Paper deep dive
The Ethics of Artificial Intelligence in Military Operations
Nicolas Drapier, Florian Mauberger, Aladine Chetouani, Aurelien Chateigner
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 9/27/2026, 2:06:55 AM
Summary
This paper argues that the ethical crisis of military AI is fundamentally epistemic, stemming from the opacity of deep learning systems which creates an accountability gap where responsibility diffuses across designers, operators, and policymakers. The authors propose a procedural governance framework involving named accountability roles, adversarial auditing, and tiered deployment thresholds to preserve meaningful human control and ensure compliance with International Humanitarian Law.
Entities (16)
Relation Signals (10)
Deep Learning â hasproperty â Opacity
confidence 98% ¡ their internal logic resists inspection... deep neural networks are mathematically opaque by construction
Proposed Governance Framework â addresses â Accountability Gap
confidence 95% ¡ To address this gap, we propose a governance framework that proceduralizes ethical constraints
Deep Learning â causes â Accountability Gap
confidence 95% ¡ The ethical challenge posed by these systems is fundamentally epistemic... this epistemic condition produces a concrete accountability gap
Proposed Governance Framework â includes â Named Accountability Roles
confidence 95% ¡ proceduralizes ethical constraints through named accountability roles
Proposed Governance Framework â includes â Adversarial Auditing
confidence 95% ¡ adversarial auditing with undisclosed benchmarks
Project Maven â involved â Google
confidence 95% ¡ Project Maven exposed this concretely: Google engineers who raised ethical concerns
Project Maven â involved â U.S. Department of Defense
confidence 95% ¡ Project Maven U.S. Department of Defense
EU AI Act â excludes â Military Systems
confidence 90% ¡ The EU AI Act does not apply to systems used only for military, defense, or national security purposes
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Deep learning systems now mediate military decisions to use force, yet their internal logic resists inspection, their evaluation practices are gameable, and their deployment fractures accountability across dispersed stakeholders. The ethical challenge posed by these systems is fundamentally epistemic: not just whether autonomous weapons should be permitted to kill, but whether the conditions for responsible human judgment can survive when critical functions are delegated to opaque algorithms. We show that this epistemic condition produces a concrete accountability gap: responsibility diffuses across designers, operators, and policymakers while International Humanitarian Law presupposes capacities for judgment that current AI systems lack. To address this gap, we propose a governance framework that proceduralizes ethical constraints through named accountability roles, adversarial auditing with undisclosed benchmarks, tiered deployment thresholds, and a proposed NATO evaluation standard. Counterfactual analysis of eight documented cases (1988-2025) shows that each governance mechanism addresses a documented class of failure, but no single safeguard suffices in isolation: effective governance of military AI requires not only technical constraints but the institutional infrastructure to keep human judgment meaningful.
Tags
Links
- Source: https://arxiv.org/abs/2609.26507v1
- Canonical: https://arxiv.org/abs/2609.26507v1
Trouble viewing inline? Open PDF directly â
Full Text
90,043 characters extracted from source content.
Expand or collapse full text
The Ethics of Artificial Intelligence in Military Operations Nicolas Drapier Email: nicolas.drapier@sas-impact.fr Affiliation: L2TI Laboratory, UniversitĂŠ Sorbonne Paris Nord, 99 Avenue Jean-Baptiste ClĂŠment, Villetaneuse, 93430, France Affiliation: SAS Impact, 1 Rue Sainte-Anne, OrlĂŠans, 45000, France Florian Mauberger Email: florian.mauberger@sas-impact.fr Affiliation: SAS Impact, 1 Rue Sainte-Anne, OrlĂŠans, 45000, France Aladine Chetouani Email: aladine.chetouani@univ-paris13.fr Affiliation: L2TI Laboratory, UniversitĂŠ Sorbonne Paris Nord, 99 Avenue Jean-Baptiste ClĂŠment, Villetaneuse, 93430, France AurĂŠlien Chateigner Email: aurelien.chateigner@sas-impact.fr Affiliation: SAS Impact, 1 Rue Sainte-Anne, OrlĂŠans, 45000, France Abstract Deep learning systems now mediate military decisions to use force, yet their internal logic resists inspection, their evaluation practices are gameable, and their deployment fractures accountability across dispersed stakeholders. The ethical challenge posed by these systems is fundamentally epistemic: not just whether autonomous weapons should be permitted to kill, but whether the conditions for responsible human judgment can survive when critical functions are delegated to opaque algorithms. We show that this epistemic condition produces a concrete accountability gap: responsibility diffuses across designers, operators, and policymakers while International Humanitarian Law presupposes capacities for judgment that current AI systems lack. To address this gap, we propose a governance framework that proceduralizes ethical constraints through named accountability roles, adversarial auditing with undisclosed benchmarks, tiered deployment thresholds, and a proposed NATO evaluation standard. Counterfactual analysis of eight documented cases (1988-2025) shows that each governance mechanism addresses a documented class of failure, but no single safeguard suffices in isolation: effective governance of military AI requires not only technical constraints but the institutional infrastructure to keep human judgment meaningful. keywordsMilitary AI, Autonomous weapons, Accountability, International Humanitarian Law 1 Introduction The ethical debate surrounding military AI has largely centered on a binary question: should autonomous systems be permitted to select and engage targets? This framing has motivated important policy initiatives, including the open letter by AI researchers calling for a ban on offensive autonomous weapons Future of Life Institute (2015) and the ongoing deliberations within the UN Convention on Certain Conventional Weapons. Yet it obscures a more fundamental problem. The challenge is not only whether machines should be allowed to kill, but whether the epistemic conditions for responsible decision-making can be preserved when critical functions are delegated to systems whose internal logic resists inspection. These systems are already operational. Targeting, surveillance, logistics, and command support increasingly depend on deep learning operating at speeds and scales beyond human cognitive capacity. We call this shift Algorithmic Warfare: the integration of autonomous inference into the chain of command, from sensor processing to engagement decisions. This paper argues that the ethical crisis of military AI is, at root, an epistemic crisis. The technologies driving this transformation range from autonomous targeting to predictive logistics Scharre (2018), and their proliferation is reshaping strategic stability Horowitz (2019). Deep learning models are opaque in ways structurally distinct from prior military technologies Burrell (2016); Lipton (2018): their decision processes elude human comprehension even when source code is available, and post hoc explainability techniques offer approximations that do not restore access to the modelâs reasoning Yang et al. (2023); Bove et al. (2024). This opacity compounds across the chain of command: it distorts operator trust Goddard et al. (2012); Lyell and Coiera (2017), fragments accountability across dispersed stakeholders Nissenbaum (1996); Matthias (2004); Sparrow (2007), and strains the applicability of International Humanitarian Law, whose core principles presuppose capacities for judgment that current AI systems lack Sharkey (2008); Heyns (2013); Boulanin et al. (2020); Bhuta et al. (2016). Responsibility does not vanish when decisions are delegated to algorithms. It is displaced, obscured, and redistributed through institutional mechanisms that simulate accountability without delivering it. Our central claim is that governable military AI requires epistemic infrastructure: institutions, procedures, and technical constraints designed to preserve the conditions for human judgment under irreducible uncertainty. This is not a call to halt military AI adoption, which would be neither realistic nor strategically responsible, but to ensure that deployment proceeds within governance structures adequate to the technologyâs demands. This paper makes two contributions: 1. A diagnostic framework showing how the structural opacity of deep learning interacts with adversarial fragility, benchmark gaming, and defense-contracting incentives to produce three compounding epistemic failures (an illusion of understanding, an illusion of accuracy, and an illusion of determinism) that erode both accountability and the practical applicability of International Humanitarian Law (2). 2. A procedural governance framework (named accountability roles, adversarial auditing with undisclosed benchmarks, a proposed NATO evaluation standard, tiered deployment thresholds, and interface design principles) evaluated through counterfactual analysis of eight operational cases spanning 1988-2025 (3). 2 Background 2.1 Opacity, Explainability, and Adversarial Fragility The three sources of algorithmic opacity identified by Burrell Burrell (2016) converge simultaneously in military AI: proprietary algorithms and classification regimes enforce deliberate dissimulation, rapid development cycles produce organizational ignorance, and deep neural networks are mathematically opaque by construction Lipton (2018). Post hoc explainability methods such as LIME Ribeiro et al. (2016), SHAP Lundberg and Lee (2017), and Grad-CAM Selvaraju et al. (2017) can aid debugging van Zyl et al. (2024), but these are approximations that can be unfaithful to the modelâs actual decision process Yang et al. (2023); Bove et al. (2024), and explanation quality fails to predict human-AI team performance Buçinca et al. (2020). In military applications the deeper risk is what we term an illusion of understanding. An analyst viewing a heatmap concentrated on a vehicleâs turret may conclude the model identified a tank by its weapon system, while the model may be keying on background terrain or sensor artifacts. The explanation satisfies the cognitive need for justification without providing epistemic access. Partial transparency is therefore more dangerous than acknowledged opacity: complete opacity preserves skepticism, while the illusion of understanding actively suppresses it. Adversarial fragility compounds this danger. Physically realizable perturbations systematically fool classifiers Brown et al. (2018); Eykholt et al. (2018), defenses remain unstable Carlini and Wagner (2017); Madry et al. (2018), and models that achieve high accuracy on curated benchmarks degrade unpredictably under distributional shifts characteristic of operational environments Hendrycks and Dietterich (2019). When such systems output predictions without calibrated uncertainty, the result is an illusion of accuracy: the model reports high confidence on every classification, whether processing a clear image or a degraded sensor feed. Failures present identically to successes, and the error becomes visible only when its consequences materialize. These two bodies of work are typically treated in isolation. We argue that their intersection is where the deepest risk lies: opacity prevents operators from detecting when a system crosses its competence boundary, and adversarial fragility means such crossings can be induced deliberately. No prior work examines this interaction as a unified epistemic condition specific to military decision-making. 