# Structured access: an emerging paradigm for safe AI deployment arXiv: https://arxiv.org/abs/2201.05159 ยท HTML: https://mlsanity.com/paper/2201.05159/ ## Key facts - Cited by 41 papers in the map (data through 14 Oct 2026). - Builds on 9 of its 27 references that are in the map. - First posted on arXiv 13 Jan 2022. ## Builds on (most cited first, 9 of 9) - [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020) - [DialoGPT: Large-Scale Generative Pre-training for Conversational Response Generation](https://mlsanity.com/paper/1911.00536/) (2019) - [Stealing Machine Learning Models via Prediction APIs](https://mlsanity.com/paper/1609.02943/) (2016) - [Release Strategies and the Social Impacts of Language Models](https://mlsanity.com/paper/1908.09203/) (2019) - [AI Research Considerations for Human Existential Safety (ARCHES)](https://mlsanity.com/paper/2006.04948/) (2020) - [AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption](https://mlsanity.com/paper/2105.13697/) (2021) - [Deep-Lock: Secure Authorization for Deep Neural Networks](https://mlsanity.com/paper/2008.05966/) (2020) - [DeepObfuscation: Securing the Structure of Convolutional Neural Networks via Knowledge Distillation](https://mlsanity.com/paper/1806.10313/) (2018) - [MimosaNet: An Unrobust Neural Network Preventing Model Stealing](https://mlsanity.com/paper/1907.01650/) (2019) ## Built on by (most cited first, 30 of 41) - [The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning](https://mlsanity.com/paper/2403.03218/) (2024) - [Model evaluation for extreme risks](https://mlsanity.com/paper/2305.15324/) (2023) - [Black-Box Access is Insufficient for Rigorous AI Audits](https://mlsanity.com/paper/2401.14446/) (2024) - [Large Language Model Unlearning via Embedding-Corrupted Prompts](https://mlsanity.com/paper/2406.07933/) (2024) - [Frontier AI Regulation: Managing Emerging Risks to Public Safety](https://mlsanity.com/paper/2307.03718/) (2023) - [On the Societal Impact of Open Foundation Models](https://mlsanity.com/paper/2403.07918/) (2024) - [The Gradient of Generative AI Release: Methods and Considerations](https://mlsanity.com/paper/2302.04844/) (2023) - [Large Language Model Safety: A Holistic Survey](https://mlsanity.com/paper/2412.17686/) (2024) - [Spear Phishing With Large Language Models](https://mlsanity.com/paper/2305.06972/) (2023) - [The Oscars of AI Theater: A Survey on Role-Playing with Language Models](https://mlsanity.com/paper/2407.11484/) (2024) - [NNsight and NDIF: Democratizing Access to Open-Weight Foundation Model Internals](https://mlsanity.com/paper/2407.14561/) (2024) - [Open-Sourcing Highly Capable Foundation Models: An evaluation of risks, benefits, and alternative methods for pursuing open-source objectives](https://mlsanity.com/paper/2311.09227/) (2023) - [Democratising AI: Multiple Meanings, Goals, and Methods](https://mlsanity.com/paper/2303.12642/) (2023) - [The Compute Divide in Machine Learning: A Threat to Academic Contribution and Scrutiny?](https://mlsanity.com/paper/2401.02452/) (2024) - [Generative AI Misuse: A Taxonomy of Tactics and Insights from Real-World Data](https://mlsanity.com/paper/2406.13843/) (2024) - [Holistic Safety and Responsibility Evaluations of Advanced AI Models](https://mlsanity.com/paper/2404.14068/) (2024) - [A Cost Analysis of Generative Language Models and Influence Operations](https://mlsanity.com/paper/2308.03740/) (2023) - [Protecting Society from AI Misuse: When are Restrictions on Capabilities Warranted?](https://mlsanity.com/paper/2303.09377/) (2023) - [Towards Publicly Accountable Frontier LLMs: Building an External Scrutiny Ecosystem under the ASPIRE Framework](https://mlsanity.com/paper/2311.14711/) (2023) - [The 2025 Foundation Model Transparency Index](https://mlsanity.com/paper/2512.10169/) (2025) - [What is it for a Machine Learning Model to Have a Capability?](https://mlsanity.com/paper/2405.08989/) (2024) - [Societal Adaptation to Advanced AI](https://mlsanity.com/paper/2405.10295/) (2024) - [International Governance of Civilian AI: A Jurisdictional Certification Approach](https://mlsanity.com/paper/2308.15514/) (2023) - [Actionable Guidance for High-Consequence AI Risk Management: Towards Standards Addressing AI Catastrophic Risks](https://mlsanity.com/paper/2206.08966/) (2022) - [Hazards from Increasingly Accessible Fine-Tuning of Downloadable Foundation Models](https://mlsanity.com/paper/2312.14751/) (2023) - [Exploring the Relevance of Data Privacy-Enhancing Technologies for AI Governance Use Cases](https://mlsanity.com/paper/2303.08956/) (2023) - [An International Consortium for Evaluations of Societal-Scale Risks from Advanced AI](https://mlsanity.com/paper/2310.14455/) (2023) - [Towards Responsible Governance of Biological Design Tools](https://mlsanity.com/paper/2311.15936/) (2023) - [An Example Safety Case for Safeguards Against Misuse](https://mlsanity.com/paper/2505.18003/) (2025) - [Technical Requirements for Halting Dangerous AI Activities](https://mlsanity.com/paper/2507.09801/) (2025) ## Abstract (arXiv) Structured access is an emerging paradigm for the safe deployment of artificial intelligence (AI). Instead of openly disseminating AI systems, developers facilitate controlled, arm's length interactions with their AI systems. The aim is to prevent dangerous AI capabilities from being widely accessible, whilst preserving access to AI capabilities that can be used safely. The developer must both restrict how the AI system can be used, and prevent the user from circumventing these restrictions through modification or reverse engineering of the AI system. Structured access is most effective when implemented through cloud-based AI services, rather than disseminating AI software that runs locally on users' hardware. Cloud-based interfaces provide the AI developer greater scope for controlling how the AI system is used, and for protecting against unauthorized modifications to the system's design. This chapter expands the discussion of "publication norms" in the AI community, which to date has focused on the question of how the informational content of AI research projects should be disseminated (e.g., code and models). Although this is an important question, there are limits to what can be achieved through the control of information flows. Structured access views AI software not only as information that can be shared but also as a tool with which users can have arm's length interactions. There are early examples of structured access being practiced by AI developers, but there is much room for further development, both in the functionality of cloud-based interfaces and in the wider institutional framework.