The Offense-Defense Balance Rarely Changes

Please note that the graph of per capita war deaths is on a log scale. The number moves over several orders of magnitude. One could certainly make the case that local spikes were sometimes caused by significant shifts in the offense-defense balance (like tanks and planes making offense easier for a while at the beginning of WWII). These shifts are pushed back to equilibrium over time, but personally I would be pretty unhappy about, say, deaths from pandemics spiking 4 orders of magnitude before returning to equilibrium.

Seems like you expect changes in offense/defense balance to show up in what percentage of stuff gets destroyed.  On my models it should mostly show up in how much stuff exists to be fought over; people won't build valuable things in the first place if they expect them to just get captured or destroyed.

To make that more concrete:

On Cybersecurity:

Computers still sometimes get viruses or ransomware, but they haven’t grown to endanger a large percent of the GDP of the internet.

This seems borderline tautological.  We wouldn't put so much valuable stuff on the Internet if we couldn't (mostly) defend it.

In WW2, when one nation wanted to read another nation's encrypted communications (e.g. Enigma), they'd assemble elite teams of geniuses, and there was a serious fight about it with real doubt about who would win.  A couple centuries before that, you could hire a single expert and have a decent shot at breaking someone's encryption.

Today, a private individual can download open-source encryption software and be pretty confident that no one on earth can break the encryption itself--not even a major government. (Though they might still get you through any number of other opsec mistakes).

This is necessary to make modern e-commerce work; if we hadn't had this massive shift in favor of the defender, we'd have way way less of our economy online.  Note especially that asymmetrical encryption is vital to modern e-commerce, and it was widely assumed to be impossible until its invention in the 1970s; that breakthrough massively favors defenders.

But in that counterfactual world where the offense/defense balance didn't radically shift, you would probably still be able to write that "viruses and ransomware haven't grown to endanger a large percentage of the Internet".  The Internet would be much smaller and less economically-important compared to our current world, but you wouldn't be able to see our current world to compare against, so it would still look like the Internet (as you know it) is mostly safe.

On Military Deaths:

Does anyone have a theory of the offense-defense balance which can explain why the per-capita deaths from war should be about the same in 1640 when people are fighting with swords and horses as in 1940 when they are fighting with airstrikes and tanks?

On my models I expect basically no relation between those variables.  I expect per-capita deaths from war are mostly based on how much population nations are willing to sacrifice before they give up the fight (or stop picking new fights), not on any details of how the fighting works.

In terms of military tactics, acoup claims the offense/defense balance has radically reversed since roughly WW1, with trenches being nearly invincible in WW1 but fixed defenses being unholdable today (in fights between rich, high-tech nations):

The modern system assumes that any real opponent can develop enough firepower to both obliterate any fixed defense (like a line of trenches) or to make direct approaches futile. So armies have to focus on concealment and cover to avoid overwhelming firepower (you can’t hit what you can’t see!); since concealment only works until you do something detectable (like firing), you need to be able move to new concealed positions rapidly. If you want to attack, you need to use your own firepower to fix the enemy and then maneuver against them, rather than punching straight up the middle (punching straight up the middle, I should note, as a tactic, was actually quite successful pre-1850 or so) or trying to simply annihilate the enemy with massed firepower (like the great barrages of WWI), because your enemy will also be using cover and concealment to limit the effectiveness of your firepower (on this, note Biddle, “Afghanistan and the Future of Warfare” Foreign Affairs 82.2 (2003); Biddle notes that even quantities of firepower that approach nuclear yields delivered via massive quantities of conventional explosives were insufficient to blast entrenched infantry out of position in WWI.)

AI is not a matter of historical evidence. Correct models here are invasive species, new pathogens, Great Oxidation Event. 99% of species ended up extinct.

AI does not have to defend against bioweapon attacks to survive them.

Wars and cyberattacks happen when people MISJUDGE their own security. You can't measure offense-defense balance by looking at how many wars are happening, just like you can't (directly) measure market capitalization from trading volume. A better idea would be to look at cybersecurity SPENDING over time (at least as a % of all IT spending). And that has certainly changed.