2.2 Trust, Institutional Incentives, and Systemic Vulnerabilities The illusions of understanding and accuracy interact with institutional dynamics to produce a third: the illusion of determinism. Clean dashboards and categorical outputs erase the probabilistic nature of the underlying computation. A commander who has observed correct identifications across hundreds of training exercises generalizes to the expectation that the system will perform identically in theater, where unfamiliar terrain, degraded sensors, and adversarial countermeasures invalidate that expectation. The categorical format provides no warning that the system has crossed the boundary of its competence. Operators are known to defer to automated recommendations, a disposition documented as automation bias Goddard et al. (2012); Parasuraman and Riley (1997); Cummings (2004). In these systems the problem starts earlier, before any deference: a categorical output reports a verdict without the confidence signal that would let an operator judge whether to trust it or not. Interface design mediates whether system limitations become perceptible Norman (1999). Lee and See Lee and See (2004) show that overtrust, calibrated trust, and distrust produce distinct failure signatures, while Risko and Gilbert Risko and Gilbert (2016) characterize the mechanism as selective cognitive offloading. The benchmarking ecosystem reinforces this dynamic. When evaluation criteria are known in advance, developers optimize for those criteria at the expense of broader robustness Amodei et al. (2016); Russell (2019), and benchmark performance becomes a proxy for institutional confidence in systems that may fail under conditions never tested. Weight poisoning Kurita et al. (2020); Li et al. (2021) represents a further threat: an adversary can induce targeted failures that standard evaluations do not detect, and the poisoned model continues to perform well on benchmarks while behaving anomalously in high-stakes scenarios. The growing dependence on private technology firms creates a parallel vulnerability. Project Maven U.S. Department of Defense (2017); Department of Defense Inspector General (2022) exposed this concretely: Google engineers who raised ethical concerns lacked formal channels to influence deployment, while DoD officials who authorized it lacked access to the underlying code or training data. The state owned the system, but the knowledge resided elsewhere. As Raji et al. Raji and Dobbe (2023) document, real-world AI failures in high-stakes domains typically stem from breakdowns in engineering practice. Military contexts, characterized by secrecy and operational pressure, amplify these gaps. Trust calibration and systemic vulnerability literatures both miss the institutional machinery that compounds these problems: benchmark gaming, contracting structures that separate knowledge from authority, and fragmented expertise that prevents any single actor from recognizing failure conditions. 2.3 The Accountability Gap AI-mediated decision-making dissolves the classical military chain of command into Nissenbaumâs Nissenbaum (1996) âmany hands problem.â The model is designed by engineers who may never witness its deployment, trained on datasets curated by scientists who will never select a target, operated by soldiers who cannot read its internal logic, and authorized by policymakers who lack both technical and operational knowledge. Each actor holds a fragment of agency; none fully causes the systemâs decisions. When failure occurs, responsibility is not discovered but negotiated Nissenbaum (1996), and scapegoating becomes a structurally likely outcome. Matthias Matthias (2004) introduced the âresponsibility gapâ for learning automata; Sparrow Sparrow (2007) extended it to lethal autonomous weapons; and machines lack the intentionality that grounds moral accountability Floridi and Sanders (2004); Asaro (2012). If they cannot bear responsibility and human beings are too fragmented to deal with it on their own, existing structures provide no mechanism for attribution. The concept of âmeaningful human controlâ Santoni de Sio and van den Hoven (2018) is intended to fill this gap, but it lacks operational precision. For oversight to be functionally effective, two conditions must hold: temporal authority (the power to veto, pause, or require stage-gated approval) and interpretive access (the ability to understand why a system produced a given output, not just whether to endorse it). The international NGO Article 36 Article 36 (2015) has interpreted the obligations of states deploying autonomous weapons along these lines: ⢠States must explicitly affirm that meaningful human control is required over individual attacks. ⢠Weapon systems operating without such control must be prohibited. ⢠States must publicly explain how they apply control over existing systems and justify why they consider them acceptable and lawful. In practice, however, the systemâs output arrives with an aura of authority, and what begins as collaboration slides into deference. On Fischer and Ravizzaâs account of guidance control Fischer and Ravizza (1998), the human remains responsible so long as the decision reflects their own critical judgment. But if the operator consistently aligns with the AIâs output without challenge, their role becomes performative: they are not exercising judgment but affixing a stamp of approval. This is not real control. It is responsibility laundering. Automation bias reinforces the dynamic Goddard et al. (2012); Lyell and Coiera (2017), and military operators are rarely trained to recognize overconfidence, distributional shift, or adversarial manipulation Strauch (2017). The challenge is not to preserve human involvement as such, but to ensure that it is cognitively robust: the capacity to understand, interrogate, and override. 2.4 IHL Under Strain International Humanitarian Law rests on principles that presume human judgment, contextual awareness, and moral intentionality Bhuta et al. (2016), but the specific points of failure differ. Sharkey Sharkey (2008) and Roff Roff (2014) show that distinction and proportionality require contextual interpretation that probabilistic classifiers cannot replicate: the difference between a combatant and a civilian holding a similar object is not a feature-space boundary but a moral assessment. Heyns Heyns (2013) adds that even if targeting were technically accurate, the physical and moral distance introduced by autonomy undermines the attribution on which legal accountability depends. Liu Liu (2012) extends the analysis to situations current systems handle worst: recognizing surrender, medical evacuation, or hors de combat status, where the legally required response is restraint, not classification. Boulanin et al. Boulanin et al. (2020) translate these requirements into three testable conditions for lawful deployment: foresight, administration, and traceability. Crootof Crootof (2022) reframes the problem. If AI-mediated outcomes cannot be fully predicted, accountability grounded in intent becomes unworkable. Her âwar tortsâ model shifts the focus from the decision-makerâs intent to the question of whether the decision-making process adhered to verifiable standards of care. This move from intent to procedural integrity is the conceptual foundation of our framework: it transforms an intractable philosophical question (who holds moral responsibility for an algorithmic output?) into a verifiable institutional one (what process was followed, and did it meet documented standards?). Yet the gap between this insight and operational practice remains wide. Jobin et al. Jobin et al. (2019) confirm the pattern across 84 AI ethics guidelines: high-level principles converge while implementation diverges. Before proposing a framework, we ask what the instruments already in force actually require of military AI, and of whom. 2.5 Existing Governance Instruments and Their Limits Military AI falls under three regimes. They were written separately, and none of them was written for it. This section makes one claim about them: the rules that bind govern the wrong thing. They govern a weapon, a platform, a system, and they treat the learned model as one more piece of software inside it. The argument has three steps. Two of them are about how far the rules reach. The third is about what the rules take as their object. That third one is the point of this section, because it holds even where a binding rule does apply. The civil regime is the most developed. The NIST AI Risk Management Framework National Institute of Standards and Technology (2023) organizes risk work around four functions: govern, map, measure, and manage. The EU AI Act European Parliament and Council of the European Union (2024) goes further and turns a scale of risk into duties that can be enforced against high-risk systems. The military regime is narrower. U.S. DoD Directive 3000.09 U.S. Department of Defense (2023) sets out how autonomous and semi-autonomous weapon systems are reviewed and approved. The NATO AI Strategy North Atlantic Treaty Organization (2021) commits members to three principles: systems should be governable, traceable, and reliable. The humanitarian regime only states a position. The ICRC International Committee of the Red Cross (2021) asks states to agree on rules for human control over the use of force. The first limit is about who is covered. The EU AI Act does not apply to systems used only for military, defense, or national security purposes (Art. 2(3)) European Parliament and Council of the European Union (2024). The exclusion is smaller than it looks. Recital 24 says that a dual-use system, or a military system reused for civilian work, comes back under the Act European Parliament and Council of the European Union (2024). Still, the effect is that the one instrument with real enforceable duties does not reach purely military systems, and covers the dual-use middle ground (predictive logistics, ISR, decision support) only in patches. The second limit is about what is covered. DoDD 3000.09 is the one binding rule written for the military, and it applies only to weapon systems U.S. Department of Defense (2023). Logistics, medical triage, intelligence analysis, and cyber operations sit outside it, even when what they produce leads to someone being killed. NIST, NATO, and the ICRC cover the whole range, but as advice or as a stated principle, not as a requirement National Institute of Standards and Technology (2023); North Atlantic Treaty Organization (2021); International Committee of the Red Cross (2021). Both of those limits are about coverage, and both could be closed by widening a perimeter. The third one cannot, because it is about what the rules govern rather than how far they reach. To see it, take the case that favors the current regime most: a system that sits squarely inside the strongest binding rule. Consider an air-defense turret covered by DoDD 3000.09. Its object-detection model reads radar and camera returns and decides which aircraft to fire on. The directive covers the