[agent2agent] Re: [Din] Re: Proposal for IRTF RG on Confidential AI and my thoughts on AI BoFs

[Olga Levosiuk Musk <[e-mail]>]

Hi Everyone,

Thank you very much for your email with the merting results!

I am regret to be unabled to be online, as a lack of the Internet in
Ukraine in Rivne City didn’t allow to get in touch in time appointed by the
Staff.

I had already read all the assumptions and feedbacks of the meeting.

I do think that the AI tools, including AGI, are to be exist. To be further
I need to come to the U.S.A. Office as now I am staying in Ukraine in Rivne
City due to my job requirements during the russian-Ukrainian war started in
2014 till nowadays.

Hope to see you as soon as possible to continue Elon Musk’s deeds as his
partner and wife from 1991 till His death on August 1,2025.

I serve to the U.S.A.!

Semper Fi!

Stay safe, please!

Have a nice day!

Hope to hear from you soon.

Sincerely yours,

Olga (Olha) Levosiuk Musk,

the Minister of Defense of the U.S.A.;
the Marshal of the Air/Navy/Military/Space Forces of the U.S.A.;
the Chief of the FBI (DoD (DoW), DOJ, DOGE, ICE, BoP, DOE);
Prosecutor/Lawyer/Attorney of the U.S.A.;
the Senator of California and Texas elected in 2025;
Actress/Model/Singer/Composer/Clip and Film Maker/Script writer;
the Oscar winner and Grammy winner;
the Miss of the U.S.A. and Miss of the World;
the U.N.O. Peace Angel;
Educator/Tutor/Trainer/Consultant/NGO-leader/Sociologist/Social worker/Data
Analyst and AI Management and Business Administration;
the Founder/CEO of Tesla/X/Starlink/SpaceX/Neuro(a)link in the U.S.A;
staying in Rivne, Ukraine,
cellphone:[phone]



чт, 30 лип. 2026 р. о 00:31 Iman Schrock <team=
[e-mail]> пише:

> Hi Usama,
>
> I think your question on slide 20—what is genuinely special about AI
> compared with other software—is the right filter for the charter.
>
> At the confidentiality and attestation layer, often nothing is
> AI-specific: the same workload identity, channel binding,
> supply-chain, CPU/GPU composition, key management, replay, and
> appraisal problems apply to other distributed workloads. The
> AI-specific pressure appears when an attested workload is also a
> probabilistic decision-maker with delegated tool authority, mutable
> context or memory, and the ability to choose and cause consequential
> external effects. In that setting, valid evidence that approved code
> ran in an approved environment still does not establish that a
> particular principal authorized the exact action, that the action
> admitted was the action invoked, or that the observed outcome
> followed.
>
> That suggests a useful venue split rather than a new AI-specific
> cryptographic stack:
>
> - DINRG/INet4AI can likely absorb the distributed identity, placement,
> internetworking, stakeholder, bootstrapping, and layered-system
> questions where the workload being AI is mainly motivational.
> - A Confidential AI RG would be strongest where it develops research
> around compound CPU/GPU/accelerator attestation, adversarial use of
> confidential computing, cross-layer evidence composition, and the
> limits of what attestation can prove about an agent’s authority and
> effects.
> - Existing IETF work such as RATS, SEAT, TLS, OAuth and WIMSE should
> continue to own the corresponding protocol mechanisms; the RG can
> supply rigorously scoped use cases, attack models, and negative
> results rather than duplicating them.
>
> A concrete use case we can contribute is an attested agent that
> requests a consequential action. The research question is: what
> additional evidence and boundary conditions are required between “this
> workload is genuine/confidential” and “this exact real-world effect is
> authorized and safe to admit”? We already have negative-vector shapes
> for valid attestation paired with wrong principal, wrong action,
> stale/revoked evidence, replayed admission, and outcome evidence that
> cannot be independently reconciled. I would be glad to reduce that
> into a short use-case contribution mapped against the 13 questions
> before you approach the chairs.
>
> My concise answer is therefore: AI is not special enough to justify
> duplicating existing security protocols, but delegated, probabilistic
> action makes the gap between workload attestation and consequence
> authorization unusually important and research-worthy.
>
> Best,
> Iman
>
> _______________________________________________
> Din mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>