You Don’t Understand the Offense-Defense Balance — Pt. 1

Note: This post was crossposted from The Course Correct by the Forum team, with the author's permission. The author may not see or respond to comments on this post.

This is the first in an essay series covering the top 10 misconceptions about the offense-defense balance as it relates to reducing catastrophic risks from artificial intelligence and emerging biotechnologies. This essay focuses on the first and most important misconception: that there is an offense-defense balance.

I. The Cult of the Defensive

Technologies are usually made safer by deploying early versions, gauging their effects in the real world, and iterating on these feedback loops to produce versions that are safer, more effective, yet interoperable with society. But we can’t really do this with potentially catastrophic biotechnologies or AI systems. It would be a bad idea to allow misaligned, superintelligent, agentic LLMs to run wild in the real world to test which alignment strategies work best.

Given that it’s also really hard to forecast how technologies develop and the effects that they’ll have on the world, one promising solution is to focus on accelerating the development of “defensive” technologies. By building technologies that favour defenders and by making dual-use technologies more defensive, we can ensure that as dangerous technological capabilities mature, successfully carrying out an attack remains costly and infeasible. In turn, not only will risks fail to materialise, but potential attackers will be deterred. Regulating the safety features of benchtop DNA synthesisers is hard, but in a world where everyone has access to readily available vaccines and therapeutics, it becomes much harder to manufacture a successful pandemic. Rather than trying to regulate the use of AI for cyberattacks out of existence, we can ensure security professionals have access to state-of-the-art AI tools so they can patch vulnerabilities and counter cyberattacks.

In my opinion, this is essentially the strongest case for being excited about “defense-dominance” as a goal, and these ideas are really gaining traction. Vitalik Buterin’s “defensive acceleration” agenda for AI is the most canonical form of this idea, but we see this offense-defense centred language all the time. In “The Adolescence of Technology”, Dario Amodei, writes that “there is an asymmetry between attack and defense in biology”, but that “it is conceivable that future technological improvements could shift this balance in favour of defense. OpenAI’s Rosalind Biodefense is explicitly intended to “advance defensive acceleration in biology”. It’s not all too uncommon to hear in the biosecurity community that biosecurity is currently “offense-dominant”, but that technological innovations could make it defense-dominant. Ideas such as Bostrom’s differential technology development speak to the same principles of preventing offensive advantage by ensuring adequate defenses are in place.

These ideas rest on the concept of an offense-defense balance—the seemingly straightforward idea that whether offense or defense has the advantage determines who wins. By making defense cheaper and more effective, we deploy more of it with greater effectiveness against attackers. It’s a very intuitive idea, and I do think it has a lot of merit. However, the prevalence of this idea is also built on a widespread misunderstanding of what the offense-defense balance actually is, and this is leading to a lot of overclaiming about how straightforward it is to confer defense-dominance through innovation alone.

The idea that safety against emerging technologies is primarily about accelerating defensive technologies to confer defense-dominance is what I’m calling “naive defensive acceleration”. I think naive defensive acceleration will do some good, but that its impact will apply less widely than the zeitgeist suggests. I’m not convinced that many technologies touted as defensive will reduce the incidence of potentially catastrophic conflicts if proliferated. I’m not convinced we’ll get much deterrence at all. I’m not convinced that these ideas will do much to prevent great-power uses of these technologies in particular.

Given that rationality demands that we care about the low-risk, high-consequence, heavy tail of things going wrong, I am convinced that accelerating defensive technologies introduces risks we aren’t taking seriously. I am convinced that communities interested in mitigating catastrophic risks are overindexed on accelerating defensive technologies and underindexed on improving the performance of political institutions that foster relationships with allies, investigate risks, and reliably neutralise threats. I think all of these takes are implied by a proper evaluation of offense-defense dynamics.

The idea of an offense-defense balance is not unique to AI and bio, but rather lies in a nearly 50-year-old body of literature that primarily analysed conventional military and nuclear conflicts^[1]. If we take this literature seriously, the offense-defense literature largely yields the exact opposite conclusion from what defensive acceleration would suggest. Technologies do not have necessary intrinsic balances; defensive technologies such as anti-ballistic missiles can be incredibly destabilising; and ultimately, the effect of a given offense-defense balance is largely a function of strategic interaction and geopolitics rather than the technological landscape. Peace comes from statecraft rather than innovation.