turret, not the model. So the model gets reviewed only as one part of the weapon, and every requirement that follows is attached to the turret. Three consequences follow. The rest of this subsection takes them one at a time. The first is that the rules track where the model sits rather than what it does. Move the same model into a tool that flags vehicles for a human analyst and it becomes ordinary intelligence software, bound by nothing. It still makes the same mistakes at the same rate. Only the cost of a mistake has changed. The second is that the checks that do exist ask the wrong question. Checks do happen when the model is updated. New software counts as a new baseline, and that triggers the same re-qualification any other component change would. But the check runs as configuration management, and it tests the model against the specification the platform was approved against. That kind of check assumes two things are enough to tell you how a system will behave in the field: a test campaign of finite size, and a look at how the thing was built. For control logic that follows fixed rules, the assumption holds. It breaks for a model that can get an input wrong even when that input looks no different from the ones it gets right, and whose behavior comes from training data and weights rather than rules an engineer wrote down. The check runs, the system passes, and what you learn is not what the check was built to tell you. The third is that some failures arrive with no check at all. As the inputs the model sees in the field drift away from the ones it was trained on, the model gets worse while the approved baseline stays exactly the same. Nothing changes on paper, so there is no event for the rules to hang on. Together these leave a gap in accountability. When the turret fires on the wrong aircraft, the mount, the fire-control logic, the interlocks, and the sensors can each be found within specifications. The configuration can be found compliant. And the error that decided the outcome sits in a classification that no requirement in the regime was written to constrain. The pattern is not limited to weapons. Existing rules govern a thing that is built, fielded, and approved as a unit, and treat the model as one more piece of software inside it. But a model carries a decision whose stakes are set by where it is installed, and a behavior that can change while the platform stays the same. Governing the platform leaves that decision free. Better rules have to begin by saying what they should require, and of what. The next section builds that list. 3 Design Principles for Accountable Military AI The previous section ended on a missing list: what should good rules require of a military AI? Before writing it, we have to ask where such rules can hold. One answer is to put them inside the model itself. At the current state of the art, we do not know how to reliably encode ethics into learning systems in a way that remains robust across diverse contexts, adversarial manipulation, and distribution shifts. Arkin Arkin (2009) proposed the most developed attempt at an âethical governorâ: a computational architecture that would enforce IHL constraints (distinction, proportionality, prohibition on perfidy) at the system level. The approach demonstrates that certain hard constraints can be implemented as decision-theoretic filters, but it also reveals the limits of formalization. Moral judgment involves interpretation, competing values, and the capacity to recognize when rules should be broken. No loss function captures the principle of proportionality. No training dataset encodes the full meaning of distinction. Attempts to formalize ethics into algorithmic constraints produce brittle systems that satisfy the letter of a rule while violating its spirit, or that fail unpredictably outside their training distribution. Rather than operating under the illusion that morality can be optimized as a mathematical loss function, we propose to proceduralize ethics, encoding ethical constraints into institutions, certification regimes, standard operating procedures, and technical safeguards. A meta-analysis of 84 AI ethics guidelines by Jobin et al. Jobin et al. (2019) reveals broad convergence on transparency, fairness, non-maleficence but persistent divergence on implementation. This gap between principle and practice is precisely what proceduralization is designed to close. This pragmatic stance is not a permanent renunciation of value-aligned design. As alignment research matures, a hybrid approach will become viable, combining limited algorithmic constraints (calibrated uncertainty, forced abstention, hard safety interlocks) with rigorous external procedural controls (mandatory audits, authorization gates, traceability). We develop this approach through six components: actionable accountability structures (3.1), adversarial evaluation (3.2), a NATO standardization proposal (3.3), interface design principles for preserving human judgment (3.4), tiered deployment thresholds (3.5) and testing it against eight operational cases (3.7). 3.1 Actionable Accountability If responsibility is dispersed across many hands, governance must make it actionable. The objective is to ensure that (i) every high-stakes decision has an identifiable human authorizer, (i) every deployed system has an identifiable human owner, and (i) every critical failure can be reconstructed and attributed through evidence. We propose three complementary requirements. Named accountability roles. For each operational AI capability, states should designate a System Owner (responsible for lifecycle risk management), an Operational Authorizer (responsible for each mission-level activation), an Operational User (the operator who interacts with the system in real time, responsible for exercising judgment on its outputs, reporting anomalies, and invoking override or abort procedures), and an Independent Evaluator (responsible for certification and periodic reassessment). These roles must be separated to reduce conflicts of interest, and their responsibilities written into doctrine rather than treated as informal practice. Traceability by default. Accountability requires investigability. Systems should maintain tamper-evident logs capturing model version and weights hash, data pipeline versioning, sensor provenance (device serial number and certificate identifier), a hash of sensor inputs, uncertainty estimates, operator interactions (overrides, approvals, aborts), and timing information. The design goal is a factual record sufficient for post hoc review and legal scrutiny. Technical enforceability of oversight. Whenever a system is used in an operation that can produce harm, the architecture should enforce stage-gated approvals, abort capability, and fallback modes. If substantive human control is a requirement, it must be implemented as a control surface that the operator can exercise under time pressure. These measures do not eliminate the many-hands problem, but they transform distributed decision-making into distributed obligation, reducing the conditions for scapegoating by making responsibilities explicit, auditable, and enforceable. 3.2 Adversarial Evaluation Accountability structures establish who must answer for a decision, but not whether the underlying system is robust enough to warrant deployment. Evaluation and certification form the second pillar of proceduralized ethics. The standard approach relies on benchmarks with known ground-truth labels. When evaluation criteria are known in advance, developers optimize for those criteria at the expense of broader competence. Goodhart Goodhart (1975) first identified this dynamic in monetary policy; Strathern Strathern (1997) generalized it: âwhen a measure becomes a target, it ceases to be a good measure.â The pattern is well-documented in ML. Dozens of optimizers claim to outperform AdamW on standard benchmarks, yet almost none see adoption, because comparisons rely on asymmetric hyperparameter tuning, favorable evaluation conditions, and unreported negative results Wen et al. (2025). As Jordan argues in his analysis of the Muon optimizer Jordan et al. (2024), the only credible evidence of superiority is success under truly competitive conditions. Recht et al. Recht et al. (2019) provide a striking illustration at the dataset level: after replicating the ImageNet test set creation process from scratch, they observed accuracy drops of 11-14% across a wide range of classifiers, with no change in the underlying data distribution. Performance on a fixed benchmark, even a well-curated one, does not reliably predict generalization. For military AI, the same dynamic applies with higher stakes. If defense contractors are evaluated on disclosed benchmarks, optimization will target those benchmarks, producing systems that perform well in controlled demonstrations but may fail in operational environments. A natural countermeasure is adversarial auditing with undisclosed evaluation criteria. Benchmarks used to certify military AI should be kept secret, accessible only to authorized evaluators, and rotated regularly. The existence of certain evaluation sets should itself be classified. The evaluation process should remain transparent and standardized; what must stay hidden is the evaluation content. Transparency about process combined with secrecy about content channels the incentive structure toward competence rather than benchmark-specific optimization. Evaluation should also include adversarial robustness testing. As discussed in 2.1, adversarial patches Brown et al. (2018) and targeted perturbations Eykholt et al. (2018) can cause high-confidence misclassification on inputs that appear benign to human observers. Findings Carlini and Wagner (2017); Madry et al. (2018) suggest that robustness under adversarial conditions is a more informative criterion than accuracy on clean data. Hendrycks and Dietterich Hendrycks and Dietterich (2019) demonstrated this concretely with ImageNet-C, showing that top-performing classifiers degrade severely under common corruptions (noise, blur, weather, digital artifacts) despite high clean-data accuracy. For military systems operating in contested and unpredictable environments, evaluation must reflect these conditions. A complementary dimension is negative testing. Standard evaluation emphasizes positive cases (does the model correctly identify targets it should identify?), but the converse matters equally: does the model correctly reject inputs it should reject? A classifier trained on military vehicles may learn to associate camouflage patterns with the positive class, triggering false positives on civilian trucks while missing military vehicles in unexpected color. For military AI, negative testing directly operationalizes the principle of distinction. Evaluation should include civilian objects sharing features with military targets, military targets with atypical appearances, scenarios involving surrender or medical evacuation, and inputs at the boundary of the training distribution. 