I think it's a mistake to look at this globally. What is relevant, especially for older conflicts, is the local outcome. For the participants in the conflict in question, what was the outcome for the militarily inferior force? The answer is sometimes surrender, sometimes enslavement, sometimes slaughter. If the AI wants human servants, which I expect it will for a temporary transition period, it can use BCIs and mind control viruses (e.g. optogenetics) to literally turn humans into permanent mind slaves. It can use horrific civilization-ending bioweapons as a threat to keep unconquered nations from interfering. When the balance of power shifts, which it does, the losers tend to have a very bad time.

I put forward the stability-reason of control mechanisms, a prominent recent example being covid. Low-hanging attack-fruit are picked, we stop doing the things that make us vulnerable, and impose quarantines, and ban labs.

AI has those, too. But calling that an argument against AI danger is a decision-theoretic short-circuit.

I think you have to zoom out and aggregate quite a bit for this thesis, and ignore the fact that it's only been a few generations of humans who legitimately had the option to destroy civilization.  Ignore the fact that "offense" and "defense" in most cases are labels of intent, not of action or capability (which means they're often symmetric because they're actually the same capability).  But notice that there's a LOT of local variation in the equilibra you mention, and as new technology appears, it does not appear evenly - it takes time to spread and even out again.

“ AI is just completely different from all of our past technological revolutions but that’s a claim that needs a lot of evidence to be proven”

Not really, it should be clear pretty quickly that if any technology is going to be different, it is going to be AI. And not just for this statement, but for almost any statement you can make about technology, even really basic statements like, "Technology isn't conscious" and "Technology is designed and invented by humans".

I’m not claiming to demonstrate here that it is different, just that there isn’t some massive burden of proof to overcome.

if AI does change the offence defence balance, it could be because defending an AI (that doesnt need to protect humans) is fundamentally different than defending humans, allowing the AI to spend much less on defence

If we look at the chart purely as a line chart, it looks like it is oscillating between 1 and 100 deaths per 100,000 per year. I'm pretty sure the drive of that oscillation is game theoretic rather than technological, because whatever the offense/defense balance between humans is, you can always either choose to fight a lot (until the casualties hit 100) or not much. 100 deaths per 100,000 per year seems to be the limit at which nations break.

So I don't think this chart really tells us anything about offense/defense asymmetry. WWI was notorious for defense being very favored, and yet it's a casualty peak.

Summary: a detailed look at offense/defense is required.  Asymmetric attacks do exist. 

Asymmetric Detail paragraph 1: The USA faced asymmetric warfare in the middle East and ultimately gave up.  While almost all individual battles were won by US forces, the cost in terradollars was drastically skewed in favor of the attackers.  8 trillion USD over 20 years should be contrasted with the entire combined GDP of Iraq + Afghanistan,  approximately 2.5 trillion over that time period.  Some small portion of that was funding attacks (and foreign support)

Asymmetric Detail paragraph 2 : Where it gets really ridiculous is something like bioterrorism.  Suppose, for the sake of argument, that Covid-19 really was developed through deliberate gain of function experiments.  And it's done in an expensive lab with no expenses spared.  So 6.8 million/year.  Suppose 5 years of experiments are done to find the most optimal pandemic causing organism before release.  So 34 million dollars to develop the weapon, which did approximately 29.4 trillion in damage and killed approximately 3.4 million people.  If the 60 lab staff went on mass shooting sprees, and killed 58 people each, they would have killed 3480 people.  A bioweapon is approximately 1000 times as effective.  

Note on cybersecurity: Most cyberattacks can be traced to:

            (1) computing architectural decisions.  The use of lower level languages and inherently insecure operating systems rather than containerized everything.  Fundamentally insecure general purpose hardware, and untrusted code uses the same silicon as trusted code.

            (2) mistakes in implementation.  Perfect software on adequately good hardware cannot be hacked.

