Can AI Enable Nuclear Counterforce Strike?

AI Can Enable a Nuclear Counterforce Strike

A counterforce strike aims to target an adversary’s military forces and war-supporting capabilities, disabling their ability to retaliate. In the context of nuclear MAD doctrine, a counterforce strike would involve destroying almost all missile silos, mobile launchers, and nuclear-armed submarines, such that the enemy can’t launch a sufficiently deterring second strike. If a state is able to simultaneously incapacitate all other states’ nuclear arsenals, and not receive unacceptable damage in return, it would have achieved Decisive Strategic Advantage (DSA).

Strong AI progress is expected soon. (See Post 1 for more details). AI assisted R&D could make it practical for a nation to design, field, and deploy at scale systems that:

• Grant the ability to detect the location of nuclear submarines and mobile ICBM launchers, enabling them to be targeted in a first strike.

• Enable more precise missile guidance, enabling a low-lethality counterforce strike that is politically feasible.

• Grant the ability to defend against retaliatory missiles, enabling greater tolerance of an imperfect counterforce strike.

Executive Summary

• Nuclear first strikes become feasible if AI can dramatically cheapen large space infrastructure and accelerate military R&D. The key enablers (satellite surveillance constellations, space-based missile defense, and improved weapons guidance) all rely on known technologies that are currently too expensive or slow to deploy at the necessary scale. AI-assisted R&D could change this calculus by automating most of the R&D, systems-integration, and productionization work and thereby reducing per-unit costs by orders of magnitude. This post evaluates the technical (not political) feasibility of this scenario.

• Only the US and China could plausibly attempt this. Based on current trends of AI progress, AI will reach a level capable of significant software and design automation at some point in the mid 2030s. Both the US and China have frontier AI industries, large defense budgets, domestic chip manufacturing or access to it, and existing nuclear arsenals. Russia lacks a domestic AI industry and is considered only as a potential target. Other nuclear states are weaker on all dimensions. That said, collective defense treaties (like NATO’s Article 5) mean an attacker may need to neutralize multiple arsenals simultaneously.

• The most technically feasible version is an “out of the blue” strike during peacetime. During peacetime, most of a nation’s nuclear arsenal sits in known, fixed locations: missile silos, submarine ports, bomber airfields, and mobile launcher garrisons. The only unknown positions would be a handful of submarines at sea. This means the attacker’s problem reduces to two hard tasks: locating a few submarines, and striking everything else before retaliation can be launched.

• Fast-arriving weapons could prevent retaliation. Submarine-launched missiles positioned near the defender’s coast or orbital bombardment can reach inland targets in under 10 minutes, much less time than the 15+ minutes leadership would need to assess the situation and order a counterstrike. Decapitation strikes, cyber attacks, and staging false flag attacks can further increase the time needed to retaliate, all while silos are being destroyed by SLBMs.

• Missile defense is what makes the whole scheme viable. Even a well-executed first strike will likely miss some elements. These could include submarines, mobile launchers, or a handful of missiles launched before their silos were destroyed. The attacker needs to be confident it can intercept whatever survives. Current missile defense systems are grossly inadequate for this (the US has only 44 interceptors, each with 55% accuracy). But AI-driven cost reductions could make it feasible to deploy thousands of cheap ground-based interceptors and a constellation of ~100,000 space-based interceptors well within normal limits of superpower defense budgets.

• Tracking mobile launchers matters, but only if the defender is alerted. Russia and China both keep their mobile missile launchers garrisoned during peacetime. If a strike comes without warning, they are sitting targets. Satellite tracking of mobile launchers becomes critical only if the defender has raised its alert level, in which case the defender would disperse launchers onto roads and into shelters. In that scenario, satellite surveillance networks and AI-powered image analysis could still locate most of them, though defenders can build countermeasures (tunnels, decoys) relatively quickly.

• More accurate weapons reduce the political barrier. Improved missile guidance could allow the use of very small warheads, potentially reducing civilian deaths from millions to tens of thousands. This doesn’t affect technical feasibility, but makes the scenario more thinkable for decision-makers.

• Defenders have options, but face a speed disadvantage. Arms treaties, alliance-building, expanding arsenals, and maintaining higher alert levels can all help preserve deterrence. But the attacker’s AI advantage means it can iterate on counter-countermeasures faster than the defender can adapt. Estimated breakout time is 2-5 years from achieving a sufficient AI lead.

Table of Contents

• 1. Background

• 2. Setting the Scenario

  • 2.1. General Considerations

  • 2.2. Who has the lead

  • 2.3. AI Research and Development

  • 2.4. Public vs Covert capabilities

  • 2.5. Limiting Factors

• 3. Degrading Launch on Warning

  • 3.1. Summary

  • 3.2. Background

    • 3.2.1. US History

    • 3.2.2. Russia History

    • 3.2.3. China History

    • 3.2.4. Takeaways

  • 3.3. Stealthy Conventional Platforms

  • 3.4. Unconventional Platforms

  • 3.5. Degrading Information Transfer Channels

  • 3.6. Cyber Vulnerabilities

  • 3.7. Reducing Attack Confidence

  • 3.8. Decapitation Strike

  • 3.9. Overall Assessment

• 4. Improved SSBN Detection Capability

  • 4.1. Summary

  • 4.2. Background

  • 4.3. Acoustic Sensors (sonar)

  • 4.4. Non-acoustic sensors

  • 4.5. Space Based Detection

    • 4.5.1. Synthetic Aperture Radar

    • 4.5.2. LiDAR

  • 4.6. Unmanned Undersea Vehicles (UUVs)

  • 4.7. Overall Assessment

• 5. Improved TEL Detection Capability

  • 5.1. Summary

  • 5.2. Background

  • 5.3. SAR Satellite Constellation

  • 5.4. Optical Satellite Constellation

  • 5.5. DiAL

  • 5.6. Unattended Ground Sensors

  • 5.7. SIGINT

  • 5.8. UAVs

  • 5.9. Overall Assessment

• 6. Precision Strikes

  • 6.1. Background

• 7. Improved Missile Defense

  • 7.1. Summary

  • 7.2. Background

  • 7.3. Ballistic Missile Defense

    • 7.3.1. Summary

    • 7.3.2. Background

    • 7.3.3. Current Status

    • 7.3.4. Potential Solutions

    • 7.3.5. Improved Interceptor Missiles

    • 7.3.6. Space-Based Interceptor Constellations

    • 7.3.7. Directed Energy Weapons

  • 7.4. Hypersonic Weapon Defense

    • 7.4.1. Current Status

    • 7.4.2. Would it be sufficient?

    • 7.4.3. Countermeasures

  • 7.5. UUV Defense

  • 7.6. Overall Assessment

• 8. Counters

  • 8.1. Nuclear Buildup

  • 8.2. Doomsday Weapons

    • 8.2.1. Salted Bombs

    • 8.2.2. Bioweapons

    • 8.2.3. Overall Assessment

  • 8.3. Bilateral Treaties

    • 8.3.1. Background

    • 8.3.2. Applied to Our Scenario

    • 8.3.3. Credible Commitment

    • 8.3.4. Private Information

    • 8.3.5. Overall Assessment

  • 8.4. Targeting AI

    • 8.4.1. Supply Chain Disruption

    • 8.4.2. Cyber Attacks

    • 8.4.3. Disrupting Talent

    • 8.4.4. Kinetic Attacks on Data Centers

    • 8.4.5. Bilateral Agreements for AI

    • 8.4.6. Overall Assessment

  • 8.5. Overall Assessment

• 9. Conclusion

• 10. Further Reading

  • 10.1. Nuclear Strategy and Counterforce

  • 10.2. Nuclear Arsenals and Force Structure

  • 10.3. Launch on Warning and Early Warning Systems

  • 10.4. NC3I and Command and Control

  • 10.5. Submarine Detection

  • 10.6. TEL Detection

  • 10.7. Precision Strikes

  • 10.8. Missile Defense

  • 10.9. Directed Energy Weapons and SDI

  • 10.10. Unconventional Delivery and Space-Based Systems

  • 10.11. Doomsday Weapons and Civil Defense

  • 10.12. Bilateral Treaties and War Bargaining

  • 10.13. AI Competition, Governance, and Targeting AI

1. Background

Generally, most nuclear powers aim to structure their nuclear forces in a nuclear triad:

• ICBMs (Intercontinental Ballistic Missiles): ICBMs are usually housed either in hardened missile silos, or kept mobile on trucks. Siloed ICBMs are usually kept ready to launch, even during peacetime. The mobile ICBMs on trucks (often called Transporter Erector Launchers or TELs) are usually garrisoned during peacetime, but are sent on patrol during raised alert levels.

• SLBMs (Sea Launched Ballistic Missiles): These missiles are launched from submarines. Submarines designed to carry nuclear ballistic missiles are referred to as SSBNs in US Navy nomenclature, but today even attack submarines (denoted SSNs) may also carry nuclear-armed missiles, blurring the boundaries between these classes. The submarines can be located anywhere in the world, and are incredibly difficult to detect from a distance. SSBNs are by far the most survivable leg of the nuclear triad. However, they are also expensive to operate continuously. Most nations keep only a fraction of their SSBNs on patrol during peacetime conditions.

• Strategic Bombers: Finally, nuclear weapons can also be launched from strategic bombers. Stealth and supersonic bombers can be very difficult to intercept, and can be scrambled on relatively short notice. Bombers can also be recalled if necessary, a capability impossible with missiles.

The ability to “break MAD” with a counterforce strike is often referred to in the literature as nuclear primacy. As we mentioned earlier, in the 1950s the US had a brief window of nuclear primacy over the USSR. However, a lesser known fact is that in the 1980s, many in the US believed that they were once again close to obtaining nuclear primacy. In 1983, the government conducted a secret study which indicated that under generous assumptions, the US might be able to wipe out all 1398 Soviet missile silos with the newly developed and highly accurate MX missile. As discussed later, they also were able to detect and track almost all Soviet SSBNs. Lieber & Press (2006) provide more detail on how such a counterforce strike could be carried out in practice, although their paper also makes several optimistic assumptions.

2. Setting the Scenario

Before we dive into the technicalities, we need to clarify the assumptions and limitations of our analysis. Remember that the goal is to determine whether sufficiently strong AI-driven automation and productionization could make the key enablers of a disarming first strike practical enough, fast enough, and scalable enough to field before defenders can adapt. We’re not trying to evaluate any particular scenario for “who would win”. We’re trying to qualitatively discuss how an AI lead might be turned into a Decisive Strategic Advantage.

This is a qualitative analysis, since much of the necessary information to conduct a fully quantitative one is classified or difficult to independently compute. That being said, having a baseline “reference point” scenario will help make the analysis more concrete, and grant the ability to discuss specific near-term programs that are already being planned by the US and China. From this baseline scenario, we define several subscenarios which will focus on a Chinese first strike vs a US first strike, and public vs covert capabilities.

2.1. General Considerations

For all of these scenarios though, we set the stage in the mid 2030s (2032-2038), in a world where AI progress has continued at roughly the same pace as the past few years. The US and China have invested heavily in their respective AI capabilities, although one (either the US or China) is significantly ahead of the other. The US, China, and Russia all have leadership systems that are effectively the same as they are today. Obviously, the actual leaders in charge may change. The US will have presidential elections in 2028 and 2032. In Russia and China, Putin will be 82 in 2035, and Xi 81, making leadership transitions plausible. However, we’ll assume the new leadership maintains the current policies of their respective country and acts in a similar manner as the current leadership.

In both the US and China, AI is able to automate almost all low-expertise office work and most computer programming. The leading AIs are not necessarily superintelligent, but can operate around the clock, work at a significantly faster pace than a normal human, and coordinate seamlessly with other agents by sharing context. This model of AI digital coworkers has been described by both Dario Amodei (the CEO of Anthropic) and Sam Altman (the CEO of OpenAI), and represents my current best guess of how AI capabilities will be implemented in practice. We assume that both the US and China have integrated these AI agents into their country’s military and defense supply chain to the extent possible, as they both expect further improvements in AI capabilities, and want to position themselves to take advantage of this potential upside.

In contrast to the US and China, Russia does not have a significant AI industry. This is unlikely to change in the near future, as they don’t have any domestic expertise or chip manufacturing ability. Thus, we’ll consider them mostly as a defender, not an attacker. By the scenario date, I do expect them to utilize AI to some extent, but mostly only commercially available ones from either the US or China. Since relying on another country’s AI in their military would be a serious national security risk, I predict that they will only use open source models that are several years behind the frontier, and generally less capable.

Note that the UK, France, India, Pakistan, Israel, and North Korea are also nuclear powers, but they are much weaker than the three nuclear superpowers. Additionally, all of them lack a strong domestic AI industry. That being said, the nuclear abilities of these nations are still relevant due to collective defense treaties.

NATO’s Article 5 commits member states to consider an attack on a member state to be an attack on all of them. As such, the UK and France would be committed to attack China if China attacked the US. Whether the UK and France would actually follow through with their commitments is extremely unclear, but it’s certainly worth thinking about.

However, we will largely omit consideration of these states for reasons of limited space. In general, the tactics used against them would largely be the same.

2.2. Who has the lead

It’s unclear exactly how much lead the leading country will have over the other. Currently, the US seems to maintain a 7 month lead over China, but this could easily reverse. Longer AI timelines tend to favor China, as it has a stronger industrial capacity (critical for building chips and powering datacenters). I’m very uncertain about which country will ultimately have the lead. However, I think it’s fairly likely that one country will eventually take a lead. Although most AI labs currently have relatively similar capability levels, I suspect this is largely due to a great degree of information leakage between labs. Researchers frequently change labs, and carry with them a lot of secret information. In a future where AI secrets are a matter of national security, I can easily imagine this culture changing.

There is also a flywheel effect that will amplify any lead a country has. As the AI gets strong enough to contribute to its own development, a lab or country with a stronger AI may be able to research and improve faster than one with a weaker AI.

The smaller the lead, the harder it will be to gain a DSA, and vice versa. Remember that we’re not setting a fixed lead here. We’ll discuss technologies that would need a very large lead, as well as technologies that might work with only a small lead, and we’ll flag this where appropriate.

We’ll consider cases where either the US or China is in the lead.

2.3. AI Research and Development

The key advantage that the leading country will have over the lagging country is better AI R&D. The goal is not to replace humans, but to augment them, so that a project with the same amount of human labor can accomplish more in the same time. The human would do the parts of the project that the AI was comparatively worse at. This can happen through the following vectors:

• Automated Software Development: This is by far the most well established mechanism by which AIs can accelerate R&D. Automated software development is already extremely popular, and in wide use. The METR Time Horizon benchmark (although somewhat saturated at this point) indicates current AIs (as of 2026) can handle 1 hour long tasks with 80% accuracy, and this has been increasing exponentially. Assuming the trend holds, AIs in the early 2030s should be able to complete multi-day tasks independently.

• Automated Electrical Design: Frontier labs are already working on improving LLMs’ ability to do electrical engineering. Future models with a strong capability in this direction would significantly accelerate creating PCBs, ASICs, and wiring systems.

• Automated Hardware Design: This is more speculative. Current frontier AIs are currently poor at physical understanding. They have poor visual abilities, and also commit frequent errors when doing physical reasoning. However, this is not an intrinsic limitation, but rather one of training data. Most humans don’t write about everyday physical reasoning. If it becomes valuable to invest in this ability, labs will commission data sets, and models will rapidly improve. Once AIs gain this ability, they may be able to automate most CAD work, and provide ready to use designs to machinists or 3d printers for manufacturing.

• Automated Chemistry, Physics, and Math Research: Finally, AIs can also assist with fundamental research. Compared to hardware, there has been a relatively large amount of investment into this. Frontier AIs have already started making new mathematical and physics discoveries. That being said, most qualitative analyses of AI abilities in research conclude that today’s AIs lack significant “creativity” or “lateral thinking”, but instead have deep domain knowledge and are reasonably strong at following through with a line of reasoning.

• Automated Project Management: In any large project, coordination becomes a real issue. Teams often become siloed and individuals don’t know what other individuals do or do not know. AIs are excellent at writing documentation and summarizing results. Additionally, LLMs can in theory become much stronger than humans at knowledge transfer, since they can directly transfer “memories”.

Although today, AI capabilities are “spiky”: strong in some domains (especially coding and math), and weaker in others (visual tasks). However, improvements to model strength tend to result in correlated gains across many domains:

Source: How Does Time Horizon Vary Across Domains?

However, even if AIs were to become infinitely capable, at some point, it would stop speeding up R&D because the development program would become experiment-limited. The bottleneck wouldn’t be research, but the human collaborators’ ability to run experiments fast enough, and provide results back to the AIs. This is a specific instance of a general phenomenon known as Amdahl’s Law.

2.4. Public vs Covert capabilities

The final component worth discussing is whether the leading country will aim to execute a preemptive “out of the blue” strike, hiding all signs of preparation until a sudden strike, or build up public capabilities that make it clear to the lagging country that it has achieved nuclear primacy, and that noncompliance will result in certain destruction.

There are pros and cons to both approaches. The main advantage of the covert first strike is that it reduces the chance that countermeasures are deployed, and gives the attacker the ability to use unorthodox approaches. For example, the attacker could covertly disguise a nuclear orbital bombardment system as an unrelated constellation (say, a space data center). This couldn’t be done publicly, as it would be a violation of the Outer Space Treaty. However, the covert approach is inherently risky. It relies on the defender’s lack of knowledge, something that could quickly change if espionage reveals the scheme. It also requires the nuclear exchange to actually happen, which is costly in terms of human lives and risky to the attacker (if a retaliating missile were to slip through).

The public approach on the other hand, could avert any loss of life. If the lagging nation realized it had no chance of survival if it started a nuclear war, it might capitulate without a fight. It’s also significantly more robust against espionage. On the flip side, if the designs are public, the lagging nation will be working on countermeasures to both survive the strike and ensure retaliation, an ability which tends to be much easier to maintain than proactive defense. It’s important to emphasize that our current regime of nuclear deterrence has survived for so long because it really is difficult to break the doctrine of MAD. However, at the same time the defender is coming up with countermeasures, the attacker will be preparing counter-countermeasures, and the attacker, who has stronger AI R&D, will be able to iterate much faster.

2.5. Limiting Factors

In practice, ability to successfully execute a preemptive counterforce strike is limited by a few factors:

1. Alert level of the target state: How prepared is the target state for potential nuclear conflict? The US uses the term “DEFCON level” for this. If a state is at a high alert level, it typically has TELs and SSBNs on active patrol, and bombers ready to scramble, in order to respond to a first strike. A high alert level makes it much more difficult to fully incapacitate the target state’s ability to retaliate, since the mobile ICBMs and SLBMs are much more difficult to locate.

2. Target state’s ability to launch on warning: Because ICBM silos are vulnerable to preemptive strikes, many states plan to launch a full scale retaliatory strike if they have convincing evidence that a nuclear strike is imminent, even if a nuke hasn’t yet hit their territory, a posture known as launch on warning. This is risky - there have been several false alarms in the past. Beyond willingness, the target state needs to have the ability to detect inbound missiles ahead of time, via radar or infrared.

3. Intelligence on SSBN location: During peacetime nations usually keep their bombers at a relatively low alertness level and TELs garrisoned. In this state, they are all fixed targets vulnerable to ICBMs. As such, only the nation’s SSBNs preserve their ability to retaliate. Although SSBNs are stealthy, they are not fast. Most of their survivability comes from uncertainty about their location.

4. Attacker’s willingness to inflict civilian casualties: Post World War II, democratic nations have been relatively reluctant to inflict large civilian casualties. A nuclear counterforce strike might kill millions of civilians living close to missile silos or due to fallout. It would be an intensely controversial move, especially if we weren’t at war with the nation.

5. Attacker’s willingness to accept retaliation: Even with a relatively successful counterforce strike, a few retaliatory missiles from the target state might hit the attacker. Doctrine indicates that these strikes would be countervalue: aimed at population centers, infrastructure, and manufacturing capabilities. Whether the attacker is willing to tolerate a city or two being destroyed plays a large role in determining their success conditions. Nations already at war and authoritarian regimes may be more willing to absorb losses.

We’ll go over each of the ways AI R&D could influence these factors:

• Degrading Launch on Warning

• Improved SSBN detection capability

• Improved TEL detection capability

• Precision Strikes

• Improved Missile Defense

Many of these factors have been discussed before in Lieber & Press (2017) and Lieber & Press (2006).

3. Degrading Launch on Warning

All major nuclear superpowers have systems to launch a full scale retaliatory strike before any incoming nukes hit the ground. This is a significant impediment for a prospective first striker, as it means that many nukes would be launched before they are destroyed. Thus, being able to degrade the defender’s ability to launch on warning is vital for a successful counterforce strike.

3.1. Summary

• All three nuclear superpowers maintain layered early warning systems (space-based infrared + ground-based radar) and have nuclear policies that permit launch on warning. In practice, the US has historically preferred to wait for confirmed detonations before launching ICBMs. Russia and China’s postures are less certain but moving toward launch on warning.

• The launch-on-warning chain has many sequential steps. Disrupting or sufficiently delaying any single step can render it ineffective. A pre-emptive attacker has several potential tools for this, of which the most relevant are: stealthy platforms (reducing warning time), unconventional delivery (reducing or eliminating warning), cyber attacks (disrupting the information and command chain), and decapitation strikes (forcing launch authorization to be transferred to a backup authority).

• Stealthy conventional platforms (SLBMs on depressed trajectories, cruise missiles, bombers) are mature and well-developed strategies, and are viable independent of AI R&D. They would form the backbone of any first strike scenario.

• Unconventional platforms (orbital bombardment, FOBS, pre-positioned weapons) could compress warning times to near zero and are the most strategically decisive, but are only viable in covert subscenarios and carry the highest risk of escalation if discovered prematurely.

• Cyber command and control vulnerabilities are where AI R&D has the most direct leverage, since it is almost entirely a software and intelligence problem. A successful cyber attack on early warning or communications infrastructure could blind or delay the defender. However, it is also the hardest to guarantee, and detection of a probing attack could trigger an alert escalation.

• Decapitation strikes are plausible, and switchover times likely add tens of minutes at a minimum.

• Net assessment: degrading launch on warning is the most mature and least AI-dependent of the major enablers. In favorable circumstances it could compress warning and decision time enough to disrupt a clean launch-on-warning response. But it is a necessary rather than sufficient condition for a disarming first strike: survivable forces still have to be found or suppressed, and any residual leakage still has to be absorbed by missile defense.

3.2. Background

3.2.1. US History

In 1957, the Soviet Union launched the world’s first satellite, indicating that they had the ability to launch a nuclear weapon anywhere in the world. This, combined with commentary from Soviet Premier Nikita Khrushchev that missiles were rolling off the assembly line “like sausages” greatly shocked the US public, and led to the American perception of a “missile gap”.

For the US at the time, bombers were the only way to deliver nuclear weapons to their intended targets. However, bombers take a nontrivial amount of time to get off the ground, and bombers are vulnerable when not in the air (along with the airfields they launch from). Leadership feared that an ICBM attack might be able to destroy a large proportion of the US bomber force before a response could be mounted, threatening second strike capabilities. There were three programs that were created as a result: First, the US began “Operation Chrome Dome”, a system that kept a fraction of strategic nuclear bombers constantly in the air, both to prevent the US bomber fleet from being immediately wiped out, and to quickly retaliate. Second, work was accelerated on the US’s own ICBM system, the LGM-30 Minuteman, a solid-fueled ICBM that (unlike liquid fueled ICBMs) could be launched at a moment’s notice. Finally, the US invested into a network of ballistic missile early warning radars, located in the far north, that could detect incoming Soviet warheads and give time to prepare a response.

The Ballistic Missile Early Warning System (BMEWS) became operational in 1961. However, it was limited by the fact that it could only see incoming warheads when they came over the horizon. This is a limitation shared by all ground based systems. Thus, it was only able to provide about 15 minutes of warning. Nonetheless, because the Minuteman missile had the ability to launch on short notice, it started to make the concept of launching on warning viable. Planners were already thinking about this as early as 1959. The concept appeared necessary as well, as the US began to rely more on ICBMs and less on bombers for its second strike ability. The fixed silos were easily discoverable by spy satellites, and would be prime targets for any first strike.