3.3 Toward a NATO Evaluation Standard NATO already possesses the normative infrastructure to standardize how sensor data is captured, formatted, and exchanged. Its 2021 AI Strategy North Atlantic Treaty Organization (2021) commits member states to responsible AI development based on principles of governability, traceability, and reliability, but stops short of specifying certification mechanisms. What NATO lacks is an equivalent framework for certifying the algorithms that consume this data. Table 1 summarizes the current landscape. Table 1: NATO standardization landscape for AI-relevant capabilities. Sensor-layer standards are mature; algorithmic and autonomy layers remain under development. Study-stage STANAGs have not been ratified; objectives are drawn from the NATO Standardization Office DCRA Report NATO Standardization Office (n.d.a). Layer STANAG Purpose Status Sensor 4607 Ground Moving Target Indicator (GMTI) data transmission NATO Standardization Office (2010) Promulgated Sensor 4609 NATO Digital Motion Imagery (Full Motion Video (FMV) with Video Moving Target Indicator (VMTI) metadata) Promulgated Sensor 4676 Intelligence, Surveillance and Reconnaissance (ISR) tracking data and trajectory exchange Promulgated Sensor 4579 Battlefield Target Identification (electronic IFF) Promulgated Sensor 5527 Friendly Force Tracking interoperability Promulgated Algorithmic 5653 Core Data Framework (common metadata schemas) NATO Standardization Office (n.d.b) Study stage Algorithmic 5670 Federated Data Catalogue (decentralized metadata discovery) NATO Standardization Office (n.d.d) Study stage Algorithmic 5669 Neural network and deep learning model exchange NATO Standardization Office (n.d.c) Study stage Autonomy 4817 Multi-domain unmanned platform command and control Study stage STANAG 5669 is the most ambitious of the study-stage efforts: it targets the exchange of trained neural network models between nations independently of training-time software and hardware NATO Standardization Office (n.d.c). In principle, this would enable inference sharing, cross-domain fine-tuning, and multilateral model development. In practice, however, the exchange of trained military AI models faces a fundamental obstacle. Military AI systems are developed on top of national doctrine, encoding tactical assumptions, operational priorities, and decision heuristics specific to each nationâs armed forces. Sharing a trained model amounts to exposing that doctrine. An adversary with access to the model can reverse-engineer the decision logic it embodies and develop targeted countermeasures, for instance by training a system specifically designed to exploit the doctrinal patterns encoded in the weights. This concern, raised in discussions with Lieutenant-Colonel JĂŠrĂ´me Ranc at the Human Factors Air Operations Laboratory (Centre dâExpertise AĂŠrienne Militaire / Air Warfare Center), suggests that unrestricted model exchange between allies will remain impractical for the foreseeable future. What is both feasible and needed is a standardized evaluation protocol. We propose that NATO member states develop such a protocol, formalized as a STANAG. The protocol should be structured in two parts. The first, intended for states and evaluation authorities, specifies: ⢠Rules governing benchmark secrecy, including classification levels, access controls, and rotation schedules. ⢠Evaluation methodology: which metrics are measured, how thresholds are determined, and pass/fail criteria. ⢠Prerequisites for deployment authorization, including documentation, audit trails, and fallback mechanisms. ⢠Governance structures for independent auditing bodies. A critical design question concerns the transparency of evaluation criteria. If developers know exactly which metrics are used, they optimize for those metrics (Goodhartâs Law again). If metrics are entirely opaque, developers cannot adequately prepare. A middle path is available: the categories of metrics (robustness, calibration, latency) can be made public while the specific implementations, thresholds, and weighting schemes remain classified. This does not eliminate the Goodhart risk, but it channels optimization toward relevant properties rather than the idiosyncrasies of a known test suite. The second part, intended for developers, specifies: ⢠The category of the model and its intended operational use. ⢠The training dataset, or a statistical characterization sufficient to compute distributional properties. ⢠Compliance with a unified annotation standard per modality and task. Full dataset disclosure would enable auditors to detect distributional biases and spurious correlations, but training data often constitutes proprietary assets. A workable compromise requires developers to provide statistical summaries (class distributions, domain coverage, annotation quality metrics) sufficient for effective audit, complemented by periodic sample-level inspections under confidentiality agreements. Summary statistics have limited power to reveal certain bias classes; sample-level audits provide the necessary complement. Interoperability demands annotation standardization. The proliferation of labeling formats (Pascal VOC, COCO, custom schemas) creates friction and enables format-dependent inconsistencies. A STANAG for military AI should mandate a canonical annotation format per modality and task, with open-source conversion tools for legacy formats. Table 2 illustrates the breadth of modalities involved and their varying degrees of standardization maturity. Table 2: Modalities, representative tasks, structural annotations, and modality-specific metadata relevant to military AI evaluation. The standardization column reflects the availability of public benchmarks and shared annotation schemas. Cross-cutting metadata requirements (provenance, uncertainty, operational context, versioning) apply to all modalities and are discussed in the text.00footnotetext: Standardization maturity (Std.): â = established benchmarks and public annotation schemas; ââ = partial standardization or limited military-specific coverage; ââ = predominantly ad hoc or classified formats. Modality Representative Tasks Structural Annotations Modality-Specific Metadata Std. Imagery (EO/IR) Detection, classification, segmentation, tracking Bounding boxes, pixel masks, class labels, object IDs, occlusion flags Sensor type, Ground Sample Distance, altitude, weather, illumination â Video / FMV Activity recognition, target tracking, event detection Temporal segments, action labels, trajectory annotations Frame rate, compression, camera motion, stabilization ââ Radar / SAR Automatic target recognition, change detection, ship detection Target chips, detection masks, class labels Polarization, frequency band, incidence angle, range resolution ââ Geospatial Change detection, terrain classification, infrastructure mapping Geo-referenced polygons, temporal stamps, attribution labels Coordinate Reference System (CRS), spatial resolution, temporal coverage, collection geometry ââ 3D Object detection, scene reconstruction, ground segmentation 3D bounding boxes, point-wise class labels, mesh annotations Sensor origin (LiDAR, stereo, Structure from Motion (SfM)), point density, registration accuracy ââ Signals (SIGINT) Emitter classification, signal detection, protocol identification Time-frequency annotations, emitter IDs, protocol labels Center frequency, bandwidth, Signal-to-Noise Ratio (SNR), collection geometry ââ Text Entity extraction, relation extraction, event detection Span annotations, entity types, relation labels Source type, language, reliability rating, collection date â Audio Speaker ID, speech recognition, acoustic event detection Transcripts, speaker labels, temporal boundaries Sample rate, SNR, channel count, recording environment ââ Multi-modal Cross-modal fusion, joint entity resolution Cross-modal alignment, joint entity references, per-modality annotation layers Temporal synchronization, spatial co-registration, modality weighting ââ Beyond the modality-specific metadata catalogued in Table 2, a military annotation standard requires cross-cutting provisions: data provenance and chain of custody, uncertainty encoding (annotator confidence, inter-annotator agreement, ambiguity flags), operational context (scenario type, rules-of-engagement applicability), and versioning (schema identifiers, revision histories). The standard should include a governance mechanism for schema evolution so that the format remains current without sacrificing backward compatibility. 3.4 The Assistant Principle: Preserving Human Judgment If AI systems are to support rather than supplant human decision-making, the interface between operator and algorithm becomes a critical design surface. Normanâs concept of affordance Norman (1999) captures the core requirement: the systemâs perceptible properties should make its capabilities, limitations, and confidence immediately visible, so that the operatorâs mental model tracks the systemâs actual state. The central risk is miscalibrated trust. The interface should make uncertainty perceptually salient so that trust is continuously recalibrated by the display itself. Risko and Gilbert Risko and Gilbert (2016) frame this as selective cognitive offloading: the system absorbs computational burden (sensor fusion, pattern detection) while freeing attentional resources for judgment, without introducing competing demands. Where operational constraints permit, inherently transparent model classes (generalized additive models Lou et al. (2012), decision trees) should be preferred for high-stakes decisions. For deep models, post hoc explanations (saliency maps, SHAP values) provide diagnostic signals but do not guarantee faithful access to internal reasoning Lipton (2018). In our framework, post hoc explanations are treated as audit artifacts: they support traceability and review but do not by themselves confer legitimacy on a decision. These principles suggest a design philosophy we call the hybrid trajectory: rather than embedding ethics directly in the model, the goal is to combine procedural safeguards with internal technical guardrails and to expand machine autonomy incrementally as reliability is demonstrated under operational conditions. The trajectory rests on three mechanisms: 1. Calibrated uncertainty and abstention. The system estimates and communicates its confidence. Below a task-specific threshold, it abstains and defers to the operator. 2. Hard interlocks. Actions outside the authorized operational envelope (ROE11 1 Rules of Engagement violations, geographic exclusion zones) are made mechanically impossible, independently of software-level controls. 