Pith. sign in

REVIEW 4 major objections 7 minor 34 references

Securing Agentic AI: Threat Modeling and Risk Analysis for Network Monitoring Agentic AI System

T0 review · 4 major / 7 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A seven-layer threat model for LLM-driven network agents is validated by two attacks on a working prototype.

desk verdict Useful MAESTRO application to LLM network monitors, but the verification claim is undercut by a mislabeled test case and thin data. read the letter →

arxiv 2508.10043 v1 pith:JJSTSAER submitted 2025-08-12 cs.CR cs.AI

Pallavi Zambare , Venkata Nikhil Thanikella , Ying Liu This is my paper
classification cs.CRcs.AI
keywords agenticAILLMsecuritythreatmodelingMAESTROnetworkmonitoringmemorypoisoningresourceexhaustionriskscoring
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that LLM-driven autonomous agents—systems that perceive, reason, and act on their own—face a new class of security failures that conventional threat-modeling methods do not capture, because the risks live in the interplay of memory, planning, tool use, and the surrounding ecosystem. It builds a working single-node monitoring agent and applies MAESTRO, a seven-layer framework that maps each threat to a primary layer and its cross-layer ripple effects, then scores every threat as $R = P \times I \times E$ (likelihood, impact, exploitability). Two attacks are demonstrated on the running system: replaying denial-of-service traffic at 10,000 packets per second stretches telemetry updates from a steady 7–8 second cadence to more than 13 seconds, and injecting 20 false high-severity entries into the agent's history file makes its parameter tuner request oversized packet captures, slowing detection and driving up resource use. The authors conclude that MAESTRO is a workable basis for operational threat mapping, risk prioritization, and resilient design, and that layer-aligned defenses—memory isolation, planner validation, rollback, and cross-layer trust controls—are the appropriate response. The reader should care because these agents are increasingly trusted to make real-time network decisions, so knowing exactly where they break under adversarial load is a prerequisite to deploying them safely.

What carries the argument

The central object is MAESTRO, a named seven-layer threat-modeling framework for agentic AI systems. It decomposes an agent into L1 Foundation Models (the LLM inference core), L2 Data Operations (telemetry pipelines and memory), L3 Agent Frameworks (planning and orchestration), L4 Deployment & Infrastructure (runtime and APIs), L5 Evaluation & Observability (monitoring and metrics), L6 Security & Compliance (access control and audit), and L7 Agent Ecosystem (multi-agent and human interfaces). It carries the argument by giving every threat a primary layer, a cross-layer propagation path, and a quantitative risk score $R = P \times I \times E$. The prototype's parameter-tuning memory file (his

What would settle it

Rerun the same two attacks at the stated scale (10,000 packets/s traffic replay; 20 injected history entries) on a distributed, multi-node version of the agent with shared memory and real operator traffic. If telemetry updates hold the 7–8 second cadence under replay, or if the poisoned history file no longer inflates capture durations and detection lag, the transferability claim fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that MAESTRO—a seven-layer decomposition of an agentic AI system into foundation models, data operations, agent frameworks, deployment/infrastructure, evaluation/observability, security/compliance, and agent ecosystem—turns agentic-AI security from an open-ended worry into a localized, scoreable problem. Applied to a prototype LLM-based network monitoring agent, the framework yields a ten-threat taxonomy, maps each threat to a primary layer and its cross-layer impacts, and assigns risk scores using $R = P \times I \times E$ with 1–3 ordinal ratings. The experimental evidence is two validated test cases: (1) a denial-of-service traffic replay at 10,000 packets/s o

Load-bearing premise

The framework's transferability rests on the assumption that this one-node prototype—its memory file, planner, and resource limits—behaves like an operational agentic network monitor, so the two confirmed attacks and the risk rankings would survive deployment in real, possibly distributed, environments.