There are some unique features of AI, and especially of biotechnologies, that mean these lessons don’t entirely apply and that some defensive acceleration is very promising. But even in these instances, not without careful execution, scale, and deep consideration of the institutional context in which they operate. Overall, this essay series is an attempt to persuade you that we shouldn’t primarily rely on defensive acceleration, and that, where it’s still viable, implementation details and geopolitical context are exceptionally important. Naive defensive acceleration will not save us, but careful defensive steering is an important part of the broader package of protection against catastrophic risks from emerging technologies.

The “cult of the offensive” led leaders to believe that late-19th- and early-20th-century technological advancements would make warfare so rapid and decisive that leaders adopted offensive postures that ultimately led to WWI. Currently, I think there’s a “cult of the defensive”, which leads people to believe that 21st-century technological developments will make the use of AI and biotechnologies in conflict so infeasible and costly that we can rely on little else but the forces of innovation. I think this is mistaken and could lead to ineffective efforts to reduce conflict. To take on this sentiment, I hope to deconstruct what I believe are the most prevalent misconceptions about the offense-defense balance. To begin, we must tackle the first and most important one: that there is just one offense-defense balance.

II. Misconception #1: “There is an ‘offense-defense balance’”

Consider three fictitious countries in conflict with one another: the plains of Countryland, the mountainous region of Nationplace, and the long coasts of Stateground. Countryland decides to invade Nationplace to seize 50% of its territory. To deploy armoured vehicles, infantry, aircraft, and to maintain supply lines, this operation will cost Countryland a certain amount of money (x). Nationplace, to prevent this attack from succeeding, must field its own vehicles, infantry, fortifications, and trenches, which will cost Nationplace a certain amount of money (y).

The “offense-defense balance” (ODB) is then the ratio of the cost required for the attacker to conduct an attack to the cost required for the defender to protect their interests against that attack, i.e., the ratio x:y. If it costs Countryland 3x as much to attack as it does for Nationplace to defend, e.g., because of Nationplace’s difficult-to-penetrate mountainous geography, the offense-defense balance is 3:1. In this instance, the ratio is greater than 1, so the conflict favours defense. The broad idea is that favouring defense means the defender is more likely to win in a conflict, so the attacker is also less likely to initiate. The greater the defense-dominance, the greater the likelihood of peace.

If Countryland decided they wanted 100% of Nationplace’s territory, they might realise that their attack scales much more efficiently than Nationplace’s defense, e.g., because Nationplace has a small population that would be spread too thin trying to defend the whole territory, such that the offense-defense balance of capturing 100% of Nationplace’s territory would be 1:1 rather than 3:1. If Countryland decided to invade Stateground instead of Nationplace, they might discover that Stateground is particularly exposed and that it would cost them only half as much to attack as it would for Stateground to defend itself (a ratio of 1:2). In this instance, the ratio is less than one, so it favours offense.

The first lesson, then, is that the “offense-defense balance” is specific to a particular configuration of capabilities, objectives, and geographies in a single two-sided conflict, and that shifts in the offense-defense balance of one setup may have little or even unintended consequences for another conflict or configuration. Making Nationplace only somewhat more defense-dominant may incentivise Countryland to pursue its 100% mission rather than its 50% mission, unless Nationplace ensures its defense is not only cheaper, but also scales as efficiently as Countryland’s offense.

Because the offense-defense balance is fundamentally about individual conflicts, a second lesson is that attempting to increase the offense-defense balance in one conflict might not increase the offense-defense balance in another. Nationplace might bolster its defenses against Countryland, only to realise that its stockpiling of defensive materiel has panicked the already-exposed Stateground into arming offensively.