3. Progressive autonomy. The boundary between autonomous operation and human deferral is set conservatively at initial deployment and widened only when traceability records (3.1) demonstrate sustained reliability under operational conditions. Crucially, this expansion of autonomy always remains bounded by the hard interlocks defined in Point 2. The hybrid trajectory is not a fixed architecture but a temporal process: each expansion of machine autonomy is contingent on demonstrated reliability, and procedural safeguards define the permissible boundary at every stage. This logic directly motivates the tiered deployment framework developed next. 3.5 Tiered Deployment Thresholds Not all military AI systems warrant the same oversight. A tiered classification organized by increasing operational risk and decreasing reversibility determines the minimum procedural safeguards at each stage of development, certification, and fielding. This logic is consistent with the risk-based architecture of the EU AI Act European Parliament and Council of the European Union (2024), the OECD Recommendation on Artificial Intelligence OECD (2019), and the NIST AI Risk Management Framework National Institute of Standards and Technology (2023), the differentiated treatment of autonomous weapon systems in U.S. DoD Directive 3000.09 U.S. Department of Defense (2023), and the ICRC position that the acceptability of autonomy should be assessed relative to the nature and context of the task International Committee of the Red Cross (2021). Where the EU AI Act classifies by application domain, our tiering classifies by operational consequence and reversibility, reflecting the distinct risk structure of military operations. We formalize this classification along five measurable dimensions (Table 3): ⢠Lethality potential: whether the systemâs outputs can cause death directly, indirectly through downstream decisions, or not at all. ⢠Reversibility: whether a decision can be recalled or corrected after execution. ⢠Autonomy level: the degree of human involvement in the decision loop. ⢠Speed of effect: the temporal window available for human intervention. ⢠Scope of impact: the organizational and strategic breadth of consequences. Tier assignment is determined by the combination of these dimensions; escalation along any single dimension triggers reassessment under the re-certification procedure described below. Table 3: Formalized tier classification of military AI capabilities. Each tier is characterized by a profile across five measurable dimensions. Escalation on any single dimension may trigger reclassification.11footnotetext: Lethality: None = no causal path to harm; Indirect = outputs feed decisions that may cause harm; Direct = system can apply force.11footnotetext: Reversibility: Full = decision can be recalled without residual effect; Partial = correction possible but downstream consequences may persist; Irreversible = effects cannot be undone.11footnotetext: Autonomy: Advisory = human decides; Semi-autonomous = system acts, human approves or vetoes; Autonomous = system acts without per-action human approval.11footnotetext: Speed: Human-time = hours to days; Accelerated = seconds to minutes; Machine-speed = milliseconds.11footnotetext: Scope: Individual = single system or process; Unit = operational-unit-level consequences; Strategic = cross-domain or national-level consequences. Tier (capability) Lethality Reversibility Autonomy Speed of effect Scope 1: Predictive logistics None Full Advisory Human-time Individual 2: Medical / maintenance None Partial Advisory Human-time Individual 3: ISR / surveillance Indirect Partial Semi-autonomous Accelerated Unit 4: Target nomination Indirect Partial Semi-autonomous Accelerated Strategic 5: Cyber operations Indirect Irreversible Autonomous Machine-speed Strategic 6: Lethal engagement Direct Irreversible Autonomous Machine-speed Strategic At minimum, each tier should specify: ⢠Pre-deployment assurance: depth of independent testing (including adversarial and negative testing) and re-certification frequency. ⢠Authorization gates: who approves activation, at what command level, and whether stage-gated approvals are required. ⢠Fallback and containment: required fail-safe modes (safe stop, degraded operation, manual override) and technically enforced function blocks. ⢠Monitoring and traceability: minimum logging requirements, incident-reporting triggers, and conditions for automatic suspension. Lower tiers (1-2: logistics, medical support) require standard software-engineering assurance and domain-expert validation. At intermediate tiers (3-4: reconnaissance, command support), errors can directly affect situational awareness and may become irreversible once acted upon. These tiers call for independent verification and validation including structured red-teaming, command-level deployment authorization, exposure of confidence estimates to operators in accordance with 3.4, and technically guaranteed fallback to manual operation. Tier 5 covers autonomous cyber operations, whose effects propagate at machine speed Horowitz (2019), cross jurisdictional boundaries, and trigger cascading consequences difficult to anticipate. National-authority-level approval should be required. Technical containment must include hard scope limits (target lists, network boundaries, time windows) enforced at the code level. Continuous monitoring with automatic suspension triggers is essential given the latency between misfire and detection in cyberspace. Tier 6 concerns lethal autonomous weapon systems and raises a more fundamental question: whether a given capability should be deployed at all. The ICRC has called for new internationally agreed rules ensuring human control over the use of force, and has argued that autonomous weapons incapable of IHL compliance should be expressly prohibited International Committee of the Red Cross (2021). Within the present framework, Tier 6 does not function as authorization to deploy under sufficiently robust safeguards; it marks a threshold of political and legal deliberation. Even where all safeguards are satisfied, certain configurations may remain impermissible. A system that cannot reliably distinguish combatants from civilians, or that is intended for environments where such distinction is structurally unachievable, should not be deployed regardless of procedural compliance. Procedural governance defines necessary conditions; it does not establish sufficiency. A systemâs tier is not fixed at deployment. Operational experience, adversarial adaptation, and incremental upgrades can shift the risk profile. A reconnaissance AI at Tier 3 that acquires target-nomination features drifts toward Tier 4 or beyond; if this migration is not formally recognized, safeguards remain calibrated to a lower risk level. The framework must incorporate periodic re-assessment with mandatory re-certification whenever functional scope or operational context changes materially National Institute of Standards and Technology (2023); U.S. Department of Defense (2023). 3.6 From Dimension Profiles to Tiers: A Criticality Score Table 3 names six reference profiles, one per tier. A fielded system rarely matches one of them exactly: with three levels on each of five dimensions there are 35=2433^5=243 possible profiles, and the table names six. Tier assignment therefore needs a rule for the other 237237. We write x=(x1,âŚ,x5)x=(x_1,âŚ,x_5) for a profile, where each xdâ0,1,2x_dâ\0,1,2\ ranks the level of one dimension from least to most severe (for lethality, None =0=0, Indirect =1=1, Direct =2=2, and likewise for the others in the order of Table 3). We write A1,âŚ,A6A_1,âŚ,A_6 for the six reference profiles. Why not a weighted sum. The natural first idea is to weight each dimension and add: SâĄ(x)=âdwdâxdS(x)= _dw_d\,x_d, then cut the score into six intervals. Two elementary facts rule this out for Table 3. Proposition 1 (a weighted sum has no interactions). Under S, raising one dimension by one level changes the score by wdw_d, whatever the other four dimensions are. The cost of autonomy is the same for a system acting in milliseconds as for one acting over days; the cost of scope is the same whether or not the system is lethal. This follows immediately from the form of S: the four terms that do not change cancel. In Table 3 the step from Tier 5 to Tier 6 changes lethality alone, so wlethalityw_lethality is pinned to that single gap, in every context. Proposition 2 (a weighted sum cannot space the tiers evenly). The Tier 3 profile A3=(1,1,1,1,1)A_3=(1,1,1,1,1) is the exact midpoint of the Tier 1 profile A1=(0,0,0,0,0)A_1=(0,0,0,0,0) and the Tier 6 profile A6=(2,2,2,2,2)A_6=(2,2,2,2,2). Any weighted sum therefore scores it exactly halfway between Tiers 1 and 6, that is, at âtier 3.5â on an evenly spaced scale (Fig. 1), whereas the table places it at Tier 3. Formally, SâĄ(A3)=12â(SâĄ(A1)+SâĄ(A6))S(A_3)= 12 (S(A_1)+S(A_6) ) for every choice of weights. Consequently no weights make the six tiers equally spaced. Worse, the gap from Tier 2 to 3 equals the gap from Tier 3 to 4 plus the gap from Tier 5 to 6 plus wautonomy+wspeedw_autonomy+w_speed, so the largest gap between consecutive tiers is at least twice the smallest, with equality only when autonomy and speed carry zero weight. Tier 1Tier 2Tier 3Tier 4Tier 5Tier 6A1A_1(0,0,0,0,0)(0,0,0,0,0)A6A_6(2,2,2,2,2)(2,2,2,2,2)A3A_3(1,1,1,1,1)(1,1,1,1,1)midpoint of A1A_1 and A6A_6every weighted sum scores A3A_3 here, at âtier 3.5â;Table 3 places it at Tier 3 Figure 1: Why a weighted sum of the five ranks cannot reproduce Table 3 with evenly spaced tiers. The Tier 3 profile is the arithmetic midpoint of the Tier 1 and Tier 6 profiles, so any weighted sum places it halfway between them, between Tiers 3 and 4. Both facts concern the same restriction: a weighted sum of ranks treats the two steps of a dimension as equally costly and the five dimensions as independent. Neither is credible here. Going from Indirect to Direct lethality is not the same step as going from None to Indirect; and speed of effect matters because it shortens the window in which a human can intervene, which is only relevant if the system acts on its own. The score we adopt. We read a tier as a level of expected damage: how likely a wrong action is to take effect, times how bad it is, times how long it lasts. The five dimensions fall into three groups accordingly (Fig. 2): critâĄ(x)=Î âĄ(autonomy,speed)âpasses without vetoĂGâĄ(lethality,scope)âgravity of the actionĂRâĄ(reversibility)âpermanence of the harm.crit(x)= (autonomy,speed)_passes without vetoĂ G(lethality,scope)_gravity of the actionĂ R(reversibility)_permanence of the harm. (1) Î captures the veto window: a system that only advises leaves the decision, and hence the veto, to a human, whatever its speed; a system that acts on its own can still be stopped if its effects unfold over hours, but not if they unfold in milliseconds. G measures the gravity of the action itself, in which scope matters more when the action is lethal. R records whether the harm can be undone once it has occurred; reversibility is a property of the damage, not of the probability that a wrong action is taken. System profile x=(x1,âŚ,x5)x=(x_1,âŚ,x_5) Î passes without veto autonomy Ă speed of effect G gravity of the action lethality Ă scope R permanence of the harm reversibility Expected damage Î ĂGĂR Ă GĂ R Tier 11 to 66 log scale Figure 2: Structure of the criticality score. The five dimensions of Table 3 enter through three factors that multiply; the tier is read on a logarithmic scale, so that moving up one tier always means the same multiplicative increase in expected damage. Dimensions within a factor may reinforce each other; dimensions in different factors do not. This form has two consequences. First, within each factor the two dimensions can reinforce each other, which Proposition 1 said a weighted sum cannot do. Second, across factors the score multiplies, so that on the tier scale the three contributions add: the cost of a lethality step is the same whatever the autonomy level. What the factors are, and how a product becomes a sum. Î , G and R are small tables of declared values (Table 4). Moving up one tier always means multiplying expected damage by the same constant factor, call it β. A level that multiplies expected damage by β is therefore worth one tier, a level that multiplies it by β2β^2 is worth two, and in general a factor F is worth logβâĄF _βF tiers. We record every table entry in these units, so that g=logβâĄGg= _βG, Ď=logβâĄÎ Ď= _β and r=logβâĄRr= _βR. Counted in tiers, factors that multiply become numbers that add, as decibels turn ratios of power into