Editorial extensions

If this is right

  • Resource exhaustion is a confirmed, highest-ranked threat (risk score 27) for this class of agent, so operational deployments should include dynamic prioritization or rate limiting for telemetry processing.
  • Memory poisoning is confirmed and can cascade into resource exhaustion, meaning memory integrity and provenance checks are not just data-hygiene concerns but direct availability defenses.
  • The risk matrix gives defenders an order: chain-of-thought manipulation, planning/reasoning exploitation, resource exhaustion, and multi-agent exploitation all score high and should be mitigated before lower-scored threats.
  • Layer-aligned defense-in-depth—input validation, memory isolation, planner verification, zero-trust infrastructure, drift monitoring, audit trails, and ecosystem trust models—is the paper's recommended design posture.
  • Telemetry update cadence can serve as a simple runtime health indicator; when it stretches under load, the agent is likely under a resource or memory-driven attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: the $P \times I \times E$ scores could be calibrated against measured outcomes such as telemetry delay and CPU/memory deltas, replacing ordinal High/Medium/Low judgments with empirically grounded thresholds.
  • Editorial extension: the confirmed poisoning-to-exhaustion cascade generalizes: any agent whose workload sizing depends on historical context turns its memory into a potential denial-of-service weapon, not just a data-integrity risk.
  • Editorial extension: a natural next experiment is to repeat both attacks in a distributed multi-agent deployment; the paper's single-node limitation suggests the layer mappings for shared memory and coordination protocols may need to be revised.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper applies MAESTRO, a seven-layer threat-modeling framework for agentic AI, to an LLM-based network-monitoring agent. It defines ten threat classes, maps them to MAESTRO layers, assigns risk scores using R = P × I × E, and proposes defense-in-depth mitigations. A prototype agent is implemented in Python/LangChain with WebSocket telemetry. Two validation tests are reported: (i) replay of a DoS PCAP at 10,000 packets/second, which slows telemetry updates from ~7–8 s to >13 s; and (ii) manual injection of 20 false high-severity entries into history.json, which causes the agent to choose longer packet-capture durations and produce larger PCAP files. The paper concludes that MAESTRO is 'viable in operational threat mapping, prospective risk scoring, and the basis of the resilient system design.'

Significance. If the validation were internally consistent and more robust, this would be a useful practical contribution: it moves from abstract threat taxonomies to a concrete prototype, maps threats to layers, gives an explicit risk formula, and proposes matching defenses. The authors openly state the single-node limitation, and the layered defense-in-depth discussion is a practical checklist. However, the evidence base is thin—single runs without error bars or quantitative metrics—and one of the two validation cases is mislabeled relative to the paper's own threat table. The headline verification claim is therefore not yet established.

