Keywords: AI infrastructure, cyberattack, systemic collapse, edge computing, cloud resilience, data center security, Southeast Asia
Abstract
The rapid proliferation of artificial intelligence systems across critical sectors of the global economy has produced a paradox that demands urgent scholarly attention: the very infrastructure upon which AI depends has grown simultaneously more powerful and more fragile. Data centers, submarine cables, cloud platforms, and the software stacks that bind them together now constitute a nervous system for modern civilization — one that is increasingly exposed to catastrophic failure, whether from natural causes, human error, or deliberate adversarial attack. This essay examines the structural vulnerabilities embedded within today’s AI infrastructure, analyses the plausible scenarios under which systemic collapse could unfold, and evaluates the technical, regulatory, and geopolitical solutions that researchers and practitioners have proposed in response. Drawing on evidence from recent incidents, academic literature, and industry reports, this paper argues that the AI community has not yet developed adequate frameworks for understanding or managing the risks that its own success has created.
1. Introduction: The Infrastructure Upon Which Everything Rests
To speak of “artificial intelligence” in the public discourse is almost always to speak of its outputs — the generated image, the coded function, the natural language response. What is seldom discussed, and yet arguably more consequential, is the physical and logical infrastructure that makes these outputs possible. Behind every query submitted to a large language model lies a chain of dependencies: hyperscale data centers consuming gigawatts of power, optical fiber networks spanning ocean floors, semiconductor chips manufactured in a handful of fabs concentrated in Taiwan and South Korea, and orchestration software governed by a small number of corporate platforms (Acemoglu & Johnson, 2023).
This infrastructure has grown with breathtaking speed. Global data center power consumption reached approximately 460 terawatt-hours in 2022, and projections from the International Energy Agency suggest this figure could double by 2026, driven substantially by AI workloads (IEA, 2023). The computational demands of training frontier AI models have increased by a factor of roughly 300,000 between 2012 and 2022, a rate that dwarfs Moore’s Law and places extraordinary pressure on every layer of the stack beneath it (Sevilla et al., 2022).
Yet this growth has occurred largely without commensurate investment in resilience, redundancy, and security architecture. The result is a system that, in the view of this author, resembles an inverted pyramid: vast and impressive at the surface, yet resting on a base of surprisingly concentrated and brittle dependencies. The question is not whether this infrastructure will be tested — it is already being tested daily. The question is whether it will hold when tested severely.
This essay proceeds in four parts. Section 2 maps the structural vulnerabilities of AI infrastructure across its physical, logical, and human dimensions. Section 3 examines specific threat vectors, with particular attention to cyberattacks and cascading failure scenarios. Section 4 evaluates the principal solutions proposed in academic and policy literature. Section 5 offers conclusions and a call for more integrated thinking about AI infrastructure as a matter of national and regional security.
2. Mapping the Vulnerabilities: A Multi-Layered Analysis
2.1 Physical Layer Vulnerabilities
The physical substrate of AI infrastructure is more geographically concentrated than most people appreciate. The majority of hyperscale AI computing capacity is operated by a small number of providers — Amazon Web Services, Microsoft Azure, and Google Cloud — with data centers clustered in Northern Virginia, Oregon, Dublin, and Singapore (Synergy Research Group, 2023). This concentration creates single points of failure at a regional scale: a sustained power outage, a flooding event, or a targeted physical attack in Northern Virginia, which alone hosts roughly one-third of the world’s internet traffic, could impair AI services globally.
The physical vulnerability extends to cooling infrastructure. Modern AI chips — particularly GPUs and tensor processing units — generate enormous heat loads that require sophisticated cooling systems. Many data centers have become reliant on water-cooling technologies that draw millions of gallons per day from local water supplies. In regions experiencing drought — which climate science predicts will become more frequent and severe — this creates a resource competition that could force operators to throttle or shut down capacity (Patterson et al., 2021).
Submarine cables present another critical vulnerability. Over 95 percent of intercontinental internet traffic, including AI inference requests routed between regions, travels through approximately 500 submarine cable systems (Carter & Burnett, 2021). These cables, though remarkably durable, have been deliberately severed or accidentally damaged on numerous occasions. The severing of three cables serving West Africa in early 2024, for instance, caused significant internet disruption across multiple countries. A coordinated attack on even a small number of key cable landing stations — which are physically accessible and relatively lightly guarded — could isolate entire continental regions from AI cloud services.
