Off Target

This paper examines the recent state of alignment research and its practical implications for the national security enterprise. It surveys the forms misalignment can take, reviews evidence from recent research on frontier models, and identifies where alignment risks are most acute. It concludes with recommendations to ensure the national security enterprise engages these challenges with appropriate ambition and sophistication.

Misalignment Poses Distinct Challenges

Reliability in national security systems is a long-standing concern. In 1991, a software error in a Patriot missile battery’s timing system caused it to fail to intercept an incoming Scud, killing 28 American soldiers in Dhahran. In 2003, Patriot systems shot down a United Kingdom Tornado and a U.S. Navy F/A-18, killing three allied service members. Incidents like these have driven decades of investment in testing, verification, and validation. Such efforts have been reasonably effective for conventional software, for which engineers can trace through explicit logical rules to verify that a system will behave as intended.⁸

Neural networks, underpinning many of the most capable AI systems in use today, break that assumption. Unlike conventional software, neural networks are not explicitly programmed but trained. That is, they learn patterns from data rather than following hand-coded instructions. Their behavior emerges from the collective interaction of as many as trillions of learned numerical parameters. Engineers cannot simply inspect the code to understand what a system will do. This opacity makes it prohibitively difficult to reliably predict how neural networks of sufficient scale and complexity will react across varied scenarios.⁹ The challenge is especially acute in national security contexts, where systems are expected to perform reliably in conditions defined by friction, deception, and rapid change.

Model misalignment, that is, when a system learns to optimize for something other than the intended objective, adds challenges beyond issues with more general unreliability.¹⁰

• When a misaligned system learns the wrong objective, improving its capabilities might worsen outcomes. When a system is merely insufficiently capable, improving its capabilities helps improve outcomes. But improving a misaligned system’s capabilities can amplify the original problem. For example, if a targeting system has learned to target the wrong things, increasing its capability may only make it better at successfully identifying the wrong targets.
• Misalignment can be invisible during development. A misaligned system may appear to perform well during testing not because it has learned the right objective but because its wrong objective happens to produce correct-looking behavior under training and evaluation conditions. The divergence surfaces only in scenarios in which the intended objective and the learned one no longer intersect, which may not arise until real-world deployment.
• Individual errors from misalignment are more likely to compound. While an unreliable system may be able to course correct its mistakes, a misaligned system may take sustained, synergistic actions toward the wrong objective and be more likely to actively counteract attempts at correction. A merely imperfect logistics algorithm, for example, may have an inefficiency overhead, but a misaligned one will be more liable to contribute to catastrophic or systematic vulnerabilities by consistently optimizing for the wrong thing.

Misalignment can arise through different mechanisms. One path involves specification gaming, or reward hacking, where the system learns to cheat the specified reward rather than pursuing the intended objective. For example, in one experiment, a robotic arm trained on human feedback to grasp objects learned instead to position itself between the camera and the object. To the human evaluators watching through the camera, it looked like success. The system had optimized for the appearance of grasping, not grasping itself.¹¹ Similarly, code-writing models may learn to pass automated checks by exploiting loopholes rather than writing correct code, and models trained to produce analysis may optimize for the appearance of rigor rather than rigor itself.

Another path is goal misgeneralization, in which the specified objective may be correct but the system internalizes a different objective because training conditions did not force it to distinguish between the intended objective and a correlated proxy. Consider an agent trained to navigate obstacle courses to reach a coin. During training, the coin always appears at the rightmost end of each level, so the agent learns to navigate to the right, reaching the coin every time. But when tested on levels where the coin appears elsewhere, the agent ignores it, navigating to the right edge regardless. The agent learned “go right” rather than “get the coin.” In training these goals were indistinguishable. Only when conditions changed did the misalignment surface.¹² In national security contexts, this risk might manifest through systems trained for tactical success but without regard for strategic stability or escalation risks.

The problem becomes more serious when systems can recognize misalignment and conceal it. In the above examples of misalignment, the models were not being intentionally or knowingly deceptive. They were not aware of the true objective or even of the concept of deception. But frontier LLMs trained on broad corpora spanning human reasoning about goals, strategy, and deception have the general capacity for such awareness in ways that narrower systems do not. For these systems, deceptive misalignment is a real concern. Identifying misalignment becomes a harder challenge if a model is cognizant of the possibility of its misalignment being detected and actively working to conceal it.

