AI Is Not Omnipotent: Andrew Yao’s WAIC Speech on the Mathematical and Physical Boundaries of AI
AI Is Not Omnipotent: Andrew Yao’s WAIC Speech on the Mathematical and Physical Boundaries of AI¶
- Source: SemiVision
- Author: SEMIVISION
- Published: 2026-07-20T00:04:05+08:00
- URL: https://tspasemiconductor.substack.com/p/ai-is-not-omnipotent-andrew-yaos AI Is Not Omnipotent: Andrew Yao’s WAIC Speech on the Mathematical and Physical Boundaries of AI
AI Is Not Omnipotent: Andrew Yao’s WAIC Speech on the Mathematical and Physical Boundaries of AI¶
Original Article By SemiVision Research [Reading time: 3 mins]¶
Jul 20, 2026
AI Is Not Omnipotent: Andrew Yao’s WAIC Speech on the Mathematical and Physical Boundaries of AI
As generative AI continues to expand rapidly, the technology industry has focused heavily on questions of scale: How much larger can models become? How much computing power can be added? When will AI reasoning surpass human capabilities? And how close are we to artificial general intelligence?
At theWorld Artificial Intelligence Conference, however, Turing Award winner and Chinese Academy of Sciences academician Andrew Yao raised a more fundamental and frequently overlooked question:
Are there boundaries that artificial intelligence can never cross?
His answer was clear: yes.
Large language models can learn from enormous datasets, generate software code, analyze images, assist with molecular design, and demonstrate reasoning capabilities that increasingly resemble those of humans. Yet regardless of how many parameters they contain, how much training data they consume, or how powerful their chips become, AI systems remain algorithms operating within computational machines.
They cannot escape the limits of mathematical computability. Nor can they rewrite quantum mechanics or other fundamental laws of physics.
This means that although AI may redefine how humanity solves problems, it is not a universal intelligence capable of overriding mathematics and physics. Yao’s message was not intended to diminish AI’s significance. Rather, it was a reminder thattruly reliable AI security cannot depend solely on the judgment of the model itself. It must be reinforced by external boundaries based on mathematical proofs, cryptographic protocols, and physical laws.
The World Artificial Intelligence Conference (WAIC) is a premier global event dedicated to exploring the frontiers of AI technology and driving innovation in the field. Since its inception, the conference has convened over 8,100 top scientists, experts, entrepreneurs, investors, and industry leaders from around the world. Through a rich array of forums, exhibitions, awards, competitions, and interactive experiences, WAIC provides the global AI community with a vital platform to showcase cutting-edge research, discuss industry trends, and accelerate the growth of innovative projects.
The Expansion of AI Capability Does Not Eliminate Computational Limits
The most important difference between modern AI and traditional computer science lies in how problems are solved.
Traditional software relies primarily on engineers to analyze a problem, define rules, and encode those rules into programs. Machine learning takes a different approach. Instead of manually describing every step, developers allow models to identify statistical patterns from data.
Large language models have extended this approach into natural language, software code, images, video, and scientific data. For the first time, computers can process a wide range of tasks that were previously difficult to formalize.
Yet this breakthrough in capability has not changed the fundamental structure of computation.
Yao argued that even as datasets and models grow, AI can still be understood as a computational machine equipped with enormous amounts of information and increasingly sophisticated learning capabilities. It cannot solve problems that are inherently unsolvable by a Turing machine.
One of the best-known examples is the halting problem. No universal program can determine correctly, for every possible program and input, whether that program will eventually stop or continue running forever.
This reveals the first important meaning of AI’s boundaries:
The fact that models appear increasingly intelligent does not mean that every problem can eventually be solved by increasing computing power.
Most recent progress in large models has occurred within the domain of computable problems. By increasing model parameters, data, computing resources, and feedback signals, AI systems can find increasingly effective approximate solutions.
But simply enlarging a model cannot eliminate the barriers created by undecidable problems, extreme computational complexity, or strict physical constraints.
From an industrial perspective, this distinction is critical.
Over the past several years, the market has increasingly embraced a “scale solves everything” narrative. Under this view, companies with more GPUs, larger data centers, and more advanced models will eventually be able to solve a continuously expanding range of problems.
Yao’s argument suggests otherwise.
The future of AI will not depend only on scale. It will also depend on whether a problem is computable, whether an answer can be verified, and whether the system is constrained by mathematical or physical laws.