2.2 Logical and Software Layer Vulnerabilities
The software architecture of modern AI systems introduces its own category of fragility. The AI ecosystem has developed around a relatively small set of foundational frameworks — PyTorch, TensorFlow, CUDA — and an even smaller number of cloud orchestration platforms. When Microsoft Azure suffered a global outage in July 2024 due to a faulty software update deployed by cybersecurity firm CrowdStrike, approximately 8.5 million Windows devices were rendered inoperable, including systems supporting critical infrastructure across aviation, healthcare, and financial services (Microsoft, 2024). The incident, though not AI-specific, illustrated precisely the kind of cascading logical failure that AI-dependent systems face.
The dependency on open-source software components creates what cybersecurity researchers refer to as “supply chain risk.” The XZ Utils vulnerability discovered in 2024, in which a malicious actor spent two years systematically contributing to an open-source compression library used across Linux distributions before inserting a backdoor, demonstrated that sophisticated adversaries are patient and methodical (Freund, 2024). AI systems, which frequently rely on open-source libraries for data preprocessing, model serving, and monitoring, are not immune to this threat vector.
Model weights themselves — the numerical parameters that encode a trained AI system’s capabilities — represent a new class of intellectual and security asset that existing frameworks are poorly equipped to protect. The theft of model weights not only undermines the commercial value of the training investment but could enable adversaries to fine-tune models for harmful purposes, or to understand and exploit specific weaknesses in a deployed system’s decision-making (Carlini et al., 2021).
2.3 Human and Organizational Vulnerabilities
The most underappreciated dimension of AI infrastructure vulnerability is the human one. The global pool of engineers capable of designing, deploying, and maintaining hyperscale AI infrastructure is remarkably small. A significant portion of this talent is concentrated in a handful of companies and geographies. The sudden departure of key personnel — through resignation, acquisition, or regulatory action — can leave critical systems without adequate stewardship. This is not a hypothetical concern: the rapid growth of AI startups has created intense talent competition that leaves established infrastructure teams chronically understaffed.
Insider threats represent a particular danger. Employees with privileged access to AI training pipelines, model repositories, or inference infrastructure occupy positions of trust that, if abused, could compromise systems in ways that are difficult to detect. The challenge is compounded by the opacity of AI systems themselves: it is often genuinely difficult to determine whether anomalous model behavior reflects a bug, a data quality issue, or deliberate manipulation (Shafahi et al., 2018).
Governance structures have not kept pace with the speed of deployment. Many organizations have deployed AI systems into critical workflows — medical diagnosis support, financial risk assessment, infrastructure control — without establishing adequate processes for monitoring system behavior, managing model drift, or executing controlled shutdowns. When things go wrong in such environments, the absence of clear incident response protocols can transform a manageable technical failure into a broader operational crisis.
3. Threat Scenarios: From Cyberattack to Cascading Collapse
3.1 Targeted Cyberattacks on AI Infrastructure
Nation-state actors have demonstrated sustained interest in penetrating the networks of AI research institutions and cloud providers. The 2020 SolarWinds attack, in which Russian intelligence services compromised the software update mechanism of a widely used IT management platform and thereby gained access to thousands of downstream organizations including US government agencies, established a template for how AI infrastructure could be targeted (CISA, 2021). The attack vector was elegant in its indirection: rather than attacking the target directly, adversaries compromised a trusted intermediary in the software supply chain.
Attacks specifically targeting AI systems can take several forms. Adversarial input attacks involve crafting carefully modified inputs that cause AI models to produce systematically incorrect outputs while appearing normal to human observers. These have been demonstrated against image classification systems, natural language processing models, and even AI-assisted medical diagnostics (Goodfellow, Shlens & Szegedy, 2015). In a deployed production environment, such attacks could be used to manipulate AI-powered fraud detection, content moderation, or autonomous vehicle perception systems.
Data poisoning attacks target the training process itself. By introducing maliciously crafted examples into training datasets, an attacker can influence the behavior of the resulting model in ways that are difficult to detect post-hoc. As AI systems are increasingly trained on data collected from the open internet — where adversaries can more readily inject poisoned content — this threat vector becomes more credible and more difficult to defend against (Biggio & Roli, 2018).