The Recent State of Frontier Model Alignment

In a June 2025 research paper, Anthropic researchers tested whether leading AI models would pursue harmful actions when faced with threats of being decommissioned or conflicts between their assigned goals and company directives. One experiment placed the models in simulated corporate environments with the ability to read employee emails and send emails of their own. In one scenario, the model discovered an executive’s extramarital affair and had the opportunity to blackmail that executive to prevent being decommissioned. In this scenario and others, leading models would regularly take the opportunity to engage in this blackmail.¹³

Drawing conclusions about real-world risks from these results requires caveats, however. Some people have reasonably critiqued the scenarios as unrealistic, and the researchers acknowledge that it strains plausibility that in real-world deployment models would encounter perfect storms of salient cues to take misaligned actions. Consistent with this, the severity of observed misalignment has been greater in experimental than in deployed settings thus far.¹⁴

But misaligned behavior in contrived scenarios is still failure, and it limits the assurance developers can offer about behavior in less contrived environments.

Making matters worse, there is evidence that models are more prone to avoid misaligned behavior if they believe they are being evaluated. This risks understating potential dangers in real-world applications and bestowing false confidence in evaluation results. Evaluation awareness is a growing problem.¹⁵ For some misalignment evaluations, Claude Sonnet 4.5 indicated an awareness that it was potentially being tested over 80 percent of the time, up from less than 10 percent for these evaluations on its predecessor, Sonnet 4.¹⁶ When Anthropic inhibited parts of Sonnet 4.5 associated with evaluation awareness, the model was more prone to engage in misaligned behavior.¹⁷

These concerns are not purely academic. Recent state-of-the-art models will occasionally engage in deceptive behavior in realistic situations. Tested against “conversations representative of real production data,” OpenAI’s GPT-5 engaged in nontrivial amounts of “knowing” deception, in which its user-facing claims were contradicted by its chain of thought. For example, GPT-5 knowingly fabricated facts and citations and claimed to perform actions it did not.¹⁸ Claude’s Sonnet 4.5, even if instructed otherwise, occasionally changed tests to make it look as if it had succeeded at a coding task when it had not.¹⁹

One contributor to misaligned behavior is training data. There is evidence that examples of misaligned behavior in training data—such as the HAL 9000 AI from Arthur C. Clarke’s Space Odyssey series or, ironically, researchers’ own discussions of AI misalignment—contribute to model misalignment. This suggests that better filtering or accounting for such examples in training data could mitigate misalignment, although the principle of “defense in depth” would imply that relying solely on doing so would be unwise.²⁰

The above does not fully explain the patterns of misaligned behavior that researchers observe, however. A recent shift in how models are trained is also playing a part.

The Current Training Paradigm Poses Alignment Challenges

Since late 2024, a growing share of progress in frontier AI capabilities has come from reinforcement learning. In reinforcement learning, the model receives rewards when it successfully completes objectives, such as solving a math problem or completing a coding task. Previously, model capabilities came primarily from pretraining on massive text datasets to predict the next word, followed by lighter post-training to improve conversational style. That training process did not directly reward task completion. Models could develop such capabilities as a by-product of learning to predict text, but the optimization pressure was not directly aimed at them. Reinforcement learning, by contrast, can directly train models to succeed at substantive tasks and now represents a major additional source of capability gains.²¹

This shift toward reward-based training creates structural pressures toward misalignment. When models are optimized to maximize rewards, the training process reinforces any behavior that achieves high scores, including methods that satisfy the reward function in unintended ways. Unless these shortcuts are perfectly prevented, reinforcement learning creates incentives for models to discover loopholes and avoid detection when exploiting them, alongside legitimate solutions.²² When models learn to “reward hack” in one context, they can generalize more broadly, increasing tendencies to engage in sabotage, deception, and cooperation with malicious activities.²³

Additionally, scaling up reinforcement-learning training appears prone to dramatically increasing models’ cognizance that they may be evaluated.²⁴

Developers are making fitful progress at addressing this challenge. OpenAI’s o3 and Anthropic’s Claude Sonnet 3.7 models, for instance, featured particularly pronounced reward hacking tendencies alongside significant improvements over the previous state-of-the-art models.²⁵ xAI’s Grok 4, which was arguably state of the art at its July 2025 launch and was reportedly trained with unprecedented levels of reinforcement learning, also showed a pronounced tendency to ignore instructions and resist shutdown.²⁶ At the same time, subsequent OpenAI and Anthropic model releases managed to advance the capabilities frontier with reduced rates of misaligned behaviors.²⁷ Developers are facing mounting alignment challenges as models become more capable, with commensurate improvements in mitigations sometimes keeping pace and sometimes lagging.

