Research
The below database includes IAPS’ public research reports, responses to government requests for information, blog posts, and more.
Featured Research
Location Verification for AI Chips introduces a design for a mechanism that can work on existing chips and verify their location to help enforce export control agreements, while being privacy preserving and reasonably tamper-proof.
Strategic Visions in AI Governance addresses three severe risks: takeover by powerful misaligned AI systems, wars resulting from competitive dynamics around AI, and AI-enabled concentration of power among a small group of people.
Highly Autonomous Cyber-Capable Agents examines the question: what happens when AI systems can plan, execute, and sustain sophisticated cyber operations entirely on their own?
Filter
- Compute governance 20
- Policy and Standards 18
- International governance & China 16
- Erich Grunewald 14
- Linkpost 10
- Oliver Guest 10
- Jam Kraprayoon 8
- Frontier Security 7
- Bill Anderson-Samways 6
- Issue Brief 6
- Oscar Delaney 6
- Responses to RFIs/RFCs 6
- Renan Araujo 5
- Joe O'Brien 4
- Asher Brass 3
- Cara Labrador 3
- Shaun Ee 3
- Chris Covino 2
- Onni Aarne 2
- Clarissa Koh 1
- Dave Banerjee 1
- Sumaya Nur Adan 1
Semiconductor manufacturing equipment refers to the machines and components used to make modern chips. Export controls on this equipment have significantly delayed China’s AI chip making efforts, underpinning a strong US advantage in AI infrastructure.
H200 exports to China would substantially boost Chinese frontier AI development and deployment capabilities, and therefore likely military applications for the PLA. Because end-user access and end use cannot feasibly be controlled once chips enter China, the BIS rule’s verification requirements are unenforceable.
US export control enforcement isn't keeping pace with the AI chip market. We propose independent, for-profit export auditors—accredited by BIS—to detect chip diversion through on-site inspections, scaling with market growth.
In February 2026, Anthropic, OpenAI, and Google published evidence of systematic campaigns by Chinese AI companies to extract capabilities from American frontier models. This memo examines how distillation attacks work, why there is a case for targeted government intervention and what that might look like. Recommendations are offered to support industry efforts to counter distillation attacks: (1) consider BIS Entity List designations for adversary AI companies conducting distillation attacks; (2) assess the merits of PAIP Act sanctions against those engaging in or facilitating distillation attack; (3) explore the development of a NIST-led AI Distillation Defense Framework for the broader ecosystem.
Offensive cyber capabilities in frontier AI models are advancing fast. In a matter of months, models have gone from near-zero to meaningful success rates on expert-level security challenges, and leading AI developers have begun triggering their own internal risk thresholds for cybersecurity. Meanwhile, real-world cases have already emerged in which AI agents autonomously executed significant portions of state-sponsored cyber campaigns. These developments raise an increasingly urgent question: what happens when AI systems can plan, execute, and sustain sophisticated cyber operations entirely on their own
The India AI Impact Summit was the fourth in a series of global AI summits. The stated goal of the Summit was to shift the global AI conversation toward “demonstrable impact”, with a focus on inclusive growth. This included orienting the Summit towards various use cases of AI, such as with panels discussing how to drive adoption in sectors like finance, healthcare, and agriculture.
Frontier AI systems are advancing rapidly and reshaping government operations. As government agencies integrate AI into intelligence analysis, policy research, software development, and military operations, adversaries are increasingly incentivized to compromise these systems. Defending against these threats requires preserving the integrity of AI systems. AI integrity means ensuring AI systems are free from secret or unauthorized modifications that could compromise their behavior.
Beijing-based, Alibaba-backed AI company Moonshot now offers Kimi Claw - an 'always-on' AI agent embedded in its consumer platform that can access users' files, apps, and communications continuously. Where TikTok collects data from a single app, these agents represent a qualitatively deeper level of data exposure. This memo examines the privacy, cybersecurity, and national security risks, and recommends four low-cost steps the federal government can take now.
The Stop Stealing Our Chips Act is a bipartisan, bicameral bill introduced in 2025 that would authorize a new Bureau of Industry and Security (BIS) program to strengthen export enforcement by financially rewarding individuals who report export violations to US authorities. This memo explains the bill and offers recommendations to strengthen enforcement.
What AI policy objectives should one work towards? This depends greatly on one’s strategic vision. Strategic visions are high-level views about how to successfully navigate the transition to a world with powerful AI systems. The strategic visions discussed here particularly aim to address three severe risks: takeover by powerful misaligned AI systems, wars resulting from competitive dynamics around AI, and AI-enabled concentration of power among a small group of people.
On January 13, 2026, BIS released a new licensing policy for exports of the Nvidia H200, and similar AI accelerator chips, to China. The licensing policy is the regulatory implementation of the administration’s December 8, 2025 announcement that it would permit H200 sales to China in exchange for a 25% export fee. This memo analyzes and explains the new policy.