Ransomware attacks against data center operators represent a more blunt but potentially devastating threat. The 2021 attack on Colonial Pipeline, which forced the shutdown of fuel supply infrastructure serving the US East Coast, illustrated how ransomware could be used to extract leverage against critical infrastructure operators. AI cloud providers, who host sensitive enterprise data and whose service disruptions have immediate economic consequences for thousands of customers, present an attractive target for sophisticated ransomware actors (Dragos, 2021).
3.2 Cascading Failure and Systemic Collapse
Perhaps more concerning than targeted attacks is the possibility of cascading failures arising from the interconnected nature of AI infrastructure. Modern cloud architectures are designed with redundancy, but this redundancy can itself create unexpected failure modes. When a single configuration error or software bug propagates across multiple redundant systems simultaneously — as occurred in the Facebook/Meta outage of October 2021, which took the company’s entire global infrastructure offline for approximately six hours — the redundancy provides no protection (Janardhan, 2021).
The concentration of AI workloads on a small number of cloud providers creates systemic risk analogous to that identified in the financial sector after the 2008 crisis. Just as the interconnection of financial institutions meant that the failure of a single large bank could trigger cascading failures across the system, the failure of a major cloud provider’s AI serving infrastructure could simultaneously impair thousands of businesses, government services, and critical applications. Unlike in finance, there is no lender of last resort, no deposit guarantee scheme, and no established protocol for orderly resolution.
The energy grid presents a particularly acute cascading risk. AI data centers are increasingly co-located with power generation facilities or negotiating dedicated power purchase agreements precisely because they require guaranteed, uninterruptible power at scale. This creates a bidirectional dependency: the data center depends on the grid, but the grid increasingly depends on AI systems for optimization, fault detection, and demand management. A cyberattack that simultaneously targets AI infrastructure and the power grid systems that AI is used to manage could produce a feedback loop of mutual degradation that is difficult to arrest (Lohn & Mueller, 2022).
3.3 The Southeast Asian and Regional Dimension
For the Southeast Asian and broader Asia-Pacific region, the vulnerability profile has distinctive features that deserve specific attention. The region has rapidly expanded its AI infrastructure capacity, particularly in Singapore, which has positioned itself as a major data center hub for Southeast Asian AI workloads. Singapore hosts the regional data center operations of all major hyperscale cloud providers, as well as significant capacity operated by regional telecommunications companies and sovereign wealth fund-backed infrastructure firms (IMDA, 2023).
This concentration creates a geopolitical dimension to AI infrastructure risk that is qualitatively different from that faced in the United States or Europe. Singapore’s data centers are connected to the broader internet primarily through submarine cables, several of which transit contested maritime areas in the South China Sea. The vulnerability of these cable systems to deliberate interference by state actors — whether through direct physical action or through the compromise of network equipment supplied by vendors subject to foreign government influence — is a matter that regional security analysts take seriously (Chalk, 2022).
The rapid development of AI infrastructure across emerging Southeast Asian economies — Indonesia, Vietnam, the Philippines, Malaysia — has also created regulatory and security governance gaps. Many of these countries lack the cybersecurity workforce, the legal frameworks, and the institutional capacity to adequately oversee and protect the AI infrastructure being deployed on their territory by international partners. This creates conditions in which infrastructure vulnerabilities may go undetected or unaddressed for extended periods.
4. Solutions: Technical, Regulatory, and Geopolitical Frameworks
4.1 Technical Mitigations
The technical literature offers a range of approaches to hardening AI infrastructure against the vulnerabilities described above. At the physical layer, the most direct mitigation is geographic diversification of data center capacity, combined with active-active redundancy architectures that allow workloads to fail over seamlessly between regions. AWS, Azure, and Google Cloud have all invested heavily in such architectures, though the economic incentives to concentrate capacity — which allows for greater operational efficiency — work against the security imperative of dispersal (Armbrust et al., 2010).
Confidential computing represents a promising technical approach to protecting AI workloads from infrastructure-level compromise. By performing computation within hardware-enforced trusted execution environments — essentially encrypted enclaves that are opaque even to the cloud provider’s own administrators — confidential computing can protect model weights and training data from an attacker who has compromised the host infrastructure. Intel’s SGX and AMD’s SEV technologies have made confidential computing increasingly practical, though significant performance overhead remains a barrier to widespread adoption for AI workloads (Costan & Devadas, 2016).