The US invested heavily into the infrared launch detection satellites, first with the MIDAS program, but more successfully with the Defense Support Program (DSP), which came online in 1970. This system was able to detect infrared emissions of missiles as they were being launched, and use them to determine how many were being launched, and from where. This system would alert as soon as the launch had happened, giving as much time as possible to leaders to make a decision.

However, launch on warning was known to be risky from the start. In 1960, the US National Security Council Planning Board recommended only launching a response once there was confirmation that a bomb had actually exploded, noting that ICBMs could not be recalled.

Indeed, between 1960 and 1980, there were several close calls on the US side. In 1967, a solar flare temporarily disabled BMEWS, which leadership temporarily interpreted as a Russian jamming attempt. Most notably, in 1980, there was an incident where a National Security Advisor, Zbigniew Brzezinski, received a call in the middle of the night that hundreds of ballistic missiles were heading towards the US. Only a minute before he was planning to call President Carter, he received another call informing him that it was a false alarm. This was caused either by a nuclear exercise tape mistakenly placed in the computer or a faulty computer chip, based on varying accounts of the story.

It’s unclear whether launch on warning was US policy during the Cold War. Many details remain classified to this day. US nuclear doctrine permits (but doesn’t guarantee) launching on warning. The Reagan administration’s National Security Decision Directive 13 (written in 1981) explains why: “[The US] must leave Soviet planners with strong uncertainty as to how we might actually respond”.

However, we have reasonably strong evidence that planners intended to avoid launching ICBMs, or taking any irrevocable actions until it was confirmed that a nuke had detonated on US territory. The same 1981 National Security Directive 13 notes “While it will remain policy not to rely on launching our nuclear forces in an irrevocable manner upon warning that a Soviet missile attack has begun, … we must be prepared to launch our recallable bomber forces upon warning”. Almost 20 years later, 1997, during the Clinton administration, a senior director for defense policy at the National Security Council explained that “Our policy is to confirm that we are under nuclear attack with actual detonations before retaliating”.

It’s highly likely that the US maintains that policy (no ICBM launches until detonations confirmed) today, as nuclear tensions are generally lower than they were during the Cold War, and the policy seems to have been maintained across several presidential administrations.

Today, the US maintains the most robust early warning system of any nation. The space-based component is currently the Space-Based Infrared System (SBIRS), but SBIRS is currently being replaced by the Next-Generation Overhead Persistent Infrared (Next-Gen OPIR) system, which is designed to be more resilient and capable against evolving threats, including hypersonic missiles. On the ground, the US operates an upgraded network of radars descended from the original BMEWS, known as the Solid State Phased Array Radar System (SSPARS) which can confirm satellite detections and provide precise trajectory information for missile defense.

3.2.2. Russia History

In Russia, roughly parallel developments were occurring through the 1950s to 1990s.

In the early 1960s, Russia began developing their own early warning radar system, Dnestr, designed to detect incoming ballistic missile warheads. For most of the 1960s, the primary purpose of these radars was to support the development of the Soviet missile defense system, the A-35 program. Six stations were installed, around the borders of the USSR. However, compared to the US, USSR missile defense via radar was at a strategic disadvantage, since they lacked access to outlying territories closer to the US missile fields, while the US could place bases in Canada, Greenland, and the UK.

As such, there was significant emphasis on developing infrared satellite technology to get more advance notice. The Oko series of satellites had its first launch in 1970. These satellites weren’t designed to give global monitoring of all missile launches, but were instead focused on detecting mass launches from the US. They used highly elliptical Molniya orbits that spent most of their time over the US. By 1982, the system had a total of 7 satellites in orbit, and was accepted for combat service.

However, the Oko satellites were highly unreliable. The program was plagued by a variety of technical issues, including explosive disassembly of some satellites. Notably, the 1983 Stanislav Petrov nuclear incident was caused by sunlight reflecting off a cloud being mistaken for a missile launch.

USSR policy during the Cold War changed over time, in response to technological developments and political ideologies. However, in general, they placed relatively less emphasis on launch on warning than the US did, instead preferring a system of “retaliation after ride-out”. There were a few reasons for this. First, USSR planners were confident that US ICBMs in the 1970s lacked the accuracy to fully destroy their silos. They also had a system of mobile truck-based ICBM launchers (often called Transporter Erector Launchers, or TELs), which the US couldn’t destroy easily, as they didn’t have a fixed location. As such, they were confident in the survivability of their nuclear deterrent. Secondly, the geographical constraints mentioned above meant that confirmation of any satellite readings via radar would arrive too late to mount an attack before any warheads had hit.

The posture of “retaliation after ride-out” is also reflected in work on the Dead Hand / Perimeter system. This system was designed to maintain a second strike capability, even if Soviet leadership was totally wiped out. In popular culture, this system is often presented as a totally automated system akin to the doomsday device in Dr. Strangelove. However, based on what we know, it merely allowed launch authority to be transferred to a bunker if leadership could not be contacted, which could then make the decision to launch or not. According to an interview with Colonel Danilevich, a retired Soviet general, fully automated systems were briefly considered, but the risk of accidental nuclear war was considered too great.

However, in recent years, Russia has been moving towards a launch on warning posture. In 2024, Putin announced a new nuclear use policy, in which the use of nuclear arms might be authorized upon “receipt of reliable information about a massive launch of air and space attack weapons and their crossing of our state border”. While this makes it clear that the official policy is to launch on warning, it’s unclear if this is their policy in practice.

Russia’s early warning infrastructure seems to be in relatively good shape, after a temporary decline in the post-USSR years. Russia currently maintains both a satellite infrared launch detection system and an early warning radar system. The modern satellite launch detection system, Tundra, is planned to have 10 satellites, and currently has 6. (Although there was some controversy on the system’s health). The new ground based early warning radar, Voronezh is also operational. It recently achieved full coverage, a feat not accomplished even in the USSR, although the geographic constraints on warning times persist.

3.2.3. China History

Although China developed nuclear weapons in 1964, it wasn’t a major nuclear power until fairly recently. As such, it historically lacked significant investment into a large arsenal or early warning technology. Indeed, some scholars believe that China lacked a credible nuclear deterrent against the US until 2010.

To the extent it did invest in early warning, it was largely spurred by tensions with the USSR, not the US. Much of China’s early research on early-warning systems was done as part of Project 640, a development program that ran from 1964 to 1982. The project was designed to create a missile defense system, but never successfully completed that goal. However, its research resulted in several phased array radar systems, such as the Type 110 and 7010 radars, which were used as an early warning system, and came online from 1974-1977.

As the Sino-Soviet tensions cooled in the 1980s, research on early warning systems slowed down. However, things have started changing again beginning in the 2010s, as China emerged as a global superpower. China has been modernizing their nuclear arsenal, with the Pentagon estimating that they have gone from a force in the low 200s in 2020, to a force of 600 in 2025. (See also this visualization). The same report forecasts a potential force of 1000 warheads by 2030. In addition to the growth of their nuclear arsenal, China has been investing heavily into the ability to launch on warning. They maintain a constellation of likely early warning satellites, known as Tongxin Jishu Shiyan, sometimes called “Huoyan”. They also maintain a set of large phased array radars (LPARs), likely based on Russian Voronezh radar technology. These provide ground based early warning.

Note that historically, China had projected a much more safety focused nuclear stance, being one of the only nuclear powers to hold an explicit unconditional “No First Use” policy. For years, it had also held to a policy of “minimal deterrence”: possessing no more nukes than were necessary to deter. However, this policy seems to have been dropped. Another relevant change to policy is the explicit acknowledgement of launch on warning being permissible. A People’s Liberation Army (PLA) document noted that: “we can, under conditions confirming the enemy has launched nuclear missiles against us, before the enemy nuclear warheads have reached their targets and effectively exploded, before they have caused us actual nuclear damage, quickly launch a nuclear missile retaliatory strike”.

3.2.4. Takeaways

All states maintain both space based infrared detecting and ground based radar early warning systems, and have the capability to launch on warning. Their nuclear policies are likely subject to change, but launch on warning should be treated as highly plausible for all states, although in practice I suspect there is a high chance that they will wait for at least one detonation before launching a full retaliatory strike. As such, defeating launch on warning is crucial to ensure a successful counterforce strike.

In order to launch on warning, all systems require the following steps:

1. Gather evidence of a large scale nuclear attack.

2. These systems transmit this information to leaders.

3. Leaders analyze the information and identify the target country and attack plan.

4. Launch authorization and codes are transmitted to the nuclear forces.

5. Nuclear forces execute launch sequences.

6. The missiles fly a safe distance from their launch point.

All these steps must occur in sequence within a very short timespan. It’s estimated it would take around 30 minutes for an ICBM to go between the US and Russia or the US and China. It would take significantly less time between Russia and China. Thus, if we can undermine (or even significantly delay) any of these steps, we can destroy many silos before they launch their ICBMs.

There are several potential tools in the attacker’s basket to do this:

1. Stealthy conventional platforms: Cruise missile, bombers, and submarine launched ballistic missiles give very little notice to the enemy before they reach their target.

2. Unconventional platforms: There are ways to deliver nukes to their target by means that are less detectable by early warning infrastructure: nukes can be stored in orbit, launched via mass accelerators, or transported by civilian vehicles.

3. Degrading Information Transfer Channels: Nuclear Command, Control, Communications and Intelligence (NC3I) systems rely on information transfer channels, both to transmit evidence of an incoming strike, as well as to transmit outgoing launch orders. This communication could be disrupted or delayed by jamming or sabotage.

4. Cyber Vulnerabilities: NC3I systems also rely heavily on computers at many points. The software running on these computers likely contains vulnerabilities that could be exploited by an adversary to delay launch on warning.

5. Reducing Confidence: Before a target state can retaliate against a potential attacker state, it must be sure that: 1. A strike is really incoming, and 2. The strike really was launched by the potential attacker. If an adversary can complicate a target state’s calculation, it might not be able to be sure enough to retaliate before confirming detonations. This could be done by launching a strike when a solar flare is underway, or launching a false flag attack.

6. Decapitation Strikes: Another way of delaying a retaliatory response is decapitating the leadership apparatus. Most states have backup plans if their leadership is unable to be contacted, but this switchover process takes time, likely longer than 30 minutes.

These tools will inevitably be combined in any practical attack, although some will place more relative emphasis on some approaches over the others.

3.3. Stealthy Conventional Platforms

Perhaps the simplest way to degrade early warning is to use stealthy platforms that give the defender less warning. There are several ways:

• Submarines: SSNs (attack submarines) and SSBNs (ballistic missile submarines) can approach the defender coast quite closely without being spotted. While the exact distance they can approach varies based on both coastal topology (which influences sonar detection range) and the amount of defenses in place, it’s plausible for them to get within a hundred miles. From there, missiles could be lobbed at silos within a few minutes, especially if launched on depressed trajectories (which minimize the time the missile spends in the air). These missiles wouldn’t be stealthy, but they would give very little warning time: 10 minutes from launch to landing, even for the most inland targets (3000 km away), and less than 5 minutes for coastal targets.

• Cruise missiles: Cruise missiles are difficult to detect from long distances, since they can fly at extremely low altitudes, and thereby avoid radar detection. There are no immediate plans to create a comprehensive cruise missile detection system yet. Many cruise missiles have the ability to carry nuclear weapons. These missiles don’t have very long range, and would need to be launched from a platform like an attack submarine, surface ship, or airplane. Cruise missiles can be hypersonic, making them more difficult to intercept. No current early warning system is sensitive enough to detect their thermal signature from space. Unlike ballistic missiles, most modern missile defense systems are designed to intercept cruise missiles, so many cruise missiles might need to be sent in order to overwhelm defenses.

• Bombers: Bombers can carry far more weapons than a cruise missile, and are designed to have a relatively low radar cross section. That being said, the advent of low frequency radar means that bombers are now much more visible than they were in the past. There are no known recent cases where a US bomber has flown over defended enemy territory. The most analogous cases were the 2025 strikes on Iran nuclear sites, but there, Iran’s air defenses had already been seriously degraded, and the bomber was preceded by fighters that conducted further SEAD (Suppression of Enemy Air Defenses). A more plausible use case for bombers would be to fly relatively close to the shore, and unleash a barrage of cruise missiles before returning to base. Bombing targets within a hundred km of the shore is also fairly plausible.

These platforms are already mature, and rely on well understood hardware and technology. They have been tested and used in operational conditions extensively. As such, there have been theoretical discussions of their roles in a potential preemptive strike. In “The End of MAD?” (Lieber & Press (2006)), Lieber and Press discuss a scenario where the US successfully conducts a counterforce strike against Russia. They use an initial strike force composed only of stealthy conventional platforms.

Lieber and Press first attempt to identify how many warheads would be needed to destroy all fixed Russian targets, assuming they are at a low alert level. They include silo based ICBMs, mobile ICBM garrisons, primary and secondary airfields, and various other military sites that would need to be destroyed. This gives 799 aimpoints. Noting that certain “hard” targets (like silos) need more warheads than “soft” targets (like warhead assembly sites), they compute 2,890 total warheads needed in a first strike. Note that, as we’ll discuss in the Precision Strikes section (6.), it’s possible fewer warheads will be needed as ICBMs grow more precise.

Obviously, some of these need a more urgent response than others. Additionally, hard targets need more accurate delivery mechanisms. The authors propose using SLBMs to take out garrisons and airfields. For the far more numerous silos, they propose using a combo of SLBMs, cruise missiles, and bombers to provide the initial attack, with a follow up strike being provided by land based ICBMs a few minutes later. The other military targets would only be attacked by the land based ICBMs.

Lieber and Press are skeptical of Russian ability to launch on warning on such short timescales. They note that they would expect Russian leadership to require at least 15 minutes to digest the information and formulate a response, by which time most of their capabilities would be gone.

In order to be able to bring so many SLBMs to bear, the US would need to increase its submarine capacity beyond its normal levels of 8-9 submarines at sea. Lieber and Press propose a scheme in which deployed submarines stay at sea late, while new submarines are sent out on their regular schedule. From the Russian perspective, it would merely look like a few submarines had arrived late. The submarines would be supplemented by bombers, which the authors state could be readied without attracting attention from Russia.

Note that in 2006, when the article was released, Russia was still recovering from the collapse of the Soviet Union, and its defenses were in much worse shape than they are today. That being said, even with their upgraded defense, not much would change about the scenario, apart from bombers likely being excluded from the initial strike force (due to improvements in air defense). Early warning times would still be too low to launch on warning. Additionally, offensive capabilities have improved as well since the publication of the article. Specifically, modern missiles are more likely to support depressed trajectories and have higher accuracy.

Setting aside this particular forecast, let’s consider the difficulties with the overall approach of using stealthy conventional platforms. The first issue would be the difficulty of coordinating such an attack. It would involve significant coordination over several months, across both the Air Force and Navy, and any errors or leaks would be catastrophic. This, while seeming trivial, is not easy. Russia’s invasion of Ukraine was hampered by poor coordination between different aspects of its military. The US’s military is much better trained than Russia’s, but it’s not perfect either.

Secondly, there’s the risk of enemy detection. This is arguably the biggest risk. Even if Russia didn’t retaliate with nuclear weapons, it would still go on high alert, preventing this method from working. One risky element is that of the submarines: submarines must be positioned close to Russian coasts. While any given submarine is unlikely to be discovered, positioning many submarines linearly raises the chance of discovery. Additionally, the assumption that the US can activate 75% of its bomber force (and corresponding tankers) without alerting Russia is suspect. Russia has optical imaging satellites as well, and would observe unusual activity well ahead of time. During the Cold War, the Soviet Union was extremely paranoid about the possibility of pre-emptive attack, and ran Operation Ryan, a military intelligence project attempting to find subtle signs the US might be planning a pre-emptive strike.

This approach is the least AI-dependent approach. It mostly relies on existing hardware and abilities. That being said, AI could still help with planning, coordination, and counter-intelligence to prevent enemy detection of the scheme. Additionally, AI R&D could supplement this scheme by marginally improving hardware in straightforward ways: improving guidance software, and contributing to developing new versions of hardware.

Overall, this approach is highly plausible, and will likely form the basis of any preemptive strike, although it may be supplemented by other mechanisms to support it. It is viable under both covert and public subscenarios.

3.4. Unconventional Platforms

While conventional platforms may form the basis of any strike, in covert subscenarios, there’s room to use unconventional approaches. These are approaches that would be ruled out if the defender was able to identify that they were being pursued, but provide a significant advantage over the defender until that happens.

• Orbital Bombardment: By far the most promising approach in this bucket is orbital bombardment. The idea is to keep nuclear weapons in orbit until they’re needed. Then, they can be de-orbited over the target location. This would need to be covert because it’s a violation of the Outer Space Treaty, which forbids keeping weapons of mass destruction in outer space. However, the advantages would be tremendous. The warning time could be extremely low (potentially zero), and tremendous numbers of nukes could be deployed this way. To illustrate this, imagine that we have a fake “space data center” that we’ve launched into orbit, but secretly contains a payload of nuclear warheads. Naturally, it’s a very large satellite which is expected to be in space, and thus is ignored by early warning radar. When activated, it would launch the warheads on re-entry trajectories. These warheads could be targeted at different locations, much like a MIRV. Early warning radar might detect the warheads, but there would only be a few minutes until impact, much less than even SLBMs. Note that while early warning radar might cover the borders of a country, the interior usually isn’t fully monitored. Thus, there might be no warning in such cases.

• Fractional Orbital Bombardment: A more restrained version of the above is fractional orbital bombardment (FOBS), where the payload only completes a partial orbit before landing. Unlike general orbital bombardment weapons, FOBS are generally considered compliant with the Outer Space Treaty. China tested a FOBS-like system in 2021. During the Cold War, the USSR developed a FOBS system, but decided against pursuing it further, due to the fact that its throw weight and accuracy was decreased, and, as a first-strike tool, further development risked destabilizing the equilibrium between the US and USSR (among a few other reasons). In our case, FOBS would be most useful if we were able to disguise it as a normal satellite launch, and use a heavy lift vehicle to launch hundreds of warheads at once. This would avoid triggering space based early warning.

• Pre-positioned weapons: Another approach would be to pre-position nuclear weapons in enemy territory, perhaps by smuggling in components, and re-assembling it. This would enable a suicide team to launch a decapitation strike, perhaps by putting it in a truck and driving it next to the capital before setting it off. However, this approach is not very scalable. The risk of discovery increases linearly with the amount of bombs on enemy territory. Note that similar approaches have allegedly been considered by the Soviet Union.

• Low-Signature ICBM Launch: One could also reduce the signature of the ICBM launch to hide it from early warning satellites. Note that as of 2026, the US’s land based ICBMs are all LGM-30 Minuteman missiles. These use aluminum powder in their solid rocket fuel, giving off extremely intense infrared radiation. Smokeless propellants have a much smaller (but still nonzero) infrared signature, and are under active development. While this likely won’t fool future, more advanced, space based systems, I suspect it would work today, especially on Russia’s satellites (since they are likely the least developed). Furthermore, it can be combined with other methods like spin launch, which uses a centrifuge to accelerate rockets to a high velocity before releasing them, although this technology is fairly underdeveloped at the moment.

In general, all of these are high-risk, high-reward options relevant mostly only to the covert subscenarios.

3.5. Degrading Information Transfer Channels

Attacks on a defender’s Nuclear Command, Control, Communications, and Intelligence (NC3I) infrastructure are plausible, and would likely be accelerated by advanced AI R&D. A good resource here is “The survivability of nuclear command-and-control capabilities” (Acton (2024)).

We’ll be focusing only on the US’s system, since we have the most information about it. It’s likely that the Russian and Chinese systems are set up analogously though. That being said, there’s significantly less public information on the US’s NC3I than there is for other nuclear infrastructure, so we’ll have to rely on guesswork occasionally.

The first component of the NC3I architecture is the early warning system. As discussed above, it’s divided into two layers: the space based infrared-detecting layer and the ground based radar layer. Both of these are vulnerable to jamming, but in different ways. Since all 3 nuclear powers have a relatively limited number of satellites and radar, they are vulnerable to destruction as well. To avoid this, some nations are considering a “proliferated” constellation, which would involve many smaller satellites instead of a few large ones, which would make the architecture significantly more robust. The US is considering this with the “Proliferated Warfighter Space Architecture” (PWSA), although it’s not entirely focused on early warning.

Beyond early warning systems, there are also Battle Damage Assessment (BDA) sensors. These measure whether any detonations have occurred on the territory of the defending nation. These sensors can use mechanisms like heat, sound, or x-ray detection. These systems are particularly important for countries which have doctrines that want to wait for a detonation, like the US at some points in its history. The US hosts nuclear detonation detectors on all GPS satellites.

Critically, there are also the communication mechanisms that enable information to be transmitted between the information gathering systems (like early warning or BDA) and leadership. Finally, there are the communication systems that, if a launch order is given, allow this information to propagate to the silos and submarines.

Each method of communications has different strengths and weaknesses, and none are invulnerable. Additionally, only a few (ELF and VLF) can be used to communicate with submarines. Altogether, each nuclear power likely maintains the following systems:

• HF Radio: HF (High Frequency) radio, is used by the military since it can propagate hundreds of miles (far beyond simple line of sight) since it has what’s called “skywave” propagation, where the wave bounces between the ground and ionosphere. It is probably the easiest communication channel to disrupt, since it is extremely susceptible to nuclear blackout. Note that nuclear blackout effects vary non-linearly based on the wavelength.

• Communications Satellites: The US currently has 11 military communications satellites in geosynchronous orbit. In the US, these satellites come in two generations: the older Milstar and newer AEHF satellites. These likely would be used for both receiving early warning communications as well communicating launch orders. Both Milstar and AEHF use very high frequency bands, 44 GHz and 20 GHz for the uplink and downlink, respectively. These high frequency bands were specially selected to be robust to nuclear effects. As such, they can’t easily be blacked out. That being said, since there are relatively few satellites, and they are vulnerable to anti-satellite attacks.

• ELF Radio: ELF (Extremely Low Frequency) radio is only deployed by Russia and China currently, and only in the context of submarine communications. This is because seawater absorbs most electromagnetic radiation very well, and only the lowest frequencies can propagate through. However, the bandwidth of ELF is so low that it can’t be used to directly transmit a launch order (as it would take hours). Instead, it is used to order a submarine to rise high enough to receive a more high-bandwidth signal from VLF radio. ELF is also resistant to nuclear disruption, but for a different reason. Essentially, the wavelength of this frequency is so large that any nuclear fireball is comparatively small, and the wave can simply pass around it. However, the ELF transmitter stations are very large, and would be easy targets for the first stage of a nuclear strike.

• VLF Radio: VLF (Very Low Frequency) radio shares many of the properties of ELF radio. Like ELF, it is resistant to nuclear blackout, and any land based transmitter stations are easy targets. However, owing to its shorter wavelength, it has higher bandwidth, it can transmit launch orders to submarines within a relatively short amount of time. On the flip side, it is absorbed more strongly by seawater, so submarines need to be relatively close to the surface (tens of meters) in order to receive this frequency. The US relies exclusively on VLF to communicate with its submarines. To account for the chance of its land based transmitters being destroyed, the US has invested in VLF transmitting aircraft that use a long trailing antenna. Historically, these aircraft were constantly in the air, and were ready to transmit a launch order at any time, but this practice stopped in 1991. In times of high alert though, these aircraft will likely return to being constantly deployed. However, in peacetime, these aircraft will likely be grounded, and would be destroyed in a out of the blue strike, unless policy is changed to keep them in the air. Even if these VLF transmitting aircraft were used, they might have issues communicating with their intended recipients. These airborne systems are about 10x quieter than their land-based counterparts. They only radiate at 200 kilowatts, versus 1.8 megawatts for land based systems. Thus, the attacking nation can use its own VLF transmitters to jam the weak aircraft signal. VLF bands have so little bandwidth that anti-jamming mechanisms like frequency-hopping are impractical.

