Vitalik Buterin does not believe that the growing concern that AI-powered hacking could make cybersecurity increasingly difficult is warranted. In a recent post, the Ethereum co-founder said he disagrees with the idea that AI hacking means “cybersecurity is doomed.”
He instead said that security could naturally favor protection once people build the right systems and use stronger verification tools.
Buterin gave a simple example involving advanced artificial intelligence and mathematics. He said,
“If AI can prove Navier-Stokes and FLT, then AI can prove the statement ‘this program is secure’ as a mathematical theorem. Even if the program is very complicated.”
However, Buterin emphasized that defining what “secure” actually means is much harder than it sounds. A system can have many different security concerns that need to be considered. Security definitions can become extremely detailed. They can cover how an attacker might interfere with a system, how information could leak, and what could happen if different parts of the software or hardware fail or are compromised.
Because of this, Buterin said making definitions more human-readable is extremely important. He described this as perhaps the only “high-level language” that matters right now. Buterin still believes that, for security-critical components, the definition can be a much smaller attack surface than the implementation itself.
Verifying whether the definition is adequate can also be more manageable than scanning the code directly. He said better tools could make this process even more practical.
He even sees an advantage in working with definitions. They are additive. If two groups have two different definitions, developers can prove that a program satisfies both. If the two definitions cannot be satisfied at the same time, the conflict is isolated and becomes an important issue for the project to address.
Code does not work this way, according to the Ethereum co-founder. If a program is made up of different parts, a bug in any one of those parts can compromise the whole thing. Buterin acknowledged that this approach does not work equally well for every type of software. In some cases, such as user-interface components, the definition may be almost as large as the implementation.
But for many critical components, he said the difference is real. He specifically pointed to message-passing protocols, sandboxes, and cryptographic systems such as SNARKs and fully homomorphic encryption. Previously, developers often verified only the parts of their code that they believed were security-critical. The rest was left unchecked. While this was understandable when verification was difficult and scarce, he believes that modern AI the situation.
See every story in Crypto — including breaking news and analysis.
For Buterin, the answer is therefore not simply to hope that “good guys” find vulnerabilities before the “bad guys.” The more important strategy is to make code much more resilient in the first place. According to him, there is no future for blockchains, especially those focused on scalability and privacy, without this kind of work.