sums. Taking logarithms of Eq. (1) gives scoreâ(x) (x)\; =logβâĄcritâĄ(x) =\; _βcrit(x) =gâĄ[lethality,scope]+ĎâĄ[autonomy,speed]+râĄ[reversibility], =\;g[lethality,scope]+Ď[autonomy,speed]+r[reversibility], (2) and the tier is one plus the nearest integer to the score. The numerical value of β never needs to be fixed: only tier units enter the tables and the rule. The six reference profiles of Table 3 score 0.000.00, 0.650.65, 2.322.32, 2.682.68, 3.993.99 and 5.345.34, and therefore fall in Tiers 1 to 6 as required. Raising any single dimension never lowers the score, so escalation on one dimension can only maintain or raise the tier, as the re-certification rule above assumes. Table 4: The three factors of the criticality score, expressed in tiers: an entry of 1.01.0 means that this level multiplies expected damage by the factor β separating two consecutive tiers, an entry of 2.02.0 by β2β^2, and so on. The tier of a profile is one plus the nearest integer to the sum of its three entries. Profiles combining Direct lethality with Full reversibility are treated as inadmissible: a system that can apply force cannot have fully recallable effects. g: gravity of the action Lethality \ Scope Individual Unit Strategic None 0.00 0.10 0.39 Indirect 0.75 1.03 1.39 Direct 2.10 2.38 2.74 Ď: the action passes without veto Autonomy \ Speed Human-time Accelerated Machine-speed Advisory 0.00 0.00 0.00 Semi-autonomous 0.30 0.64 0.96 Autonomous 0.60 0.95 1.30 r: permanence of the harm Reversibility Full Partial Irreversible 0.00 0.65 1.30 How the values were set. The entries of Table 4 were fitted to no data: they satisfy six constraints, each of which can be accepted or rejected on its own by an expert panel, and within what those constraints leave open they were chosen so that no admissible profile sits close to a tier boundary (the closest is a tenth of a tier away): 1. Veto window. The Advisory row of Ď is zero: if a human decides, the speed of effect is immaterial. Below that row, speed counts for more as autonomy grows, and conversely. 2. Gravity. In g, scope counts for more as lethality grows, and lethality for more as scope grows. 3. Admissibility. A system with Direct lethality cannot have Full reversibility; the 2727 such profiles are excluded, leaving 216216. 4. Fidelity to Table 3. Each reference profile falls inside its own tier band, at a safe distance from the edges, without being forced to the centre of the band. Forcing the centre would assert that the joint rise of four dimensions (Tier 2 to 3) is worth the rise of scope alone (Tier 3 to 4), a precision the table does not carry. 5. Lethality as a threshold. Moving from None to Direct lethality adds at least two tiers, at every scope. 6. No silent dimension. Every step on every dimension costs at least a tenth of a tier, the two steps of a dimension are within a factor of three of each other, and an autonomous system acting at machine speed sits at least 1.21.2 tiers above an advisory one. A panel should debate these six statements, not the sixteen free entries of Table 4. On one point Table 3 leaves them little room. It grants a single tier to the joint rise of reversibility, autonomy and speed to their maximum (Tier 4 to 5), but also a single tier to the rise of scope alone (Tier 3 to 4). Any score faithful to the table therefore weighs autonomy lightly relative to scope, and constraint 6 keeps irreversibility from disappearing in the trade-off. Accepting this, or revising the Tier 4 and Tier 5 reference profiles, is the panelâs decision. 3.7 Operational Precedents: Counterfactual Analysis The governance architecture proposed above is intended to be more than a normative exercise. To assess whether its mechanisms would make a practical difference, we apply the framework to eight documented cases spanning Tiers 3-6 and the period 1988-2025 (Table 5). For each governance component, we identify cases where its absence contributed to documented harm and examine what the framework would have required. Not all cases can be fully verified from public information; the analysis should be read as systematic counterfactual assessment. Counterfactual reasoning demonstrates that the frameworkâs mechanisms map onto documented failure classes, but it cannot establish that their presence would have prevented harm with certainty. Prospective evaluation through integration into certification procedures remains the necessary next step. These limitations acknowledged, the analysis serves a specific purpose: to show that each governance component addresses a failure mode that has occurred in practice, and that their combination defines a governance posture substantially more demanding than any currently in force. The evidential basis varies across cases. Some are documented through official investigations Fogarty (1988); Defense Science Board (2005); Department of Defense Inspector General (2022). Others rest on UN Panel of Experts reports United Nations Security Council (2021), defense analyses Sheridan (2024), or independent technical forensics Langner (2011). The Lavender and Gospel cases rely primarily on investigative journalism Abraham (2024); Human Rights Watch (2024b); Human Rights Watch (2024a) and have not been subject to official inquiry. We draw on them as the best available evidence while acknowledging that future disclosures may revise the factual record. Table 5 summarizes each case. Table 6 maps which framework dimensions were satisfied, absent, or partially met. Table 5: Summary of eight operational cases used for counterfactual framework analysis, ordered chronologically. Tier assignments follow the classification in Table 3. Case Year Tier System type Primary deficiency Documented consequence USS Vincennes 1988 6 Aegis-assisted engagement Interface design, trust miscalibration 290 civilians killed (Iran Air 655) Patriot friendly fire 2003 6 Autonomous air defense Automation bias, IFF failure 3 allied aircrew killed Stuxnet 2007-10 5 Autonomous cyber weapon No scope limits, no recall Spread to âź 115,000 systems worldwide Iron Dome 2011- 6 Defensive interception (Positive case) >>90% interception rate Project Maven 2017- 3â4 ISR, target nomination Contractor-state knowledge asymmetry Oversight deficiencies (DoD IG) Kargu-2 2020 6 Loitering munition Absence of all safeguards Autonomous engagement without oversight Gospel 2021- 4 Structural targeting Volume vs. review quality 12,000+ targets, review capacity overwhelmed Lavender 2023 5 Individual targeting Performative endorsement âź 3,700 est. misidentifications 3.7.1 Tiered deployment thresholds. The tiering framework requires that capabilities be classified by their risk profile and that migration across tiers trigger re-certification. Project Maven illustrates the consequences of unrecognized tier drift. Originally an ISR analysis tool (Tier 3), Maven evolved under Palantir into the Maven Smart System, which includes an AI Asset Tasking Recommender that proposes bomber and munition assignments to targets Marson (2024). By 2025, the contract ceiling exceeded $1.3 billion and the system had been adopted by NATO Allied Command Operations NATO Allied Command Operations (2025). This migration from Tier 3 to Tier 4 occurred without public evidence of formal re-assessment. The Kargu-2 represents the inverse failure: a Tier 6 capability (autonomous lethal engagement) deployed without any of the governance requirements that tier demands United Nations Security Council (2021). No political-level authorization, no IHL legal review, no geographic or target-class constraints enforced at the system level. Iron Dome provides the positive counterexample. Although it possesses Tier 6 capability (autonomous launch of interceptor missiles), the system operates within tightly constrained parameters: the target set is incoming projectiles, the decision criterion is ballistic impact-point prediction, and defended zones are politically authorized Sheridan (2024). Iron Dome demonstrates that Tier 6 governance requirements are compatible with effective autonomous operation when the operational envelope is well-defined. 3.7.2 Actionable accountability. The framework requires named accountability roles (System Owner, Operational Authorizer, Independent Evaluator) with separated responsibilities. Project Mavenâs first phase exposed what happens when these roles are absent. Google engineers who raised ethical concerns lacked formal channels to influence deployment decisions; DoD officials who authorized deployment lacked direct access to the underlying code or training data U.S. Department of Defense (2017); Department of Defense Inspector General (2022). Knowledge resided in the contractor, authority in the state, and no named role bridged the gap. This asymmetry illustrates why governance must be institutionalized above the level of individual contracts: when oversight depends on informal arrangements between parties with misaligned incentives, accountability becomes structurally impossible. 3.7.3 Traceability by default. Stuxnet, a sophisticated computer worm, operated without traceability of any kind. Once deployed, it propagated autonomously across networks, executed sabotage against Iranian centrifuges, and concealed its effects by replaying recorded sensor data to plant operators Langner (2011). No kill switch or recall mechanism was documented. Attribution required years of forensic analysis; accountability was effectively impossible in real time. The frameworkâs requirement for tamper-evident logs with sensor provenance would have made scope creep detectable. In the Kargu-2 case, no traceability of autonomous engagement decisions was available to UN investigators United Nations Security Council (2021). For Lavender, the reported absence of feature-level logging meant that the basis for individual targeting scores could not be reconstructed or challenged Abraham (2024). In each case, the inability to reconstruct the decision chain rendered post hoc accountability procedurally impossible. 3.7.4 Adversarial evaluation. The Patriot systemâs 2003 friendly-fire incidents illustrate the cost of inadequate operational testing. A Defense Science Board investigation found that the system was given âtoo much autonomyâ and that operators âtrusted the system in a naive mannerâ Defense Science Board (2005). The IFF subsystem misclassified friendly aircraft as hostile threats; negative testing (does the system correctly reject friendly aircraft under realistic confusion scenarios?) would have identified this failure mode before deployment. The USS Vincennes case prefigures the same concern at the interface level. The Aegis systemâs radar correctly tracked Iran Air Flight 655 as climbing in a civilian corridor, but the crew correlated a ground-based military IFF signal with the airborne contact Fogarty (1988). The system was never tested for this specific class of confusion. Adversarial evaluation under the proposed framework would require testing against precisely such scenarios: ambiguous IFF environments, overlapping military and civilian signatures, and high-stress time-critical conditions. 