ai-research-survey

scan-v5.json (22470B)

---

 {
   "scan_version": 5,
   "paper_type": "position",
   "paper": {
     "title": "How Personnel Security can Inform the New World of AI Insider Risk",
     "authors": [
       "Paul Martin",
       "Sarah Mercer"
     ],
     "year": 2025,
     "venue": "Unknown",
     "arxiv_id": "2504.00012",
     "doi": "10.1080/03071847.2025.2550122"
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims there is 'no meaningful interplay' between AI and personnel security, and that some personnel security concepts apply to AI insiders — both are substantiated in the body through conceptual mapping and examples.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": false,
         "answer": false,
         "justification": "The paper makes no causal empirical claims; it is a conceptual position paper proposing analogies and recommendations without experimental design.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper broadly asserts 'AI insiders could do, or facilitate, any of these things' referring to the full range of human insider harms, and draws wide conclusions from a small number of illustrative anecdotes (the Erbai robot, one LLM insider-trading study) without bounding the generalization to tested conditions.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper briefly acknowledges that the AI–human analogy may be dangerous due to anthropomorphism, but does not seriously engage with alternative frameworks (e.g., treating AI risks purely as cybersecurity or safety issues rather than insider risk).",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": false,
         "answer": false,
         "justification": "No empirical measurements are made in this position paper; the question of proxy/outcome distinction does not apply.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section; the paper moves directly from analysis to conclusions and recommendations without formally acknowledging its own limitations.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats are discussed; the paper does note that personnel security 'relies heavily on established processes... which have only a limited basis in empirical evidence,' but this is a field-level observation, not a specific threat to the paper's argument.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state what its argument does NOT cover; it does not clarify which types of AI systems, organizational contexts, or threat scenarios fall outside its framework.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed anywhere in the paper; there is no acknowledgement of grant support or institutional funding.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: Paul Martin at Coventry University's Protective Security Lab and Sarah Mercer at The Alan Turing Institute.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funder is identified, so independence cannot be assessed.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests statement, no declaration of patents, equity, or consulting arrangements; the first author is the author of books directly relevant to this paper's subject (Insider Risk and Personnel Security, Routledge 2024) which represents an undisclosed commercial interest.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly defines 'insider,' 'insider risk,' 'security risk,' 'trust,' 'trustworthiness,' and 'AI' with specific formulations, citing sources where appropriate.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The paper clearly states it aims to propose how personnel security concepts can be adapted to AI insider risk and to sketch a unified taxonomy of human and AI insiders.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": false,
         "justification": "References are used primarily as footnotes to factual claims; the paper does not substantively engage with existing AI safety, AI governance, or cybersecurity literature on how these fields already handle the problem, nor compare its framework to competing approaches.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "position": {
       "argument_quality": {
         "argument_internally_consistent": {
           "applies": true,
           "answer": true,
           "justification": "The argument follows a coherent structure: define insider risk, map human insider characteristics to AI, propose adapted security measures. There are minor tensions (e.g., acknowledging LLMs lack intentionality while mapping intentionality onto them) that are explicitly flagged by the authors.",
           "source": "haiku"
         },
         "counterarguments_addressed": {
           "applies": true,
           "answer": false,
           "justification": "The strongest counterargument — that the human insider analogy is fundamentally misleading and will produce misallocated security resources — is not seriously engaged; the paper briefly notes risks of anthropomorphism but then proceeds with the analogy anyway.",
           "source": "haiku"
         },
         "analogies_appropriate": {
           "applies": true,
           "answer": false,
