Bow-tie analysis

Definitionp. 36

Bow-tie analysis is a method to assess the utility of implemented controls against a particular risk event. It involves centering the unwanted risk event within a diagram. On the left, the factors that can cause the event are listed, followed by the controls that will prevent or minimize the likelihood of the event. On the right, the event is assumed to happen, and the potential effects and the relevant post-hoc controls that could minimize their impact are listed [107].

Additional Information

For example, given a hazard where an AI model has the capability of generating potentially harmful outputs, a risk event may be an AI providing information on how to create dangerous bioweapons. The risk factors could include the use of dangerous data for training as well as a lack of fine-tuning prior to deployment. The risk effects may include creation and use of bioweapons using the AI generated information. Once these risk factors and risk effects are in place, both preventive controls and post-hoc controls can be planned, such as appropriate filtering of training data and rigorous red teaming prior to model deployment as preventive barriers, as well as know-your-customer policies and model output censoring techniques as reactive barriers.

Part of