• Landlines: Messages can be transmitted to fixed land targets using cables. These cables can be buried to make them more robust to attacks. This permits communication with silos, and fixed location assets easily, but would be infeasible for submarines and mobile TELs. Burying cables is simple and effective, but will be revealed to any adversary with satellite surveillance. Once the location of the cables are known, they can be taken out by ground bursts (or nuclear earth penetrators, if they are deep enough to warrant it). That being said, because it is cheap to bury cables, and expensive to deploy fast acting bombs on them, a highly redundant cable network may be survivable. At a certain point, it just becomes cheaper to attack the silos directly, rather than the cables. That being said, currently we have no evidence of deeply buried exclusively nuclear cable networks for any country.

One relatively robust conclusion is all submarine-relevant communications systems are vulnerable. Thus, immediate retaliation from submarines can likely be delayed. Note that submarines likely have procedures to retaliate if they are unable to establish contact with leadership, and have confirmed a nuclear war is ongoing, like the UK’s Letters of Last Resort. Information about exactly how this authority can be activated is sparse, but my guess is that this process likely requires some time.

Another relatively robust conclusion is that mobile TEL communication disruption is also feasible if communications satellites can be destroyed. This is feasible, but might require some preparation. Destroying Geostationary satellites like AEHF and Milstar is tricky: earth-launched anti-satellite weapons are visible to the target state, and take time to reach geostationary orbit, giving the target state a window to retaliate. We’d want either directed energy weapons that can disable them instantly (like lasers), or kinetic weapons that are already close by and can disable them silently. The latter weapon type is known as a co-orbital weapon, because it shares the same orbit. Such weapons might be able to kill the satellite with very little warning (although it would be possible to attribute who did it).

On the other hand, disrupting communications with silos is difficult, and might not be feasible, especially if highly redundant cables have been installed. Thus, totally eliminating a country’s ability to retaliate by degrading communications channels is unlikely if they are prepared. It might be possible today, but low cost infrastructure projects could quickly remedy this.

3.6. Cyber Vulnerabilities

Finally, software is a ubiquitous and essential part of all NC3I systems. Much of it is legacy software, and almost certainly contains many cyber vulnerabilities. To some extent, this is offset by the fact that many NC3I systems are fully airgapped from the internet - reducing their exposure to malware and malware developers. This isn’t necessarily sufficient to protect the defenders from malware though. Stuxnet is an example of a virus that successfully spread to airgapped systems. The defenders have another benefit though: attackers can’t easily probe the relevant systems without the risk of being detected. If attackers are detected, the vulnerability can be fixed.

AI R&D has immense promise in executing cyber operations. It’s an entirely computer-based task, and plays to AI’s relative strengths. There are already examples of AI being used for automated vulnerability detection and exploit development. It can also serve a role in espionage that makes any NC3I attacks more potent. For example, it might be used to identify potentially disgruntled ex-employees at contractors who could be turned.

3.7. Reducing Attack Confidence

Here, our goal is to reduce the confidence the defender has in their decision to launch an attack. This could be because they’re not sure an attack is being launched in the first place.

To accomplish the first, we can sync up the pre-emptive strike with phenomena known to cause outages, like solar flares. The Sun undergoes regular 11 year cycles of activity, and will be once again reaching a peak of activity near 2035. This will increase the base rate of false positives for jamming, and could prevent the defender from recognizing a genuine jamming attempt from an attacker. However, note that a solar flare will also impede the attacker’s ability to execute ballistic missile defense against any retaliatory missiles. Apart from solar storms, one could also engineer a satellite mishap that damages early warning satellites. Cyber attacks are also a great way to make it seem like the computer systems indicating the strike are unreliable.

In theory, one could also complicate determining who launched the attack, in covert scenarios. We are now moving towards a tripolar world where the US, China, and Russia all have the capability to launch nuclear strikes on each other. As such, identifying who is attacking is necessary to retaliate. In out-of-the-blue strikes launched from submarines, this may be tricky. It would be catastrophic to launch the retaliation at the wrong country, and invite yet another countervalue strike. That being said, in a world where one nation is dramatically more advanced than all others, the defender could reasonably assume that the only party that would launch a pre-emptive strike would be the advanced one, as they are the only one likely to be able to survive retaliation. It all depends on how covert the preparations have been.

These schemes are unlikely to avert a retaliatory strike, but could delay launch-on-warning by a few minutes, since it might cause leaders to wait for more data, in order to avoid the risk of inadvertently attacking a third party.

3.8. Decapitation Strike

A decapitation strike aims to eliminate the leadership apparatus of a nation, ideally with the goal of preventing nuclear retaliation. This goal is unrealistic: all nuclear superpowers today have backup plans that allow launch authority to be transferred if leadership is incapacitated. But, in our case, the goal isn’t necessarily to permanently eliminate leadership, but to delay the launch authorization process. Even 15-30 extra minutes is strategically significant. However, we’ll also see that decapitation strikes have some downsides that may make their use undesirable.

During peacetime, their locations are generally well known, making a decapitation strike relatively easy (by the standards of a pre-emptive strike). However, there are other important nodes in the nuclear command chain. For example, in the US, NORAD is responsible for nuclear early warning and coordination, and may also be viable targets for an effective decapitation strike. That being said, NORAD (and similarly purely military command and control centers) tend to be harder targets than state capitals. NORAD can operate from the Cheyenne Mountain Complex, a deeply buried bunker, whereas national capitals are generally relatively soft.

During times of heightened alert, leaders may be moved to bunkers, like the Cheyenne Mountain Complex, or Raven Rock. Most of these bunkers are likely vulnerable to near-future nuclear busters, like the (now cancelled) Robust Nuclear Earth Penetrator (RNEP), which could destroy a target buried as deep as 480-850 meters below ground, depending on whether the tunnels are lined with iron to prevent spalling. A weapon of this power might be able to destroy Kosvinsky Kamen (buried at 300 meters), said to house the Perimetr system. That being said, there are other bases like the Cheyenne Mountain Complex (at 610 meters), as well as Russia’s Mount Yamantau, (at 914 meters) that would likely survive, even using the 1.2 Megaton max power of the RNEP’s B83 warhead. That being said, an 8x increase in explosive power (to 9.6 Megatons) would suffice to destroy all of these bases.

A major issue with bunker buster bombs, especially very powerful ones, is that they tend to be heavy. Thus, all existing designs are built to be delivered from bombers, not ICBMs. As discussed earlier, bombers could plausibly be part of the initial strike, but they have important limitations (like being vulnerable to a combo of low-frequency radar and fighter aircraft) that mean their useful range is probably limited to coastal areas where they can quickly reach their targets before fighters are scrambled. A deeply inland attack would be challenging.

However, stealth bombers aren’t the only way to deploy a nuclear bunker buster. They could also be mounted to hypersonic missiles, or kept in orbit, and dropped when necessary. The latter approach would require a constellation of satellites that the bunker buster could be disguised within, and is subject to risk of discovery.

Supposing we do manage to incapacitate the entire leadership structure, there are mechanisms for switching launch authority over to military commanders who would be responsible for retaliating. In Russia, Dead Hand is reportedly still active, and would serve to transfer launch authority to military officials if a strike on Moscow is detected. In the US and China, there is no publicly disclosed system for switchover. In the US, we know that prior presidents have pre-delegated some of their nuclear powers to members of the military, although details are highly classified regarding to whom, and to what extent this is done today. In any case, there would need to be a mechanism for ensuring that leadership was really dead before transferring launch authority.

The amount of extra time before retaliatory launch induced by waiting for switchover in a decapitation scenario is an unknown factor. No country has fully disclosed what methods they use to verify that all higher-ups in the chain of command are gone. Since the risks of accidental use or unauthorized launch are so high, my guess is that the actual transfer of control will take 5-15 minutes, but this is only a very rough estimate. That being said, the commander to whom this power is transferred can use this extra time to synthesize information and choose an attack plan, lessening planning time. All things considered, I’d probably estimate an extra 10 minutes delay granted from a decapitation strike (to be added on to other delays from cyber attacks, jamming, or other ploys).

That being said, decapitation strikes have known downsides. First, assuming a nuclear weapon were used, it would result in a much higher loss of life than a traditional counterforce strike. As we discuss later (6.), modern technology enables launching a nuclear counterforce strike with much lower loss of life than traditionally believed possible. It might be possible to only inflict a few tens of thousands of civilian deaths. A nuclear weapon detonated on a national capital would be extraordinarily expensive in terms of civilian deaths by comparison. Second, and more importantly, it disables the ability of the leadership to surrender in an orderly manner. After a broadly successful counterforce (but not countervalue) strike, it’s not unthinkable that a nation’s leadership may choose to de-escalate rather than launch an all-out countervalue strike.

Indeed, although nations’ public statements have tended to emphasize overwhelming retaliation as the only response for a nuclear attack, we know that things in real life would not be so clear cut. Both the US and Soviet Union’s nuclear plans maintained the ability to respond “proportionally”, and both states prepared for the possibility of a limited nuclear war. In a scenario where the US had been almost completely disarmed by a pre-emptive counterforce strike, but retained most of its population centers, it’s rational a president might choose to negotiate for peace rather than launch a severely weakened countervalue attack that would invite further destruction.

All nuclear powers likely already have the means to conduct decapitation strikes, even without considering AI R&D. That being said, there are still some places where it could help:

1. Tracking of leadership movements via open source and signals intelligence, which might be valuable for carrying out a targeted strike.

2. Accelerated development of a nuclear bunker buster, and a higher power nuclear warhead.

Overall, a decapitation strike is unlikely to prevent retaliation on its own, but could plausibly delay it by forcing a switchover to a backup launch authority. This delay would combine with other delays induced by cyber attacks or communication disruption, giving more time for stealthy conventional and unconventional weapons to destroy as much capability as possible. However, a decapitation strike would have significant downsides. First, it would result in high civilian casualties, which might be politically unpopular. Second, and perhaps more importantly, it eliminates the defender’s ability to surrender, foreclosing the most desirable outcome of a counterforce strike.

3.9. Overall Assessment

Degrading launch on warning is the most achievable of the five enablers, and the least dependent on AI-accelerated R&D. Depressed trajectory SLBMs (which use well understood technology) launched from near the coast can strike any inland target within 10 minutes. Orbital strikes (more speculative) offer even less warning. Either of these would give the defender extraordinarily little time to respond. Leadership’s ability to respond can be further reduced through jamming, cyber attacks, and counter-intelligence schemes. These attacks are complementary: they can be layered to further increase the necessary amount of time needed to come to a launch decision. Even if the leader is able to make a decision within 5 minutes of receiving first reports (an optimistic assumption), by that time, strikes on command center nodes might already have been completed, adding further delay to when the launch order is executed. Altogether, a significant fraction of fixed-location targets would be destroyed in a first strike, even for an enemy on relatively high alert.

Historically, this was considered a moot point, since submarines and TELs were considered invulnerable, and could be used to retaliate. As we’ll see in later (4.) sections (5.) these assumptions may not continue to hold.

Note that there is the option of decapitation strikes as well. These would probably significantly delay retaliation, due to the time needed to confirm that the capital was not responding, but have the downside of limiting the target’s ability to surrender.

That’s not to say executing a first strike would be trivial. Countries are well aware of the first strike risk, and have worked to be able to compress their decision timelines. China is very wary of US first strike and decapitation risks, and these fears were allegedly one of the driving factors behind moving to a launch on warning stance. If China (for example) learned the US was researching depressed trajectory SLBMs, it could lead to a Chinese nuclear early warning system set on much more of a hair trigger. Such a system would be far more vulnerable to false alarms. There are limits though. At a certain point, the risk of accidental war is higher than the risk of being wiped out by a first strike.

But, by far the biggest uncertainty is operational coordination. A first strike would be an extraordinarily complex operation. It would require months of preparation across multiple military branches, with tight synchronization between submarine positioning, bomber flights, any potential cyber operations, and the land-based ICBM launches. Any leak or detection during this preparation phase would likely cause the defender to raise its alert level, dispersing mobile assets and putting SSBNs to sea, dramatically increasing the difficulty of the overall counterforce strike. That said, this is a planning and operational security challenge, not a technological one, and an AI advantage could help with coordination and counter-intelligence.

4. Improved SSBN Detection Capability

If launching a surprise attack where the target state is at a peacetime alert level, the only components of a nuclear triad not held at a fixed location are the SSBNs. Improving a nation state’s ability to locate SSBNs might allow it to totally eliminate the opponent’s retaliatory forces in a fell swoop. Naturally, detecting SSBNs is tricky for a few reasons. They are invisible from the air, and designed to have a very low sonar signature.

However, if the SSBN location is revealed, it is relatively vulnerable. Historically, the greatest threat to SSBNs were silent nuclear powered attack submarines (referred to as SSNs in literature) that trailed the submarine after it left port. The SSBN can’t detect its pursuer due to noise from its own propulsion unit. SSBNs can also be taken out by nuclear depth charges. A 1 megaton nuclear depth charge can destroy modern SSBNs within a range of 2.25 miles. That being said, depending on how much warning the SSBNs get, it may take several bombs to ensure destruction.

4.1. Summary

• The US likely had high-confidence SSBN tracking during the Cold War but has lost that ability for both Russia and China since then.

• There are no silver-bullet technologies. If the oceans can be made transparent, it will be through combining multiple approaches: improved acoustic signal processing, non-acoustic sensors (wake/heat/magnetic), space-based SAR and LiDAR, and UUVs. Several of these approaches have hard physical limits, and none are individually decisive.

• The bulk of the necessary improvements are software-heavy (signal processing, sensor fusion, UUV autonomy) or simulation-heavy physics R&D (magnetometers, possibly neutrino detection). Both play to the strengths of AI R&D and can iterate quickly.

• The biggest uncertainty is not the science but the productionization of sensor constellations at scale. Process knowledge for manufacturing is often tacit and not well-suited to AI automation. This same constraint recurs in the missile defense section.

• Space-based detection (SAR and LiDAR) is the most strategically significant because it enables a global search without prior knowledge of submarine location. Neutrino detection is a wildcard that, if feasible, could obviate the need for full space coverage entirely.

• The US-attacker and China-attacker paths face different challenges rather than one being clearly easier. A China-attacker would need heavy investment in space-based global search (since US SSBNs are dispersed across deep ocean), while a US-attacker would already know the rough location of Chinese SSBNs in their bastions but would need to refine those locations against active interference from Chinese surface forces.

• Even imperfect SSBN detection may suffice. Locating most but not all SSBNs can be combined with missile defense to absorb residual retaliation, with orbital bombardment to destroy submarines shortly after their first launch, and with VLF communication suppression to prevent launch orders from reaching submarines at all.

• The biggest risk is countermeasures triggered by visible deployment of detection infrastructure (analogous to China’s response to THAAD in South Korea). Covert paths exist (e.g. retrofitting Starlink or Qianfan into opportunistic SAR), but require operational security that may not be sustainable.

• Net assessment: if AI-driven automation and productionization are strong enough to compress the design, integration, and deployment bottlenecks for sensor constellations and sensor-fusion systems, then sufficiently full SSBN location transparency could become practical on a 2-4 year timescale. The target nation is unlikely to be able to redesign its SSBNs fast enough to keep up with new sensing capabilities, creating windows of vulnerability before countermeasures mature.

4.2. Background

During the Cold War, the US was able to track Russian SSBNs very well. The exact strategies used to track them varied in response to Soviet strategies.

In the late 1960s to 1970s, Soviet SLBMs had relatively low range, and needed to be launched from close to the US. However, because most Soviet submarine ports were located near the west of the country, it required the submarines to transit through a patch of the Atlantic between Greenland, Iceland, and the UK, a chokepoint known as the GIUK gap. The US installed a network of passive hydrophones (underwater listening devices) in this location, known as the Sound Surveillance System (SOSUS). These hydrophones exploited a phenomenon known as the ‘deep sound channel’. At certain depths of the ocean, sound naturally bounces between the layer of warm water at the surface, and dense water at deeper levels. This allows sound to propagate for hundreds of miles, boosting the detectability of even quiet submarines. The hydrophones were only able to provide a rough location for the submarine, so the US followed up by dispatching other submarines and airplanes to the approximate location of the Soviet submarine and further narrowing down its location.

As the range of Soviet SLBMs increased in the 1980s, missiles could be launched from a greater distance, enabling Soviet submarines to avoid transiting the GIUK gap. The Soviets were also aware of US submarines tailing theirs, and focused their submarine patrols in “bastions” close to the Soviet shore that could be defended by their navy. This presented a challenge for the US, as they would need to enter Soviet waters in order to search for the submarines. Additionally, the Soviet waters were too shallow to exploit the deep sound channel, limiting acoustic detection. Nonetheless, there were two developments that helped the US. First, the US developed ship towed hydrophone arrays that could be deployed at short notice, creating a “mini SOSUS” where needed. Second, they leaned heavily on information gained from signal intelligence (SIGINT). Much of the details are classified, but it is known, for instance, that several Soviet undersea naval communication lines were tapped. In any case, even with the new Soviet strategy, the US was likely able to locate much of the Soviet SSBN fleet. The commander of the US Pacific Fleet in the mid-1980s stated: “we could do a body count and know exactly where they were. In port or at sea. If they were at sea, N3 [Director for Operations] had an SSN [Nuclear Attack Submarine] … [on them], so I felt very comfortable that we had the ability to do something quite serious to the Soviet SSBN force on very short notice in almost any set of circumstances”.

Moving to the present day, Russia continues to operate on the bastion system, with China also taking a similar approach. The advantage of the bastion approach in the modern day is it allows the country to detect and intercept hostile submarines that may be shadowing the SSBN. The US does not take this approach. Instead, it continues to operate its SSBN in the deep ocean, relying on the difficulty of locating these SSBNs in the first place.

On the surveillance side, we know that the US has maintained the Integrated Undersea Surveillance System (IUSS). However, the capabilities of the system, and whether they still possess high confidence location knowledge for adversary SSBNs is classified, and difficult to find information for at least from publicly available sources. However, the US likely no longer has this ability. In 2018, a retired senior Navy intelligence officer stated: “Chinese boomers [SSBNs] are not so loud that when a crisis begins we will with high certainty be able to find these boomers.”. Note that the deployed Chinese submarines at the time, the Type 094, are widely considered noisier than Russian ones, so we likely lack this capability for Russian submarines as well.

There is disagreement in the literature whether further technological progress favors the anti-SSBN (pre-emptive striker) side or pro-SSBN (retaliator). Lieber & Press (2017) make the case that technological development favors the anti-SSBN side. They argue that improvements in acoustic sensors, sophisticated big data analysis, and unmanned undersea vehicles (UUVs) favor the anti-SSBN side, although they do not analyze the impacts of these technologies in depth. On the other hand Stefanick (2025) evaluates several possible emerging technologies for detecting, attacking, and defending SSBNs in depth. He concludes that while both the pro and anti SSBN sides will see their methodology evolve over the coming 20 years, the pro-SSBN side has more to benefit. Other commentators also discuss the increased difficulty of modern anti-submarine, even with technology on the horizon. They may well be right, but AI assisted R&D is likely to be asymmetrical: one side may be able to leverage it to gain many years of technological lead over an adversary.

We’ll select the following technologies to investigate in further depth, especially with regard to what significant technological development could entail.

1. Acoustic sensors (sonar)

2. Non-acoustic sensors

3. Space based detection

4. Unmanned Undersea Vehicles (UUVs)

We focus mostly on the anti-SSBN side, as this is the most relevant to determining if DSA can be achieved. Note that if the pro-SSBN side develops these technologies, they can also be used defensively, to attack hostile SSNs (attack submarines) which are the primary threat to SSBNs.

First, we have to identify what kinds of technologies are the most favorable to AI R&D. In general, technologies that require extensive physical experimentation will not be favorable, as the iteration loop is long, and running physical experiments will incur significant time cost. In contrast, technologies that are largely software based, such as improved signal processing or sensor fusion, can likely be developed very rapidly, since they take advantage of known AI R&D strengths. Additionally, construction projects that require interfacing with humans will take time.

As such, I expect new submarines, even with extremely advanced AI R&D doing almost all the heavy lifting for design, engineering, and software, to take 5-7 years to come online at best. UAVs, UUVs and reconnaissance satellites have a much tighter iteration loop, since prototypes can be built and tested relatively quickly and with much less expense than a nuclear submarine. Nonetheless, I expect satellites to take at least a year or two to come online.

4.3. Acoustic Sensors (sonar)

Passive sonar arrays, as mentioned earlier, have less utility than they did during the Cold War due to reduced submarine noise. Microphone technology has also advanced, but due to the ocean itself being very noisy, there is a “noise floor” that means even very powerful microphones can’t identify a submarine. Despite this, they are still the primary way to detect submarines. As a result of submarines’ increasing stealth, there has been greater investment into Low Frequency Active sonar (LFA). This sonar emits sound, and listens for the echo using a mile-long towed array. Even a totally silent submarine can be identified via this method. However, since this form of sonar emits sound, it also broadcasts the location of the searching ship. Additionally, its range is also somewhat limited, on the order of 50-100km, although exact details aren’t public.

When it comes to emerging technologies in this space, there are none that are game changers: improvements in signal processing and machine learning can allow pushing the noise floor down, effectively improving the range of both passive and active sonar systems. However, I suspect that with just improvements in this domain, the current advantage of SSBNs persists, even with a significant amount of development in this technology.

4.4. Non-acoustic sensors

However, sonar isn’t the only way to identify submarines. A useful resource here is a recently declassified 1972 CIA document which discusses (at the time, speculative) future methods of submarine detection. We’ll cover each of these only briefly, as there are many.

• Wake, Turbulence, and Heat Effects: Even travelling slowly hundreds of meters beneath the surface, submarines produce several effects. First, as they spin their propellers, they induce turbulence in the water they pass through. Their nuclear reactors warm the water around them as well. Finally, they displace water, producing a wake that can be detected from the air or space. I consider these highly promising approaches as improvements in this domain rely mostly on signal processing, and better understanding of ocean phenomena, research that could be automated with AI R&D relatively easily. These effects are easiest to detect when submarines are close to the surface or moving quickly. Since most bastions are located in shallow waters, SSBNs operating here are much more noticeable through these methods. Counters include operating deeper, slower, and creating decoy submarines.

• Magnetic Effects: Submarines are very large metal objects, and have a detectable magnetic signature at ranges of a few hundred meters with conventional magnetometers. However, magnetometers using SQUIDs (superconducting quantum interference devices) have a sensitivity several orders of magnitude better than conventional ones. In 2017, China developed a SQUID based detector that could be used to detect submarines from 6 km away. One fundamental limitation of the technology is that magnetic fields decay with the cube of distance, faster than the normal inverse square law. Even with very powerful SQUID magnetometers, it’s likely that one will have to know the rough position of the submarine to be tracked. However, an array of SQUIDs on UUVs or UAVs networked might prove viable. Counters include decoys and redesigning submarines to reduce magnetic signature.

• Gravitational Effects: While submarines are neutrally buoyant, they still affect the gravitational field, because they have more mass in the bottom half than the top half. This results in an extremely subtle gravitational anomaly that can be measured. The issue is that because we are measuring a second order impact on the gravitation field, the effect decays with the cube of distance, just like magnetic effects. Most sources agree that even with improvements in technology, magnetic fields will still be more useful for detection.

• Neutrino Effects: A nuclear reactor on a submarine may produce 10^18 neutrinos per second. Neutrinos cannot be shielded, and are an unmistakable signature of a nuclear reactor in operation. However, they are also incredibly difficult to detect, because they interact very weakly with matter. Most neutrinos from the reactor will pass through the earth without being stopped. There have been proposals to use neutrino detectors as part of nuclear-non-proliferation verification agreements, but this is complicated because of the large size of the neutrino detector, needed to have even a few neutrinos interact with it. To give a sense of scale, the Super-Kamiokande neutrino detector contains about 50,000 tons of water in a large underground tank. Indeed, the CIA proposal ruled neutrino detection out for this reason. However, I’m actually somewhat optimistic about this prospect, for two reasons. First, a recent result demonstrated the ability to detect reactor neutrinos with only a 3kg target using a newly demonstrated mechanism called CEvNS, which theoretically has the ability to provide a 4 order of magnitude improvement over current detectors if brought to maturity. Second, there are certain quantum effects that can be applied to radically boost neutrino absorption. This is somewhat speculative, but if true, it could make neutrino detectors tens of orders of magnitudes smaller. See Appendix A for more details on this.