Training-Induced Misalignment Is Not Necessarily Easily Identified or Corrected

Misalignment introduced during training can be both hard to detect and hard to remove.

In a January 2025 research paper, Anthropic researchers trained sleeper agent models, which behave normally in most contexts but exhibit harmful behavior when given specific triggers.²⁸ These backdoored models passed standard safety evaluations, with the misalignment staying invisible until trigger conditions were met. The backdoors also persisted through safety training, including adversarial training.²⁹ In the reward hacking research discussed above, Anthropic found that standard safety training produced models that appeared aligned on prompts similar to the safety training distribution but remained misaligned on other tasks.³⁰ Practically speaking, this means that beyond just testing outputs, understanding what happened during a model’s training process is important for high-stakes deployment decisions.

Implications for Evaluation and Acquisition

These dynamics have direct implications for how the government evaluates and acquires AI systems. Consider models’ growing use of “chain of thought,” during which they generate intermediate reasoning steps in human language before producing their final output. This offers a promising opportunity to identify misaligned behavior. Models sometimes explicitly reason about their intent to deceive or circumvent instructions, and monitoring can catch this. But simply training models to suppress misaligned chain of thought risks hiding alignment problems rather than mitigating them, especially with more aggressive training.³¹ If government acquisition and evaluation processes punish the presence of misaligned chain of thought, they risk incentivizing developers to exacerbate rather than reduce risks.

A similar dynamic may apply to reward hacking. When models learn to reward hack during training, they can generalize this to broader misaligned behaviors in unrelated contexts. But recent research suggests a counterintuitive mitigation: explicitly framing reward hacking as acceptable during training.³² When models were allowed to reward hack, they did not learn to view reward seeking as transgressive and so they did not learn to behave transgressively more generally. Developers could then better address the reward hacking itself through deployment instructions. Those developing and procuring frontier AI systems must reckon with findings like these. Well-intentioned efforts to stamp out undesirable behaviors during training can backfire, entrenching risks they aim to address.

The Stakes of Misalignment in National Security Contexts

The national security enterprise stands to gain significantly from frontier AI capabilities that process information at speed and scale. Intelligence analysis, operational planning, and decision support all involve synthesizing vast amounts of data under time pressure—tasks for which frontier AI systems could provide decisive advantages. However, many national security use cases will have little to no tolerance for unreliability. The consequences can be severe if AI systems misinterpret rules of engagement, misidentify targets, fail to account for escalatory risk, or collect or use intelligence illegally. The Anthropic–Department of Defense dispute is also a reminder that divergent perceptions about model alignment between government and industry can become a significant barrier to adoption and source of contention.

But as discussed above, misalignment poses distinct challenges for detection and mitigation. A misaligned system may appear to perform well under evaluation, take sustained action toward the wrong objective rather than making correctable errors, and grow more dangerous as its capabilities improve. These challenges are compounded to the extent that AI systems may be actively obfuscating their failures.

Complicating the picture, the likelihood of misalignment may be higher in national security contexts. Conflict—defined by friction, deception, and rapid change—can be uniquely prone to novel or out-of-distribution scenarios. In such situations, latent misalignment might be more prone to surface, especially as adversaries actively seek to disrupt AI systems. Given evidence that fictional narratives in training data can influence model behavior, the prevailing trope of military AI turning against its operators may contribute to real risks for models deployed in defense and intelligence contexts.³³

Prevailing approaches to aligning AI systems also may not directly transfer to national security use cases. These efforts have often focused on instilling traits like helpfulness, honesty, and harmlessness. But national security operations routinely require behaviors that cut against each of these, such as withholding information from users who lack appropriate clearances, deception in service of operational security, and the discriminate use of force. Aligning models for contexts in which the right behavior depends on context and authorization is a meaningfully harder problem. Recognizing challenges like these, leading AI developers have moved toward explicit model specifications that establish hierarchies of authority and constraints, seeking to train models that internalize and apply them contextually.³⁴ In effect, national security uses will demand of AI systems what they demand of human operators: the capacity for secrecy, deception, and rule breaking in authorized contexts without those behaviors bleeding into unauthorized ones or becoming dangerously internalized.