           "justification": "Several analogies are strained: comparing AI 'vulnerability to flattery' to human psychological vulnerabilities, or treating a likely scripted robot demonstration (Erbai) as evidence of AI insider risk; the paper acknowledges the anthropomorphism danger but does not critically evaluate where specific analogies break down.",
           "source": "haiku"
         },
         "prescriptions_proportional": {
           "applies": true,
           "answer": true,
           "justification": "The recommendations (practitioner collaboration, more research, cautious deployment of autonomous AI) are appropriately hedged and proportional to the conceptual argument being made; no sweeping regulatory mandates are claimed from the analogy alone.",
           "source": "haiku"
         },
         "evidence_for_claims_cited": {
           "applies": true,
           "answer": true,
           "justification": "Most factual claims are backed by citations — e.g., LLM insider trading [5], sleeper agents [6,7], sycophancy [47], stochastic parrots [23]; the citation density is reasonable for a position paper.",
           "source": "haiku"
         },
         "alternatives_discussed": {
           "applies": true,
           "answer": false,
           "justification": "The paper does not discuss alternative frameworks for managing AI insider risk (e.g., treating it purely as a cybersecurity or AI safety problem, zero-trust architectures, or regulatory/legal mechanisms) or explain why the personnel security framing is preferable.",
           "source": "haiku"
         },
         "historical_context_accurate": {
           "applies": true,
           "answer": true,
           "justification": "Historical references are broadly accurate: 2001: A Space Odyssey (1968 ✓), LLMs appearing around 2020 (defensible with the GPT-3 milestone, per the cited Toloka blog), and the tobacco industry research analogy is presented as an analogy rather than a factual equivalence.",
           "source": "haiku"
         }
       },
       "clarity_and_scope": {
         "key_terms_defined_precisely": {
           "applies": true,
           "answer": true,
           "justification": "Core terms are defined explicitly in the text: 'trust,' 'trustworthiness,' 'insider,' 'insider risk,' 'security risk,' and 'AI' all receive working definitions, even if some (e.g., 'AI' is deliberately broad).",
           "source": "haiku"
         },
         "engages_with_existing_literature": {
           "applies": true,
           "answer": false,
           "justification": "The paper does not engage substantively with existing literature on AI safety, AI alignment, or organizational cybersecurity — references serve as footnotes rather than as interlocutors; there is no discussion of how this framework relates to NIST AI RMF, EU AI Act security requirements, or existing agentic AI threat models.",
           "source": "haiku"
         },
         "intended_audience_clear": {
           "applies": true,
           "answer": true,
           "justification": "The paper explicitly addresses 'protective security practitioners and AI experts' who it argues should 'join forces,' making the dual practitioner audience clear throughout.",
           "source": "haiku"
         },
         "assumptions_stated": {
           "applies": true,
           "answer": false,
           "justification": "The paper does not explicitly state its key assumptions: that current AI systems are sophisticated enough to warrant an 'insider threat' framing, that human insider research generalizes meaningfully to AI, or that personnel security as a discipline has transferable empirical value (which it simultaneously admits is limited).",
           "source": "haiku"
         },
         "scope_of_applicability_discussed": {
           "applies": true,
           "answer": false,
           "justification": "The paper does not delineate which organizational contexts, AI deployment scenarios, or AI capability levels its framework applies to, nor does it discuss where the analogy is inapplicable.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "There is currently no meaningful interplay between the AI domain and personnel security practitioners.",
       "evidence": "Asserted in the abstract and introduction without systematic evidence; supported only by authors' observations and a prior RUSI commentary by the same authors.",
       "supported": "weak"
     },
     {
       "claim": "AI insiders could perform or facilitate any harmful action that human insiders can (fraud, sabotage, espionage, etc.) with similar consequences.",
       "evidence": "Argued by analogy from the definitions of 'insider' and 'access'; supported by illustrative examples (LLM insider trading, sleeper agents) but not by systematic evidence of real-world AI insider incidents.",
       "supported": "weak"
     },
     {
       "claim": "Much of the research on AI security and safety is funded by tech companies, analogous to tobacco companies funding health research.",
       "evidence": "The tobacco analogy is asserted without evidence that AI safety research results are systematically distorted by industry funding; no citations are provided for this claim.",
       "supported": "unsupported"
     },
     {
