In computer science, a monoculture is a community of computers that all run identical software. All the computer systems in the community thus have the same vulnerabilities, and, like agricultural monocultures, are subject to catastrophic failure in the event of a successful attack.[1]
With the global trend of increased usage and reliance on computerized systems, some vendors supply solutions that are used throughout the industry (such as Microsoft Windows) - this forms algorithmic monocultures. Monocultures form naturally since they utilize economies of scale, it is cheaper to manufacture and distribute a single solution. Furthermore, by being used by a large community bugs are discovered relativity fast.
Like agricultural monocultures, algorithmic monocultures are not diverse, thus susceptible to correlated failures - a failure of many parts participating in the monoculture. In complete non-monocultures, where the outcome of all components are mutually independent thus un-correlated, the chance of catastrophic event (failure of all the parts in the monoculture) is the multiplication of each component failure probability (exponentially decreasing).
On the other end, perfect monocultures are completely correlated, thus have a single point of failure. This means that the chance of a catastrophic event is constant - the failure probably of the single component.
Since operating systems are used in almost every workstation they form monocultures. For example Dan Geer has argued that Microsoft is a monoculture, since a majority of the overall number of workstations connected to the Internet are running versions of the Microsoft Windows operating system, many of which are vulnerable to the same attacks.
Large monocultures can also arise from software libraries, for example the Log4Shell exploit in the popular Log4j library estimated to affect hundreds of millions of devices.[2]
The concept is significant when discussing computer security and viruses, the main threat is exposure to security vulnerabilities. Since monocultures are not diverse, any vulnerability found exists in all the individual members of the monoculture increasing the risk of exploitation.[3] An example to that is exploit Wednesday in which after Windows security patches are released there is an increase exploitation events on not updated machines.
Clifford Stoll wrote in 1989 after dealing with the Morris worm:[4]
Another main concern is increased spread of algorithmic bias. In the light of increased usage of machine learning there is a growing awareness of the biases introduced by algorithms. The nature of monocultures exacerbate this problem since it makes the bias systemic and spreading unfair decisions.
Monocultures may lead to Braess's like paradoxes in which introducing a "better option" (such as a more accurate algorithm) leads to suboptimal monocultural convergence - a monoculture whose correlated nature results in degraded overall quality of the decisions. Since monocultures form in areas of high-stakes decisions such as credit scoring and automated hiring, it is important to achieve optimal decision making.
This scenario can be studied through the lens of mechanism design, in which agents are choosing between a set of algorithms, some of which return correlated outputs. The overall impact of the decision making is measured by social welfare.
This section demonstrates the concern of suboptimal monoculture convergence using automated hiring as a case study. Hiring is the process of ranking a group of candidates and hiring the top-valued. In recent years automated hiring (automatically ranking candidates based on their interaction with an AI powered system) became popular.
As shown by Kleinberg,[5] under some assumptions, suboptimal automated hiring monocultures naturally form, namely, choosing the correlated algorithm is a dominant strategy, thus converging to monoculture that leads suboptimal social welfare.
In this scenario we will consider two firms and a group
S
n
xi
The ranking algorithm
l{F}\theta
S
\theta>0
In order for
l{F}\theta
\pi
\theta
\pi*
\lim\theta\toinfinPr[\pi*]=1
\theta
S
These conditions state that a firm should always prefer higher values of
\theta
Both the algorithmic and human ranking methods are of the form of
l{F}\theta
\thetaA,\thetaH
| l{F} | |
| \thetaH |
For
s1,s2\in\{A,H\}
| W | |
| s1,s2 |
The Braess's like paradox in this framework is suboptimal monocultures converges. That is, using the algorithmic ranking is dominant strategy thus converging toward monoculture yet it yields suboptimal welfare
WA,A<WH,H
The main theorem proved by Kleinberg of this model is that for any
\thetaH
l{F}\theta
\theta>0
\pi,\sigma\siml{F}\theta
E[\pi1-\pi2|\pi1\ne\sigma1]>0
\theta1>\theta2,\sigma\sim
| l{F} | |
| \theta1 |
and \pi,\tau\sim
| l{F} | |
| \theta2 |
:
| (-\sigma1) | |
| E[\pi | |
| 1 |
]<
| (-\tau1) | |
| E[\pi | |
| 1 |
]
there exists a
\thetaA>\thetaH
The implications of this theorem is that under these conditions, firms will choose to use the algorithmic ranking even though that the correlated nature of algorithmic monocultures degrades total social welfare. Even though algorithmic rankings are more accurate.
The first condition on
l{F}\theta
The intuition behind preference for weaker competition is that when a candidate is removed (hired by a different firm), the best remaining candidate is better in expectation when the removed candidate is chosen based on a less accurate ranking. Thus, a firm should always prefer that its competitors would be less accurate.
These conditions are met for
l{F}\theta
. Stoll, Clifford. The Cuckoo's Egg. Doubleday. 1989. 978-0-307-81942-0. 320–321. registration. Clifford Stoll.