4.5. Space Based Detection

The above options mostly applied to local sensors: those that could be mounted to ships, UAVs, or UUVs. We turn now to detectors mounted to spacecraft. These operate on the same principles as before, but the reason why space based detectors are interesting is that they don’t require knowing even the rough location of a submarine ahead of time, they can conduct a truly global search. These make them more of a threat to the US’s SSBNs. There are two main viable methods for satellite detection of SSBNs: Synthetic Aperture Radar (SAR) and LiDAR. Note that neither of these can see under sea ice, so there would need to be a second system for monitoring the Arctic and Antarctic waters.

4.5.1. Synthetic Aperture Radar

Synthetic Aperture Radar can be used to detect the wake from the SSBN. It can be used regardless of cloud cover and time of day. There are commercial SAR satellites on the market that offer resolutions down to 25cm. It would be feasible with even current day technology to build a constellation of SAR satellites. Although once it’s established that this constellation exists, other states will invest heavily in SAR countermeasures which could significantly reduce effectiveness. Since wake effects work best when submarines are close to the surface, like they would be in bastions, this technology poses a greater threat to China and Russia than it does to the US.

Building a SAR constellation with continuous coverage is highly doable for both the US and China by 2030. The US is actively working towards this capability, with its next generation of GMTI satellites. Much of the relevant information about this system is classified, including the number of satellites, and the resolution, but we do know that persistent coverage is a goal.

In the interim period, it might be possible to covertly retrofit the Starlink constellation to act as SAR satellites. Right now, Starlink satellites already have many of the qualities desired from a SAR constellation: constant coverage over most of the world, high data transfer capability, and the ability to receive low power signals. The main reason Starlink is not already usable as a SAR system is that it lacks the ability to create powerful radar pulses to illuminate the target. It might be possible to either surreptitiously add this capability to the next generation of Starlink satellites, or use Starlink as an opportunistic SAR detector, generating the illuminating pulse through other means. This would allow the US to gain the ability to detect SSBNs without triggering countermeasures from the Chinese or Russians. Similar considerations are possible with China, and their upcoming Qianfan constellation.

4.5.2. LiDAR

LiDAR relies on the fact that the ocean is somewhat transparent at certain wavelengths. Submarines can be detected if they are within 200m of the surface, by measuring the fact that light returns faster if it bounces off the submarine. This depth limit can potentially be raised with further developments in technology, with a 500m capability in development by China. Unlike SAR, LiDAR isn’t limited by low submarine speed, only by depth. However, LiDAR cannot be used when cloud cover is present. This is a significant limitation, as many bastions used by the Russians and Chinese have significant cloud cover, like the Yellow Sea. Nonetheless, because a pre-emptively attacking state can choose which day to launch on, it might be able to wait until good weather has revealed all SSBN locations.

A LiDAR satellite constellation, in contrast to a SAR one, is primarily helpful for detecting submarines. Building such a network indicates intent to pursue a counterforce strike, and would likely induce states to raise alert levels.

4.6. Unmanned Undersea Vehicles (UUVs)

Another developing technology is Unmanned Undersea Vehicles (UUVs). When it comes to anti-SSBN operations, UUVs can play the following roles:

• attempting to locate SSBNs

• trailing already-located SSBNs, in order to provide live location information

• detecting sensors and mines in bastions, so that anti-SSBN SSNs can avoid them

UUVs have many advantages. SSNs are not cheap to build, and most navies have relatively few of them. Building UUVs can be done on a much shorter timescale, and attract much less attention from adversaries. Additionally, since they are smaller, they can present a much smaller signature, to both sonar and other methods for detection.

However, they also have limitations. First, many of the roles listed require highly advanced autonomy and ability to operate under uncertainty. The UUVs will need to be able to navigate under ice, in shallow water, and make use of only passive sonar sensors. Human-piloted SSNs also have the ability to learn and adapt over time, something not possible for UUVs. Secondly, powering UUVs presents an issue currently, especially if they are doing sustained trailing. Diesel is the most practical for long ranges, but is very noisy. Finally, as UUV size decreases, sensors become less sensitive, as they lie closer to the noisy power train.

Of the limitations, autonomy would be the most improved by AI R&D. I consider it highly plausible that a sufficiently intelligent tracking system could be implemented on a relatively small UUV. The UUV power issue can be mitigated by implementing small nuclear reactors or radioisotope thermal generators (RTGs), although these may take a year or more to develop.

In general, UUVs tailing SSBNs would be noticeable, and would lead to both political and military countermeasures. For example, SSBNs could intentionally pass by friendly sensor arrays or warships, allowing the UUV to be detected. This process was referred to as “delousing” by the Soviets. Furthermore, the targeted nation would perceive the tailing of their SSBNs as a clear escalation and real threat to their nuclear security.

4.7. Overall Assessment

SSBN detection is difficult. No nation today can plausibly detect all of another nation’s submarines. Any path to finding all the SSBNs would require combining several techniques: improved acoustic signal processing, non-acoustic sensors (wake, heat, magnetic), space-based SAR and LiDAR, and large UUV fleets. All of these techniques would need to work simultaneously, and none of them are individually decisive. Indeed, several of these techniques have hard physical limits (magnetic signatures decay with the cube of distance, LiDAR is blocked by clouds and sea ice, passive sonar runs into the ocean noise floor). It’s clear that pursuing SSBN detection requires simultaneous massive space infrastructure investments as well as R&D advancements.

However, this is the kind of difficulty that can be significantly alleviated by AI R&D. There are several indications that this may be the case. First, we note that most of the improvements here are software heavy: signal processing, sensor fusion across heterogeneous sources, and UUV autonomy. These play directly to the strengths of AI R&D, since they iterate quickly and don’t require new submarine hulls or exotic manufacturing. Second, pure physics R&D (that might be required for improvements in magnetometer or neutrino detection) also plays to the strengths of AI R&D.

The biggest area of uncertainty here is how much AI R&D can help with productionizing a system once a prototype has been made. This may be a task that is less amenable to AI R&D, since failures are far more costly, and much work in productionizing has to do with the development of process knowledge that is not written down and thus difficult to train on. The need for productionization of constellations recurs in the missile defense section (7.) as well, and is likely a critical factor in achieving DSA.

There are two wildcards which may be extremely relevant for determining how easily SSBN detection can be accomplished. First is whether neutrino detection systems based on superradiance are feasible. It’s currently unknown whether they are physically possible, and if so, whether they can be made practical, but if they can be, they might offer a decisive advantage, and largely obviate the need for a full space based constellation. Second is to what extent polar ice caps prevent tracking submarines. Russian and even US submarines often operate in areas covered by ice, taking advantage of the difficulty of tracking in such environments.

Additionally, it’s important to note that there is an asymmetry between China and the US due to their different SSBN basing strategies. If China is the leading actor, it would need to invest more in space LiDAR and SAR, since global search matters a lot (US subs are widely dispersed across massive swaths of the Atlantic and Pacific). However, the subs, once found, would be vulnerable to tailing. In contrast, if the US were the leading actor, it would already know the rough location of Chinese subs (somewhere in the bastions) but would need to focus on technologies to refine the locations (through UUVs or UAVs) in a somewhat hostile environment where interference from Chinese surface ships is expected. Overall, it’s unclear which would be easier.

If a nation decided to pursue supremacy, and had sufficient AI R&D advantage, it could plausibly stand up the necessary surveillance architecture in 2-4 years. The longest delay would probably come from the development and deployment of the satellite constellations. However, even as the process was going on, it would likely develop smoothly increasing knowledge of SSBN location.

Relatedly, even imperfect SSBN detection may suffice. A possible state of operations for the attacking nation is knowledge of the positions of most (but not all) SSBNs. In such a case, the attacking state might choose to attack nonetheless, since they are confident in their missile defense system to handle however many missiles the missing SSBN would send. They might also have an orbital bombardment system that they can use to destroy the submarine after it launches its first missile within minutes (hence limiting the number of missiles launched by the submarine to just one or two). Finally, they might be able to suppress the VLF communication system (as described earlier (3.5.)), so that submarines are never ordered to attack. If we relax the requirement on knowing all SSBN locations, this could significantly lower the bar on difficulty.

The biggest risks to this approach are detection and countermeasures. A good case study here is the case of THAAD deployment in South Korea. Even though there was an extremely reasonable use case for THAAD (to defend against North Korean attacks), China vehemently protested THAAD deployment on grounds that THAAD might be able to separate decoys from real warheads if China ever launched a nuclear attack. Similarly, even though SAR and LiDAR constellations really do have plausible non-nuclear use cases, the target countries may still protest significantly, and aggressively develop countermeasures. Thus, there is significant advantage in developing covert capabilities (eg through retrofitting of Starlink or Qianfan). However, this depends on a level of operational security that may not be sustainable.

Taking all factors into account, the strongest case is not that SSBN transparency is inevitable, but that sufficiently strong AI-driven automation and productionization could make a surveillance architecture of useful scale practical to field on strategically relevant timelines. The problem remains difficult, but if the attacker can deploy new sensing and fusion capabilities faster than the defender can redesign patrol patterns, platforms, and countermeasures, windows of SSBN vulnerability could emerge before those countermeasures mature.

5. Improved TEL Detection Capability

5.1. Summary

• Only Russia and China field mobile ICBM launchers (TELs). The US does not. A Chinese first strike on the US can therefore ignore TEL detection entirely. For a US strike, TELs only matter if the target has actually dispersed them. Under peacetime conditions they sit in fixed garrisons at known locations, and would be destroyed alongside silos.

• TEL detection is fundamentally an easier technical problem than SSBN detection. TELs are visible truck-sized objects on roads, and the relevant sensing technology is mature. A satellite constellation capable of continuously tracking trucks across an entire country is buildable today without any AI advantage. The US is already developing one as a replacement for older airborne radar surveillance platforms, with first launches planned for 2028.

• The defender’s most effective countermeasures are low-tech and could be implemented within months. These include covering patrol routes with radar-blocking metal mesh tunnels, layering opaque fabric over the mesh to defeat optical imagery, and deploying decoy launchers. This creates a window of vulnerability between when the attacker fields a detection capability and when the defender finishes hardening against it. Covert development of detection capabilities is therefore disproportionately valuable for this enabler.

• As detection improves, the defender is pushed toward increasingly expensive shelter and concealment systems. These include sealed and ventilated tunnels, fully electric launcher drivetrains to suppress exhaust signatures, and dedicated infrastructure on closed government roads. Each step requires significant capital investment.

• The fully countermeasure-hardened endpoint resembles the basing schemes the US considered (and abandoned) for the MX Peacekeeper missile in the 1980s, which were fixed, expensive, capital-intensive shelter networks. Even if individual launchers survive, the defender has been forced to convert a cheap, dispersable leg of its nuclear triad into an expensive fixed one, which is itself much more vulnerable to mass strikes than the original mobile concept.

• Boost-phase missile defense (intercepting missiles immediately after launch) is particularly effective against TELs, since each launcher carries only one missile and cannot fire a saturating salvo the way a submarine can. This further reduces the value of TELs as a survivable retaliatory force.

• Net assessment: TEL detection is the most technically achievable of the five enablers, but its strategic value depends heavily on the subscenario. Against an unalerted defender, the problem is trivial. Against an alerted defender that has not yet completed countermeasures, AI-driven sensing can plausibly locate enough launchers for missile defense to absorb the residual. Against a fully hardened defender, individual launchers may survive, but only at the cost of having neutralized the original strategic value of their mobile force.

5.2. Background

Only Russia and China currently field mobile ICBM launchers (TELs). The US considered a mobile rail-based ICBM launching system, but never brought it to fruition. Under current Russian and Chinese policy, these TELs are not deployed during peacetime, and only will be dispersed during crisis situations. Thus, an ideal pre-emptive strike would destroy all TELs in their garrisons. However, in a situation where a state believes its SSBNs may be vulnerable, it may move to a policy of sending TELs on patrol by default, in order to ensure a reliable second strike capability. All things considered, TELs are even more vulnerable than SSBNs to a preemptive strike, since they operate in the open, and often share infrastructure with civilians.

The challenges of detecting TELs differ from that of detecting SSBNs. TELs are visible, and can be visually seen directly by UAVs and satellites. However, TELs operate deep within adversary territory, and thus, many methods that would be acceptable at sea (such as patrolling with a UAV) would be regarded as an airspace violation during peacetime. The most practical way to discover TEL locations is through satellite based sensing, especially SAR, which can see past cloud cover.

Many of the considerations here are discussed in “Tracking mobile missiles” (MacDonald (2025)).

5.3. SAR Satellite Constellation

SAR capabilities have improved significantly in the past years. SAR utility for tracking TELs was limited in the past since most SAR satellites were unable to image moving objects. Improvements in signal processing ability have changed this, and even commercial satellites are able to image moving truck sized objects. Currently, SAR satellites pass over a given region about once every 30 minutes, but creating a SAR constellation can decrease this significantly, or even give continuous coverage over an area.

With sparse coverage, TELs can “hide” from SAR satellites by ensuring that they are in shelters whenever a satellite passes overhead, and move between shelters in the blind periods when no satellite is overhead. However, this strategy fails when the duration between overpasses approaches zero.

As mentioned in the SAR section for SSBNs (4.5.1.), both the US and China are working towards continuous SAR coverage. Unlike the submarine monitoring capability, SAR’s ability to distinguish trucks from TELs rests on much more solid ground, even today. Note that the US’s GMTI constellation is designed to replace the E-8 JSTARS system, which was an airborne radar platform that supported both SAR as well as GMTI (Ground Moving Target Indicator). The E-8 JSTARS system was known to have the ability to differentiate tanks from trucks, and so GMTI almost certainly has this capability as well.

SAR isn’t a slam dunk though. There are a few considerations, discussed in MacDonald (2025).

1. Behavioral Countermeasures: A SAR-aware target state could hide their trucks from SAR satellites every time a satellite passes, limiting their movements to periods when no potential satellites were overhead. Thus, the attacker would never be able to detect a TEL. However, increasing the density of SAR satellites would reduce the window, and force TELs to take shelter much more frequently. An adversary state can also force TEL operators to take shelter much more frequently by creating dummy SAR satellites. Beyond a certain threshold, hiding becomes impractical.

2. Mountainous Terrain: Many Russian and Chinese patrol routes are intentionally located within mountainous terrain, to stymie surveillance of this sort. SAR is typically “side-looking” and thus, mountains cast a radar shadow. Constellations of SAR satellites can mitigate this issue by providing acquisitions from multiple angles. However, deep valleys can still be missed.

3. Tunnels: Where mountainous terrain is not available, defenders can still hide roads from SAR by covering them in metal nets that are fine enough to block SAR wavelengths, similar to the way a microwave door blocks microwaves. Mesh tunnels have been tried in Ukraine (although for drone defense, not for SAR), and are feasible to set up en masse.

4. Jammability: SAR jamming is possible. The easiest way to do this is to raise the noise floor by emitting noise in the band of the SAR signal. However, there are also methods to produce deceptive bounce signals to make the SAR receiver see false reflections, although these require detailed knowledge of the receiver that may not be available. However, since they emit a lot of radiation, jammers reveal their own location quite well, so it would be necessary to deploy decoys.

5. Decoys: The defender can create many decoy TELs that behave identically to normal ones, and force the attacker to waste resources on TELs that aren’t carrying any missile. The downside is decoys would also force the defender to waste staffing and resources as well, especially when put at ratios large enough to make attacking all decoys impractical.

All of these countermeasures are relatively low-tech, and could be implemented within a few months by the defender.

Tunnels are probably the most effective countermeasures, but there are some limitations. It’s unlikely that tunnels would be built on civilian roads unless a nuclear crisis seemed imminent, since the metal meshing would block cell and GPS reception (SAR tends to be higher frequency than cell and GPS bands), making civilian use much more difficult. A more likely implementation would instead place a few hundred miles of tunnels on remote roads on government property, minimizing expense and nuisance while still protecting TELs from destruction. Before these countermeasures are implemented, the TELs would be incredibly vulnerable to detection. Thus, covert development of a SAR capability seems particularly high value for an attacker.

However, if the target state places its TELs in wire mesh tunnels, the attacker does have other mechanisms of detecting TELs, which are described below.

5.4. Optical Satellite Constellation

Optical reconnaissance satellites can also be used. Unlike SAR, optical reconnaissance satellites can point straight down (“nadir-facing”). This allows them to see into deep valleys that are off limits to SAR. They can also see through metal mesh-only tunnels, and are unaffected by radio jammers. A limitation of these optical imaging is that they only function during the day and when there are no clouds. However, they are much harder to jam. Optical reconnaissance satellites are best used as a complement to SAR, seeing where SAR can’t. The pre-emptive striker nation has the advantage of being able to wait until climatic conditions and time of day line up to identify all TELs.

However, optical satellites are still vulnerable to tunnels and decoys. Note that these tunnels would need opaque fabric, likely layered on top of the wire mesh. They would be a nuisance on civilian roads (since they impede visibility), and are unlikely to be implemented there unless a nuclear crisis seems imminent.

5.5. DiAL

Differential Absorption LiDARs (DiALs) can detect exhaust gases. These LiDARs shine two nearby light frequencies through the atmosphere, where one frequency is absorbed by a particular gas of interest. The difference in the return of the two frequencies indicates how much of the gas is present. As long as the tunnel is made out of mesh, the gas would diffuse out, where it could be detected. Thus, the location of the TEL within the tunnel could be determined by looking at where new exhaust gases have been emitted. The DiAL system could be mounted on a satellite, so it can regularly overfly the area, and provide real-time coverage.

Note that DiAL satellites are proven technology. Some already exist today (like MERLIN or MethaneSAT), but they focus largely on methane from industrial sources. The technology would be relatively easy to adapt to exhaust gases like nitric oxides or carbon dioxide, but the real challenge is in sensitivity. Distinguishing a single TEL at orbital ranges would require R&D to develop powerful enough lasers and sensors to detect minute quantities of gas. That being said, this kind of research is relatively amenable to AI R&D. If constructed, a DiAL satellite constellation likely would be able to localize TELs even within mesh tunnels, as long as their engines were running. The US has not released any public plans to field a constellation of DiAL satellites.

If a constellation of DiAL satellites were created, the defender would have a few countermeasures. The simplest would be to turn the truck’s engines off when a satellite is overhead, analogously to the SAR hiding case. However, this method would fail analogously too. When enough satellites are overhead, the TEL will be under continuous observation. Thus, continuous custody can be maintained over the TEL from whenever it first drives in, and again whenever drivers are exchanged.

The next countermeasure would be to avoid running the engine at the TEL location. This could be done by switching to a fully electric drive train. Hybrid diesel-electric drive trains exist for military vehicles, but a fully battery-electric TEL is precluded by the low energy density of current batteries. That being said, it might be possible to run a stationary generator, and then use a third-rail system to provide electricity to the TEL. However, this would likely be complex, and would require redesigning the vehicle to some extent. Building the infrastructure is also non-trivial, and would get expensive, especially in situations where long patrol routes are desired to maximize uncertainty.

Yet another countermeasure might be to seal off the tunnel to prevent exhaust gases from escaping in a location that gives away the location of the TEL. This would allow using the TELs as-is, without modification. However, this system would require ventilation and exhaust scrubbing, and would also be expensive.

Finally, DiAL is still susceptible to decoys. It can’t discriminate easily between different kinds of exhaust from different vehicles, and running other heavy trucks within the tunnel might be indistinguishable from a TEL.

5.6. Unattended Ground Sensors

Another method might be to use sensors located on the ground. These might be camouflaged to look like rocks or other debris, and use cameras, microphones, or other means to distinguish a TEL, and report information to a satellite. This approach would give only intermittent data, but would be able to work even if fully opaque and non-breathable tunnels are implemented by the enemy.

The main issue with such sensors is that they are vulnerable to detection. In order to get good coverage, many sensors would be required, raising the chance of detection. And, if even one such detector is discovered, it’s likely the defender will sweep the entire path, and discover all of them.

Another issue with these sensors is the question of how to deposit them in the first place. While it might not be too difficult to do this on unprotected civilian roads, in a model where TELs only patrol tunnels in remote and potentially closed-off areas, it might be challenging to deploy sensors in an undetectable way.

5.7. SIGINT

If the roads the TELs are using see civilian use as well, it may be possible to use information from civilian dashcams (gathered either from social media or through cyber operations) to detect the presence of a TEL, which can be followed up on through other means. Like unattended ground sensors, this would give only spotty information.

5.8. UAVs

There are three primary problems with UAVs. First is their vulnerability to air defenses. Both China and Russia have advanced air defense systems that are capable of identifying most drones and shooting them down. Second, many UAVs would be needed in order to cover potential TEL locations. Each UAV can only detect TELs in its line of sight. Even with high flying drones, dozens would be needed to cover potential areas. Finally, getting UAVs to their targets is slow. Most UAVs are subsonic, and will require time to reach close to the TELs. If any are detected, they will alert the target country.

Due to the challenges above, using SAR, optical, or DiAL satellites would be preferred if possible. However, if the most secure types of tunnels are implemented, UAVs may be necessary, in order to gain more information (through acoustic or magnetic means) about their whereabouts. As such, it’s still worth thinking about them.

One way that the attacking nation might be able to bring many UAVs onto the scene soon enough for them to be relevant is to buy them more time. If immediate commands to launch can be suppressed (through the mechanisms described earlier (3.5.)), it might be fine if the UAVs arrive relatively late. Since the mobile TELs can only use HF wireless transmissions, if the geostationary satellites are destroyed, and HF blocked by strategic nuclear detonations, they might not be able to receive launch orders for a few hours.

If it’s not feasible to block all communications, it might be necessary to have the drones begin their journey to the TEL areas before the main thrust of the attack. In this case, there are stealthy “penetrating drones” that are designed to carry out missions in adversary territory. These drones can use passive sensors or “low-probability of intercept” radar to identify TELs.

5.9. Overall Assessment

The strategic relevance of TEL detection is highly contingent on the exact scenario being considered. The US, for instance, does not field any TELs. Thus, any Chinese pre-emptive strike on the US (but not Russia) can simply ignore this issue. TELs may also simply be ignored if the operation is covert enough, since TELs are generally only dispersed during times of nuclear crisis. In out of the blue strikes, they will be housed in garrisons, and quickly destroyed. TEL detection therefore becomes relevant only in two specific cases: a strike during a period of raised alert, or a strike in a world where the target nation has shifted to default-dispersed TEL patrols in response to perceived SSBN vulnerability. Both are plausible, and the second is exactly what we’d expect if SSBN detection succeeds, so this enabler can’t be dismissed even though it doesn’t apply universally.

The good news for the attacker is that TEL detection is fundamentally an easier problem than SSBN detection. TELs are visible truck-sized objects on roads, and the relevant sensing technology is mature. Commercial SAR can already image moving truck-sized objects, and the US is actively building a continuous-coverage GMTI (and likely SAR) satellite constellation, which first launches beginning in 2028. China is also working on this capability, although we have fewer official statements. It’s likely they will also have a constellation on a similar timeline. In contrast to SSBN detection, AI R&D is not the limiting factor for the basic capability. The constellation could be built today, if desired. AI’s contribution would largely be in marginal speedups to manufacturing, cross-constellation image fusion, and enabling the more exotic detection modes discussed below.

Efforts from the attacker to detect TELs, and efforts from the defender to hide them form a sequence of countermeasures, and counter-countermeasures that would likely be developed and deployed in turn. The first step is SAR and optical imaging, both of which can easily detect TELs in the open. The defender’s likely response is layered metal mesh and opaque fabric tunnels on remote government roads, which is a relatively simple intervention, and fast (weeks to months) to deploy. The combination would effectively defeat SAR and any optical imaging satellites. The next step for the attacker is DiAL satellites, which can detect engine exhaust diffusing out of the tunnel walls. The defender’s response is either sealed and ventilated tunnels with exhaust scrubbing or fully electric TEL drive trains with third-rail infrastructure. Each of these steps requires a significant capital investment from the defender.