major comments (4)
  1. [§VI.C, Table 5, §VIII] Test Case 2 is labeled 'Memory Poisoning (Threat #8: Knowledge Base Poisoning),' but the attack described—manual insertion of 20 false entries into history.json—is exactly Threat 4 'Memory & Context Manipulation' ('Poisons historical memory/context for decisions') in Table 1. Knowledge Base Poisoning (Threat 8) is defined as corrupting 'learned information or references,' a different object (e.g., RAG pipelines). Table 4 scores Threat 4 at 12 and Threat 8 at 9, so the experiment validates neither the layer mapping cited for Threat 8 in Table 5 nor the risk-priority ordering. This internal inconsistency directly undermines the paper's central claim that two threats were 'confirmed' and that MAESTRO is 'viable' for threat mapping and risk scoring.
  2. [§IV.C, Eq. (1), Table 4] The risk scores are computed from P, I, and E values that are assigned by the authors without a stated elicitation procedure, calibration, or sensitivity analysis. The text in §IV.C.2 calls the matrix 'evidence-based,' but no evidence is provided for the specific ordinal ratings (e.g., why Multi-Agent Exploitation has E=3 while Goal Manipulation has E=1). Since the conclusion advertises 'prospective risk scoring' as a validated capability, the authors should document a rubric, provide inter-rater agreement, or show that the risk ordering is robust to plausible perturbations of the ratings.
  3. [§VI.B, §VI.C] The empirical support for the two 'confirmed' threats consists of a single execution each, with no repeated trials, no error bars, and no statistical analysis. The reported telemetry delay ('7–8 s' vs 'more than 13 s') is qualitative, and CPU/memory utilization is mentioned but not quantified. TC2 gives no measured capture durations or PCAP sizes. For a paper whose main claim is that MAESTRO is 'verified viable' in operational use, the evaluation should include multiple runs, quantitative metrics, and ideally a comparison baseline. At minimum, the language should be softened from 'verifies/confirms' to 'illustrates' or 'demonstrates in a single prototype.'
  4. [§VI.D.1, §VIII] The paper itself concedes (twice, as D.1 and D.2) that the system is single-node and that this 'does not help the agent to generalize its multi-agent behavior across distributed or federated environments.' Yet §VIII concludes that MAESTRO is 'viable in operational threat mapping, prospective risk scoring, and the basis of the resilient system design.' The single-node prototype can support claims about the local application of MAESTRO, but not claims about operational distributed or multi-agent deployments. The conclusion should be explicitly scoped to the single-node setting, or additional evidence (e.g., a distributed testbed or simulation) must be provided.
minor comments (7)
  1. [§VI.D.1] Sections D.1 and D.2 are identical duplicated paragraphs; remove the duplicate.
  2. [§VI.D] The limitation text refers to an 'ICMP flood' test, but the experiments in §VI.B/VI.C use a GoldenEye PCAP replay (a TCP-based DoS tool). Use consistent attack terminology.
  3. [§VI.C, Figures S10–S13] The text references supplementary figures S10–S13, but these are not present in the manuscript; either include them or remove the references.
  4. [Tables 1, 2, and 4] Threat names and layer mappings are inconsistent across tables. For example, Threat 4 is 'Memory & Context Manipulation' in Table 1 with primary layer L1 in Table 2, but Table 4 lists it under 'Agent Frameworks (L3).' Similarly, Table 1 uses 'Instruction Manipulation' while Table 4 uses 'Input-Induced Behavior Manipulation.' Harmonize all tables.
  5. [§IV.C.1] The first illustrative risk-score example is confusing: 'probability, impact, and exploitability are low and high respectively (P=1, I=1, E=3).' Rewrite to clarify which dimension has which value.
  6. [§II.C] The phrase 'as-soon-as-you-see-it (as-soon-as-you-collaborate-on-it)' appears garbled; please correct.
  7. [References [27]–[34]] Several cited references are general AI-ethics or policy papers and are not clearly connected to the specific mitigation claims they support; review and replace with more targeted security/agentic-AI references.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: risk scores are qualitative inputs, experiments are independent observations, and framework credit is external.

full rationale

The paper presents MAESTRO as an external framework (Huang [14]) and applies it to a prototype; the authors do not derive the threat taxonomy from their own results. The risk-scoring model R=P×I×E (Eq. 1) uses hand-assigned ordinal values (Table 4), and the two test cases measure behavioral outcomes (telemetry delay, CPU/memory utilization) that are not computed from those values, so no fitted parameter is renamed as a prediction. TC1 confirms that a replay DoS degrades responsiveness, an empirical result independent of the taxonomy's definition. TC2 is internally mislabeled—poisoning history.json corresponds to Threat 4 (Memory & Context Manipulation) in Table 1, not Threat 8 (Knowledge Base Poisoning)—so the paper's validation claim is inconsistent; however, this is a correctness/labeling flaw, not a circular reduction. The acknowledged single-node limitation (Section VI.D.1) and rule-based fallbacks (D.3) weaken external validity but do not make the derivation self-referential. No load-bearing step is equivalent to its inputs by construction, and no self-citation chain is invoked.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claim leans on three kinds of unpaid debts: the MAESTRO decomposition and threat taxonomy are adopted from prior work and are not independently justified; the risk scores are free qualitative judgments by the authors; and the empirical validation covers only two of the ten listed threats on a single-node prototype whose representativeness is conceded as a limitation. No new theoretical entities are invented.