An important wrinkle is that this setup implies that we know who the attacker and defender are in a conflict. However, if Countryland and Nationplace are geopolitical rivals locked in a new Cold War, they might both have incentives to attack first, and which country attacks first could change the structure of the offense-defense balance. For some kinds of catastrophic risk-relevant conflicts, it makes sense to conceive of the good guys as always being the defenders (e.g., lone-wolf bioterrorism). But this is not always the case. In the case of geopolitical conflict, a face-off with an autonomous, misaligned system, or even a conflict with a well-resourced terrorist group, strategic incentives might push us towards pre-emptive attack.

For example, return to the assumption that Countryland, seeking 50% of Nationplace’s territory, would have an offense-defense balance of 3:1 (favouring defense). However, if Nationplace sought 50% of Countryland’s territory instead, imagine that Nationplace has such a comparative advantage in attack that it is 6x cheaper for Nationplace to achieve this objective than for Countryland to defend, i.e., an offense-defense ratio of 1:6 (favouring offense). We might expect this outcome, for example, if Countryland is very geographically exposed and Nationplace has entirely focused its military capabilities on attack rather than defense. In turn, there is not just one offense-defense balance: there are two: Countryland as the attacker and Nationplace as the defender, and vice versa.

Appreciating that there are two balances elicits a third lesson: a change in the offense-defense balance as a defender may not translate to a meaningful change in the offense-defense balance as an attacker. We may have robust defenses at home, but they don’t allow us to neutralise an adversary pre-emptively if their defenses are even stronger. Of course, we can try to ensure we are the defender in all conflicts. But I’m not convinced I want to live in a world where states allow adversary capabilities to proliferate indefinitely, banking on their ability to defend alone, rather than also seeking to prevent or neutralise threats.

More importantly, in a potential conflict, it’s possible to structurally bias both parties towards defense—but this requires thinking about your offense-defense balance as both an attacker and a defender. The reasoning for this is as follows: for Countryland, an offense-defense ratio of 3:1 as an attacker but 1:6 as a defender means that offense is 3x as costly for Countryland (3) as Nationplace’s defense (1). However, defense is 6x as costly for Countryland (6) as Nationplace’s offense (1). In other words, for Countryland, defense against Nationplace is twice as expensive as offense against Nationplace (6/3 = 2). Even though it is disadvantaged in offense, it is even more disadvantaged in defense, so offense is preferred given the choice.

For Nationplace, defense is 3x as cheap for Nationplace (1) as it is for Countryland’s offense (3). However, offense is 6x as cheap for Nationplace (1) as it is for Countryland’s defense (6). So even though Nationplace has an advantage in both offense and defense, its advantage is twice as great in offense as it is in defense (6/3 = 2). Nationplace would also prefer offense over defense.

Whichever country actually attacks first ultimately comes down to game theory and context. However, Countryland’s exposure and Nationplace’s offense-centred military result in both parties being incentivised to attack despite their individual offense-defense balances. We can represent this quantitatively as just the product of the offense-defense balance when Countryland is the attacker and Nationplace the defender, and vice versa. This metric is known as the compound offense-defense balance (CODB)^[2]. In this case, it is 3:1 × 1:6 = 1:2, which suggests structural offense-dominance for both parties.

The compound offense-defense matters because it elicits a fourth lesson: when adversaries are not pre-selected as the attacker or defender, whether a conflict structurally favours offense or defense depends on comparative advantage rather than their lone balances. Countryland may want to pursue a defensive strategy given the heavy-tailed consequences of war, but Nationplace’s considerable comparative advantage in attack may pressure Countryland towards a preemptive strike. It isn’t enough for Countryland to merely shift its offense-defense balance as a defender towards defense—it must boost defense to the point that it regains an even greater comparative advantage in defense than Nationplace’s advantage in attack, or Countryland must increase the costs of attack for Nationplace.

The final wrinkle, then, is that we have so far considered only the conflict between Countryland and Nationplace. However, when we refer to defense-dominance as a goal, we really mean increasing defense-dominance across conflicts. In other words, the offense-defense balance we often care about is systemic. Yet, this introduces a fifth and crucial lesson: it’s possible for a local offense-defense balance (ODB-a, ODB-d, or CODB) to become more defense-dominant without the system becoming defense-dominant.