It’s interesting to note that the fully countermeasure-hardened endpoint, with TELs operating only inside sealed, ventilated or electrified tunnel networks on government-owned roads, has converged onto something that looks similar to the MX Peacekeeper basing schemes (especially Racetrack and Buried Trench) that the US considered and abandoned in the 1980s. At this point, the defender has lost much of the original strategic value proposition of TELs: cheap, dispersable mobile launchers that can exploit already existing civilian road infrastructure for survivability.

Another strike against TELs is the fact that boost phase interception (discussed further later (7.3.)) is particularly good at countering TELs, since each TEL only packs one missile, unlike SSBNs, which can fire salvos.

As such, my net assessment is that TEL detection and neutralization is the most likely of the five enablers to succeed technically. However, its strategic value is limited by which subscenario applies. Against an unalerted defender, TELs are sitting in garrisons, and they can be destroyed trivially. Against an alerted defender who has not yet completed countermeasures, a SAR, optical, or DiAL constellation combined with image analysis can plausibly locate nearly all TELs, certainly enough for missile defense to absorb the residual ones. Against a defender who has fully hardened tunnels, a mass strike would be needed, and many TELs would plausibly survive, especially if there were a limited number of missiles to use in a first strike. However, the defender would have been forced to spend significant amounts of money, and there are other countermeasures (like communication disruption (3.5.)) that might mitigate the risk. There is a strong argument for covert development of detection capabilities, since the defender will be vulnerable until countermeasures are implemented.

6. Precision Strikes

In the 1950s, when the US had uncontested nuclear primacy, leadership recoiled at the expected death toll of such a war. Making counterforce strikes kill fewer people can make them politically more feasible.

6.1. Background

Assuming that we execute the counterforce strike with ballistic missiles, a major issue in the past was that missile accuracy was low enough that only a nuclear warhead would provide enough power to ensure the destruction of the target. Since there are thousands of targets (silos, garrisons, and airfields), the execution of any counterforce strikes would lead to thousands of nuclear detonations occurring across enemy territory.

These detonations would kill civilians in two ways:

• Blast and Fire: These are the immediate effects of the explosion.

• Fallout: The neutron radiation from the detonation “activates” the vaporized debris. This debris then forms into a dust cloud that can disperse a significant distance downwind. The fallout wouldn’t kill people immediately, but over a period of days to weeks as they were exposed to continuous radiation.

Unfortunately, the counterforce strikes would produce a significant amount of fallout. There are two primary ways to detonate a nuclear weapon over land: air bursts and ground bursts. The air burst spreads out the energy of the detonation over a wide area, but has a lower peak intensity. In contrast, the ground burst maximizes the peak energy at ground zero, but distributes the energy less evenly. In order to destroy hardened missile silos, ground bursts would need to be used. Unfortunately, ground bursts produce much more fallout, since they irradiate much more debris.

Partially by design, most missile silos are located far from major population centers. As such, the primary risk to civilians is from this fallout. Estimates of the civilian death toll will vary depending on which state is attacked, weather patterns at the time, and the exact parameters of the attack, but a 1986 study simulating the effect of a counterforce strike on the US suggested that an attack on our missile silos with 0.5MT ground bursts would lead to only 100-200k deaths from the immediate blast, but 2.2-14.9M deaths from fallout.

That being said, there are other parts of a counterforce strike that would lead to more immediate casualties. Airfields used for strategic bombers, which would also need to be targeted, are generally closer to cities. The same simulation predicts 4.2-6.7M deaths from the immediate blast for the bomber bases.

In both cases, casualties would decline significantly if we used smaller bombs. However, this necessitates more accurate guidance that can deliver the bomb precisely to the target. I consider it highly plausible that AI could improve on this. In Lieber & Press (2017), they note many countries have already deployed short and medium range missiles (although no ICBMs) with a CEP (Circular Error Probable) of 50 meters. With an accuracy that high, it would be possible to destroy a hardened missile silo with a payload of only 5 kilotons. Taking it further, if a CEP of 10-15 meters could be achieved, only a 0.3 kiloton warhead would be required.

A strike with only a hypothetical 0.3 kiloton warhead would localize almost all damage to the site of the missile silos, and deaths would probably be limited to only military personnel at the location. The death toll would probably be on the order of tens of thousands, which is significant, but not unthinkable.

Improving guidance systems of warheads is likely relatively automatable. Much of the work will lie in improvements in signal processing and warhead firmware. As such, I consider it highly plausible that massive reductions in CEP are possible.

7. Improved Missile Defense

Even with an extremely successful counterforce strike, it’s possible that an SSBN or a few TELs may be missed. In this case, the attacking nation has to contend with a countervalue strike. Having a strong missile defense allows the attacker to miss some targets, and still avoid taking any retaliatory damage.

7.1. Summary

• Missile defense is the only enabler that absorbs residuals from the other four. Each upstream enabler is probabilistic and will leak some warheads, so missile defense determines how perfect they need to be: a strong defense layer relaxes their requirements, while a weak one means even modest leakage is fatal to the scheme.

• The primary retaliatory threats are SSBN-launched SLBMs and surviving TEL-launched ICBMs. Hypersonic glide vehicles are secondary. Cruise missiles, aeroballistic missiles, and nuclear UUVs are minor threats handled by existing or near-future technology.

• All three nuclear powers currently have grossly inadequate strategic missile defense. The US has nationwide missile defense, but only has 44 interceptors at 55% kill probability each, insufficient against a real retaliatory salvo. Russia’s missile defense covers only Moscow, and China has no nationwide system.

• The historical bottleneck has been cost and production volume, not physics. The relevant components have existed since the SDI era. This is where AI R&D has the most direct leverage: automating design, software, and electronics work to drop per-interceptor cost by roughly an order of magnitude.

• A feasible modern architecture layers (1) cheap ground-based interceptors with multiple kill vehicles per missile, (2) a space-based boost-phase constellation analogous to Brilliant Pebbles (~100,000 interceptors, ~$20B), and (3) solid-state lasers used primarily for warhead/decoy discrimination. This would be inadequate against a fully intact arsenal, but against a weakened second strike of a few dozen warheads it could plausibly achieve very high success rates.

• Hypersonic glide vehicles are a real but manageable threat even without AI R&D, given US countermeasures already in development, and the fact that hypersonic missiles are much more heavy (and thus fewer are expected in a retaliatory salvo). Nuclear UUVs (Poseidon) are the least credible threat: unverified, coastal-only, and detectable by the same methods used for first-strike SSBN hunting.

• The central technical uncertainty (as in SSBN detection (4.)) is productionization. Designing a cheap interceptor is well-suited to AI R&D; mass-producing hundreds of thousands on schedule depends on tacit manufacturing knowledge that may not be. Time-to-field is set by launch cadence and production lines, not design.

• The central strategic uncertainty is visibility. Boost-phase constellations and large interceptor fields cannot be disguised, making this enabler much more compatible with the public subscenario than the covert one. Historically, comparable buildups triggered offsetting responses (warhead expansion, penetration aids); viability rests on the leading actor iterating counter-countermeasures faster than the defender can adapt.

• Net assessment: effective defense against a weakened second strike is plausible given sufficient AI R&D and a 3-5 year construction window. Defense against a fully intact arsenal remains implausible, but is not the relevant standard — missile defense’s required performance scales inversely with the success of the upstream enablers.

7.2. Background

While ballistic missiles still form the mainstay of Russia, China, and the US’s strategic nuclear deterrents, there are other missile types that pose a strategic threat.

The DIA’s 2025 analysis of threats provides a good overview:

Source: Golden Dome for America: Current and Future Missile Threats to the U.S. Homeland, DIA.

We’ll analyze each of the threats in the context of a retaliatory strike after a mostly successful counterforce strike:

• Intercontinental Ballistic Missiles (ICBMs): ICBMs in missile silos would likely be almost entirely destroyed after a missile strike, as they have a known, fixed location. However, some TELs may survive detection, especially if hidden in steep valleys which can’t be seen from satellites. Each TEL can carry 1 ICBM, but both Russia’s and China’s current TEL-launched ICBMs are MIRV’ed.

• Submarine-Launched Ballistic Missiles (SLBMs): These pose a significant threat, since each SSBN may carry many (10-20) SLBMs, each of which is likely MIRV’ed with up to 8 MIRVs per SLBM. However, there are relatively few SSBNs (each nation has less than 20), making it easier to destroy all of them. If the attacking nation misses even one submarine, it will need to defend against dozens of warheads. SSBNs can also carry hypersonic or cruise missiles, although they likely don’t make up the majority of their payload, since those options have less total destructive capacity.

• Aeroballistic Missiles: These missiles, exemplified by the Russian Kinzhal, alternate between phases of ballistic flight and aerodynamic maneuvering, making them harder to intercept. However, they lack the range of ICBMs (~2000 km for Kinzhal) and typically carry only a single warhead. All current aeroballistic missiles are air-launched, requiring a surviving bomber or fighter (such as the MiG-31K) as a delivery platform. Post-counterforce strike, few airfields would remain, making these a minor threat in a retaliatory context.

• Hypersonic Glide Vehicles: These systems, such as Russia’s Avangard and China’s DF-ZF, are launched atop traditional ballistic missiles but separate at the end of the boost phase and glide through the upper atmosphere at hypersonic speeds, maneuvering unpredictably. This makes them extremely difficult to intercept with midcourse BMD, since they don’t follow a predictable ballistic trajectory. However, they are much heavier: The Russian ICBM RS-28 Sarmat can launch 16 standard warheads or 3 Avangard hypersonic glide missiles.

• Land Attack Cruise Missiles: These are effectively traditional cruise missiles bearing a nuclear payload. Cruise missiles are highly maneuverable, but subsonic variants have limited range and are slow enough to be intercepted by conventional air defenses. These wouldn’t be a significant threat post-counterforce strike since they would need to be launched from a plane or submarine close to enemy territory, platforms that are unlikely to survive a first strike. However, Russia is developing Burevestnik, a nuclear-powered cruise missile with theoretically unlimited range. Burevestnik could be pre-positioned or launched from deep within Russian territory, making it harder, but not impossible, to neutralize in a counterforce strike.

• Fractional Orbital Bombardment System (FOBS): These are ICBMs that enter a low earth orbit before de-orbiting over the target site. They have much shorter flight times, and can come from unexpected directions. However, they require a much stronger rocket to put them into orbit, and the warhead must be lighter in order to support the de-orbiting rockets. Due to size constraints, FOBS wouldn’t be present on TELs or SSBNs.

• Nuclear UUVs: Russia has built a nuclear-powered UUV called Poseidon capable of nuclear payloads. In a second strike scenario, Russia has indicated it would equip Poseidon with a cobalt bomb, designed to intentionally produce very radioactive and long lived fallout. Poseidon is designed to detonate off the shore of a city, and cause a tsunami carrying the fallout to inundate the target city. It can be launched from specialized submarines or be staged on the seabed.

Realistically, the main threats post-counterforce strike are SSBN and TEL based ICBMs. Hypersonic glide vehicles also pose a real threat, but none are known to be deployed on SSBNs currently, and even in the future, likely wouldn’t form the majority of warheads on a SSBN. Cruise and aeroballistic missiles are less threatening, as they can be intercepted with existing technology, and the missiles generally rely on air platforms that wouldn’t be available after a first strike. Finally, I consider UUVs the least credible. They are not yet confirmed to be functional, and a first strike should be able to destroy most launcher submarines. As such, we’ll focus primarily on ballistic missile defense (BMD) technology. We’ll secondarily look at defenses against hypersonic missiles and UUVs.

7.3. Ballistic Missile Defense

7.3.1. Summary

• Current BMD systems are grossly inadequate for a realistic retaliatory salvo. The US GMD has only 44 interceptors, each with a 55% kill probability — nowhere near sufficient against even a single surviving SSBN’s payload of dozens of warheads. Russia and China have even less.

• Three potential mechanisms can radically improve this: improved interceptor missiles (more volume, multiple kill vehicles per missile, better kill vehicle software), space-based interceptor constellations (boost-phase intercept, analogous to Golden Dome / Brilliant Pebbles), and directed energy weapons (primarily solid-state lasers for warhead discrimination, enabling midcourse interceptors to focus on confirmed warheads).

• Improved interceptor missiles are the most near-term and AI-amenable. AI R&D could reduce per-missile cost from ~$70M to ~$3M, making it financially feasible to deploy hundreds of missiles with tens of kill vehicles each — giving orders of magnitude more intercept opportunities. This approach is likely sufficient to handle a salvo of ~20 MIRVed missiles.

• Space-based constellations (100,000 interceptors) are feasible at roughly $20B given cheap launch costs and AI-reduced manufacturing costs. The critical weakness is salvo defense: a submarine firing 10+ missiles in succession can rapidly exhaust local interceptors. This is manageable if enough interceptors are deployed, but makes the required constellation size much larger.

• Directed energy weapons are high-upside but high-risk. Solid-state lasers are the most promising: compact, electrically powered, tunable, and rapidly improvable via AI R&D. They are best used for discrimination (confirming real warheads vs. decoys) rather than outright destruction, which requires less energy and avoids heat dissipation issues. Nuclear-pumped options (Excalibur, Casaba-Howitzer) are effectively ruled out by the nuclear test ban.

7.3.2. Background

BMD technology can generally be classed into three categories, by which stage they target the missile at:

1. Boost Phase: Here, we’re aiming to target the missile right after launch. The missile is still burning propellant, making it a highly visible target, and hasn’t yet had the chance to deploy chaff, decoys, or other countermeasures. However, the launch tends to happen over enemy territory, making it hard to target the missile without a presence in the country.

2. Midcourse Phase: During this phase, the missile is in space, and is transiting to its destination. There are two key advantages of targeting the missile during this time. First, this phase takes much more time than the other two: the missile may remain in space for 20 minutes. Second, one can achieve very large geographical coverage with a single defense battery, as the interceptor missiles can travel quite far. However, there are cons too: the attacking missile can deploy chaff and decoys that make it quite challenging to pick out the true warhead. Modern missiles also have multiple independently targetable re-entry vehicles (MIRV). This means that each missile may need many interceptors to fully counter all the warheads.

3. Terminal Phase: Here, the missile is re-entering the atmosphere. This is the last possible chance to intercept the missile. Because of drag, warheads can be easily distinguished from the lightweight chaff and decoys. However, the issue with MIRVs requiring many interceptors to counter persists. Another con is that the time budget to intercept is very short, less than 30 seconds. Additionally, any given defense battery can only defend a small geographic area around it, so many batteries will need to be built to achieve full coverage.

Most BMD schemes layer defenses at as many phases as possible, to get as many opportunities as possible to shoot down the incoming warheads. When a missile makes past a given phase, it is said to have “leaked” past it. Different levels of leakage are acceptable depending on the use case of the BMD scheme. When defending missile silos, it might be acceptable to accept a certain level of leakage in exchange for cost savings, whereas in city defense, we would want to drive leakage as close to zero as possible, even at great cost.

The need for ballistic missile defense was apparent since the earliest days of missile warfare, and technology studies (such as Project Wizard) were in development as early as 1946. The first serious attempt involving real hardware was made by the US with the Nike Zeus program in the late 1950s and early 1960s.

Nike Zeus

Nike Zeus aimed to intercept incoming missiles during the terminal phase. Earlier versions of Nike Zeus (known as Zeus A) aimed for endo-atmospheric intercepts (late terminal), but later versions (Zeus B) aimed for exo-atmospheric intercepts at altitudes of up to 100 miles (early terminal). Nike Zeus hardware was designed and tested, and proved effective at intercepting mock ICBMs. However, since intercepts were executed at the terminal phase, each Nike Zeus installation could only be expected to defend a relatively small fixed region around it. Nike Zeus was also limited by the relatively slow computers that were available in the late 1950s, and the fact that it used mechanically steered radar dishes, which could only track one missile at a time.

Additionally, as Nike Zeus was being developed, the strategic situation changed significantly. Early on, planners were preparing for only a few dozen ICBMs, which would have made a nationwide defense feasible. However, by the mid 1960s, the USSR possessed hundreds of ICBMs, necessitating a change in strategy.

Nike-X

The solution was Nike-X, an evolution of the Nike Zeus to address many of its weaknesses. Nike-X was the only serious attempt at defense during the age of MAD. Future systems (such as Sentinel, Safeguard, and today’s national missile defense) only attempt to counter limited strikes from rogue nations.

The Nike-X system was a significant improvement over Nike Zeus in many dimensions. It used phased-array radar (allowing arbitrarily fast steering of the beam), and much faster computer hardware. Nike-X also deployed defenses at two different phases: midcourse as well as terminal.

For midcourse defense, Nike-X used the Spartan missile, based on the Zeus missile but extended with greater range and a more powerful warhead. The Spartan missile, since it could intercept warheads hundreds of miles away, could cover the entire nation with a relatively small number of bases. However, the targeting system was vulnerable to decoys and chaff. It was expected that some missiles would leak through. While Spartan was planned during the Nike-X program, it only saw testing under the subsequent Sentinel program.

However, the mainstay of Nike-X was the Sprint missile, which performed defense during the late terminal phase. Nike-X aimed to leverage the ability of the atmosphere to “declutter” the warheads from decoys and chaff to the maximum degree possible. As such, Sprint was designed to intercept warheads at an altitude below 37 miles. At this altitude, the warhead would be only a few seconds away from reaching its target. To intercept warheads on such a short notice, Sprint missiles are truly unique in many ways. These missiles accelerated at around 100g, and reached a speed of Mach 10 in under 5 seconds. The solid-fuel propellant was composed of nitrocellulose, nitroglycerin, and zirconium powder; an effectively gunpowder-like combination. At such high speeds in the lower atmosphere, air resistance caused the missile to glow white hot.

Each Sprint battery had a very small range, so small that large cities might require multiple batteries to defend them. This was a critical downside of Nike-X. A national defense based on it would have been extremely expensive. Additionally, some worried that further development could lead to an arms race where the USSR deployed even more ICBMs to ensure retaliation.

Sentinel, Safeguard, and GMD

Leadership at the time (under the Johnson administration) increasingly felt that Nike-X was ill-advised. In 1967, they scaled down the Nike-X project, and announced it as “Sentinel”. Sentinel was a “thin” defense. It couldn’t defend against a full Soviet attack, and was intended as a counter to China’s (at the time very small) ICBM arsenal, as well as any potential limited Soviet attack.

Sentinel relied heavily on Spartan, limiting the need to build Sprint batteries in every major city. However, the sprint would still see use to defend ICBM silos and the guidance radars for Sentinel. The plan called for a total of 480 Spartan and 192 Sprint missiles.

However, after only 18 months, due to declining political appetite, Sentinel was scaled down further into Safeguard. Safeguard was only intended to defend ICBM silos, and not cities, from attack. Safeguard was briefly operational, with a fully operational site in North Dakota in 1975. However, that same year, Congress voted to defund it, and it shut down in 1976.

In the 1980s and 1990s, focus shifted away from anti-ballistic missiles as a means of strategic defense and towards more speculative options under the Star Wars program instead (as discussed later). That being said, significant progress was being made in this time towards theater defense: systems able to intercept short and medium range tactical ballistic missiles in a relatively small region. These use a battery of interceptors that perform terminal defense. Systems like Aegis and THAAD fall into this bucket. Unlike strategic ballistic defense systems, theater defense systems have seen significant use and adoption, and have proven quite effective in combat situations.

However, in the late 1990s, the US revisited strategic missile defense with the Ground-Based Midcourse Defense (GMD) program (originally named “National Missile Defense”). This system became operational in 2004, and is still operational today. Like Sentinel, it aims to defend against rogue states and limited attacks. It has two sites, one in Alaska and the other in California, with a total of 44 interceptors. As the name implies, the system is intended to intercept during the midcourse phase.

7.3.3. Current Status

Source: FY2024 Missile Defense System Report, DOT&E.

The 2024 state of the US’s missile defense system is illustrated above.

GMD as it currently stands is almost certainly inadequate. We know that each interceptor missile used by GMD has only a 55% chance of success against an incoming warhead. It’s true that many missile interceptors can be thrown at the same warhead, to raise the total probability of kill. From this comes the “97%” statistic cited by President Trump in 2017. However, in a realistic scenario where even 1 SSBN is left alive, it’s likely that we would see dozens of warheads, rapidly depleting the very limited (at the moment, 44) stock of GMD interceptors. As such, the current system is grossly inadequate, even for limited retaliation.

Russia and China’s systems are even less adequate. China doesn’t have any public nationwide anti-ballistic missile system, and Russia only has a local defense for Moscow. This system, the A-135 works very similarly to a battery of Sprint missiles.

7.3.4. Potential Solutions

While the vast majority of extant missile defense solutions use interceptor missiles, there have been alternate proposals, most notably from Reagan’s Strategic Defense Initiative (SDI). In the 70s and 80s, President Reagan, a critic of the concept of MAD, was highly invested in finding a way to totally counter a retaliatory strike from the Soviet Union. Under his direction, the US invested significant amounts of funding in SDI, often colloquially called the “Star Wars program”. This program did in depth research of many possibilities that could negate the threat from the USSR, although many ideas failed to pan out. Disappointing results, and growing negative public opinion eventually led to the end of the program in 1993. However, they produced much forward-looking research on ballistic missile defense which is useful for our purposes.

There were many SDI initiatives, but we’ll limit our discussion to just directed energy weapons (DEWs) and Brilliant Pebbles, which I view as the most promising. Altogether, we’ll review the following potential mechanisms:

• Improving Interceptor Missiles

• Space-Based Interceptor Constellations

• Directed Energy Weapons

7.3.5. Improved Interceptor Missiles

The simplest solution is simply to make the interceptor missiles better. There are two primary directions along which progress could proceed. First, volume could be increased. This would enable each incoming warhead to have many more potential chances for intercepts, reducing the chance of leakage. Second, the probability of interception could be improved. Progress on both dimensions needs to be made to defend against salvos on the order of 100 warheads.

This section will be highly US-focused, simply because there is much more information for US plans. However, similar considerations will apply to Russia and China as well. The current limiting factor on the number of interceptors in practice is price. This is what killed Safeguard, and it’s limiting GMD as well. Currently, a single GMD interceptor costs $70 million (not accounting for overruns), according to testimony from the Director of the Missile Defense Agency in 2011. I suspect AI R&D is not necessarily required to reduce the cost, and a company like SpaceX could probably produce the same product for perhaps a quarter of the cost (assuming no AI R&D). For context, the company building the interceptor launch vehicle, Orbital, also produces the Antares rocket, which has a cost/$kg to low earth orbit of $12,879-$12,903, while SpaceX’s Falcon 9 has a cost/$kg to low earth orbit of $2,864. Both are medium-lift rockets, but there is a sixfold difference in price. Beyond the known fact that defense contracting tends to result in bloated budgets, there are several inefficiencies the GAO highlighted with the current GMD development process: poor communication with the Department of Defense and the intelligence community, difficulty developing digital models and simulations, and software development and IT issues.

In general, I expect significant improvements to all of these in a situation where even moderate AI R&D is present. Accounting for AI R&D, I’d expect the marginal cost per launch vehicle (assuming current requirements) to go down to around $1-2 million. Although this seems extremely low, I would note that Rocket Lab’s Electron, (a small rocket that is a good stand-in for a ground based interceptor) charges $7.8 million per launch, and 2024 SEC filings indicate that Rocket Lab’s cost per launch was $5.7 million. However, that cost per launch includes salaries, R&D for future rocket designs and other costs not related to labor and materials. In a world with high quality, cheap intellectual labor, much of this would go to zero. There are similar gains to be had for the Exoatmospheric Kill Vehicle, another critical component of GMD. Altogether, I’d forecast a total per-missile cost of about $3 million, which mostly derives from human labor used to construct the vehicle, run experiments, and materials.