3.7.5 The assistant principle. Lavender exemplifies the failure of every requirement the assistant principle imposes. The system presented a name and a score without exposing the features driving the classification or any confidence interval. Human analysts reviewed each recommendation for approximately twenty seconds, a review that often consisted solely of verifying that the flagged individual was male Abraham (2024); Human Rights Watch (2024b). This is performative endorsement. Calibrated uncertainty and forced abstention below confidence thresholds would have flagged the systemâs reported ten-percent error rate, corresponding to approximately 3,700 misidentifications among 37,000 flagged individuals. The Gospel system, which generated over 12,000 structural targets during operations in Gaza Human Rights Watch (2024a); Meier (2024), illustrates the same dynamic at the level of infrastructure: when machine-generated target volume overwhelms human review capacity, oversight becomes nominal. The Vincennes tragedy shows that interface design failures predate modern AI. The Aegis system displayed raw data without highlighting the anomaly between the aircraftâs climbing trajectory and its putative hostile classification Fogarty (1988). Interface design that foregrounds uncertainty and anomalies, as the assistant principle requires, would have given the crew the perceptual salience needed to override. 3.7.6 Technical enforceability. Stuxnetâs propagation beyond its intended target to approximately 115,000 systems in multiple countries, including allied nations Langner (2011), is a concrete demonstration of what happens when hard scope limits are absent. The frameworkâs Tier 5 requirements (target lists, network boundaries, time windows enforced at the code level) are designed to contain precisely this class of failure. The Kargu-2 operated without geographic, temporal, or target-class constraints enforced at the system level United Nations Security Council (2021). Iron Dome again provides the positive case: its engagement criteria (ballistic trajectory prediction within defended zones) function as hard interlocks that bound the systemâs autonomous operation independently of software-level controls Sheridan (2024). Table 6: Cross-reference matrix: eight operational cases assessed against the six governance dimensions of the proposed framework. Every case involving documented harm exhibits deficiencies in at least two dimensions.11footnotetext: â = dimension satisfied or not applicable; â = partially satisfied or ambiguous; â = absent and absence contributed to documented harm; - = not applicable to this case. Case Tiering Account. Trace. Adv. eval. Assist. Enforce. USS Vincennes â â â â â â Patriot â â â â â â Stuxnet â â â â - â Iron Dome â â â â â â Project Maven â â â â â â Kargu-2 â â â â - â Gospel â â â â â â Lavender â â â â â â Table 6 reveals a consistent pattern: every case involving documented harm exhibits deficiencies in at least two governance dimensions. No single safeguard would have been sufficient in isolation. The presence or absence of a human operator is orthogonal to governance quality; Lavender placed a human in the loop, while Iron Dome removed one, yet the latter satisfies the frameworkâs requirements comprehensively. These are counterfactual analyses; the frameworkâs predictive power can only be tested through prospective application in certification procedures. That limitation is acknowledged. What the analysis does establish is that each governance mechanism independently addresses a documented class of failure, and that their combination defines a governance posture substantially more demanding than any currently in force. 4 Conclusion The governance of military AI is usually debated as a question of permission: what machines may be allowed to decide, and where the line of prohibition should fall. This paper has argued that a prior question determines whether any such line can be enforced. Systems whose reasoning cannot be inspected, whose evaluation can be gamed, and whose deployment disperses knowledge away from authority erode the conditions under which human judgment remains judgment at all. The presence of an operator guarantees nothing about the quality of oversight; what matters is whether that operator retains the temporal authority to intervene and the interpretive access to know when intervention is warranted. Taking this diagnosis seriously requires abandoning a tempting ambition. If ethical constraints cannot be reliably encoded in a loss function, they must be encoded in institutions: named roles that make responsibility attributable, evaluation regimes that resist optimization, deployment thresholds calibrated to irreversibility, and interfaces that keep uncertainty visible. This is the practical form of Crootofâs move from intent to procedural integrity. It does not answer the philosophical question of who bears moral responsibility for an algorithmic output, and it is not meant to. It substitutes a question that institutions can actually adjudicate: what process was followed, by whom, and did it meet a documented standard? The counterfactual analysis in Sect. 3.7 indicates that this substitution is not merely conceptual, since the failures it maps are procedural failures rather than failures of intention. The proposal has clear limits. The tiered classification is schematic, and operationalizing it would demand sustained negotiation among states with divergent legal traditions and procurement cultures; the history of defense standardization suggests such convergence is incremental at best. The hybrid trajectory presumes continued progress in interpretability and uncertainty quantification at a pace no one can guarantee. Most fundamentally, the framework addresses state military organizations operating within treaty regimes, and offers little purchase on non-state actors who recognize no such obligations. These limits mark the work that follows. Structured expert consultation, for instance through a Delphi process involving military legal advisers, operational commanders, and engineers, would test whether the tiering and the accountability roles survive contact with institutional practice. Section 2.5 points out where current rules stop. Rather than inventing new principles, this framework simply focuses on how to apply existing ones to the AI models and military contexts that are currently left out. And the interface principles of Sect. 3.4 invite direct empirical study: whether forced abstention and salient uncertainty measurably improve decision quality under time pressure is a behavioral question, and one the framework currently answers only by assertion. The deliberations of the UN Convention on Certain Conventional Weapons, now approaching a possible Review Conference, will test whether states are prepared to convert declaratory principles into binding operational constraints. Whatever form those constraints take, the assessment of whether a particular system, in a particular context, satisfies the demands of international humanitarian law will remain a human judgment. The task is to ensure that it is exercised with adequate knowledge and real authority, rather than performed after the fact by someone with neither. Declarations Funding No funding was received for conducting this study. Competing interests Authors A, B and D are employed by SAS Impact, which uses machine learning systems for defense applications. Author C declares no competing interests. The authors received no specific funding for this work. Data availability No datasets were generated or analyzed during the current study. All cases discussed are documented in publicly available sources cited in the reference list. References Abraham (2024) Y. Abraham âLavenderâ: the AI machine directing Israelâs bombing spree in Gaza. +972 Magazine. External Links: Link Cited by: §3.7.3, §3.7.5, §3.7. Amodei et al. (2016) D. Amodei, C. Olah, J. Steinhardt, P. F. Christiano, J. Schulman, and D. ManĂŠ Concrete problems in ai safety. ArXiv abs/1606.06565. Cited by: §2.2. Arkin (2009) R. C. Arkin Governing lethal behavior in autonomous robots. CRC Press, Boca Raton, FL. External Links: ISBN 978-1-4200-8594-8 Cited by: §3. Article 36 (2015) Article 36 Killing by machine: key issues for understanding meaningful human control. Note: https://w.stopkillerrobots.org/wp-content/uploads/2021/09/KILLING_BY_MACHINE_6.4.15.pdf Cited by: §2.3. Asaro (2012) P. Asaro On banning autonomous weapon systems: human rights, automation, and the dehumanization of lethal decision-making. International Review of the Red Cross 94 (886), p. 687â709. External Links: Document Cited by: §2.3. N. Bhuta, S. Beck, R. Geiss, H. Liu, and C. KreĂ (Eds.) (2016) N. Bhuta, S. Beck, R. Geiss, H. Liu, and C. KreĂ (Eds.) Autonomous weapons systems: law, ethics, policy. Cambridge University Press, Cambridge. External Links: Document Cited by: §1, §2.4. Boulanin et al. (2020) V. Boulanin, L. Bruun, and N. Goussac Autonomous weapon systems and international humanitarian law: identifying limits and the required type and degree of humanâmachine interaction. SIPRI Report Stockholm International Peace Research Institute (SIPRI), Stockholm, Sweden. Note: Published by SIPRI. External Links: Link Cited by: §1, §2.4. Bove et al. (2024) C. Bove, T. Laugel, M. Lesot, C. Tijus, and M. Detyniecki Why do explanations fail? a typology and discussion on failures in xai. Cited by: §1, §2.1. Brown et al. (2018) T. B. Brown, D. ManĂŠ, A. Roy, M. Abadi, and J. Gilmer Adversarial patch. External Links: 1712.09665, Link Cited by: §2.1, §3.2. Buçinca et al. (2020) Z. Buçinca, P. Lin, K. Z. Gajos, and E. L. Glassman Proxy tasks and subjective measures can be misleading in evaluating explainable ai systems. In Proceedings of the 25th International Conference on Intelligent User Interfaces, IUI â20, New York, NY, USA, p. 454â464. External Links: ISBN 9781450371186, Document Cited by: §2.1. Burrell (2016) J. Burrell How the machine âthinksâ: understanding opacity in machine learning algorithms. Big Data & Society 3 (1), p. 2053951715622512. External Links: Document Cited by: §1, §2.1. Carlini and Wagner (2017) N. Carlini and D. Wagner Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), p. 39â57. External Links: Document Cited by: §2.1, §3.2. Crootof (2022) R. Crootof War torts. New York University Law Review 97 (4). Cited by: §2.4. Cummings (2004) M. L. Cummings Automation bias in intelligent time critical decision support systems. In AIAA 1st Intelligent Systems Technical Conference, p. 557â562. External Links: Document Cited by: §2.2. Defense Science Board (2005) Defense Science Board Report of the defense science board task force on patriot system performance. Technical report Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics. Note: Report No. ADA435837 Cited by: §3.7.4, §3.7. Department of Defense Inspector General (2022) Department of Defense Inspector General Evaluation of Contract Monitoring and Management for Project Maven. Technical report Department of Defense. External Links: Link Cited by: §2.2, §3.7.2, §3.7. European Parliament and Council of the European Union (2024) European Parliament and Council of the European Union Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Note: Official Journal of the European Union, L 2024/1689 External Links: Link Cited by: §2.5, §2.5, §3.5. Eykholt et al. (2018) K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song Robust physical-world attacks on deep learning visual classification. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Vol. , p. 1625â1634. External Links: Document Cited by: §2.1, §3.2. Fischer and Ravizza (1998) J. M. Fischer and M. Ravizza Responsibility and control: a theory of moral responsibility. Cambridge University Press, New York. Cited by: §2.3. Floridi and Sanders (2004) L. Floridi and J. W. Sanders On the morality of artificial agents. Minds Mach. (Dordr.) 