Until recently, this left testers with an awkward choice, which Google DeepMind described well: either the testers hand over their questions, so the company sees the exam in advance, or the company hands over its model.

In August, DeepMind showed a way around it. The institute, in collaboration with the AI ​​Safety Institute of Singapore and three other foreign groups, conducted what it called the world's first double-blind trial of an AI model, based on the same principle as a double-blind drug trial. The test was conducted on sealed computer hardware, so outside testers never saw the model and Google never saw their questions. Google says that any party can mathematically verify that its content remains private.

It also conveys confidence in the hardware. Last year, researchers broke into this type of sealed hardware with less than $1,000 worth of equipment, though they needed physical access to the server to do so. It is worth taking seriously. But this is a much smaller problem than "we can't let anyone near the model" and can be managed by being careful about who controls the machines.

For our report, "Alternatives to Centralized AI," published this week by the Center for Decentralization Research, my co-author Kyle Bligen and I interviewed 36 people and mapped out nearly 30 alternatives to centralized AI control. Our main finding was this: outsiders can now investigate advanced AI without owning the model or its data.

If agreement audits are to be of any value, auditors must choose what they test now that they can do so without obtaining a copy of the model. Companies must also say who their auditors are and what the audits cover, even if the exact findings remain private. For decades, public companies have named their auditors without disclosing trade secrets. And board committees that read these reports must answer to someone outside the company. Sarbanes-Oxley created an ombudsman for auditors. This agreement does nothing like that, and Congress will have to decide what fills the gap.

Note: The opinions expressed in this column are those of the author and do not necessarily reflect those of CoinDesk, Inc. or its owners and affiliates.

Diversified RWA stablecoins maintain a 5-7% return on real credit as crypto capital drops to 4%. GENIUS increases performance off-chain. TAM increases to $4 billion in 3 years.