free parameters (1)
  • Per-threat Likelihood (P), Impact (I), Exploitability (E) ratings = Ten triples in Table 4, e.g., Threat 7: P=3, I=3, E=3, R=27; Threat 3: P=3, I=3, E=2, R=18
    Qualitative 1-3 ratings chosen by the authors without a documented rubric, calibration, or inter-rater check; they determine every risk score in Table 4 and are the basis of the claimed 'prospective risk scoring'.
assumptions (4)
  • domain assumption MAESTRO's seven-layer decomposition is a valid and sufficiently complete model of agentic AI systems for threat localization.
    Taken from Huang et al. [14] and used as the backbone of all Tables 1, 2, and 4 in Section IV; no independent evidence is given that these layers are the right decomposition.
  • ad hoc to paper The ten threat classes in Table 1 are imperative and complete for the network-monitoring agent.
    Section III.B says 'we classify ten imperative classes of threats' without a completeness or coverage argument; the empirical validation covers only two of them.
  • domain assumption Risk scores computed as R = P x I x E with ordinal 1-3 values preserve risk ordering across threats.
    Section IV.C treats qualitative Low/Medium/High as numeric 1/2/3 and multiplies them, assuming ordinal values behave like an interval scale; no calibration or sensitivity analysis is provided.
  • ad hoc to paper The prototype agent is representative of operational LLM-based network-monitoring agents.
    Section III.A describes the architecture and Section VI evaluates it; the paper's own limitations (D.1 single-node, D.3 rule-based fallbacks) show representativeness is assumed rather than established.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Securing Agentic AI: Threat Modeling and Risk Analysis for Network Monitoring Agentic AI System." pith.science (2026). https://pith.science/paper/JJSTSAER

@misc{pith2026250810043,
  author       = {Pith},
  title        = {Pith review of: Securing Agentic AI: Threat Modeling and Risk Analysis for Network Monitoring Agentic AI System},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JJSTSAER}},
  note         = {Machine review of arXiv:2508.10043}
}
read the original abstract

When combining Large Language Models (LLMs) with autonomous agents, used in network monitoring and decision-making systems, this will create serious security issues. In this research, the MAESTRO framework consisting of the seven layers threat modeling architecture in the system was used to expose, evaluate, and eliminate vulnerabilities of agentic AI. The prototype agent system was constructed and implemented, using Python, LangChain, and telemetry in WebSockets, and deployed with inference, memory, parameter tuning, and anomaly detection modules. Two practical threat cases were confirmed as follows: (i) resource denial of service by traffic replay denial-of-service, and (ii) memory poisoning by tampering with the historical log file maintained by the agent. These situations resulted in measurable levels of performance degradation, i.e. telemetry updates were delayed, and computational loads were increased, as a result of poor system adaptations. It was suggested to use a multilayered defense-in-depth approach with memory isolation, validation of planners and anomaly response systems in real-time. These findings verify that MAESTRO is viable in operational threat mapping, prospective risk scoring, and the basis of the resilient system design. The authors bring attention to the importance of the enforcement of memory integrity, paying attention to the adaptation logic monitoring, and cross-layer communication protection that guarantee the agentic AI reliability in adversarial settings.

Figures

Figures reproduced from arXiv: 2508.10043 by the authors.

Figure 1
Figure 1. FIGURE 1 [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. FIGURE 2 [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. FIGURE 3 [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: FIGURE 4 [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: FIGURE 5 [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 8
Figure 8. Figure 8: FIGURE 8 [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: FIGURE 9 [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

34 extracted references · 28 canonical work pages

  1. [1]

    Khosla, S., Zhu, Z., & He, Y . (2023). Survey on Memory- Augmented neural networks: Cognitive insights to AI applications. arXiv preprint arXiv:2312.06141

    work page Pith review arXiv 2023

  2. [2]

    & Lam, K

    Xu, M., Fan, J., Huang, X., Zhou, C., Kang, J., Niyato, D., ... & Lam, K. Y . (2025). Forewarned is forearmed: A survey on large language model-based agents in autonomous cyberattacks. arXiv preprint arXiv:2505.12786

    arXiv 2025

  3. [3]