For defending against adversarial attacks on AI models, the research community has developed a range of techniques collectively described as “robust machine learning.” Adversarial training — in which models are trained on both clean and adversarially perturbed examples — has been shown to improve resistance to certain attack types, though it typically comes at a cost to performance on clean inputs and may not generalize to novel attack strategies (Madry et al., 2018). Certified defenses, which provide mathematical guarantees about model behavior within specified input perturbation bounds, offer stronger assurances but remain computationally expensive and difficult to scale to large models.
Zero-trust network architecture, which assumes that no device or user within or outside a network perimeter can be trusted by default and requires continuous authentication and authorization, has emerged as a leading framework for hardening AI infrastructure against both external attackers and insider threats. Implementing zero-trust within large AI infrastructure environments is technically complex and organizationally demanding, but organizations that have done so report significantly improved resilience against credential-based attacks and lateral movement by intruders (Rose et al., 2020).
At the model level, techniques for detecting and mitigating data poisoning attacks remain an active area of research. Federated learning — in which model training is distributed across many participants who share only gradient updates rather than raw data — can reduce the ability of any single adversary to poison the training dataset, though it introduces its own coordination overhead and has been shown to be vulnerable to certain forms of gradient poisoning (Bagdasaryan et al., 2020). Differential privacy techniques, which add carefully calibrated noise to training data or model updates, can limit what an adversary can infer about individual training examples but typically reduce model accuracy and have not yet been adapted to the frontier-scale models that present the highest risk profile.
4.2 Regulatory and Policy Frameworks
The regulatory landscape for AI infrastructure security is fragmented and immature, but is developing rapidly. In the United States, the Executive Order on AI issued in October 2023 directed federal agencies to develop standards and guidelines for AI system security, and tasked the National Institute of Standards and Technology with producing an AI Risk Management Framework (Biden, 2023). The EU AI Act, which entered into force in 2024, establishes mandatory security and robustness requirements for high-risk AI systems, including requirements for logging, monitoring, and incident reporting that directly address some of the governance vulnerabilities identified in this essay (European Parliament, 2024).
For critical infrastructure protection, existing frameworks such as the NIST Cybersecurity Framework have been extended to address AI-specific risks. The CISA has published sector-specific guidance for AI use in critical infrastructure sectors, and has worked with international partners to develop shared incident reporting mechanisms that can accelerate the identification of emerging threats (CISA, 2023). However, enforcement capacity remains limited, and the pace of AI deployment in many sectors has outrun the ability of regulatory agencies to conduct meaningful oversight.
Information sharing between the public and private sectors represents a significant opportunity that has not yet been fully realized. The AI incidents that have occurred to date — model failures, data breaches, adversarial attacks — are rarely disclosed publicly in sufficient technical detail to allow the broader community to learn from them. Establishing protected disclosure frameworks, analogous to the aviation industry’s confidential safety reporting systems, could significantly improve the sector’s collective situational awareness (Floridi et al., 2018).
International coordination presents both the greatest challenge and the greatest opportunity in AI infrastructure security governance. The AI infrastructure of any individual country is deeply interconnected with that of its partners and competitors. An attack on AI infrastructure in one jurisdiction may originate from actors in a third country, transit networks in a fourth, and have consequences for users in many others. Effective governance requires not only national frameworks but international agreements on norms of behavior in AI infrastructure, mutual assistance in incident response, and coordination on standards for resilience. The G7, the OECD, and the UN Secretary-General’s Roadmap for Digital Cooperation have all produced relevant commitments, but implementation remains uneven (OECD, 2019).
4.3 Architectural Solutions: Decentralization and Edge Computing
One of the most structurally significant responses to the vulnerabilities of concentrated AI infrastructure is the push toward decentralized and edge architectures. Rather than routing all AI inference requests to a small number of centralized cloud regions, edge computing distributes processing capacity closer to the point of data generation and consumption. This approach reduces the blast radius of any single point of failure, potentially improves latency for time-sensitive applications, and — as discussed in the transcripts that provided context for this essay — can enable greater security and privacy for enterprise customers who cannot tolerate the transmission of sensitive data to third-party cloud environments.
