Introduction: The Purple Loop with AI

All courses / AI Purple / Module 1 / Chapter 1

Learning objectives

After the lesson the participant can:

• Explain the five parts of the working thesis and what evidence would count against it.
• Compare the contracted catalogue run at Nordvik Region with the pipeline run at Hansa Mutual by what each can later prove.
• Classify uses of AI in the loop into the three groups of usage modes and say where the risk sits in each.
• Draft a one-page inventory of AI in testing and in detection, marking where AI is on both sides of one check.

Key concepts

The purple loop

The structure that carries a finding from an adversary's behaviour to a defence that has been shown to work. The purple team in this book is that joint loop between the red team and the blue team, not a team beside them.

Working thesis

The author's own five-part claim: purple is a loop, not a team; AI moves the loop from the event to the pipeline and keeps the event; a loop closed by machines alone verifies nothing new; coverage is a claim that needs evidence; safe emulation is a design question.

Agreement without verification

The risk that an emulation agent and a detection agent share training data, a model family and blind spots, so that a passing result shows only that two similar systems agree.

Usage mode groups in the loop

Modes 1 to 3 assist a person under the person's identity; Mode 4 performs a loop function under a service identity bounded by a mandate; Mode 5 agents such as an emulation runner act with an identity of their own, in effect a privileged account.

Inventory of AI in the loop

A one-page list of every testing and detection activity, whether AI takes part, whose it is, its usage mode, its identity and its highest level, with the entries marked where AI is on both sides of one check.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The book commits in advance to evidence that would show its thesis wrong. Which of the two kinds of disconfirming evidence would be hardest for your organisation to collect, and why?
2. Neither Thursday night is better in every respect. What would be lost if Nordvik Region copied Hansa Mutual's pipeline, and what would be lost if Hansa Mutual dropped its human-led work?
3. Where in your own testing and detection might a provider's AI already be on both sides of one check without the contract saying so?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which statement is the third part of the book's working thesis?

   1. A purple team should be staffed and budgeted as a third team beside red and blue.
   2. A loop closed by machines alone verifies nothing new.
   3. Continuous emulation makes the human-led exercise redundant within a few years.
   4. Coverage is proved once every catalogued scenario has passed at least once.
   Show the answer

   B. A loop closed by machines alone verifies nothing new.
   The thesis holds that a machine-closed loop can show that the known still works but cannot by itself show that its scenarios were the right ones, which is why verification needs independence. The other options contradict parts one, two and four.

2. In the chapter's grouping of usage modes, where does the risk sit for a Mode 5 emulation runner?

   1. In over-reliance on a draft, because the person who asked for it remains accountable for the output.
   2. In a meeting tool that summarises a tabletop and assigns actions without review.
   3. In a shared service identity that only has read access to the telemetry.
   4. In an agent with its own identity and permissions, in effect a privileged account.
   Show the answer

   D. In an agent with its own identity and permissions, in effect a privileged account.
   The chapter distinguishes modes by whose identity the AI uses. A Mode 5 runner executes against the estate with an identity of its own, so it is treated as a privileged account; over-reliance on a draft is the risk of Modes 1 to 3.

3. What must an answer to AIDR-0800 and AIDR-0850 state, according to the worked example?

   1. What was tested, when and with what result, and not a count of findings or of scenarios.
   2. The number of findings closed in the quarter and the share of green results.
   3. The names of the tools used by the tester and by the managed provider.
   4. The budget needed to move from two catalogue runs a year to a pipeline.
   Show the answer

   A. What was tested, when and with what result, and not a count of findings or of scenarios.
   Both decision records ask for an answer in the form the thesis requires: what was tested, when and with what result. The chapter says neither can be answered by a count of findings or scenarios.