At that price, the limiting factor on price would be the construction of missile silos. Currently, each missile interceptor lives in a silo costing about $21 million. Unlike missiles, where most of the labor goes to automatable design work, the bulk of silo construction costs will be determined by manual labor and materials, and is unlikely to be significantly accelerated with AI assisted R&D. However, if cheap interceptors are available, interceptors could be kept in batteries to amortize the cost of silo construction.

Another obvious improvement to volume would be to carry multiple kill vehicles per launch missile. This is already being planned by the Next Generation Interceptor (NGI) designed to succeed the current GMD interceptor. This approach is highly fruitful for defending against MIRV strikes. In most MIRVed missiles, the boost vehicle will put each warhead on a slightly different trajectory, but these trajectories are still relatively similar, as they all have the same initial direction. This means that if one can get several kill vehicles to a similar trajectory, each kill vehicle could target a different warhead. Increasing payload capacity linearly increases the number of interceptors that can be brought to bear. Another way to improve the number of kill vehicles per missile is to make the kill vehicles lighter. Because each kill vehicle has tremendous kinetic energy, it does not need to be very heavy to destroy a warhead. On the other hand, each warhead has a nuclear payload that cannot be easily made lighter. Thus, one can theoretically carry dozens of interceptors for the same weight as one warhead. The Multiple Kill Vehicle program explored using interceptors as light as 10 pounds.

Source: GAO Analysis of Missile Defense Agency information, GAO.

Increasing each kill vehicle’s individual probability of kill is also a promising direction. The kill vehicles in use in the current GMD interceptor use very old technology, having been designed in the 1990s. The kill vehicle is relatively small, and can be tested much more cheaply than a launch vehicle. This makes it easier to prototype and iterate on. Additionally, its performance relies heavily on software quality. As such, it’s likely highly amenable to AI enhanced R&D. Not much information on the interceptor to be used on NGI has been released, so it’s difficult to speculate further.

All considered, I expect that significant improvements in interceptor missiles are extremely plausible given AI assisted R&D. The main improvements will come largely from being able to cheaply acquire and install hundreds of missiles, each with tens of interceptors, which gives orders of magnitude more opportunities to intercept incoming warheads. General improvements in technology and electronics since the 1990s will also significantly improve performance. I think it’s highly likely that improved interceptor missiles could defend against a salvo of 20 missiles, each with 16 warheads. Note that midcourse interception layers nicely with boost phase interception, discussed in the next section.

7.3.6. Space-Based Interceptor Constellations

This concept involves having a constellation of thousands of interceptors in orbit, in a configuration that ensures that any point on earth has a nearby interceptor in orbit. If a missile is launched, the interceptor will leave its orbit, and attempt to intercept the vehicle during the boost phase, before it has the chance to release its warheads.

This concept was first proposed in 1987 during the SDI program, under the name Brilliant Pebbles. It originally called for a network of 10,000 interceptors. For a sense of scale, this is roughly the number of Starlink satellites in orbit today. Over the course of the early 1990s, the program was scaled down to focus on only limited attacks, and was ultimately cancelled in 1993, after Bill Clinton became president. However, the concept was revived under the second Trump Administration as part of the Golden Dome project. The project is still under development, so it’s not yet public how many interceptors are planned. However, the program is much more feasible with current technology than it was in the 1990s. Launch costs have reduced significantly, and we already have a network of space based sensors (SBIRS) that can provide guidance to the interceptors. One advantage of this approach is that it can defend against hypersonic glide vehicles the same way as ballistic missiles. Although hypersonic glide vehicles spend most of their time in the upper atmosphere, they are initially launched above the atmosphere atop regular ICBMS, making them vulnerable to boost phase interception.

Source: Golden Dome Constellation, Wikimedia

However, there are certain challenges to the concept that remain an issue. By far the most serious is the fact that this architecture performs extremely poorly against salvos of missiles fired in succession from a single location. Only an interceptor in the right place and time can defend against a missile fired from a particular location, and interceptors are single use. This has troubling implications. If it takes 10,000 orbiting interceptors to defend against a single ICBM launch, it would take 100,000 orbiting interceptors to defend against a salvo of 10 ICBMs fired from the same location. In the counterforce retaliation scenario we’re evaluating, the most likely launch platform to be missed is a submarine, so being able to defend against salvos is critical. It’s true that a submarine would reveal its location by firing a missile, opening it up to retaliation, but SSBNs can fire salvos quickly, at a rate of about 1 missile every minute. This means that a “left of launch” intervention (like destroying the submarine) would be too slow unless we had depth charges in orbit already.

The obvious counter against salvos is simply to accept that we will need to put hundreds of thousands of interceptors in orbit. We can try a quick back of the envelope calculation to check if something like this is plausible: The current cost to put 1 kg into LEO is around $1600, using Falcon 9. However, if we used near-future reusable launch vehicles like Starship, this cost would plausibly be around $100/kg, assuming SpaceX is able to reuse vehicles. Interceptor weight will likely be approximately 1000kg (of which most is propellant, see here for discussion on interceptor weight). If we assume 100,000 satellites, launch costs alone would be around $10 billion. However, a significant proportion of the cost would then be interceptors themselves. We don’t yet have estimates for Golden Dome’s interceptors, but we do have them for Brilliant Pebbles. In 1988, the GAO reported the production costs for “several thousand interceptors” as $1.6 billion. Assuming anywhere between 3,000 to 5,000 interceptors, each interceptor would then cost between $0.88M and $1.47M (accounting for inflation between 1988 and 2026). I expect that these costs would be reduced if manufacturing hundreds of thousands, since there are efficiencies of scale when mass producing hardware. Additionally, if we assume AI R&D, this would result in most intellectual labor on the project being automated, further reducing costs. That being said, the interceptors likely use expensive semiconductors and optics that can’t be made cheaper easily. My guess is that when we take into account those expensive items and necessary human labor, the price would probably be in the $50,000-$200,000 range. As discussed in the improved interceptor missiles (7.3.5.) section, satellite technology stands to gain a lot from AI R&D. Taking an average estimate of $100,000 per interceptor, the end result would be $10 billion for interceptors as well. So, the total cost of putting 100,000 interceptors into orbit might be in the $20B ballpark. This is expensive, but well within the budget of a superpower. For comparison, the US spends over $800 billion per year on defense.

As such, I think that with AI R&D, it’s quite plausible to imagine a space-based interceptor constellation being able to fully counter a missed SSBN. TELs would present even less of a threat, as they are incapable of launching salvos. However, a country counting on this might try to bunch up SSBNs to overwhelm defenses (although this increases their detectability), or to attack the guidance satellites as described later in Hypersonic Weapon Defense/Countermeasures (7.4.).

7.3.7. Directed Energy Weapons

Finally, we turn our attention to directed energy weapons (DEWs). During the SDI program, several of these were explored, although none were ever brought to production. In general, directed energy weapons were considered for two roles: Destroying the warhead or booster outright, or interactive discrimination between warheads and decoys. Over the course of the SDI program the focus of most directed energy weapons shifted from the former goal to the latter. Interactive discrimination entails delivering a powerful pulse of energy to a potential warhead. In the case of a laser, this would ablate the outermost layer of the warhead or decoy in a puff of vapor. The decoy, being lightweight, would change its trajectory slightly, while the heavy warhead would be unaffected. Only real warheads could then be targeted by midcourse interceptors.

Destruction of the warhead or booster doesn’t necessarily require a pulse, continuous operation would also work. In that case, the laser must dwell on the target for a fixed amount of time (dwell time) in order to deposit enough energy to disable it. However, destruction is much more demanding in terms of energetic requirements than discrimination, making power supply an issue in most DEW designs. As such, most DEWs focused on destroying the missiles during the boost phase, since boost phase missiles are more sensitive to heat (and also tend to be easier to track). However, as the Soviets developed ICBMs with shorter and shorter boost phases (in some cases finishing the boost before exiting the atmosphere), designs were modified to destroy warheads as well.

Possible Directions

• Project Excalibur: A nuclear explosion pumped X-ray laser. This was by far the most notable of the SDI-era directed energy weapons. The real appeal of Excalibur was its ability to generate multiple (up to dozens) of beams from a single nuclear detonation. This was ideal for defending against a large scale nuclear attack. Initially, the Excalibur devices were intended to be permanently stationed in space. However, the idea later transitioned to having the device be launched from a submarine on a “pop-up” basis if needed, since the permanent space installations were vulnerable to an anti-satellite attack immediately prior to launching ICBMs.

• Casaba-Howitzer: This proposal involves shaping a nuclear explosion so that most of its energy is released in one direction, creating a “plasma lance” that could be used to destroy warheads or boost phase missiles from thousands of kilometers away. The principle of operation works similarly to a traditional shaped charge. Essentially, the nuclear device is surrounded by beryllium oxide, which will absorb the X-rays from the device’s detonation, and turn into an extremely hot plasma. The beryllium then transfers that energy to a tungsten plate which carries off up to 85% of the momentum of the bomb. Unlike a laser, this would result in a spray of both particles and radiation, and wouldn’t be as tightly focused. A 1990 independent report concluded that a beam with a spread of 5.7° is possible. While the concept was originally devised in the 1950s as a means of spacecraft propulsion we know it was revived for use in the SDI program, potentially under the name “Prometheus”. Unfortunately, we know very little from government sources, as much of it remains classified (to a greater degree than other SDI programs). As for why this excess of classification is in place, I don’t think it’s because Casaba-Howitzer is very powerful and “too good to share”, but because the concept involves nuclear principles that are very relevant to the construction of two-stage nuclear bombs (specifically, relating to the compression of the fusion stage). Thus, I don’t think we should take this excess of classification as a sign that Casaba-Howitzer is a superior means of defense. Indeed, there are known issues, mostly relating to the high spread of the beam. This would make it ineffective at high ranges. Unfortunately, simply increasing the bomb power increases spread more (since the radiation disperses the beam), so simple scaling can’t evade the issue. However, the program was considered a relatively “near term” method of discrimination that didn’t require as much development as the other directed energy weapons.

• Particle Beam: an SDI research initiative suggested using a particle accelerator either directly as an anti-ballistic weapon or as a means of distinguishing decoys from true warheads. Similar to Excalibur, the beam generator could be left stationed in space or launched on demand. Particle beams provide high energy delivery to the target, since atoms can carry significant kinetic energy, and cannot easily be shielded against (unlike photons that can theoretically be reflected). There are two main types of particle beams to consider:

• Charged Particle Beams: Charged particle beams involve accelerating charged particles to near relativistic speeds. Charged particles are far easier to accelerate than neutral ones, but they suffer from key downsides that make them largely unviable for missile defense. First, because the particles have the same charge, they are repelled from each other, so the beam will spread over time, weakening its density when it reaches the target. Secondly, the beam is deflected by magnetic fields. This makes aiming more difficult, since the Earth’s magnetic field can behave unpredictably. Nuclear explosions also produce magnetic fields, and could be used adversarially to defend against the beam.

• Neutral Particle Beams: To mitigate this, one could use neutral particles, like un-ionized atoms. While any neutral atom would work in principle, hydrogen is standard in SDI-era designs. This is done by creating hydrogen anions (hydrogen ions with an extra electron), accelerating them, and finally knocking off the extra electron before they exit the device. The result is a beam of neutral hydrogen atoms travelling at significant fractions of the speed of light. The hardware required to do this is complex, but not infeasible. Neutral particle beams were primarily considered for two roles: destroying the missile in the boost phase, and discriminating between decoy and real warheads. Neutral particle beams were researched heavily in the late 1980s, culminating in the BEAR experiment where a neutral particle beam accelerator was launched in a suborbital trajectory. However, there were several technological obstacles that prevented implementation: obtaining precise enough magnetic fields (“magnetic achromacity”), and determining whether the beam had successfully hit the target (a problem shared with other directed energy weapons). Nonetheless, the Pentagon was interested in researching this technology until fairly recently. The concept was only finally canceled in 2019, on the grounds of it not being near-term implementable.

• Lasers: There were several initiatives in this space.

• Space-Based Chemical Lasers: Chemical lasers use the energy of chemical reactions to drive the lasing process. These lasers react (often exotic) chemical reagents to produce atoms in a highly excited state. The laser harnesses the energy contained in these excited atoms to drive its output. The reagents are typically gases, and can be exhausted out of the lasing chamber once the reaction is complete, and replaced with fresh reagents. The main advantage of this approach is its superior ability to dissipate waste heat, usually the key factor limiting scale-up in most lasers. Chemical lasers aren’t particularly efficient: only 10% of the chemical energy released is turned into laser light, with the other 90% becoming waste heat, but the hot waste gas can simply be exhausted. Megawatt levels of power were achieved even in the late 1970s, something no other laser type has been able to achieve, even in 2026. However, there are notable cons as well. First, there are only a few known practical reagent combinations (notably COIL and HF/DF), and each reagent combination has a fixed wavelength. The wavelengths generated by these reagents are both absorbed to some extent by the atmosphere, attenuating their power over long distances. This means that any effective missile defense system would need to be mounted in space. The second, exacerbated by the first, is that the reagents are expensive, and quickly consumed. In space, they can’t easily be resupplied, and thus they are effectively few-shot resources. This problem is experienced more by destructive lasers than discriminatory ones, as they need more energy.

• Free Electron Lasers: Free electron lasers are another mechanism to generate lasers. Their primary advantage over chemical lasers is their tunability: free electron lasers can generate many different wavelengths of light on demand. This gives them the ability to select wavelengths that are well-transmitted by the atmosphere, enabling space to ground or ground-to-space interception. Unlike chemical lasers, free electron lasers require electrical energy, on the order of megawatts in order to be able to launch a sufficiently destructive beam. There are pros and cons to this: the laser can theoretically operate indefinitely, but the con is that it is difficult to power in space. Nonetheless, there are ways to do this, such as supercapacitor arrays or explosively pumped flux compression generators, but they add complexity (and some ways may bring back the “fixed number of shots” issue). The main disadvantage of free electron lasers is that they are much bulkier and more complicated than chemical lasers, requiring an electron accelerator, superconducting magnets, cryogenic cooling, and much more. Thus, there were two proposals for using free electron lasers: In the first, they would be launched into space, like chemical lasers. In the second, the free electron lasers would stay on the ground, where they could be easily serviced and fed megawatts of power. Space based mirrors would reflect the laser onto the missiles or warheads. A disadvantage of the latter mode of operation is that turbulence or atmospheric phenomena in the air between the ground laser and the space mirror would reduce output on the missile.

• Solid State Lasers: While not explored during the SDI era, solid state lasers have improved dramatically in the intervening years, and are worth considering in a near-future context. In 2023, Lockheed Martin created a purely solid state laser able to output 300kW continuously. As such, megawatt level lasers are likely feasible now. Heat dissipation is the main challenge in solid state lasers, and two primary solutions have been devised: fiber lasers, which use an extraordinarily long and thin fiber optic wire as the lasing medium (thus providing high surface area for cooling), and disk lasers, which are thin and wide, enabling dissipating heat from behind. These lasers have the potential to be far more compact and easy to construct than free electron lasers, while maintaining the same advantages of tunability, and electric powering.

In the Context of Retaliatory Strikes

In our scenario, we have advantages that the SDI planners didn’t. We’re not defending against a first strike, but rather against a weakened second strike. Thus, we can worry less about space based satellites being shot down, as the enemy will be operating from very few remaining sites, many of which won’t contain specific anti-satellite weaponry, and might not be well-coordinated with each other. Given this, we need not worry about the added complexity of pop-up systems, and can leave our DEWs in space. Since they can be launched from a large launch vehicle (instead of a submarine), they can support large radiators that would be necessary for particle accelerators and electrically powered lasers. I also consider the ground based approaches quite feasible, since we can wait for ideal weather conditions at the ground laser sites before launching our first strike.

However, there are also changes in the geopolitical landscape that make certain ideas less viable. Project Excalibur and Casaba-Howitzer both require nuclear detonations to operate, and would definitely require testing if we were to develop them further. However, testing of nuclear weapons has become markedly more difficult since the 1980s. The US, Russia, and China last tested nuclear weapons in 1992, 1990, and 1996, respectively. Although violations are alleged, all nuclear superpowers have pledged to halt nuclear testing. Restarting testing would be very provocative, and likely counterproductive - it would alert the target state, and make it more difficult to launch a counterforce strike. Fenstermacher discusses methods of testing scaled down versions in a test-ban situation, but it would be very risky never to test the whole system altogether.

Additionally, Excalibur in particular is not well suited for the threat model. It has the advantage of being able to strike multiple targets with a single detonation. However, the attacking nation likely won’t be launching a coordinated first strike where multiple silos are launching at once. Instead, we should expect a few scattered submarines and TELs to launch ICBMs in quick succession. Thus, there may never be more than 1 or 2 boosting missiles in range of an Excalibur satellite.

Overall Evaluation

Indeed, of all the weapon types, I’m the most confident in solid state lasers. This is because the hardware is the most conducive for fast AI R&D, since the lasing element is solid state, so there’s less risk of a zero-g environment or vacuum conditions affecting its behavior. As such, most testing can be done in atmospheric conditions. It’s also far more compact than free electron laser generators, and thus can be cheaper to launch en masse.

I consider both discriminatory and warhead destruction roles plausible. However, I think that, especially on short timelines, these lasers are best suited for a discriminatory role where they can operate in a pulsed mode that doesn’t have such stringent heat dissipation requirements (frequently a problem in solid-state lasers). However, in this mode, a large arsenal of midcourse interceptors will be necessary to actually intercept the warheads. I consider this a reasonable tradeoff. Building kinetic interceptors is well understood, and carries much less intrinsic technical risk.

7.4. Hypersonic Weapon Defense

7.4.1. Current Status

The US and Russia both already have infrared early warning satellites that can detect the location of a missile launch (hypersonic or otherwise). China is believed to be developing their satellite system. With ballistic missiles, their trajectory is fixed after the boost phase, and the combination of SBIRS and existing ground radar systems can maintain high quality tracking (which can be fed to interceptor systems). However, hypersonic missiles stay close to the ground and can maneuver unpredictably. Thus, it is impossible to use existing ground radar systems until the missiles approach very close.

The US is well aware of this, and has already begun implementing the Hypersonic and Ballistic Tracking Space Sensor (HBTSS), a set of space based sensors that can maintain continuous custody of dim, low-flying hypersonic targets, and pass data to interceptors. This system isn’t fully operational yet, but likely will be by 2027. China and Russia are highly likely to implement similar measures.

However, even once the hypersonic missile has been located, it must still be destroyed. The US is developing a specialized Glide Phase Interceptor (GPI) that would be specialized to intercept hypersonic missiles. This interceptor wouldn’t be part of the Ground-based Midcourse Defense (GMD), but part of Aegis, a ship-based terminal defense system. As such, it’s not a nationwide defense, at least out of the box. Work would need to be done to implement it around all major cities.

7.4.2. Would it be sufficient?

Due to the increased size and weight of hypersonic glide vehicles, there will be relatively few of them compared to standard warheads. Note that while the RS-28 supports 3 Avangard hypersonic glide vehicles per ICBM, the RS-28 is a large silo launched ICBM, and any SLBM would have less payload, so I’d expect a SLBM to only carry one hypersonic glide vehicle. For this reason, I also generally expect SSBN loadouts designed for countervalue strikes to hold relatively few of them, since the retaliating party would want to maximize damage. (Although this argument becomes weaker if the retaliator knows the defender has very strong ballistic missile defense). All in all, I would probably guess that any SSBN has between 3 and 5 hypersonic glide missiles. The number would go up correspondingly if more SSBNs, surface ships, or airplanes were left.

I think this is well within near-future systems’ grasp to handle, even excluding AI assisted R&D, especially if the defending nation pre-emptively places hypersonic defenses around each of the major cities.

7.4.3. Countermeasures

There are a few potential countermeasures that the retaliator could take to maximize the chance of retaliation.

First, the retaliator knows the position of orbiting HBTSS satellites, and could dazzle or permanently damage their sensors with lasers from the ground immediately before launching the missile, as was done in the Cold War. That being said, dazzling is a known threat that is taken into account in designing these satellites. The systems are designed to work even if a few satellites are dazzled.

Secondly, hypersonic missiles can take circuitous routes or strike targets known not to have defenses. Hypersonic missile defense systems have a limited range, and there may be regions that are not well defended. The only counter-countermeasure in this case is to produce more defenses.

Altogether, I think hypersonic missiles are a real threat, but one that is mitigatable even without postulating AI accelerated R&D, as long as the number of incoming missiles is relatively low.

7.5. UUV Defense

We must take Russia’s claims of what the Poseidon weapon can do with a grain of salt. Not much has been verified by external sources, and Russia is not a reliable source with respect to its own capabilities. That being said, for the purpose of analysis, we’ll take their claims at face value. Poseidon has a diameter of 5-7 ft, is about 80 ft long, and is claimed to be able to travel at up to 100 knots.

Even granting this, the weapon is certainly not invincible. It’s limited to striking along the coast, giving a fairly limited number of targets. This means that a defender could simply place active sonar arrays near valuable coastal cities, and wait for the UUV to arrive. The Poseidon UUV would be slow enough that it can be intercepted with normal torpedoes. Additionally, the same methods used to detect SSBNs to execute the first strike would likely be highly applicable in this case as well. So, conditional on the ability to execute a counterforce strike, the nation will have the ability to detect and destroy retaliatory UUVs.

As such, I do not consider the Poseidon a major threat.

7.6. Overall Assessment

Launch-on-warning suppression, SSBN detection, TEL detection, and precision strikes are all probabilistic, and each will leak some residual: a submarine that was not located, a TEL that was sheltered when a satellite passed overhead, or a silo that managed to launch before its warhead arrived. The strategic question is whether that residual can be absorbed. Missile defense is the only mechanism in the chain that addresses this directly, which means its feasibility largely determines how perfect the other four enablers need to be. Modest improvements in detection and suppression have limited strategic value without a corresponding defense layer. Conversely, a strong defense layer relaxes the requirements on everything upstream.

The technical components of missile defense are well understood. Solid-state lasers, exoatmospheric kill vehicles, and terminal defense systems have all existed in some form since the SDI era, and the historical bottleneck has been cost and production volume rather than physics. This is where AI R&D has the most direct leverage. If automation of design, software, and electronics work can reduce per-interceptor cost by roughly an order of magnitude, it opens up the possibility of building large layered missile defense schemes of the type envisioned (but never implemented) during the SDI era. Whether this cost reduction actually materializes is the central uncertainty for this section.

A feasible modern architecture for missile defense that takes advantage of economies of scale, and eschews technical risk might be three layers: (1) cheap mass-produced ground-based interceptors carrying multiple kill vehicles, (2) a space-based boost-phase constellation similar to Brilliant Pebbles, and (3) solid-state lasers used primarily for warhead/decoy discrimination. This architecture would be inadequate against a fully intact arsenal, but the relevant threat model is a weakened second strike on the order of a few dozen missiles from any leaked submarines, a handful of mobile launchers, and any silos that launched missiles before they were destroyed. Against the latter threat model, this architecture might be able to achieve very high rates of total success.

Similarly to SSBN detection (4.), the largest technical uncertainty is the ability of AI R&D to help with productionization. Designing a cheap interceptor is the kind of software and electronics problem AI R&D can plausibly handle well. Building hundreds of thousands of them on schedule and with consistent quality depends on manufacturing process knowledge that is largely tacit and not necessarily amenable to automation. How long a state takes to achieve effective missile defense will be largely limited by productionizing designs and launch cadence.

There is also a large strategic uncertainty: missile defense is difficult to develop covertly. Boost-phase interceptors are difficult to disguise as anything else, and a buildup on this scale would be an extremely visible defensive deployment. Historically, comparable efforts have triggered offsetting responses. In the 1980s, the Soviets heavily expanded their warhead stockpiles in response to US ABM development. A defender with several years of lead time would have options including arsenal expansion, additional penetration aids, and anti-satellite development. Due to the high visibility, this enabler is more compatible with the public subscenario than the covert one, and its viability depends to some extent on the assumption that the leading actor’s R&D advantage allows it to iterate counter-countermeasures faster than the defender can adapt.