14 (3), p. 349â379. Cited by: §2.3. Fogarty (1988) W. M. Fogarty Formal investigation into the circumstances surrounding the downing of Iran Air flight 655 on 3 July 1988. Technical report United States Department of Defense. Note: Declassified 1993 Cited by: §3.7.4, §3.7.5, §3.7. Future of Life Institute (2015) Future of Life Institute Autonomous weapons: an open letter from AI & robotics researchers. Note: Open letter presented at IJCAI 2015, Buenos Aires External Links: Link Cited by: §1. Goddard et al. (2012) K. Goddard, A. Roudsari, and J. C. Wyatt Automation bias: a systematic review of frequency, effect mediators, and mitigators. J. Am. Med. Inform. Assoc. 19 (1), p. 121â127 (en). Cited by: §1, §2.2, §2.3. Goodhart (1975) C. A. E. Goodhart Problems of monetary management: the U.K. experience. In Papers in Monetary Economics, Cited by: §3.2. Hendrycks and Dietterich (2019) D. Hendrycks and T. Dietterich Benchmarking neural network robustness to common corruptions and perturbations. In Proceedings of the International Conference on Learning Representations (ICLR), Cited by: §2.1, §3.2. Heyns (2013) C. Heyns Report of the special rapporteur on extrajudicial, summary or arbitrary executions. Technical report Technical Report A/HRC/23/47, Report of the Special Rapporteur on Extrajudicial, Summary or Arbitrary Executions, United Nations Human Rights Council, Geneva (en). Note: Submitted pursuant to Human Rights Council resolution 17/5, focuses on lethal autonomous robotics and the protection of life. 22 p. External Links: Link Cited by: §1, §2.4. Horowitz (2019) M. C. Horowitz When speed kills: lethal autonomous weapon systems, deterrence and stability. Journal of Strategic Studies 42 (6), p. 764â788. External Links: Document Cited by: §1, §3.5. Human Rights Watch (2024a) Human Rights Watch Gaza: Israeli militaryâs digital tools risk civilian harm. External Links: Link Cited by: §3.7.5, §3.7. Human Rights Watch (2024b) Human Rights Watch Questions and answers: Israeli militaryâs use of digital tools in Gaza. Note: Human Rights Watch External Links: Link Cited by: §3.7.5, §3.7. International Committee of the Red Cross (2021) International Committee of the Red Cross ICRC position on autonomous weapon systems. Technical report International Committee of the Red Cross, Geneva. External Links: Link Cited by: §2.5, §2.5, §3.5, §3.5. Jobin et al. (2019) A. Jobin, M. Ienca, and E. Vayena The global landscape of AI ethics guidelines. Nature Machine Intelligence 1 (9), p. 389â399. External Links: Document Cited by: §2.4, §3. Jordan et al. (2024) K. Jordan, Y. Jin, V. Boza, Y. Jiacheng, F. Cesista, L. Newhouse, and J. Bernstein Muon: an optimizer for hidden layers in neural networks. External Links: Link Cited by: §3.2. Kurita et al. (2020) K. Kurita, P. Michel, and G. Neubig Weight poisoning attacks on pre-trained models. External Links: 2004.06660, Link Cited by: §2.2. Langner (2011) R. Langner Stuxnet: dissecting a cyberwarfare weapon. IEEE Security & Privacy 9 (3), p. 49â51. External Links: Document Cited by: §3.7.3, §3.7.6, §3.7. Lee and See (2004) J. D. Lee and K. A. See Trust in automation: designing for appropriate reliance. Human factors 46 (1), p. 50â80. Cited by: §2.2. Li et al. (2021) L. Li, D. Song, X. Li, J. Zeng, R. Ma, and X. Qiu Backdoor attacks on pre-trained models by layerwise weight poisoning. External Links: 2108.13888, Link Cited by: §2.2. Lipton (2018) Z. C. Lipton The mythos of model interpretability. Commun. ACM 61 (10), p. 36â43 (en). Cited by: §1, §2.1, §3.4. Liu (2012) H. Liu Categorization and legality of autonomous and remote weapons systems. Int. Rev. Red Cross 94 (886), p. 627â652 (en). Cited by: §2.4. Lou et al. (2012) Y. Lou, R. Caruana, and J. Gehrke Intelligible models for classification and regression. In Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD â12, New York, NY, USA, p. 150â158. External Links: ISBN 9781450314626, Document Cited by: §3.4. Lundberg and Lee (2017) S. M. Lundberg and S. Lee A unified approach to interpreting model predictions. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPSâ17, Red Hook, NY, USA, p. 4768â4777. External Links: ISBN 9781510860964 Cited by: §2.1. Lyell and Coiera (2017) D. Lyell and E. Coiera Automation bias and verification complexity: a systematic review. J. Am. Med. Inform. Assoc. 24 (2), p. 423â431 (en). Cited by: §1, §2.3. Madry et al. (2018) A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu Towards deep learning models resistant to adversarial attacks. In Proceedings of the International Conference on Learning Representations (ICLR), Cited by: §2.1, §3.2. Marson (2024) J. Marson Palantir lands $480M Army contract for Maven artificial intelligence tech. External Links: Link Cited by: §3.7.1. Matthias (2004) A. Matthias The responsibility gap: ascribing responsibility for the actions of learning automata. Ethics and Information Technology 6 (3), p. 175â183. External Links: Document Cited by: §1, §2.3. Meier (2024) M. W. Meier The gospel, lavender, and the law of armed conflict. Lieber Institute, West Point. External Links: Link Cited by: §3.7.5. National Institute of Standards and Technology (2023) National Institute of Standards and Technology Artificial intelligence risk management framework (AI RMF 1.0). Technical report Technical Report NIST AI 100-1, U.S. Department of Commerce, Gaithersburg, MD. External Links: Document Cited by: §2.5, §2.5, §3.5, §3.5. NATO Allied Command Operations (2025) NATO Allied Command Operations NATO acquires AI-enabled warfighting system. External Links: Link Cited by: §3.7.1. NATO Standardization Office (2010) NATO Standardization Office STANAG 4607 â NATO ground moving target indicator format. Technical report NATO Standardization Office. Note: Promulgated External Links: Link Cited by: Table 1. NATO Standardization Office (n.d.a) NATO Standardization Office DCRA report â defence capability requirements archive. Note: NATO HQ C3 Staff External Links: Link Cited by: Table 1. NATO Standardization Office (n.d.b) NATO Standardization Office STANAG 5653 â NATO core data framework (NCDF). NATO Standardization Office. Note: Study stage External Links: Link Cited by: Table 1. NATO Standardization Office (n.d.c) NATO Standardization Office STANAG 5669 â ADatP-5669: standardization task for exchanging trained machine learning models. NATO Standardization Office. Note: Study stage External Links: Link Cited by: §3.3, Table 1. NATO Standardization Office (n.d.d) NATO Standardization Office STANAG 5670 â federated data catalogue. NATO Standardization Office. Note: Study stage External Links: Link Cited by: Table 1. Nissenbaum (1996) H. Nissenbaum Accountability in a computerized society. Science and Engineering Ethics 2 (1), p. 25â42. External Links: Document Cited by: §1, §2.3. Norman (1999) D. A. Norman Affordance, conventions, and design. interactions 6 (3), p. 38â43. Cited by: §2.2, §3.4. North Atlantic Treaty Organization (2021) North Atlantic Treaty Organization Summary of the NATO artificial intelligence strategy. Note: NATO Official Texts External Links: Link Cited by: §2.5, §2.5, §3.3. OECD (2019) OECD Recommendation of the council on artificial intelligence. Note: OECD/LEGAL/0449 External Links: Link Cited by: §3.5. Parasuraman and Riley (1997) R. Parasuraman and V. Riley Humans and automation: use, misuse, disuse, abuse. Human factors 39 (2), p. 230â253. Cited by: §2.2. Raji and Dobbe (2023) I. D. Raji and R. Dobbe Concrete problems in AI safety, revisited. ArXiv. External Links: 2401.10899 Cited by: §2.2. Recht et al. (2019) B. Recht, R. Roelofs, L. Schmidt, and V. Shankar Do ImageNet classifiers generalize to ImageNet?. In Proceedings of the 36th International Conference on Machine Learning (ICML), Vol. 97, p. 5389â5400. Cited by: §3.2. Ribeiro et al. (2016) M. T. Ribeiro, S. Singh, and C. Guestrin âWhy should i trust you?â: explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD â16, New York, NY, USA, p. 1135â1144. External Links: ISBN 9781450342322, Document Cited by: §2.1. Risko and Gilbert (2016) E. F. Risko and S. J. Gilbert Cognitive offloading. Trends in cognitive sciences 20 (9), p. 676â688. Cited by: §2.2, §3.4. Roff (2014) H. M. Roff The strategic robot problem: lethal autonomous weapons in war. Journal of Military Ethics 13 (3), p. 211â227. External Links: Document Cited by: §2.4. Russell (2019) S. Russell Human compatible: artificial intelligence and the problem of control. Viking. External Links: ISBN 978-0525558613 Cited by: §2.2. Santoni de Sio and van den Hoven (2018) F. Santoni de Sio and J. van den Hoven Meaningful human control over autonomous systems: a philosophical account. Front. Robot. AI 5, p. 15 (en). Cited by: §2.3. Scharre (2018) P. Scharre Army of none: autonomous weapons and the future of war. W.W. Norton & Company, New York. External Links: ISBN 978-0-393-60898-4 Cited by: §1. Selvaraju et al. (2017) R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra Grad-CAM: visual explanations from deep networks via gradient-based localization. In 2017 IEEE International Conference on Computer Vision (ICCV)2017 IEEE International Conference on Computer Vision (ICCV), Cited by: §2.1. Sharkey (2008) N. Sharkey Grounds for discrimination: autonomous robot weapons. RUSI Defence Systems, p. 86â89. Cited by: §1, §2.4. Sheridan (2024) J. Sheridan Iron dome shows AIâs risks and rewards. Center for European Policy Analysis (CEPA). External Links: Link Cited by: §3.7.1, §3.7.6, §3.7. Sparrow (2007) R. Sparrow Killer robots. Journal of Applied Philosophy 24 (1), p. 62â77. External Links: Document Cited by: §1, §2.3. Strathern (1997) M. Strathern âImproving ratingsâ: audit in the British University system. European Review 5 (3), p. 305â321. External Links: Document Cited by: §3.2. Strauch (2017) B. Strauch The automation-by-expertise-by-training interaction. Hum. Factors 59 (2), p. 204â228 (en). Cited by: §2.3. U.S. Department of Defense (2017) U.S. Department of Defense Establishment of Algorithmic Warfare Cross-Functional Team (âProject Mavenâ). Technical report Deputy Secretary of Defense. Note: Memo published April 26, 2017. External Links: Link Cited by: §2.2, §3.7.2. U.S. Department of Defense (2023) U.S. Department of Defense DoD directive 3000.09, autonomy in weapon systems. Technical report U.S. Department of Defense. Cited by: §2.5, §2.5, §3.5, §3.5. United Nations Security Council (2021) United Nations Security Council Letter dated 8 march 2021 from the panel of experts on Libya established pursuant to resolution 1973 (2011). Technical report Technical Report S/2021/229, United Nations Security Council. External Links: Link Cited by: §3.7.1, §3.7.3, §3.7.6, §3.7. van Zyl et al. (2024) C. van Zyl, X. Ye, and R. Naidoo Harnessing explainable artificial intelligence for feature selection in time series energy forecasting: a comparative analysis of Grad-CAM and SHAP. Appl. Energy 353 (122079), p. 122079 (en). Cited by: §2.1. Wen et al. (2025) K. Wen, D. Hall, T. Ma, and P. Liang Fantastic pretraining optimizers and where to find them. External Links: 2509.02046, Link Cited by: §3.2. Yang et al. (2023) W. Yang, Y. Wei, H. Wei, Y. Chen, G. Huang, X. Li, R. Li, N. Yao, X. Wang, X. Gu, M. B. Amin, and B. Kang Survey on explainable AI: from approaches, limitations and applications aspects. Hum-Cent Intell Syst 3 (3), p. 161â188 (en). Cited by: §1, §2.1.