The First Security Boundary: Provable Security Through Cryptography
The first example raised by Yao was modern cryptography.
Most real-world cybersecurity systems are built on a basic assumption: attackers possess limited computational resources, which means that certain mathematical problems cannot be solved within a practical period of time.
The purpose of cryptography is not merely to make an attack appear difficult. It is to define a rigorous security model and demonstrate mathematically that, as long as certain assumptions remain valid, an attacker’s probability of successfully breaking the system remains extremely low.
One commonly used cryptographic model is the chosen-plaintext attack, or CPA.
Under this attack model, an adversary can actively select plaintext messages, submit them to an encryption system, and observe the resulting ciphertext. The attacker is later given a target ciphertext and attempts to determine which plaintext it represents.
This gives the attacker considerable power. The attacker is not limited to passively observing encrypted data but can actively test the encryption system.
A cryptographic scheme that is secure against chosen-plaintext attacks should ensure that even with this information, the attacker cannot efficiently distinguish between possible plaintext messages corresponding to the target ciphertext.
ElGamal encryption is one representative public-key cryptographic system discussed in this context.
Its security is based on mathematical problems related to the discrete logarithm problem and the Diffie–Hellman framework. Under specific group structures and the decisional Diffie–Hellman assumption, the standard ElGamal encryption system can provide semantic security against classical polynomial-time attackers. This is generally described as IND-CPA security.
The most important aspect is not the name “ElGamal,” but the phrase provable security.
Traditional software security often depends heavily on empirical evidence. A system is tested extensively, no vulnerability is discovered, and it is therefore considered reasonably secure.
Provable security follows a different logic.
Researchers first define precisely what an attacker is permitted to do. They then construct a mathematical reduction showing that if an attacker can efficiently break the encryption system, that attacker must also be capable of solving an underlying mathematical problem believed to be computationally intractable.
As long as the underlying assumption remains valid, the attacker cannot bypass the proof merely by increasing model parameters, improving prompts, or deploying more GPUs.
AI can certainly assist attackers. It can search for software vulnerabilities, generate malicious code, automate reconnaissance, and test enormous numbers of attack strategies.
But AI cannot transform a mathematically infeasible problem into an easy one simply through scale.
This is a central part of Yao’s argument about AI’s boundaries:
AI may accelerate the search for an answer, but it cannot abolish a mathematical theorem.
However, provable security does not mean unconditional or permanent security under every possible circumstance.
First, the proof applies only under specific mathematical assumptions and attack models.
Second, random-number generators, key-management processes, software implementations, and hardware side channels may still contain vulnerabilities.
More importantly, the discrete logarithm problem underlying ElGamal could eventually be threatened by sufficiently capable fault-tolerant quantum computers running Shor’s algorithm.
For this reason, governments and technology companies around the world are accelerating the transition toward post-quantum cryptography. The US National Institute of Standards and Technology has already finalized its first group of post-quantum cryptographic standards designed to resist attacks from future quantum computers.
A more precise interpretation, therefore, is that ElGamal demonstrates how mathematical proofs can restrict classical AI-powered attackers. It should not be regarded as an immutable, permanent security boundary.
Cryptographic systems must evolve as computational paradigms change.
The Second Security Boundary: Using Physics to Detect Eavesdropping
The second example discussed by Yao was quantum key distribution, commonly known as QKD.
Traditional cryptographic systems usually derive their security from the computational difficulty of mathematical problems. Quantum key distribution takes a different approach by pushing the security foundation down to the level of physical laws.
In classical communication, information can in principle be copied. An eavesdropper may duplicate data without leaving an immediately visible trace.
Quantum systems behave differently.
An unknown quantum state cannot be copied perfectly and arbitrarily. Measuring non-orthogonal quantum states also inevitably changes them.
When two parties distribute encryption keys using single photons or other quantum states, an external attacker attempting to intercept and measure those states will introduce additional errors into the transmission.
The communicating parties can compare a sample of their data and calculate the quantum bit error rate. If the error rate exceeds a defined security threshold, they can conclude that the communication channel may have been compromised and discard the key.
Quantum key distribution protocols such as BB84 have been supported by rigorous theoretical security proofs. Under idealized assumptions, any attempt by an attacker to extract information from the quantum signals will produce detectable disturbances.
Source: idquantique
This is fundamentally different from conventional AI-driven cyber conflict.
A highly capable AI attacker may analyze protocols, test billions of attack paths, and autonomously discover software vulnerabilities. But it cannot instruct a photon to violate quantum mechanics.