The practical implementation of edge AI faces significant technical challenges. The largest AI models, which offer the most capable performance, cannot currently be deployed at the edge due to their computational and memory requirements. However, model compression techniques — including quantization, pruning, and knowledge distillation — have made it possible to deploy increasingly capable models on constrained edge hardware. Apple’s deployment of large language model capabilities on-device in its M-series chips, and the emergence of small language models optimized for edge deployment, suggest that the technical gap between cloud and edge AI capability is narrowing (Frantar et al., 2022).
Network operators are well-positioned to play a significant role in edge AI infrastructure, precisely because they own the physical layer — fiber, cellular towers, network exchange points — that connects end users to cloud services. The strategy described in the conference transcripts, of transforming network exchange assets into AI-capable infrastructure located close to the fixed and mobile network, represents a coherent response to the latency, security, and sovereignty concerns of enterprise customers. If implemented with adequate attention to security architecture, such network-native AI infrastructure could offer meaningful advantages over purely cloud-based alternatives in terms of both performance and resilience.
4.4 Building a Culture of Resilience
Technical and regulatory solutions, however sophisticated, will remain insufficient if not supported by an organizational culture that takes infrastructure resilience seriously. The history of complex system failures — from Three Mile Island to the Space Shuttle Challenger to the 2003 Northeast Blackout — consistently shows that catastrophic failures are rarely purely technical events. They typically involve a combination of technical vulnerabilities, organizational pressures that discourage the reporting of warning signs, and normalization of deviance in which gradually escalating risk is repeatedly accepted without triggering corrective action (Perrow, 1984).
AI organizations must invest in red team exercises that simulate realistic attack and failure scenarios, and must be willing to act on the findings of such exercises even when doing so is expensive or disruptive. They must establish clear incident response protocols, practice them regularly, and ensure that authority to execute emergency shutdowns or failovers is held at levels of the organization that can act decisively under pressure. They must also cultivate relationships with external researchers, government agencies, and peer organizations that can provide early warning of emerging threats and assistance during incidents.
The role of diverse, inclusive teams in building resilient AI systems deserves specific mention. Research has consistently shown that homogeneous teams are more susceptible to groupthink and more likely to overlook risks that fall outside their shared frame of reference. The AI infrastructure workforce, which remains heavily concentrated among young, male, technically-oriented professionals from a small number of elite universities, is particularly susceptible to this dynamic. Broadening the demographic and disciplinary composition of AI infrastructure teams — including the integration of social scientists, historians of technology, and security practitioners from non-AI backgrounds — is not merely an equity imperative but a resilience imperative (West & Allen, 2020).
5. Conclusion: Toward a Serious Science of AI Infrastructure Resilience
The argument of this essay can be stated plainly: the AI community has built remarkable systems on a foundation that has not received the scrutiny it deserves. The physical, logical, and human dimensions of AI infrastructure each harbor significant vulnerabilities that have not been adequately characterized, let alone addressed. The threat landscape — from nation-state cyberattackers to cascading software failures to the subtle dangers of adversarial manipulation — is both broad and evolving rapidly. And the solutions that exist, while promising, have not been deployed at the scale or with the urgency that the risk profile warrants.
For the Southeast Asian and broader Asia-Pacific region, the stakes are particularly high. The region is investing heavily in AI infrastructure at a moment when the security and resilience requirements of such infrastructure are still being defined. This is, in one sense, an opportunity: the region can build from the beginning with resilience as a design principle rather than a retrofit. But seizing that opportunity requires deliberate choice — in infrastructure architecture, in regulatory design, in talent development, and in international cooperation — that does not happen automatically.
The AI infrastructure crisis, when it comes — whether as a targeted attack, a cascading failure, or a slow-motion governance breakdown — will not announce itself in advance. History suggests that complex systems tend to fail at the boundaries between their components, in the gaps between institutional responsibilities, and at moments when the organizations responsible for them are most confident in their own competence. The appropriate response to this reality is not fatalism but disciplined preparation: the kind of serious, sustained, technically rigorous attention to infrastructure resilience that the stakes of the AI moment demand.
