Agentic ai systems need accountable partial understanding for security
Accountable partial understanding: securing the epistemic attack surface of agentic systems
Cryptography and Security
Summary
Attackers take advantage of what defenders do not fully understand about software systems. The authors explain that with AI systems that act on their own, the parts people understand become smaller, faster changing, and tied to important decisions. They create a framework called accountable partial understanding (APU) that helps keep AI systems secure even when we can't fully understand them. This includes specific rules and ways to check that the AI's actions and evidence are clear, responsible, and manageable over time.
What this means in practice
- •For security engineers: Design and maintain AI-driven security tools with clear accountable boundaries and evidence for decision making to reduce risks from misunderstandings.
- •For medical device developers: Create AI-assisted systems like insulin delivery that track assumptions and maintain oversight even when full AI behavior is not understood.
A position paper. It proposes an approach and reports no results.
Authors
Josiah Dykstra
Abstract
Attackers profit from what defenders do not understand. Software security has treated the gap between system behavior and human comprehension as a condition to narrow through analysis and assurance, booking the remainder as accepted risk. Agentic AI systems change that gap: when software reads, writes, explains, and authorizes security-relevant behavior, partial understanding moves faster, grows more opaque, and couples to delegated authority. This paper characterizes the resulting epistemic attack surface and presents a taxonomy of four interacting attack categories, which target the interpretation of intent, the production and consumption of evidence, the scope of delegated authority, and the comprehension of human supervisors. It then defines accountable partial understanding (APU) and specifies six necessary conditions: bounded scope with explicit assumptions, inspectable evidence, assigned responsibility, visible residual unknowns, actionability, and temporal maintenance. It explains why delegating interpretation to software agents differs from distributing knowledge among people and distinguishes APU from risk acceptance, explainable AI, assurance cases, formal verification, and human-in-the-loop oversight. From the conditions, the paper derives five design principles: bounded delegation, decoupled evidence, assumption tracking with invalidation, role-specific accountability views, and intervention-preserving design with residual unknown registers. It introduces two measurable probe dimensions, evidence linkage and invalidation latency, for testing whether accountability mechanisms hold under change and adversarial pressure. Three running examples (an AI coding agent, an autonomous cyber-defense agent, and an AI-mediated insulin delivery update) ground the analysis. Security without full understanding is already here; the task is to make it accountable.