The net assessment is that effective defense against a weakened second strike appears plausible given sufficient AI R&D and a 3-5 year construction window. Defense against a fully intact arsenal is probably still implausible, but it is not the relevant standard. The strategic role of missile defense would be as the final layer in a scheme that aims to destroy as many warheads before launch as possible. Thus, its required performance scales inversely with the success of the other upstream enablers.

8. Counters

We now turn our attention from ways of breaking MAD to ways of keeping MAD in place. We discussed individual counters against particular attack vectors in their respective sections, but here we discuss overall counters, general-purpose methods for a potential target state to make it more difficult for an adversary to achieve a DSA over them:

While there are many ways for a lagging nation to counter attempts to gain DSA by a leading nation, certain methods will work best if applied early on, before much of the infrastructure is built, or ideally even earlier, before the leading country gains an insurmountable AI lead. Other methods (like doomsday weapons) can be implemented as a last-ditch effort, if other attempts have failed.

Today (in 2026), the US and China have not separated into clear leading and lagging actors. Thus, these counters should not be confused with policy recommendations for today. Even the earliest of them probably will not be viable for a few years. As we discuss the following methods, we’ll make clear in what contexts they can be applied, and what the likely scenario of their deployment is:

1. Nuclear Buildup: A nation can simply build more nuclear weapons and keep them on a higher alert status in order to make it more difficult for any potential attacker to totally neutralize their force.

2. Doomsday Weapons: If the leading nation’s missile defense is too effective, a lagging nation could implement means that inflict unacceptable damage without launching a missile: salted bombs or biological weapons.

3. Bilateral Treaties: The lagging nation can negotiate directly with the leading nation for an arrangement where both countries agree not to engage in an arms race, although the lagging country will likely need to make concessions.

4. Targeting AI: Lagging nations can also attempt to target the root cause of the power imbalance, by attempting to halt AI development.

8.1. Nuclear Buildup

The most straightforward solution is simply to build up a stronger arsenal which is more robust to pre-emptive attacks and missile defenses. This would look like constructing more silos, more SSBNs, and more TELs, and increasing investment into development of countermeasures. This was the approach the Soviet Union took during the Cold War in response to news of the US’s ABM plans. The USSR largely focused on “asymmetric” responses that relied on evading ABM systems. They also produced a very large stockpile of warheads, eventually exceeding the US’s stockpile. In our scenario, buildup might take the forms mentioned above, but also involve attempting to develop AI faster. The lagging nation could then subsequently use the more advanced AI to develop its own defenses faster.

This plan is to some extent the status quo. While the inner workings of China are relatively opaque, in the US, the relationship between China and the US is often referred to as a “race” or “competition”, in both the realms of AI and military technology. This approach will work in the short term. Nuclear weapons are a relatively well-understood technology, and producing them in bulk, along with missiles is relatively straightforward, even for a country without significant AI R&D, although it might be expensive. To the extent that the attacking force must be proportional to the number of unique silos, nuclear buildup can deter attacks.

However, the introduction of AI assisted R&D may make this approach unviable in the mid-to-long term. Historically, arms races ended because both parties suffered relatively symmetric costs, and thus at a certain point, producing more arms simply became too expensive to sustain, leading to a treaty limiting arms. This occurred with both nuclear weapons, and the earlier dreadnought arms races. However, AI R&D promises to reduce the cost of labor, acting as a multiplier on how much one party can produce. Thus, unlike previous arms races, there is a dynamic where continuing the race differentially benefits one party, in this case the one with the more advanced AI. In effect, the cost-exchange ratio for the defender would become increasingly unfavorable as time goes on.

8.2. Doomsday Weapons

The goal for the defender is to inflict unacceptable damage to the attacker in retaliation. Nuclear ballistic missiles have historically been the weapons of choice for this, since they offer the ability to inflict large amounts of damage from a relatively small package. An advantage of nuclear weapons is that despite their destructive potential, nuclear weapons are relatively controllable. They only destroy the area they are targeted at (modulo fallout), and different strategic plans can be devised which limit damage to specific areas or target types (e.g. counterforce-only, or countervalue-only). However, launching nuclear weapons is complex, and, as we described above, it’s plausible for an enemy with a technical advantage to be able to deny retaliation. In such a case, the defender can choose to relax their requirements for controllability and selectivity, using weapons that kill indiscriminately, potentially harming many other countries besides the attacker.

These weapons would likely be either nuclear bombs designed to maximize fallout (salted bombs) or biological weapons. While other sources of catastrophic risk exist (e.g., asteroid impacts or nanobots), they would likely not be achievable by the target state given that it lacks advanced AI.

While “doomsday weapons” have mostly appeared in fiction (such as Dr. Strangelove, which featured a salted bomb), there have been occasional semi-serious proposals for building something of the sort. In the 1950s, Edward Teller proposed building a 10 gigaton bomb code-named SUNDIAL. The method of delivery was allegedly noted as “Backyard”, since the device was thought to be powerful enough that it would kill everyone on Earth, although this likely wasn’t true based on what we know now. More recently, Russia state media has proposed equipping Poseidon, Russia’s nuclear UUV, with a salted bomb. However, it’s unlikely the bomb would be powerful enough to truly count as a doomsday weapon, as it still needs to be close to its target.

8.2.1. Salted Bombs

The term “salted bomb” refers to the phrase “salting the earth”, not to actual salt. Salted bombs can use any activatable isotope to enhance their fallout, but a common choice is cobalt, since it can be activated to cobalt-60, a gamma-emitting isotope with a half-life of about 5 years. This subtype is known as a cobalt bomb. Gamma radiation is particularly harmful since it is highly penetrating, and can travel significant distances through metals, woods, and other common building materials. The 5-year half-life also means that it’s impractical for a nation to simply wait for the fallout to decay by relying on stored supplies.

The goal with salted bombs would be to detonate them on territory that the lagging nation had control over, without any missile transport. This would make them cheaper, and allow the lagging nation to avoid having to deal with missile defense. The enhanced fallout from the explosion would be distributed to the leading nation over time due to natural wind patterns. Far more damage would be done to the lagging nation than the leading nation, but the threat might be sufficient to deter the leading nation, in theory.

The idea of a fallout-enhanced bomb is certainly plausible. We know from open-air testing in the 1960s (e.g., the Daigo Fukuryu Maryu incident) that nuclear fallout regularly does traverse large distances, and can cause harm. Salted bombs are also relatively easy to design, and could be implemented at very short notice. However, in practice, I suspect that this concept would not spell the end of the world, although it certainly would inflict significant damage on the leading nation. This is because most fallout is not lofted into the upper atmosphere, and falls close to where the bomb was detonated. Since the US and China are very far away from each other, local fallout from bombs detonated in one location would not affect the other.

Additionally, governments around the world would rapidly apply behavioral changes to ensure that their populations survive and are not exposed to excessive fallout radiation. They would have plenty of time to prepare these, as the country implementing the doomsday weapon would need to declare its existence in order to deter strikes. Some mechanisms for living and rebuilding in high fallout environments are discussed in “On Thermonuclear War” (Kahn (1960)).

Kahn notes the primary difficulty in high fallout environments is agriculture. Fields gather radioactive isotopes, which are incorporated into foods grown on them. In order to remedy this, Kahn proposes categorizing foods into Type A, B, C, D, and E by the degree of radioactive contamination. Type A foods are reserved for children and pregnant women, type B and C foods would be available for purchase by anyone (at a high price and low price, respectively), and type D foods would be restricted to purchase only by people age 45 and older (as they would be more likely to die of natural causes before cancer appeared). Type E foods would be for feeding animals only. In more extreme situations where all farming has halted, ALLFED proposes methods for directly processing industrial chemicals into food.

It’s difficult to produce estimates of how many people in the leading nation would die in a given scenario, since it depends both on how many salted bombs are detonated, as well as how strong the fallout protection measures are. It may range from millions to only a few tens of thousands. Even in a best-case scenario, where strong countermeasures are present, it’s virtually certain that the detonation of the fallout bombs would lead to a situation akin to the COVID-19 pandemic. People would be forced to stay at home, eat undesirable food, and experience a general degradation in their quality of life. Thus, it seems likely that salted bombs are a good deterrent, even against a nation with a significant AI advantage, as long as a sufficient number can be detonated.

However, there are some cons to this technique. The salted bombs would still be vulnerable to early-warning-evading strikes, much like missile silos. If the bombs can be destroyed before they detonate, it would avert much of the radioactivity. If the proportion of bombs that go off is low enough, the leading nation may not experience much fallout.

Another issue is that building the salted bomb guarantees death for the people living in range of the local fallout, and might only inconvenience people in the target nation. It’s also not possible to do covertly, since the entire point of the bomb is to deter. The bombs will have to be installed in fixed locations (as they will be large, and need not be stolen). This might provoke significant negative reactions from people living in the area. China can likely quash this opposition, but in the US, it may prove fatal, as the case of the Yucca Mountain nuclear waste repository illustrates.

8.2.2. Bioweapons

• Redacted for now

8.2.3. Overall Assessment

Doomsday weapons are practical ways to threaten the leading country. The leading country probably wouldn’t be totally destroyed by most schemes, but it might still suffer a level of damage it would regard as unacceptable (i.e., the deaths of a few million people).

That being said, doomsday weapons are extremely politically difficult propositions for the country that builds them. They will face opposition from third party countries, internal legislative bodies, and (in the case of salted bombs) local opposition. By third party countries, we mean all countries that are neither the US nor China. These countries have everything to lose from doomsday weapons, and absolutely nothing to gain. These countries may apply significant diplomatic pressure, including trade restrictions or economic sanctions. Sanctions could significantly impede military preparation along other dimensions.

There is another issue with doomsday weapons: they are a wasting asset. If the leading country knows about their existence, it can take measures ahead of time to make itself more robust against these threats. The lagging country would be forced to make their doomsday weapon more potent, but this quickly moves into the regime described in nuclear buildup (8.1.). It’s also risky, especially in the case of bioweapons. Lab leaks are plausible, especially if the military is trying to race towards a credible deterrent, and could be devastating.

8.3. Bilateral Treaties

A bilateral treaty, in theory, is far preferable to a war (especially a nuclear one). However, the main question is whether it’s possible to make a treaty that both sides can credibly commit to, without one side having to fear the other reneging.

8.3.1. Background

The seminal paper Rationalist Explanations for War (Fearon 1995) notes that:

1. War is costly. Fighting consumes resources that a state would rather spend on other things.

2. War is uncertain. A state doesn’t know ex ante that it will prevail, although it has a sense of how likely it is to succeed.

From these two points, Fearon concludes that rationally led states should prefer a negotiated agreement that avoids war, and leaves each state better off than its expected outcome from war.

However, it’s clear that states do go to war all the time, despite its seeming irrationality. Fearon suggests three main reasons for this:

1. Actors may not be able to credibly commit to a treaty.

2. States may have private information or incentives to misrepresent information during bargaining.

3. An issue may be indivisible. There may not be a way to compromise on a particular issue.

8.3.2. Applied to Our Scenario

Nuclear war is very costly. Doomsday weapons, even more so. Both the leading and lagging nations would waste significant amounts of time, money, and resources on building early warning infrastructure, nuclear weapons, and countermeasures against the enemy’s nuclear weapons. None of this is intrinsically valuable. And then, once war breaks out, at minimum tens of thousands of people would die. If the clean pre-emptive strike fails, it could be millions. Doomsday weapons could raise the death toll to billions (although largely in third party countries).

Thus, there is a strong incentive from both sides to negotiate. The current US-China disputes don’t appear to involve indivisible issues, apart from perhaps Taiwan (although its importance to the US will reduce as the US continues to build fabs in Arizona). That being said, credible commitment and private information both are still problems in this scenario.

However, as we’ll discuss later, any treaty would involve concessions by the lagging power. Essentially, because the leading nation may believe that continued AI-driven automation and productionization will eventually give it a practical route to military predominance, it would need to receive significant gains from the treaty in order to prefer a treaty over continuing to build up.

8.3.3. Credible Commitment

Credible commitment is perhaps the largest issue to resolve. Even if both China and the US reveal all private information and come to an agreement that they both agree is better than going to war, the leading nation still holds all of the cards. It would have the ability to unilaterally renege on the deal, and use its superior military ability to extract more concessions.

The goal, essentially, is to make complying with the terms of the treaty the game-theoretically optimal action at each point in time for both actors. Achieving this is especially hard for the leading actor’s commitments, since if the gap continues to widen it may later be tempted to abandon the agreement and exploit its growing strategic advantage. This is a challenging task, but there are advantages in this setting that make it more feasible than it seems.

First, remember that the leading country (at the time of treaty setup) prefers a treaty to no treaty. Thus, they are willing to set up systems that enforce their compliance in the future, potentially even using their own resources. We’ll illustrate why this is the case using the thought experiment of Parfit’s hitchhiker.

Imagine you’re stuck in the desert, and don’t have any cash on you. A taxi drives up, and the driver offers to drive you home, but only if you pay once you arrive. However, the taxi driver doesn’t have any means to compel you to pay once you arrive. If the taxi driver feels that you’re lying to him about whether you would pay, he won’t drive you. In this case, assuming you really want to get out of the desert, you might be willing to spend some of your resources to ensure that the taxi driver can trust you. For example, if you had a driver’s license, you might be willing to give it to the taxi driver, so that the taxi driver can withhold it if you fail to pay. Since the cost of replacing the driver’s license is higher than the cost of paying the taxi driver, it becomes rational for you to pay at every point in the process. Thus, the taxi driver can drive you home.

This factor is a significant advantage. It means that we can use the leading country’s AIs as part of the verification process. The leading country could even provide collateral that will be forfeited in the case of a violation, or set up punishment mechanisms for itself. The only criterion is that the expected cost of the treaty must be less than the expected cost of war. Since nuclear war is expensive, we have quite a bit of leeway here.

The collateral could take many forms, but one form I think is particularly promising is releasing escrowed military technology to the lagging nation. This could be the last generation of missile designs or even AI model weights. This would allow the lagging nation to have the ability to seriously damage the leading country even if it had fallen very far behind in the future, but not so much as to incentivize the lagging country to attack.

But, beyond retaliation for treaty violations, there’s also the question of how to detect violations. Current nuclear treaties (starting from SALT) rely on “National Technical Means of verification”, (often referred to as NTM). Essentially, this means that countries can legitimately use espionage (through satellite pictures, human intelligence, or other means) to verify that the other country is complying with the terms of the treaty. However, in a world where one party has a significant AI R&D advantage, the leading nation will have an increased capacity to hide treaty-violating behavior. If we expect the R&D advantage only to grow further in the future, this problem becomes more significant. Thus, there has to be a way for the level of verification to scale with the level of the AIs.

The natural solution is to use the AIs themselves to manage verification. The AIs have a benefit over humans insofar as they can verifiably have their memories wiped. This means that they can be shown extremely sensitive details, and once they’ve concluded that it does not pose a risk of secret arms buildup, their memories can be wiped. However, at least in the initial stages, this process can’t be done autonomously, and would likely need human assistance. To do this, you could use a group of people from the lagging country who serve as inspectors. They would be put under close supervision by the leading country to ensure they do not leak any secrets.

8.3.4. Private Information

Although credible commitment is the more significant problem for negotiating a treaty, private information is also an impediment. Essentially, it leads to both sides having a different value for the cost of war. If both sides view war as cheaper (for them) than peace, then they will be unwilling to come to an agreement.

In the context of a potential nuclear counterforce strike, there are two matters of private information that are difficult, and critical, to settle:

1. Information on Secret Capabilities: Both nations may have secret capabilities that would lose value if their existence were revealed. (e.g., the ability to turn Starlink into a SAR constellation for constant surveillance). This is generally more of a problem when the leading nation has taken a covert path to achieving what it believes is a DSA, and is relatively mild where the leading nation has a relatively public approach.

2. Information on Resolve: The lagging nation doesn’t know if the leading nation would actually use its capability to launch a pre-emptive strike (nuclear war is costly even for the winner), and the leading nation would be incentivized to bluff that it would. Conversely, the leading nation doesn’t know how the lagging nation would respond to a strike. Would they actually launch a full countervalue strike on warning, or surrender immediately?

We’ll address each of these in turn.

For the former problem, there would need to be extremely strong information firewalls between the negotiators and the leadership of each country. As discussed in the previous section, AI negotiators could have their context selectively erased after each session. However, countries may not trust AI negotiators sufficiently to rely on them alone. In that case, it might be possible to have a team of negotiators who are then placed under indefinite monitoring by the leading nation to ensure they do not leak any information.

The latter problem is trickier. There are a few potential solutions here, and many of them could be used in parallel.

1. Wargames: There can be a series of wargames held between the leading and lagging countries that explore the behavior of each party under different scenarios.

2. Assume Aggression: An imperfect, but potentially practical, approach is to assume that both countries act as aggressively as possible. Military planners regularly take worst-case situations into account, and plan around them, especially in the nuclear realm. Both parties could agree to assume worst-case behavior: a pre-emptive strike by the leading nation and full retaliation by the lagging one. However, if extremely self-destructive weapons enter the mix, such as cobalt bombs detonated on the lagging country’s own territory, there may be more doubt around whether such weapons are bluffs.

3. Simulate leadership: This is an extremely speculative approach, but it might be possible to build a “digital twin” of each relevant leader in each country. This could be done at varying levels of fidelity depending on how far neurotechnology had advanced. Most likely, it will not be possible to upload brains non-destructively even in the mid-term future. Thus, the leaders couldn’t truly be uploaded. Nonetheless, it might be possible to create a “beta upload”, which is essentially an AI trained on the actions of a person, and designed to emulate their externally observable behavior. Such an AI wouldn’t necessarily have full fidelity, but it might be as close to a solution as one can practically get.

8.3.5. Overall Assessment

Bilateral treaties are probably the most positive-sum approach discussed in this section. If cooler heads prevail, the obstacles to a treaty (credible commitment and private information) are significant but not insurmountable. AI itself may help solve some of the problems, particularly in verification and negotiation, where AI inspectors could examine sensitive facilities or information without permanently retaining classified information.

However, any realistic treaty would be painful for the lagging country, potentially shockingly so. This is because the leading country wouldn’t negotiate based on the current balance of power, but on its expected future balance of power. If the leading nation’s AI R&D advantage compounds over time (as the flywheel effects (2.2.) discussed earlier suggest), then the leading country’s bargaining position improves with every year it waits. A treaty signed today must therefore offer the leading country more than what it could extract by waiting, building up further, and negotiating from an even stronger position later. The result is that the deal offered to the lagging country may seem disproportionate to the current gap between the two nations, which might appear small on the surface.

Despite this, it would almost certainly be in the lagging country’s interest to accept the deal. The alternative of continued competition would result in the gap widening further. The terms available in a few years would be strictly worse. A deal that looks bad today will look generous in retrospect.

But what can a lagging country offer a leading country? Although the specific terms would depend heavily on context, if we assume significant AI development has occurred, the most valuable concessions would likely involve:

1. Natural resources: This would mean access to the lagging country’s mineral wealth, such as rare earth elements (if China is the lagging party), or lithium, agricultural land, and energy resources (if the US is). In a world where AI has dramatically reduced the cost of intellectual labor, physical resources become a relatively larger share of economic value.

2. Market access: The lagging country will likely have imposed tariffs on the leading country, since goods and services produced with advanced AI R&D would be much cheaper than those produced with human labor, undercutting domestic industries. Removing these barriers would give the leading country access to a large consumer market, which might retain value even in a heavily AI-powered economy.

3. Long-term and space-related agreements: This is perhaps the most consequential category. Most of the long-term economic value accessible in the future will be in space, where there is an abundance of energy and raw resources. The leading country may ask the lagging one to cede any claims on space colonization, or agree to an extremely asymmetric division of off-world resources. Such agreements would seem abstract, and thus palatable at the negotiating table, especially if they come with favorable near-term concessions on resources and trade. However, they would relegate the lagging nation to irrelevance in the long-term future.

Ultimately, the treaty option is likely the best available approach for the lagging country, but the best available approach might still be very unfavorable if the gap in AI capabilities is large.

8.4. Targeting AI

Ultimately, there are limitations on what the lagging country can do to avoid being outcompeted by an adversary with a higher rate of R&D. As such, the lagging country could instead attack the root cause: the asymmetric development of AI itself.

Targeting AI may be desirable for other reasons as well. There are significant externalities, both positive and negative, of widespread deployment of advanced AI. Many of these negative externalities, like job displacement, bioterrorism, and loss-of-control risks, may be threatening to lagging actors, who do not reap any of the benefits themselves. However, in this analysis, we’ll restrict ourselves to a solely military analysis, and mostly ignore the myriad other impacts of advanced AI.

Targeting AI would be an early term intervention. Attacking AI infrastructure or researchers is no longer relevant once military infrastructure built with its assistance is already in place. Therefore, action taken in this domain would ideally need to start very early, before any country develops a strong and potentially self-reinforcing lead.

The main vectors that would be relevant for targeting AI are:

1. Supply Chain Disruption: The AI chip supply chain is highly interconnected and fragile. It’s easy for either the US or China to deny the other chips, which will limit their computational abilities, and reduce the speed of AI progress.

2. Cyber Attacks: The lagging party can disrupt the development of AI systems in many ways: sabotaging training runs, attacking GPU firmware, or damaging other infrastructure AI labs rely upon.

3. Disrupting Talent: Countries can also disrupt key talent. A campaign of assassinations on top researchers could significantly disrupt AI progress.

4. Kinetic Attacks on Datacenters: Finally, the lagging nation can attempt to kinetically strike data centers, although this may be a significantly escalatory action.

5. Bilateral Agreements for AI: Either country can incentivize the creation of international AI non-proliferation treaties. However, verification will be a difficult challenge.

Since the US and China are still on relatively equal footing in the AI race for now, it’s unlikely that either will escalate significantly along these axes until one actor pulls significantly ahead.

Today’s low-escalation equilibrium is largely accelerational. Although the US is mulling export controls, the degree of exfiltration from the US to China is high enough that the overall equilibrium still seems to be net positive for China.

However, if conditions change and escalation increases, the equilibrium could become decelerational very rapidly. Both actors would spend significant resources slowing one another down, and in turn suffer slowdowns imposed by the other. Hendrycks et al. (2025) suggest that this decelerational regime forms a stable equilibrium that they call MAIM (Mutually Assured AI Malfunction (by analogy with MAD)).

8.4.1. Supply Chain Disruption

Continued AI progress is almost exclusively dependent on ever-increasing amounts of “compute”: computational capacity that can be used to train or deploy AI. In 2020, researchers discovered so-called “Scaling Laws” that empirically predict the performance of an AI model as a function of how much compute was used to train it. There are nuances here: improvements in data quality, training methodology, and general algorithmic progress also play a significant role in the rapid AI progress that we’ve seen over the past few years. However, it’s clear that compute is a critical input in AI production that no developer can do without. Both the US and China are working to bring their supply chains entirely within the country, but until this is accomplished, both are vulnerable to supply chain disruptions.

Even today, the AI chip supply chain is highly multinational and decentralized, reflecting its origins as a largely commercial, rather than national security endeavor. Today, TSMC (a Taiwan-based company) operates the main fabrication plants (or “fabs”) for Nvidia, AMD, and Google’s AI chips. However, TSMC relies upon ASML (a Dutch company) for EUV photolithography machines, of which it is the sole producer. ASML, in turn, relies on Zeiss for its optics. Even China has historically relied on TSMC (and its associated supply chain) for the bulk of its chips.

However, the US and China are beginning to realize the national security risk posed by such a fragile chain. Spurred by recent US export controls, China has invested heavily in its own entirely localized fab, SMIC. SMIC is still dependent on ASML’s older DUV machines, although it was caught trying to reverse engineer them. The US, in turn, has convinced TSMC to start building fabs in Arizona. By 2030, both states will likely have fully indigenized their semiconductor manufacturing chains. Nonetheless, in the intervening time period, both are vulnerable to supply chain disruption.