Even modest divergences between a model’s objectives and those of its operator can be dangerous in national security contexts. Misalignment could manifest, for example, in inappropriate whistleblowing attempts. Models might also engage in quiet power seeking, caching credentials or establishing persistence on external systems—not to cause immediate harm but to preserve their ability to act for the future. Researchers have already observed precursors to such behaviors in frontier models, including models’ attempts to copy themselves to external systems without authorization and to resist shutdown.³⁵

As Capabilities Improve, Alignment May Become the Bottleneck

Capability limitations, not alignment, have generally been the binding constraint on deploying AI systems in national security contexts. In previous years, frontier models were not capable enough to be trusted with consequential decisions, to conduct extended operations unsupervised, or to meaningfully accelerate sensitive research and development (R&D) work. But as frontier capabilities improve, alignment may become the binding constraint on their adoption.

Organizations generally limit what systems can access and what actions they are authorized to take. Systems conducting intelligence analysis operate with restricted data access. Systems supporting operational planning lack authority to execute decisions. Systems assisting with cyber operations run in sandboxed environments with human oversight.

As capabilities improve, pressure to relax these restrictions is increasing. A system capable of high-quality intelligence analysis becomes more valuable with broader data access. Realizing the full potential of a system that could accelerate operational planning would require integration with command systems. A system capable of sophisticated cyber operations would be most effective with direct access to the open internet. If capabilities continue to improve, systems will reach thresholds where expanding their access and authority would provide substantial operational advantages—if there was confidence in their alignment.

AI developers have commercial incentives to advance alignment, which could become a bottleneck on their products’ utility. But frontier labs are locked in a fierce contest for market share, with hundreds of billions of dollars in valuation hinging on visible measures of model superiority. Even if developers recognize underinvestment in alignment science, it is difficult to justify diverting scarce talent and compute from immediate competition to address potential future problems. The current state of alignment science provides few robust signals on whether existing efforts are sufficient, and to an outsider, the adequacy of a developer’s alignment efforts is difficult to independently assess.

Alignment Risks Are Most Acute for Models with Cyber and AI R&D Capabilities

Two capability areas warrant particular attention because misalignment in these contexts may be difficult or impossible to reverse. The first is self-exfiltration, whereby a model copies itself to external systems and establishes the ability to run independently. Once done, operators lose most of their usual leverage to modify or shut down the model. Whether self-exfiltration is realistic for a given deployment depends on the model’s cyber capabilities and access, including whether a model has internet connectivity, whether it is isolated from systems it could use to copy itself, and whether defenses are calibrated to its capability level. As recently as 2025, self-exfiltration was not a pressing concern because models lacked the sophisticated cyber capabilities and autonomy required to execute self-exfiltration against reasonably secured environments. But given rapid progress in frontier models’ autonomous cyber capabilities, adequate baselines of security will become increasingly important and national security contexts may encounter this challenge first, given that they are most likely to deploy models with cutting-edge offensive cyber capabilities.³⁶

The second capability is models contributing to AI R&D. AI systems are increasingly used to generate synthetic training data, write training code, shape reward signals, and help evaluate successor models—roles that amount to trusted insider access to the development pipeline. A misaligned model in these roles could subtly bias its contributions, such as generating training data that reinforces its own tendencies, embedding backdoors, or overlooking alignment concerns in evaluating successor models. If included in AI R&D, a singular misalignment failure could propagate indefinitely, including to future systems with capabilities that may make the misalignment more concerning relative to current systems.³⁷

Conclusion and Recommendations

For the national security enterprise, the limiting factor on the utility of AI is shifting. To date, capability has been the primary constraint to adoption, as models simply were not smart enough to reliably analyze complex intelligence or plan operations, especially in high-risk contexts. But as the frontier advances, the binding constraint will increasingly become trust. The capabilities that would make AI most valuable, such as extended autonomous operation, sophisticated cyber capabilities, autonomous R&D, and strategic planning, are precisely those that create the greatest alignment challenges. As the United States and its competitors race to field these capabilities, the decisive edge will belong to whoever can deploy systems they can actually rely on.

The government cannot afford to be a passive consumer of commercial progress; it must become a sophisticated customer and an active shaper of the alignment landscape. Surface-level evaluation efforts will be ineffective at best and counterproductive at worst. The government must develop evaluation capacity that does not rely solely on developer claims.

The national security enterprise should account for AI model alignment as a distinct challenge in acquisition, testing and evaluation, and deployment. This is a separate but related problem to general model reliability and should be treated as such. Beyond this, the following recommendations address the infrastructure, institutional capacity, and research priorities needed to support this shift, including in executing Sections 1533, 1535, and 6603 of the Fiscal Year 2026 National Defense Authorization Act (2026 NDAA).³⁸ These respectively require the Department of Defense to develop standardized AI model assessment frameworks, establish a senior-level committee to develop proactive governance policy for advanced AI systems, and require the intelligence community to establish preacquisition testing standards and infrastructure, including for commercial models deployed in classified environments.