Consider, for example, that Countryland decides that its best course of action is to spend billions on impenetrable walls and fortifications along its border with Nationplace and Stateground to greatly increase the cost of Nationplace’s attack, changing Nationplace’s offense-defense balance as the defender from 1:6 to 1:1. Because Countryland’s offense-defense balance as an attacker remains at 3:1, this now changes the compound offense-defense balance from 1:2 (formerly 3:1 × 1:6) to 3:1 (now 3:1 × 1:1). Countryland’s comparative advantage in defense means both Countryland and Nationplace are incentivised to defend.

However, Stateground has long secretly stockpiled highly transmissible biological weapons. Stateground has never used these agents against Countryland because it has long feared that these pathogens would spread uncontrollably and infect its own denizens. The cost of robust biodefenses against accidental spread would be much too costly for the resource-poor Stateground. But now, Countryland has handed the solution to Stateground on a silver platter. By putting up impenetrable defenses against Nationplace and Stateground, Countryland has greatly reduced the risks of such a biological attack backfiring, greatly reducing the biodefenses needed to effect a successful biological weapons attack.

In other words, Countryland’s actions greatly shifted its offense-defense balance with Stateground—where Stateground is the attacker—towards offense, via policies intended to shift its offense-defense balance with Nationplace—with Nationplace as the attacker—towards defense. Exactly how we aggregate these two balances into a systemic offense-defense balance is an open question. But we can, for example, imagine taking the geometric mean of these compound offense-defense balances. If the Countryland-Stateground conflict now has an extremely offense-weighted compound offense-defense balance due to Stateground’s bioweapons (e.g. 1:50), then averaging this with the Countryland-Nationplace compound offense-defense balance of 3:1 would be roughly 1:4 (i.e., √(0.02 × 3)). This suggests offense-dominance in the system.

Whether simple averaging of this sort is best remains an open question, and different aggregation rules yield different implications. We may want to weight conflicts by expected disvalue. We may care about any conflict reaching an offense-dominance threshold because it can then be exploited by a rogue AI. The question of what systemic defense-dominance means is hugely underexplored. However, the crucial point is that this example highlights the mistake of conceiving of a singular offense-defense balance and accelerating “defense” unconditionally.

Advising Countryland to build defensive fortifications because “walls are a defensive technology” would be a terrible idea. Building walls may be a great idea for 99% of the conflicts Countryland might find itself in, yet not worthwhile if it enables its own destruction from one of its primary adversaries. However, one solution could be as straightforward as ensuring Countryland allies with Stateground to disincentivise conflict altogether. This problem may also be avoidable if the walls do not actually prevent significant population flows between Countryland and Stateground. Or it’s possible that it’s ultimately more cost-effective for Countryland to focus on robust biodefenses at the expense of vulnerability to Nationplace.

I won’t dedicate a whole blog post to each of the other 9 misconceptions; this won’t be a 10-part series. But this first misconception—that there is a single offense-defense balance—is by far the most important. It is ultimately the limitations of generalising across the different balances that result in attempts to confer defensive advantage merely relocating offensive advantage, or causing inadvertent destabilisation. Future essays in this series will explore, more concretely, what this looks like for AI and biotechnology. But the takeaway will be constant: defense is the goal, but defense-dominance is not a singular condition. Countryland did not appreciate this, and naive defensive acceleration may have cost them everything. We should not make the same error.

1. ^{^}

   Canonical texts include: George Quester, Offense and Defense in the International System (1977); Robert Jervis, "Cooperation Under the Security Dilemma" (1978); Ted Hopf, "Polarity, the Offense-Defense Balance, and War" (1991); Sean Lynn-Jones, "Offense-Defense Theory and Its Critics" (1995); Charles Glaser and Chaim Kaufmann, "What Is the Offense-Defense Balance and Can We Measure It?" (1998); Stephen Van Evera, "Offense, Defense, and the Causes of War" (1998) and Causes of War (1999); Stephen Biddle, "Rebuilding the Foundations of Offense-Defense Theory" (2001).

2. ^{^}

   Charles Glaser and Chaim Kaufmann, "What Is the Offense-Defense Balance and Can We Measure It?" (1998).