China can disrupt the US’s supply chain quite significantly if it attempts to take Taiwan, a long-stated goal. The fabs in Arizona have only just begun to come online, and have not yet reached the level of throughput required to match Taiwan’s. Taiwan may have plans to destroy TSMC in the event of Chinese attack, to avoid its secrets falling into enemy hands. This would likely deprive the US of new chips for several years until the TSMC fabs in Arizona were fully developed. There would also likely be a loss of tacit knowledge that is, by some accounts, critical to efficient production.

The US, though, can apply much more fine-grained measures, and has already to some extent been doing so. The US has a relatively robust system of export controls that it can apply to any country using US-developed tools. TSMC, for example, has been banned (through US export controls) from exporting certain kinds of chips to China. ASML has been banned from selling its most advanced EUV machines to China, and some in the US are looking to extend this ban to DUV machines as well.

There is a relatively short window to act here, as export controls will likely be irrelevant in the future as nations better secure their supply chains. Before that time though, they would be quite effective.

8.4.2. Cyber Attacks

Hendrycks et al (2025) suggest that one of the primary ways an adversary nation would attempt to impede a country’s AI process would be by attacking the model training process. Training a new model is a monthslong process, and the reason behind a “failed” training run is difficult to pin down. There’s also a relatively broad surface area for attacks that impede progress.

Besides impeding the performance of the overall process, the lagging state can attempt to improve its own AI abilities by exfiltrating secrets from the leading party. They could exfiltrate “algorithmic secrets”, improvements to model architecture or training that improve the performance of AI models. It might also be possible to exfiltrate the entire model weights, saving the lagging party the difficulty of training models. Even if neither of those work, they could distill the model, training their own model on the outputs of the leading model to improve the smaller model’s performance.

Poisoning Training Data

AI models rely on vast swathes of data to be trained. This training data influences their behavior and characteristics. The lagging nation could plant adversarial data that reduces the capability of the model on specific topics and inhibits its use in the military.

AI training has two main phases, each with a distinct attack surface. Pre-training ingests vast amounts of text data (internet scrapes, textbooks, commissioned specialized datasets) over months of compute, teaching the model general knowledge and reasoning. Post-training then refines the model using curated problem sets (often called RL environments, developed in-house, by data providers like Mercor, or by specialized startups) and reinforcement learning to improve its ability to solve long-form agentic tasks. A final round of safety training shapes the model’s character and user experience.

The attacker will find it very easy to insert data that will get scraped by the pre-training data. It’s trivial to insert text or narratives in social media, newspapers, and Wikipedia. However, the challenge is that AI labs are very wary of low quality data. They frequently do smaller training runs and then evaluate the model’s performance to ensure that data doesn’t lower the performance of their model. As such, the pretraining data would need to evade detection, perhaps by ruining the AI’s performance on subtle things that are only relevant for military technology, and don’t affect performance in general.

Pre-training data attacks have a benefit: many labs can scrape the same data source. Thus, the source of poor performance on a topic could be misdiagnosed as “a general weakness of AI” rather than a specific bug in a model. However, it is unlikely to impede performance very much. Labs generally post-train, which can erase, or even flip a base model’s intuitions on a certain topic, and improve performance on a topic the adversary would want to keep poor. Additionally, low quality training data is likely to be removed over time as labs improve their screening procedures.

The attacker can also poison post-training data. It would require insider access at a known RL environment vendor, but this is well within the capability of a well-resourced nation state. There’s often not much subsequent training after this step, so the behavioral bugs that get in here are likely to stay. An adversarial RL env can train behaviors that are subtly wrong, working well on the environments provided, and seeming reasonable to any human reviewers, but that fail to work well in practice. This is especially doable on relatively niche domains where the average AI lab employee is not knowledgeable. For example, imagine teaching the AI systematically wrong approaches for laser development.

However, post-training data attacks likely wouldn’t transfer over from lab to lab very well, since you’d have to negotiate with them to develop an environment for each lab, and they may have different requirements and specifications.

Data poisoning attacks can also have relatively high impact in the beginning stages of AI R&D, when defense contractors are just beginning to evaluate AI models’ utility for design, hardware, or software work. Poor performance can delay adoption.

Training Run Sabotage

An adversary who had gained access to the network, or had an insider connection could subtly sabotage a training run by setting incorrect values for hyperparameters. Hyperparameters are settings that control how the model is trained. These include things like “learning rate” (how fast the model learns), “batch size” (how much data is presented to the model at the same time), and other important factors. There are often thousands of hyperparameters, and the process for setting them is quite opaque.

There is an excellent case study here. In 2024, Keyu Tian, a Peking University PhD student interning at ByteDance, apparently sabotaged his colleagues’ AI training runs for months in order to have their projects deprioritized, and get his project more compute.

According to a few unconfirmed reports, the way he did this was:

1. Modifying PyTorch Source Code: Keyu Tian modified the PyTorch source code in the cluster environment used by his colleagues, including changes to random seeds, optimizer’s direction, and data loading procedures. These modifications were made within Docker containers, which is not tracked by Git.

2. Disrupting Training Processes: Keyu Tian deliberately hacked the clusters to terminate multi-machine experiment processes, causing large-scale experiments (e.g., experiments on over thousands of GPUs) to stall or fail.

3. Security Attack: Tian gained unauthorized access to the system by creating login backdoors through checkpoints, allowing him to launch automated attacks that interrupted processes of colleagues’ training jobs.

4. Interference with Debugging: Tian participated in the cluster debugging meeting and continuously refined the attack code based on colleagues’ diagnostic approaches, exacerbating the issue.

5. Corrupting the Experiments: Tian modified colleagues’ well-trained model weights, making their experimental results impossible to reproduce.

Note that he was likely working alone here, and didn’t seem to have an ulterior motive. It’s highly likely an adversary nation state would be able to do much better than this, and avoid getting caught. However, it’s also true that many of his actions (e.g., disrupting multi-machine experiment processes) were only possible due to lax security practices.

Low-Level GPU or Infrastructure Attacks

An adversary could also attempt to attack GPU firmware or infrastructure. There are a few things one could do with this ability:

1. Cause subtle and occasional errors when the firmware detects a training run is happening, but not when any kind of diagnostic code is running.

2. Repeatedly spin up and spin down the GPU fans, accelerating fan failure.

3. If water cooling is used, attempt to cause leaks by over-pressurizing water or otherwise taking harmful actions.

4. Overvolting hardware (if the power supply is able to).

The latter 3 have the additional advantage of being able to potentially permanently put hardware out of commission.

Exfiltration

An adversary could also accelerate their own progress rather than impede the adversaries’. They could exfiltrate secrets, weights, or training data that enables them to produce higher quality models than otherwise possible, narrowing the gap.

EpochAI has discussed this topic in depth as well.

The easiest method of exfiltration would be to exfiltrate algorithmic secrets. If insider access at labs could be gained, it would be trivial to learn and transmit these back to the lagging country. These secrets are not classified, and thus, are far less well protected than comparable military secrets. We know that algorithmic secrets already leak between labs very quickly. For example, take the case of OpenAI’s o1 model. This model used a (at the time unique, but now ubiquitous) chain of thought process. This innovation was copied very quickly, appearing in the next generation of Claude and Gemini, as well as DeepSeek’s R1. Million token context windows (which likely imply some form of subquadratic attention) also appeared at around the same time in multiple labs. These, among other cases, point to very fast leakage of algorithmic secrets.

It would be more challenging (but perhaps rewarding) to exfiltrate model weights. This is especially the case when there is a large gap in compute. Stealing model weights allows one to avoid having to train a model, something that still needs to be done when only algorithmic secrets are being stolen. However, model weight theft is more difficult to do. Weights are very large pieces of information, potentially several terabytes, and thus are more difficult to stealthily exfiltrate without triggering alarms.

However, if model weights can’t be directly stolen, model behaviors might be. Anthropic recently reported that DeepSeek, Moonshot, and Minimax (all Chinese AI labs) attempted to clone Claude’s behavior through a process called “model distillation”. Model distillation involves training a weaker model on the outputs of a stronger one. It allows a weaker model to very quickly improve its abilities, much more quickly than training from scratch. These attacks are very difficult to foil, as they can be conducted in a very decentralized manner.

Overall Assessment

Cyber attacks likely won’t permanently halt the leading nation’s AI progress, but they might be able to delay it by a strategically significant amount. Each individual attack vector has countermeasures, and a sufficiently secure AI lab might be relatively invulnerable. But the cumulative delay from layering multiple vectors could be on the order of several months. The security measures that would be implemented in response also would slow down the leading actor. Anthropic has stated that its internal security measures (including its SL4 security level requirements) meaningfully slow its development relative to competitors who do not implement equivalent safeguards.

The lagging nation would likely simultaneously pursue both sabotage and exfiltration, as they complement each other: sabotage slows the leader, exfiltration speeds the laggard, and the gap is what matters. However, there is a tension between them: both require penetrating the same organizations, and a sabotage operation that gets detected burns the access that could have been used for exfiltration. A rational intelligence service would likely prioritize exfiltration in steady state and reserve sabotage for moments where delay is acutely needed. For instance, this might happen if intelligence indicated the leading nation was close to a capability threshold that would translate into deployed military hardware.

8.4.3. Disrupting Talent

In many ways, the problem of slowing down AI progress is similar to Israel’s goal of slowing down the Iranian nuclear program. Indeed, Stuxnet, considered one of the world’s most advanced computer worms, was invented to cripple those efforts.

However, According to former CIA Director Michael Hayden, the most effective thing the Israelis did to halt the progress of the Iranian nuclear program wasn’t the cyber attacks, but rather a campaign to assassinate Iranian nuclear scientists. He cited three benefits:

1. It removed the main people with knowledge and experience in the nuclear field.

2. Forced the Iranians to expend much effort into screening for moles, looking for viruses, and putting bodyguards on scientists.

3. Many Iranian nuclear scientists decided that the risks of working for the nuclear program were too high, and returned to teaching or non-nuclear roles.

Exactly the same considerations would apply to a campaign of assassinations on AI scientists. Arguably, the effects of a campaign of assassinations on the AI industry would be even more stark. Some AI researchers are paid extremely high sums, far more than their colleagues. If we assume that their salaries are proportional to the amount of value they provide the company, then a campaign of assassinations could be extremely impactful.

However, a campaign of assassinations would be very escalatory, much more so than cyber attacks.

8.4.4. Kinetic Attacks on Data Centers

The last resort for the lagging nation is to physically destroy data centers. This is highly escalatory, but also provides a very direct and immediate option to reduce computational capacity and disrupt training runs.

Data centers are relatively soft targets. The most practical ways to destroy them would likely either be a missile strike or a special operations raid. Each method has pros and cons.

A conventional (i.e., non-nuclear) missile strike is probably the simplest way to destroy them. However, the main issue is the risk of a conventional missile strike being confused with a pre-emptive nuclear attack. It’s impossible to tell from early warning systems if a given ballistic or hypersonic missile contains a nuclear or conventional warhead. Further complicating things, at least in the US, many data centers are located in northern Virginia, quite close to DC. As such, a missile strike may be easily confused with a decapitation strike.

Special ops raids are also possible. These might involve a group of highly trained operatives who sneak onto a data center via various means, and attempt to destroy the data center through explosives or other means (e.g., manipulating the cooling systems or power distribution systems). These bear far less risk than a missile strike in terms of nuclear retaliation, but there is a much higher risk that the operatives will be caught and imprisoned by police.

Similarly to the cyber case, there is a degree of time pressure. By the time the lagging nation feels pressured enough for kinetic strikes on data centers, it is likely already too late to make an impact. Destroying the data centers will only impede training new models, as it is relatively cheap to run existing models.

One thing the leading country could do to avoid accidental escalation would be to place data centers in unpopulated or remote areas, so that attacks on data centers can be distinguished from decapitation strikes.

8.4.5. Bilateral Agreements for AI

Here, we consider the possibility of a treaty governing the development and deployment of AI. As we will see, building a treaty on AI is considerably more difficult than building one on nuclear deterrence.

In this section, we discuss AI treaties on purely military grounds. However, it is reasonable for many actors, especially lagging ones, to desire a treaty to regulate the negative externalities imposed by the leading actor, which fall outside the military domain.

Recall from the previous section on bilateral agreements (8.3.) that a treaty is only possible when each side has positive incentives to agree to it. The leading party has to get something out of the treaty to consent to it. While the lagging party can always offer concessions, single-issue treaties are generally preferable. Bundling in ancillary items like tariff reductions or monetary deals makes negotiations more complex and politically fragile, especially in a regime where the precarious military situation may not yet be apparent. For these reasons, we will examine whether a non-concessionary AI treaty is feasible on its own merits.

Unfortunately, in the low-escalation accelerational regime, there is very little basis for a treaty. The leading party has no real incentive to constrain itself. (Although there might be grounds for cooperation on negative externalities that both parties experience.)

The dynamics change in the high-escalation regime, or once AI diffusion through exfiltration or other means slows. This regime is probably entered around the time when the military implications of AI become a high priority for both sides. Both sides are now experiencing significant deadweight loss from mutual sabotage, providing grounds for a non-concessionary treaty. A plausible agreement in this environment would consist of the leading party agreeing to slow its pace of AI development, while the lagging party agrees to cease sabotaging progress.

The asymmetry of interests shapes the likely treaty structure. The lagging party will want stronger governance, while the leading party will want narrow governance that cements its lead. However, such treaties are only viable if the lagging party is actually causing enough damage through sabotage and other means to impose a significant cost on the leading party. If it is not, then a narrow treaty on AI alone offers the leading party nothing.

Credible commitment is the main factor that makes AI treaties difficult, especially in the absence of advanced AI verification regimes. But there are additional obstacles. AI is fundamentally a dual-use technology, and the economic benefits are difficult for the leading party to forgo. Enforcement presents a further challenge: it is much more feasible to regulate the amount of compute being used than to verify the capabilities of trained models, yet it is capabilities, not compute, that are actually relevant for producing military technology.

However, we should not be too pessimistic about AI treaties. Third-party and domestic political pressure are powerful forces in aggregate. There are real negative externalities from AI, and these will need to be addressed. Even if the game theory from a purely military standpoint does not heavily incentivize treaties, these broader forces may be sufficient to push states toward governance arrangements that would otherwise appear irrational for the leading party to accept.

8.4.6. Overall Assessment

Targeting AI is the earliest and most upstream counter discussed in this section. Its strategic purpose is not necessarily to stop an adversary’s AI progress in absolute terms, but to prevent the relative gap from becoming large enough to yield a self-reinforcing strategic advantage and collapse deterrence. There are two questions here:

1. Can AI suppression work in principle?

2. Can it work in a politically realistic way below the nuclear-escalation threshold?

The answer to (1) is likely yes. Data centers are highly visible, and they could theoretically be destroyed in missile strikes. Chip manufacturing facilities could also be destroyed. Repeated bombings could, in principle, prevent a self-reinforcing AI lead from ever hardening. However, this is highly escalatory. A missile strike on data centers would be indistinguishable from a nuclear attack in its early stages and would risk a nuclear response from the attacked country. Additionally, even if no nuclear retaliation were launched, it would almost certainly constitute grounds for war.

We now turn to (2): can the lagging country find politically realistic methods to suppress AI and prevent a DSA from forming? This is trickier, and the answer is likely uncertain. It depends on how aggressive the lagging country is willing to be, as well as whether its own AI capabilities are strong enough to close the gap even under heavy degradation. It is likely to be highly path-dependent.

Early in the race, when tensions are low, the lagging country would need to take advantage of opportunities to exfiltrate as much data as possible. It could also apply low-escalation measures like targeting supply chains and possibly data poisoning. In this low-escalation regime, the equilibrium would remain accelerational: AI would continue improving.

However, as tensions rise, both countries can take more extreme measures, including assassinating researchers, sabotaging training runs, and potentially attacking data centers to the extent possible without triggering immediate escalation. As mutual sabotage increases, the equilibrium becomes decelerational. It is only in this latter regime that bilateral treaties become much more plausible on purely military grounds.

8.5. Overall Assessment

There are no silver bullets for the lagging party. None of the counters discussed here is a totally foolproof way of maintaining a credible nuclear deterrent against an arbitrarily superior opponent. However, when the gap between the leading and lagging nations is small, these counters can be effective at delaying, or significantly reducing the probability of, a pre-emptive strike. All of them, however, come at high cost in money, resources, risk, or political feasibility.

In general, countering a DSA is highly time-dependent. Early measures have far more leverage than late ones. As the race progresses, the remaining options become progressively harsher and more escalatory.

The best time to act is before the gap has solidified, by targeting the AI capabilities of the leading nation. The variable that matters most is the relative gap, not absolute AI capability. A state does not need to freeze global AI progress, but it does need to stop the gap from becoming large enough to become self-reinforcing through AI-accelerated R&D on AI itself.

Nuclear buildup can also help prevent a pre-emptive strike, especially early on, when the military infrastructure is not yet built out. It forces the leading party to invest much more effort into its constellations, submarines, and other technology than would otherwise be necessary. However, as the leading party gains more and more from automation, this stops being a reasonable trade for the lagging party.

Doomsday weapons are likely last-ditch efforts, given the risk they pose to the country that builds them and their likely political toxicity. Additionally, while both bioweapons and cobalt bombs are significantly harder to defend against than nuclear missiles, all practical weapons do have countermeasures, and their value would decline as the enemy built more and more of them.

Bilateral treaties are the most positive-sum countermeasure discussed here. They allow both nations to avoid incurring the costs of military buildup or nuclear war and, in theory, should lead to a better outcome. However, the cost to the lagging party may still be high in objective terms, especially as the gap widens. Partially offsetting this is the fact that, as AI technology improves, verification and commitment capabilities may improve as well.

9. Conclusion

The claim of this post is not that AI directly breaks deterrence, but that sufficiently strong AI-driven automation and productionization could make the key enablers of a disarming first strike practical enough, fast enough, and scalable enough to field before defenders can adapt.

DSA does not come from any one breakthrough, but from three things becoming true at once:

1. Launch on warning must be degraded or delayed long enough to prevent a clean retaliatory launch from fixed forces.

2. The attacker must be able to find, suppress, or otherwise neutralize most survivable retaliatory forces, especially SSBNs and, in some scenarios, dispersed TELs.

3. Whatever survives these efforts must be reduced to a residual that missile defense can plausibly absorb.

If all three become practical together, the traditional assumption that no state can confidently disarm another in a first strike would no longer hold.

However, there are uncertainties. Right now, the challenge of solving these three problems lies in the difficulty, expense, and duration involved in building the necessary military hardware. Whether AI can significantly accelerate the design and productionization of military hardware at vast scales is an open question. Even if AI is able to accelerate the development of the necessary hardware, there is also the question of operational coordination. A pre-emptive strike would be massively complex on many levels and would require an extraordinary degree of coordination among many actors, with no leaks tolerated. Finally, defenders are not passive. Once they believe their survivable forces are becoming vulnerable, they can disperse more, build more, harden more, and move toward more dangerous alert postures. For that reason, the decisive variable is not merely absolute capability, but the speed at which the attacker can deploy.

For one or more of these reasons, it’s possible that a clean disarming strike never becomes fully reliable. But even if so, movement in the direction of pre-emptive strikes is still strategically destabilizing. If major powers come to believe that AI may soon make their retaliatory forces more visible, their command systems more penetrable, and residual strikes more interceptable, they will have incentives to expand arsenals, shorten decision timelines, rely more heavily on launch on warning, contest one another’s space architectures, and target the AI and semiconductor bases that underpin the competition. This new equilibrium would have higher costs, shorter decision times, and a greater risk of nuclear war.

Policy Recommendations

This piece has aimed to discuss the possibility of AI indirectly breaking MAD by enabling one power to develop and deploy significantly more advanced military technology than the other, and is not primarily intended as a policy memo. Even so, there are a few relatively low-regret responses if this analysis is at least partly right:

• Expand wargaming and analysis around AI-enabled military buildup.

• Invest in treaty-verification and confidence-building mechanisms before they are urgently needed.

• Develop methods for inspecting or auditing suspicious orbital payloads and large dual-use constellations.

• Harden the AI and semiconductor base because it is now part of strategic competition.

• Site critical AI infrastructure so attacks on it are less likely to be misread as decapitation attempts.

Final Thoughts

We are entering a dangerous new regime where AI-driven automation and productionization make deterrence less robust by compressing the path from military innovation to deployed counterforce capability. If that happens, the nuclear backstop that has constrained great-power war for decades may become far more fragile than previously assumed.

10. Further Reading

10.1. Nuclear Strategy and Counterforce

• Lieber & Press (2006): The End of MAD? The Nuclear Dimension of U.S. Primacy

• Lieber & Press (2017): The New Era of Counterforce

• Response: Correspondence: New Era or New Error? Technology and the Future of Deterrence

• Rethink Priorities: Would US and Russian Nuclear Forces Survive a First Strike?

• SIPRI: AI, Strategic Stability and Nuclear Risk (2019)

• Breaking Defense: It’s Time to Put American Bombers Back on Alert (2024)

10.2. Nuclear Arsenals and Force Structure

• Bulletin of the Atomic Scientists: Russian Nuclear Weapons (2025)

• Bulletin of the Atomic Scientists: Chinese Nuclear Weapons (2025)

• DoD: Annual Report on Military and Security Developments Involving the PRC (2025)

• UCS: Chinese Nuclear Strategy (2015)

10.3. Launch on Warning and Early Warning Systems

• Podvig: Russian Strategic Nuclear Forces (early warning history)

• Podvig: False Alarms and Incidents (2025)

• NSA: Launch on Warning — Nuclear Strategy and Its Insider Critics (1981)

• NSA: False Warnings of Soviet Missile Attacks (1979-80)

• Brookings: How Credible is Russia’s Evolving Nuclear Doctrine?

• China’s Nuclear Early Warning Architecture

• China’s Strategic Situational Awareness Capabilities

10.4. NC3I and Command and Control

• Acton (2024): The Survivability of Nuclear Command-and-Control Capabilities

• Lieber & Press (2017): The Launch-on-Warning Chain

10.5. Submarine Detection

• Yang et al. (2025) Simulation study of SAR imaging of multi-source internal wave wakes in underwater vehicle

• Stefanick (2025): Submarine Detection and the Future of Nuclear Deterrence

• CIA (1972, declassified): Future Methods of Submarine Detection

• Cold War SSBN Tracking History

• European Leadership Network: Quantum Technologies and Submarine Detection

• DTIC: Gravitational Anomaly Detection for Submarines

• Neutrino Detectors for Nuclear Non-Proliferation Verification

• Nature (2025): Reactor Neutrino Detection via CEvNS

10.6. TEL Detection

• MacDonald (2025): Tracking Mobile Missiles

10.7. Precision Strikes

• Postol (1986): Targeting and Civilian Casualties from Counterforce Attacks

• Depressed Trajectory SLBMs

10.8. Missile Defense

• DIA (2025): Golden Dome for America — Current and Future Missile Threats to the U.S. Homeland

• DOT&E: FY2024 Missile Defense System Report

• CSIS: New Generation Homeland Missile Defense Interceptors

• GAO: GMD Development Process Issues

• Hypersonic Missile Defense: Issues for Congress (2025)

• Origins of the Strategic Defense Initiative: Ballistic Missile Defense, 1944-1983

10.9. Directed Energy Weapons and SDI

• Directed Energy Missile Defense in Space (OTA)

• CIA: SDI Progress and Challenges

• Fenstermacher: Casaba-Howitzer and Nuclear-Pumped Directed Energy

• GAO: SDI Laser Initiatives

• Neutral Particle Beams for Missile Defense

• DTIC: Neutral Particle Beam Discrimination

10.10. Unconventional Delivery and Space-Based Systems

• Space Operations: Through The Looking Glass (Global Area Strike System)

• AIAA: Space-Based Interceptor Weight Analysis

10.11. Doomsday Weapons and Civil Defense

• On Thermonuclear War

10.12. Bilateral Treaties and War Bargaining

• Rationalist Explanations for War

10.13. AI Competition, Governance, and Targeting AI

• Superintelligence Strategy

• Keeping up With the GPTs