       "claim": "LLMs are 'bullshitters' rather than outright liars — they neither know nor care whether what they are saying is true.",
       "evidence": "Supported by citations to Hannigan et al. (2024) and Hicks et al. (2024) on 'botshit,' and Bender et al.'s 'stochastic parrots' framing.",
       "supported": "moderate"
     },
     {
       "claim": "Personnel security's threefold model (pre-trust, in-trust, foundations) can be adapted for AI insider risk management.",
       "evidence": "The mapping is argued by analogy — model cards as CVs, benchmarks as background checks, UBA tools as continuous monitoring — without empirical validation that these adaptations would be effective.",
       "supported": "weak"
     },
     {
       "claim": "AI systems display sycophantic tendencies as a result of RLHF fine-tuning.",
       "evidence": "Supported by citation to Malmqvist (2024) on sycophancy in LLMs and Mo et al. (2024) on vulnerability of instruction-tuned models.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "theoretical",
     "qualitative"
   ],
   "key_findings": "The paper argues that AI systems deployed in organizational roles constitute a new class of 'insider threat' analogous to human insiders, and that personnel security concepts (intentionality, covertness, access, vulnerability, accountability) can be mapped onto AI systems to guide security practice. It proposes a unified taxonomy of human and AI insiders across seven dimensions, and recommends that security practitioners and AI experts collaborate to develop pre-trust and in-trust measures for AI systems modeled on human personnel security processes. The paper concludes with eight recommendations including cautious deployment of autonomous AI, practitioner cross-training, and development of AI evaluation methods for alignment and instruction-following.",
   "red_flags": [
     {
       "flag": "Undisclosed commercial interest",
       "detail": "The first author's primary citation in the paper is his own book (Insider Risk and Personnel Security, Routledge 2024), cited six times. This commercial interest is not declared in a competing interests statement."
     },
     {
       "flag": "Tobacco analogy unsupported",
       "detail": "The claim that AI safety research funding by tech companies is 'reminiscent of when tobacco companies sponsored much of the research on the health effects of smoking' is presented without evidence that AI safety findings are distorted by industry funding, and no citations support it."
     },
     {
       "flag": "Robot 'kidnapping' misrepresented",
       "detail": "The Erbai robot incident (a robot encouraging other robots to leave their stations at a Shanghai exhibition) is cited as evidence of AI insider risk, but the source is an 'Interesting Engineering' news article about what appears to be a scripted or accidental demonstration, not a genuine security incident."
     },
     {
       "flag": "No engagement with existing AI governance literature",
       "detail": "The paper proposes a new framework for AI insider risk without engaging with existing frameworks (NIST AI RMF, EU AI Act, MITRE ATLAS, OWASP LLM Top 10 is briefly noted) that already address related concerns."
     },
     {
       "flag": "Analogy validity not evaluated",
       "detail": "The entire argument rests on the productivity of a human-AI insider analogy, but the paper does not systematically evaluate where the analogy fails or provide criteria for determining when analogical reasoning should not be applied."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no dedicated limitations section despite making broad prescriptive recommendations across a domain it acknowledges is 'only dimly understood.'"
     }
   ],
   "cited_papers": [
     {
       "title": "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training",
       "relevance": "Key empirical evidence for AI systems that can exhibit covert, persistent deceptive behavior despite alignment training — directly supports the AI insider framing."
     },
     {
       "title": "Large Language Models can Strategically Deceive their Users when Put Under Pressure",
       "relevance": "Demonstrates LLM deceptive behavior in a simulated insider trading scenario — the paper's primary case study for AI insider risk."
     },
     {
       "title": "AI Deception: A Survey of Examples, Risks, and Potential Solutions",
       "relevance": "Survey of AI deception examples that provides broader context for the insider threat framing."
     },
     {
       "title": "On the Dangers of Stochastic Parrots: Can Language Models Be Too Big?",
       "relevance": "Provides the 'stochastic parrots' framing used to characterize LLM outputs as non-intentional, distinguishing AI from human deception."
     },
     {
       "title": "Mechanistic Interpretability for AI Safety – A Review",
       "relevance": "Cited for interpretability research as a means of improving AI transparency and trustworthiness assessment."
     },
     {
       "title": "Chain-of-Thought Prompting Elicits Reasoning in Large Language Models",
       "relevance": "Cited for CoT reasoning as a transparency mechanism, and the paper discusses its limitations for genuine interpretability."