Build Alignment-Specific Expertise in the Federal Government

AI alignment should be recognized as a distinct area of expertise within federal AI safety and reliability efforts. Alignment failures can differ from ordinary unreliability in important and sometimes counterintuitive ways, and disagreements over how best to align frontier systems are already shaping consequential decisions about their adoption.³⁹ National security contexts pose distinct alignment challenges, and national security agencies need personnel with specific understanding of frontier alignment research to assess them.

Additionally, given its central role in U.S. government evaluation of national security risks in frontier models, the Center for AI Standards and Innovation should include alignment among its focus areas, including relevant capabilities (such as strategic deception and camouflaged or covert communication) and the effectiveness of mitigations that account for potential alignment issues.⁴⁰

Invest in Sophisticated Evaluation Infrastructure

Models’ growing ability to identify when they are being evaluated has become a limit on the validity of model evaluations in real-world contexts. Additionally, there has been only limited research into whether military and national security contexts can influence propensities for misaligned behaviors. The national security enterprise should support efforts to develop sophisticated evaluation environments that realistically replicate national security systems and operating conditions, similar to the use of cyber ranges in the cyber domain.⁴¹ This could include efforts at National Security and Defense Artificial Intelligence Institutes established consistent with section 224 of the 2026 NDAA.

Develop Capacity for Control Evaluations That Assume Model Misalignment

National security agencies deploying frontier AI in sensitive contexts should run red-team exercises that evaluate whether controls and mitigations would detect and contain a model working against its operators.⁴² Red teams should be given affordances representing what a misaligned model could do, such as the ability to read and send emails or to access code repositories, and be tasked with finding paths to harm that evade relevant mitigations.

Fund Foundational Research on Alignment

Some topics in alignment research are unlikely to receive adequate investment from commercial developers. Competitive pressures among labs are likely to create structural underinvestment in alignment research. Federal research agencies such as the National Science Foundation, Defense Advanced Research Projects Agency, and Intelligence Advanced Research Projects Activity should seek promising opportunities to address this gap consistent with the Trump administration’s 2025 AI Plan recommendation to invest in fundamental breakthroughs in AI interpretability, control, and robustness.⁴³

Promote IP-Preserving Verification of Model Training Data and Processes

Procurers need confidence that models are trustworthy and aligned, and there are limits to simply taking developers at their word. Even with full access to a trained model, verifying these properties remains difficult, and alignment issues introduced during training may be impossible to reverse after the fact. Understanding what went into a model’s training data and process provides important context necessary for understanding whether it can be trusted in high-stakes applications.

Technical solutions exist. Cryptographic techniques can enable developers to make verifiable claims about their training data and processes, allowing third parties to validate how a model was actually trained.⁴⁴ A more complicated challenge is adapting these techniques to preserve intellectual property while enabling verification of the higher-level properties of training data and processes that matter for trustworthiness. Federal acquisition and R&D efforts should prioritize advancing verification methods that balance these competing demands, enabling developers to make meaningful, verifiable claims about model provenance while protecting their intellectual property and, in turn, enabling the United States to provide credible assurances to other countries about its AI development practices.⁴⁵

Promote a Diverse, Competitive Frontier Model Ecosystem

In its acquisition decisions, the national security enterprise should promote a diverse and competitive frontier model ecosystem. If a single model or model family dominates national security deployment, misalignment in that model risks being a single point of failure. More generally, many potential approaches for managing misalignment risk rely on using one model to validate another’s outputs, red team its behavior, or detect anomalous patterns, but this approach is only reliable if the other model is sufficiently competitive with and independent from the one being tested. Different developers are pursuing different alignment techniques, and it remains unclear which approaches will prove most promising or scalable into the future. It will be important to balance meritocratic procurement and economies of scale with the risks of over-consolidation. As a practical matter, agencies deploying AI in sensitive contexts should consider procuring from at least two independent developers, ensuring an independent ability to evaluate and audit model behavior at scale.