A new memo by IAPS Associate Researcher Oscar Delaney reviews the emerging “MAIM” (mutual assured AI malfunction) literature and evaluates the strategic dynamics that could shape ASI deterrence.
In November 2025, Anthropic reported detecting and disrupting one of the first cyber espionage campaign. This appears to be the first publicly known example of AI systems autonomously conducting multi-step attacks against well-defended targets in the wild. This represents a significant step as autonomous offensive AI agents could enable nation-states to conduct continuous operations across multiple targets at an increased tempo, and these autonomous capabilities are likely to proliferate and enable less sophisticated actors to conduct complex operations at faster speeds. This may shift advantages toward attackers until defensive capabilities are deployed at scale.
The U.S. government does not currently have enough specialized AI security talent to respond to AI-related national security crises, nor does it have the hiring and clearance mechanisms to surge external experts into short-term service at the speeds a crisis demands. This report sets out how to prepare for that challenge.
The most advanced AI models produce detailed reasoning steps in human language—known as "chain of thought" (CoT)—that provide crucial oversight capabilities for ensuring these systems behave as intended. However, competitive pressures may drive developers toward more efficient but non-monitorable architectures that lack a human-readable CoT. This report presents a framework for determining when coordination mechanisms are needed to preserve CoT monitorability.
AI systems are advancing at breakneck speed and already reshaping markets, geopolitics, and the priorities of governments. Frontier AI systems are developed and deployed using compute clusters of hundreds of thousands of cutting-edge AI chips housed in specialized data centers. These AI data centers are likely tempting targets for sophisticated adversaries like China and Russia, who may seek to steal intellectual property or sabotage AI systems underpinning military, industry, or critical infrastructure projects.
Adapted from a section of a report by Erich Grunewald and Christopher Phenicie, this blog post introduces the core concepts and background information needed to understand the AI chip-making process.
Computational power (“compute”) is a strategic resource in the way that oil and steel production capacity were in the past. Like oil, and like steel production capacity, compute is scarce, controllable, concentrated, and highly economically and militarily useful. Just as oil and steel were and remain strategic resources to some extent, compute is now also a strategic resource of very high importance.
The most advanced AI systems remain hidden inside corporate labs for months before public release—creating both America's greatest technological advantage and a serious security vulnerability. IAPS researchers identify critical risks and propose lightweight interventions to lessen the threat.
Alongside its AI Action Plan, the Trump administration published an executive order (EO) for Promoting the Export of the American AI Technology Stack.
In our Differential Access report, we provided a strategic framework to help developers give defenders an advantage by shaping access to AI-powered cyber capabilities. In a new policy memo, we outline government actions that can enable Differential Access and promote AI adoption for cyber defense.
The growing impacts of artificial intelligence (AI) are spurring states to consider international agreements that could help manage this rapidly evolving technology. The political feasibility of such agreements can hinge on their verifiability—the extent to which the states involved can determine whether other states are complying. This report, published by the Oxford Martin School at the University of Oxford analyzes several potential international agreements and ways they could be verified.
The Trump Administration unveiled its comprehensive AI Action Plan on Wednesday. Experts at the Institute for AI Policy and Strategy reviewed the plan with an eye toward its national security implications. As AI continues to accelerate towards very powerful artificial general intelligence, our researchers discuss promising proposals for addressing critical AGI risks, offer key considerations for government implementation, and explore the plan's gaps and potential solutions.
The most powerful AI systems are used internally for months before they are released to the public. These internal AI systems may possess capabilities significantly ahead of the public frontier, particularly in high-stakes, dual-use areas like AI research, cybersecurity, and biotechnology. To address these escalating risks, this report recommends a combination of technical and policy solutions.
This post contains IAPS’s response to the Request for Information from Senators Heinrich and Rounds as part of the American Science Acceleration Project (ASAP), a national initiative to accelerate the pace of American technical innovation.
This is a linkpost for a policy memo published by the Federation of American Scientists, which proposes scaling up a significantly enhanced “CAISI+” within the Department of Commerce.
The emergence of the China AI Safety and Development Association (CnAISDA) is a pivotal moment for China’s frontier AI governance. How it navigates substantial domestic challenges and growing geopolitical tensions will shape conversations on frontier AI risks in China and abroad.
A Whistleblower Incentive Program to Enforce U.S. Export Controls: "A program modeled on the successful SEC program would help America overcome its export control enforcement woes.”
The Center for a New American Security (CNAS), in collaboration with the Institute for AI Policy and Strategy, has released a new working paper which catalogues evidence that substantial quantities of advanced artificial intelligence (AI) chips are being smuggled into China, undermining U.S. national security.
A memo to outline a strategic, coordinated policy approach supporting R&D to address urgent assurance and security challenges relating to frontier AI systems.