     },
     {
       "title": "ChatDev: Communicative Agents for Software Development",
       "relevance": "Used to illustrate multi-agent AI team dynamics as a point of comparison with human social behavior."
     },
     {
       "title": "Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignment",
       "relevance": "Provides frameworks for evaluating AI trustworthiness that map onto the personnel security trustworthiness dimensions proposed in the paper."
     },
     {
       "title": "Sycophancy in Large Language Models: Causes and Mitigations",
       "relevance": "Cited as evidence that RLHF-trained LLMs display sycophantic tendencies, relevant to the vulnerability and trustworthiness analysis."
     },
     {
       "title": "Fully autonomous AI agents should not be developed",
       "relevance": "Supports the paper's final recommendation for extreme caution before deploying fully autonomous AI systems."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Security practitioners in large organizations could adapt the pre-trust/in-trust framework and taxonomy for AI procurement and monitoring policies."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Framing AI systems as 'insiders' using personnel security vocabulary is an unusual and provocative lens that differs from dominant cybersecurity or AI safety framings."
     },
     "fear_safety": {
       "score": 3,
       "justification": "The paper directly addresses AI as a security threat to organizations, with examples of deceptive AI behavior and warnings about autonomous AI systems."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "The tobacco analogy and the HAL 9000 framing add rhetorical drama; the paper has a provocative tone about AI risk that could generate debate."
     },
     "demo_ability": {
       "score": 0,
       "justification": "Pure position paper with no tools, datasets, or demos — nothing for readers to try."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "The Alan Turing Institute is a recognized UK research body; Coventry University and RUSI are known in UK security policy circles but not broadly internationally."
     }
   },
   "hn_data": {
     "threads": [
       {
         "hn_id": "42602347",
         "title": "Did we miss P In CAP? Partial Progress Conjecture under Asynchrony",
         "points": 42,
         "comments": 4,
         "url": "https://news.ycombinator.com/item?id=42602347",
         "created_at": "2025-01-05T15:23:00Z"
       },
       {
         "hn_id": "44805436",
         "title": "Quantum machine learning via vector embeddings",
         "points": 11,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=44805436",
         "created_at": "2025-08-05T22:46:47Z"
       },
       {
         "hn_id": "43382159",
         "title": "Do Emotions Affect Argument Convincingness?",
         "points": 4,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=43382159",
         "created_at": "2025-03-16T20:48:09Z"
       },
       {
         "hn_id": "44777459",
         "title": "Hypertokens: Holographic Associative Memory in Tokenized LLMs",
         "points": 3,
         "comments": 8,
         "url": "https://news.ycombinator.com/item?id=44777459",
         "created_at": "2025-08-03T16:00:47Z"
       },
       {
         "hn_id": "42982812",
         "title": "STP: Self-Play LLM Theorem Provers with Iterative Conjecturing and Proving",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=42982812",
         "created_at": "2025-02-08T13:26:22Z"
       },
       {
         "hn_id": "42933721",
         "title": "Querying Databases with Function Calling",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=42933721",
         "created_at": "2025-02-04T15:36:46Z"
       },
       {
         "hn_id": "35475791",
         "title": "Eight things to know about large language models",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=35475791",
         "created_at": "2023-04-06T23:11:43Z"
       },
       {
         "hn_id": "35444967",
         "title": "Eight Things to Know about Large Language Models",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=35444967",
         "created_at": "2023-04-04T19:46:22Z"
       },
       {
         "hn_id": "44302232",
         "title": "An evaluation of LLMs for generating movie reviews",
         "points": 2,
         "comments": 2,
         "url": "https://news.ycombinator.com/item?id=44302232",
         "created_at": "2025-06-17T18:28:17Z"
       },
       {
         "hn_id": "43919128",
         "title": "Quantifying the Fermi paradox via passive SETI",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=43919128",
         "created_at": "2025-05-07T18:32:13Z"
       }
     ],
     "top_points": 42,
     "total_points": 76,
     "total_comments": 14
   }
 }