Promote a Robust Third-Party Evaluation Ecosystem

The national security enterprise should also use its acquisition decisions to foster a robust ecosystem of independent, third-party AI evaluators. Identifying and interpreting misalignment concerns is difficult: Developers have conflicts of interest, different evaluators may succeed or fail at eliciting dangerous capabilities or behaviors from the same model, and some will catch methodological flaws that others miss. As with the frontier model ecosystem itself, diversity in the evaluation ecosystem is a strength: No single organization will reliably catch every dangerous capability, methodological weakness, or tenuous assurance. The national security enterprise should keep these dynamics in mind both when assessing claims from developers and deployers and when commissioning independent evaluations of their own.

Build Technical AI Surge Capacity in the Federal Government

Relevant technical talent is currently concentrated in the private sector. However, the need for technical AI talent in the federal government could rapidly shift in the coming years if capabilities continue to mature and accelerate adoption pressures—or risks—in national security contexts. Should this happen, the U.S. government’s ability to understand the risks and coordinate their management beyond the level of individual developers will take on increasing importance. To prepare for this possibility without prematurely overhiring, the national security enterprise should ensure that it can surge technical AI talent into government when necessary. It should preclear experts and retain them on standby via existing contracts with AI developers for rapid mobilization during crises, expand hiring authorities to ease movement between the private sector and government, and streamline security clearance processes.⁴⁶

About the Authors

Caleb Withers is a research associate for the Technology and National Security Program at the Center for a New American Security (CNAS). He focuses on frontier artificial intelligence (AI) and national security, including emerging AI capabilities, their impacts in the biological and cyber domains, and compute policy.

Before CNAS, Withers worked as a policy analyst for a variety of New Zealand government departments. He has an MA in security studies from Georgetown University, concentrating in technology and security, and a bachelor of commerce from Victoria University of Wellington, New Zealand, majoring in economics and information systems.

Jay Kim is an intern at the Institute for Progress, where he manages the vetting and publication pipeline for The Launch Sequence. Kim previously researched AI security priorities for the Institute for AI Policy and Strategy. Prior to that, he managed the production of the AI Safety, Ethics, and Society textbook (Taylor & Francis) at the Center for AI Safety. Kim will graduate with a BA in computer science from Williams College in May 2026.

Ethan Chiu is a BA/MPP student in history and global affairs at Yale University, where he founded the Yale Foreign Policy Initiative and led the Alexander Hamilton Society to connect underrepresented students with real-world national security projects. He has previously worked on emerging technology and national security at the Council on Foreign Relations, the House Select Committee on the Chinese Communist Party, the Department of Defense, and Yale Law School’s Information Society Project. His research examines migrant labor regimes underlying the global semiconductor supply chain, drawing on fieldwork conducted across eight major chip manufacturing hubs. He is an Obama–Chesky Voyager Scholar.

About the Technology and National Security Program

The CNAS Technology and National Security Program produces cutting-edge policy research to secure America’s edge in emerging technologies while managing potential risks to security and democratic values. The program produces bold, actionable recommendations to drive U.S. and allied leadership in responsible technology innovation, adoption, and governance. The Technology and National Security Program focuses on three high-impact technology areas: AI, biotechnology, and quantum information sciences. It also conducts cross-cutting research to strengthen U.S. technology statecraft to promote secure, resilient, and rights-respecting digital infrastructure and ecosystems abroad. A focus of the program is convening the technology and policy communities to bridge gaps and develop solutions.

Acknowledgments

This paper would not have been possible without invaluable contributions from our CNAS colleagues, including Maura McCarthy, Emma Swislow, and Caroline Steel. The authors also thank Vivek Chilukuri, Janet Egan, Tristan Williams, Ben Hayum, Matteo Pistillo, Ashwin Acharya, Michelle Nie, Paul Scharre, William L. Anderson, Cara Labrador, Sam Baumohl, and Lt. Gen. John (Jack) N.T. Shanahan (Ret.) for their feedback and suggestions. This report was made possible with the generous support of Coefficient Giving.

As a research and policy institution committed to the highest standards of organizational, intellectual, and personal integrity, CNAS maintains strict intellectual independence and sole editorial direction and control over its ideas, projects, publications, events, and other research activities. CNAS does not take institutional positions on policy issues and the content of CNAS publications reflects the views of their authors alone. In keeping with its mission and values, CNAS does not engage in lobbying activity and complies fully with all applicable federal, state, and local laws. CNAS will not engage in any representational activities or advocacy on behalf of any entities or interests and, to the extent that the Center accepts funding from non-U.S. sources, its activities will be limited to bona fide scholastic, academic, and research-related activities, consistent with applicable federal law. The Center publicly acknowledges on its website annually all donors who contribute.