Former NIST AI official emphasizes need for weight and measurements framework to ensure security

Elham Tabassi, former chief AI officer at the National Institute of Standards and Technology, questioned efforts by frontier AI firms to develop their own standards in an Oct. 22 presentation at a cybersecurity conference here, arguing that the focus should be on weights and measurements developed in a consensus model. Tabassi highlighted OpenAI CEO Sam Altman’s Sept.

23 briefing before the United Nations Security Council, where she said he was asking for “standards on measuring capabilities, assessing risks, determining whether safeguards are sufficient and common standards so countries can compare evidence.” Tabassi said Altman, in effect, was asking for “weights and measures for AI.” Tabassi said there isn’t a “real agreement on a single model” for AI governance and different institutions are comparing “AI capabilities, risks [and] safeguards” but there is still a question on evidence. Tabassi spoke at the CS5 East conference hosted by the accreditation body behind the Pentagon’s Cybersecurity Maturity Model Certification program. Tabassi said she is “excited and encouraged” by the idea of bringing an independent evaluator into AI firms, referring to a pitch from Anthropic which has brought in employees from METR to conduct evaluations.

But, Tabassi said, “Unless we have an agreed and published protocol, we don't really know” whether the evaluation and “evidence is worth trust or not.” Measurements need to be “credible,” Tabassi said, adding that AI governance can take lessons learned from other disciplines such as oversight of clinical trials in the healthcare sector and the use of financial audits. “Credible measurement also need[s] governance rules for access, disclosure, conflict of interest,” Tabassi said. “And more importantly,” Tabassi said, there should be “reproducibility and a way for the public to challenge the results.” Tabassi also spoke about incident reporting and having a “defined trigger for where [incidents] should be reported.” President Trump’s Super Intelligence Force includes a working group to “[r]eview and develop protocols and mechanisms for labs to provide early warnings and systemized notifications to the government of breaches, hacks, jailbreaks, and other issues,” according to a readout from the group’s first meeting.

Tabassi said the “mandate” from the SI Force for incident reporting “really warms my heart because it’s extremely important.” “My hope is that we should even start thinking about near misses,” Tabassi said, referring to the aviation sector’s practices as a potential model to follow.