            (3) channel insecurity.  The way emails work, where the sender isn't tied to a real identity and the status of the sender isn't checked (corporate workers only want to hear from other corporate workers, jailers only from judges, bank officers only from the SEC and other bank workers) allows malware.  Similarly, 'fake news' is only possible because it doesn't require a publication license to open a website at all and there are minimal accountability standards for journalism.  

Mitigations:

           (1) is fixable, we'll just need all new silicon, new languages, and new OSes.  Some use of existing crypto ASICs and enclave CPUs is already done.

           (2)  is fixable, we just need to formally prove key parts of the software stack

           (3) is fixable.  Being a journalist has to be a title and it would be a licensed profession with requirements and standards.  Calling yourself one without the license would be a crime.  Opening a website that allegedly offers news would require a license and the web backend would need to contain some consensus mechanism to validate a given site.  (blockchain might be used here).  The same would be true for any other online service.  Sending emails would similarly require verification and a connection to a business or a person.

Everything outside of this would be the dark web.  Note that all the mitigations have costs, some substantial.  There is less free speech in this world, less open communication, and computers are less efficient because of using dedicated silicon (CPU and memory) to handle separate programs.  

Uses for AI Pauses: So while I personally think AI pauses are hopeless, I will note here that the above would be what you want to fix during one.  You can't find out the latest issues with more advanced AI than the current SOTA during a pause, but you could lock the world's computers down to reduce the damage when an AI tries to escape.  

Conclusion: Asymmetric attacks do exist, cyberattacks are an example where the advantage favors the defender, while bioattacks favor the attacker.  With that said I do agree with the OPs general feeling that the best way to prepare for an upcoming age of AI and advanced weapons made possible by AI is to lock and load.  You can't really hope to compete in a world of advanced weapons by begging other countries not to build them.  

Cybersecurity — this is balanced by being a market question. You invest resources until your wall makes attacks uneconomical, or otherwise economically survivable. This is balanced over time because the defense is ‘people spend time to think about how to write code that isn't wrong.’ In a world where cyber attacks were orders of magnitude more powerful, people would just spend more time making their code and computing infrastructure less wrong. This has happened in the past.

Deaths in conflicts — this is balanced by being a market question. People will only spend so much to protect their regime. This varies, as you see in the graph, by a good few orders of magnitude, but there's little historic reason to think that there should be a clean linear trend over time across the distant past, or that how much people value their regime is proportionate somehow to the absolute military technology of the opposing one.

Genome sequencing biorisk — 8ish years is not a long time to claim nobody is going to use it for highly damaging terror attacks? Most of this graph is irrelevant to that; unaffordable by 100x and unaffordable by 1000x still just equally resolve to it not happening. 8ish years at an affordable price is maybe at best enough for terrorists with limited resources to start catching on that they might want to pay attention.

I'd expect per capita war deaths to have nothing to do with offence/ defence balance as such (unless the defence gets so strong that wars simply don't happen, in which case it goes to zero).

Per capita war deaths in this context are about the ability of states to mobilize populations, and about how much damage the warfare does to the civilian population that the battle occurs over. I don't think there is any uncomplicated connection between that and something like 'how much bigger does your army need to be for you to be able to successfully win against a defender who has had time to get ready'.

In encryption, hasn't the balance changed to favor the defender? It used to be that it was possible to break encryption. (A famous example is the Enigma machine.) Today, it is not possible. If you want to read someone's messages, you'll need to work around the encryption somehow (such as by social engineering). Quantum computers will eventually change this for the public-key encryption in common use today, but, as far as I know, post-quantum cryptography is farther along than quantum computers themselves, so the defender-wins status quo looks likely to persist.

I suspect that this phenomenon in encryption technology, where as the technology improves, equal technology levels favor the defender, is a general pattern in information technology. If that's true, then AI, being an information technology, should be expected to also increasingly favor the defender over time, provided that the technology is sufficiently widely distributed.

shift the

Minor edit -  should be "shift in the"