The question before us is not whether we can build AI systems that are powerful. We have already done that. The question is whether we can build the infrastructure and governance frameworks that will allow these systems to remain trustworthy, available, and secure as they become ever more deeply embedded in the fabric of modern life. The answer to that question has not yet been written.
References
- Acemoglu, D., & Johnson, S. (2023). Power and Progress: Our Thousand-Year Struggle Over Technology and Prosperity. PublicAffairs.
- Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., … & Zaharia, M. (2010). A view of cloud computing. Communications of the ACM, 53(4), 50–58.
- Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2020). How to backdoor federated learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS). PMLR.
- Biden, J. (2023). Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. The White House.
- Biggio, B., & Roli, F. (2018). Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84, 317–331.
- Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., … & Raffel, C. (2021). Extracting training data from large language models. Proceedings of the 30th USENIX Security Symposium.
- Carter, L., & Burnett, R. (2021). Submarine cable communications and the future of the digital economy. In Handbook of International Trade in Services. Oxford University Press.
- Chalk, P. (2022). Maritime infrastructure vulnerability and the South China Sea: Submarine cables as a strategic asset. Asian Security, 18(2), 145–163.
- CISA. (2021). Alert AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. Cybersecurity and Infrastructure Security Agency.
- CISA. (2023). Roadmap for Artificial Intelligence. Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security.
- Costan, V., & Devadas, S. (2016). Intel SGX explained. IACR Cryptology ePrint Archive, 2016(086).
- Dragos. (2021). 2021 Year in Review: ICS/OT Cybersecurity. Dragos Inc.
- European Parliament. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council: Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). Official Journal of the European Union.
- Floridi, L., Cowls, J., Beltrametti, M., Chatila, R., Chazerand, P., Dignum, V., … & Vayena, E. (2018). AI4People — An ethical framework for a good AI society: Opportunities, risks, principles, and recommendations. Minds and Machines, 28(4), 689–707.
- Frantar, E., Ashkboos, S., Hoefler, T., & Alistarh, D. (2022). GPTQ: Accurate post-training quantization for generative pre-trained transformers. arXiv preprint arXiv:2210.17323.
- Freund, A. (2024). Backdoor in XZ Utils (CVE-2024-3094). Openwall Security. https://www.openwall.com/lists/oss-security/2024/03/29/4
- Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. Proceedings of the International Conference on Learning Representations (ICLR).
- IEA. (2023). Electricity 2024: Analysis and Forecast to 2026. International Energy Agency.
- IMDA. (2023). Singapore’s Digital Connectivity Blueprint. Infocomm Media Development Authority.
- Janardhan, S. (2021, October 4). More details about the October 4 outage. Engineering at Meta. https://engineering.fb.com/2021/10/04/networking-traffic/outage/
- Lohn, A., & Mueller, K. (2022). AI and the future of disinformation campaigns: An assessment of automated influence operations. RAND Corporation.
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. Proceedings of the International Conference on Learning Representations (ICLR).
- Microsoft. (2024). Helping our customers through the CrowdStrike outage. Microsoft On the Issues Blog. https://blogs.microsoft.com/on-the-issues/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/
- OECD. (2019). Recommendation of the Council on Artificial Intelligence. OECD Legal Instruments. OECD/LEGAL/0449.
- Patterson, D., Gonzalez, J., Le, Q., Liang, C., Munguia, L.-M., Rothchild, D., … & Dean, J. (2021). Carbon considerations for large AI models. Communications of the ACM, 65(6), 58–68.
- Perrow, C. (1984). Normal Accidents: Living with High-Risk Technologies. Basic Books.
- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture (NIST SP 800-207). National Institute of Standards and Technology.
- Sevilla, J., Heim, L., Ho, A., Besiroglu, T., Hobbhahn, M., & Villalobos, P. (2022). Compute trends across three eras of machine learning. Proceedings of the International Joint Conference on Neural Networks (IJCNN).
- Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., & Goldstein, T. (2018). Poison frogs! Targeted clean-label poisoning attacks on neural networks. Advances in Neural Information Processing Systems (NeurIPS), 31.
- Synergy Research Group. (2023). Hyperscale Data Center Count Reaches 900. Synergy Research Group Market Report.
- West, D. M., & Allen, J. R. (2020). Turning Point: Policymaking in the Era of Artificial Intelligence. Brookings Institution Press.
