Reps. Pat Harrigan, R-N.C., and George Whitesides, D-Calif., introduced legislation Oct. 22 that would direct the National Institute of Standards and Technology (NIST) to develop voluntary standards for protecting artificial intelligence (AI) models from foreign exploitation and using AI to strengthen cybersecurity defenses for critical infrastructure.
The AI Cyber Defense Act would give NIST 180 days after enactment to begin engaging private-sector AI stakeholders on model protection and establish an AI Cybersecurity Roundtable. The roundtable would develop voluntary standards and best practices for defensive uses of AI. It would include representation from AI companies and critical infrastructure owners and operators.
“We need to get the companies developing this technology working directly with the people responsible for defending our power grids, hospitals, and financial systems,” Harrigan said in an announcement. “That’s how we stay ahead of the threats and protect the Americans who depend on these systems every day.”
To protect AI models, NIST would work with industry to establish a definition of AI distillation attacks, which allow outside actors to extract valuable capabilities from advanced AI models. NIST and industry would also develop voluntary standards and best practices for detecting and preventing these attacks.
NIST would have to publish those standards and best practices on its website within one year after they are established. The bill does not set a separate deadline for their development.
Within one year of establishing the roundtable, NIST would have to publish its voluntary standards and best practices for defensive AI use.
The bill defines eligible private-sector AI stakeholders broadly, covering businesses that develop, train, deploy, offer, sell, or license AI systems, as well as those providing substantial computing infrastructure, data, or technical services for AI development or deployment.
That definition excludes entities of concern, including foreign businesses headquartered in China, Russia, Iran, North Korea, or Cuba, or whose parent companies are headquartered in those countries.
Whitesides said the proposal would help protect American AI development while supporting infrastructure operators facing evolving cyber threats.
“AI is advancing at a breakneck pace, and every month we keep China and other adversaries from stealing our progress is a month we gain to build the safeguards this technology needs,” Whitesides said.
The bill was referred to the House Committee on Science, Space, and Technology.