    Azam, N., Michala, L., Ansari, S., & Truong, N. B. (2022). Data privacy threat modelling for autonomous systems: a survey from the gdpr’s perspective. IEEE Transactions on Big Data, 9(2), 388- 414

    work page 2022

  4. [4]

    Molinari, G.,&Ciravegna, F. (2025). Towards Pervasive Distributed Agentic Generative AI–A State of The Art. arXiv preprint arXiv:2506.13324

    arXiv 2025

  5. [5]

    A., Sallabi, F., Shuaib, K., & Khater, H

    Khayat, M., Barka, E., Serhani, M. A., Sallabi, F., Shuaib, K., & Khater, H. M. (2025). Empowering Security Operation Center with Artificial Intelligence and Machine Learning–A Systematic Literature Review. IEEE Access

    work page 2025

  6. [6]

    Sindiramutty, S. R. (2023). Autonomous threat hunting: A fu- ture paradigm for AI-driven threat intelligence. arXiv preprint arXiv:2401.00286

    work page Pith review arXiv 2023

  7. [7]

    Bhattacharyya, S. (2024). Cloud Innovation: Scaling with Vectors and LLMs. Libertatem Media Private Limited

    work page 2024

  8. [8]

    Das, P., Asif, M. R. A., Jahan, S., Ahmed, K., Bui, F. M., & Khon- doker, R. (2024). STRIDE-Based Cybersecurity Threat Modeling, Risk Assessment and Treatment of an In-Vehicle Infotainment System. Vehicles, 6(3), 1140-1163

    work page 2024

Show all 34 references
  1. [9]

    Tete, S. B. (2024). Threat modelling and risk analysis for large language model (llm)-powered applications. arXiv preprint arXiv:2406.11007

    2024 arXiv

  2. [10]

    F., Nour, B., Laaroussi, Z., Karac ¸ay, L., & Karakoc ¸, F

    G ¨ulen, U., Tuna, ¨O. F., Nour, B., Laaroussi, Z., Karac ¸ay, L., & Karakoc ¸, F. (2024, October). Threat Modeling of AI-as-a-Service Framework. In 2024 20th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob) (pp. 1-7). IEEE

    2024

  3. [11]

    Selin, J. (2019). Evaluation of threat modeling methodologies

    2019

  4. [12]

    B., Kayas, G., Rashidi, B.,& Garg, V

    Dev, J., Akhuseyinoglu, N. B., Kayas, G., Rashidi, B.,& Garg, V . (2025). Building guardrails in ai systems with threat modeling. Digital Government: Research and Practice, 6(1), 1-18

    2025

  5. [13]

    K.,& Jose, E

    Khan, R., Sarkar, S., Mahata, S. K.,& Jose, E. (2024). Security Threats in Agentic AI System. arXiv preprint arXiv:2410.14728

    2024 arXiv

  6. [14]

    Huang, K. (2025). Agentic AI threat modeling framework: MAE- STRO. Cloud Security Alliance

    2025

  7. [15]

    Alwaheidi, A. (2024). Cybersecurity Threat Modeling and Mit- igation in Large-Scale AI Systems [Doctoral dissertation, North Carolina A& T State University]

    2024

  8. [16]

    Mollaeefar, M., Bissoli, A., & Ranise, S. (2024). PILLAR: an AI-Powered Privacy Threat Modeling Tool. arXiv preprint arXiv:2410.08755

    2024 arXiv

  9. [17]

    Krishnamurthy, O. (2023). Enhancing Cyber Security Enhance- ment Through Generative AI. International Journal of Universal Science and Engineering, 9(1), 35-50

    2023

  10. [18]

    Coletta, A., Dwarakanath, K., Liu, P., Vyetrenko, S., & Balch, T. (2024). LLM-driven Imitation of Subrational Behavior: Illusion or Reality?. arXiv preprint arXiv:2402.08755, 2

    2024 arXiv

  11. [19]

    Clement, M. (2025). Automated Threat Detection and Mitigation Strategies Using Large Language Models (LLMs) in Secure Soft- ware Development

    2025

  12. [20]

    A., Jerad, C., & Sikora, A

    Messaad, M. A., Jerad, C., & Sikora, A. (2021). Ai approaches for iot security analysis. In Intelligent Systems, Technologies and Applications: Proceedings of Sixth ISTA 2020, India (pp. 47-70). Springer Singapore

    2021

  13. [21]

    Chen, Z., Xiang, Z., Xiao, C., Song, D., & Li, B. (2024). Agentpoi- son: Red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37, 130185-130213

    2024

  14. [22]

    R., Manikyala, A., Nizamuddin, M., Kommineni, H

    Talla, R. R., Manikyala, A., Nizamuddin, M., Kommineni, H. P., Kothapalli, S., & Kamisetty, A. (2021). Intelligent Threat Identi- fication System: Implementing Multi-Layer Security Networks in Cloud Environments. NEXG AI Review of America, 2(1), 17-31

    2021

  15. [23]

    Huang, K. (7). Layered Agentic AI Reference Architecture [Jelek- tronnyj resurs]

  16. [24]

    Sere, A., Sie, O.,& Saeed, R. A. (Eds.). (2025). Towards new e-Infrastructure and e-Services for Developing Countries: 15th International Conference, AFRICOMM 2023, Bobo-Dioulasso, Burkina Faso, November 23–25, 2023, Proceedings, Part I (V ol. 587). Springer Nature

    2025

  17. [25]

    (2023, September)

    Fuchs, A., Passarella, A., & Conti, M. (2023, September). Opti- mizing delegation between human and ai collaborative agents. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases (pp. 245-260). Cham: Springer Nature Switzerland. VOLUME , 11 Auth...

    2023

  18. [26]

    Zhang, Y ., Lu, H., Liu, X., Chen, Y ., & Wu, K. (2024). Advanc- ing generalizable remote physiological measurement through the integration of explicit and implicit prior knowledge. arXiv preprint arXiv:2403.06947

    2024 arXiv

  19. [27]

    Anderson, H., & Rainie, L. (2023). Experts say the ’new normal’ in 2025 will be far more tech-driven, presenting more big challenges. Pew Research Center. https://www.pewresearch.org/internet/2021/02/18/experts-say- the-new-normal-in-2025-will-be-far-more-tech-driven-presentin...

    2023

  20. [28]

    & Amodei, D

    Brundage, M., Avin, S., Clark, J., Toner, H., Eckersley, P., Garfinkel, B., ... & Amodei, D. (2018). The malicious use of artificial intelligence: Forecasting, prevention, and mitigation (arXiv:1802.07228). arXiv. https://arxiv.org/abs/1802.07228

    2018 arXiv

  21. [29]

    Clarke, R. (2019). Principles and business processes for respon- sible AI. Computer Law & Security Review, 35(4), 410–422. https://doi.org/10.1016/j.clsr.2019.04.007

    2019 doi

  22. [30]

    Floridi, L., & Cowls, J. (2019). A unified framework of five principles for AI in society. Harvard Data Science Review, 1(1). https://doi.org/10.1162/99608f92.8cd550d1

    2019 doi

  23. [31]

    Metzinger, T. (2019). Ethics washing made in Europe. Der Tagesspiegel. https://www.tagesspiegel.de/politik/ethics-washing- made-in-europe-6371431.html

    2019

  24. [32]

    Whittlestone, J., Nyrup, R., Alexandrova, A., & Cave, S. (2019). The role and limits of principles in AI ethics: To- wards a focus on tensions. In Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society (pp. 195–200). https://doi.org/10.1145/3306618.3314289

    2019

  25. [33]

    Taddeo, M.,& Floridi, L. (2018). How AI can be a force for good. Science, 361(6404), 751–752. https://doi.org/10.1126/ science.aat5991

    2018

  26. [34]

    IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems. (2020). Ethically aligned design: A vision for prioritizing human well-being with autonomous and intelligent systems (1st ed.). IEEE. https://ethicsinaction.ieee.org/ 12 VOLUME ,

    2020

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.