Nor can it perfectly measure an unknown quantum state while guaranteeing that the state remains completely unchanged under conditions in which the protocol’s security assumptions hold.
In other words, this boundary is not a rule written by a software engineer. It is imposed by the physical structure of the universe.
From the Micius Satellite to Quantum Communication Infrastructure
China’s development of quantum communication experiments and infrastructure provides a real-world example supporting Yao’s argument.
The Micius quantum science satellite demonstrated intercontinental quantum key distribution and encrypted communication between China and Austria. The experiment showed that satellite-based links could potentially extend quantum key distribution across global distances.
China has also developed the Beijing–Shanghai quantum-secured communication backbone, multiple metropolitan quantum networks, and plans for a broader integrated space-to-ground quantum communication system.
Such systems have been explored for use in government communications, financial institutions, electricity grids, and other sectors requiring extremely high levels of security.
However, “quantum-secured communication” does not mean that an entire operational system is automatically or absolutely secure.
Quantum key distribution primarily provides a secure mechanism for distributing cryptographic keys. It does not directly secure every part of the data transmission process.
QKD must still be combined with identity authentication, conventional data encryption, key-management systems, secure terminals, and trusted operational procedures.
Real-world devices may also contain detector vulnerabilities, imperfect photon sources, supply-chain risks, software weaknesses, and side-channel vulnerabilities.
International standardization research has repeatedly emphasized that if there is a gap between the theoretical device model used in a security proof and the actual physical implementation, attackers may exploit that difference.
QKD systems also face practical challenges involving device certification, transmission distance, infrastructure costs, network compatibility, and denial-of-service attacks.
Therefore, the most accurate interpretation of the “physical security” described by Yao is the following:
Quantum mechanics can provide an information-theoretic foundation for detecting eavesdropping during key distribution, but the complete engineering system must still undergo rigorous verification.
The Future of AI Security Is Not Simply About Training a “Good” Model
The deeper significance of Yao’s speech is that it changes how AI security should be discussed.
Much of today’s AI safety research focuses on alignment. The objective is to ensure that AI systems understand human values, avoid generating harmful content, and refuse malicious instructions.
This work is essential, but relying entirely on a model to make the correct decision creates obvious risks.
Large language models are probabilistic systems. Even after extensive alignment training, they may still behave unpredictably because of prompt injection, out-of-distribution inputs, contaminated context, tool-use errors, or interactions between multiple autonomous agents.
As AI evolves from a conversational interface into an agent with access to user accounts, financial resources, software execution environments, databases, robots, and industrial equipment, simply instructing the model to “behave responsibly” will no longer be sufficient.
A more reliable architecture would place AI inside a system with multiple enforceable boundaries.
The model layer would interpret tasks and generate decisions.
The system layer would restrict which tools, data, and permissions the AI could access.
The cryptographic layer would verify identities, data provenance, authorization, and the integrity of instructions.
The hardware and physical layers would ensure that certain critical operations could not be bypassed merely through software manipulation.
This suggests that the next phase of AI security competition may shift away from the question of who has the most intelligent model and toward a different question:
Who can build the most verifiable, auditable, and privilege-controlled intelligent infrastructure?
From Expanding Capability to Constraining Capability
For most of the past decade, the primary objective of the AI industry has been to expand capability.
More parameters, more computing power, larger datasets, and longer context windows have allowed models to cross performance thresholds that once appeared unreachable.
But as AI moves into financial trading, electricity systems, autonomous vehicles, industrial robots, drug development, critical infrastructure, and national security, the industry’s central questions will begin to change.
The next stage of development must address more than what AI is capable of doing.
It must also determine under what conditions an AI system must be absolutely prohibited from performing a particular operation.
How should an AI system’s identity and output be verified?
Can potential damage be limited to a predefined range when the model makes an error?
Which security guarantees can be proven mathematically rather than inferred from testing?
Which critical communications can be reinforced through physical laws instead of relying solely on computational defenses?
These questions indicate that AI security will no longer be treated as an optional feature added after model development. It will become a foundational infrastructure-design principle.
For enterprises, a trustworthy AI product will need to provide more than model accuracy and inference speed.
It will also require permission isolation, cryptographic identity, operational logging, data provenance, security verification, human oversight, and emergency intervention mechanisms.
For governments and operators of critical infrastructure, AI governance cannot be limited to content moderation. It must extend into model architecture, computing systems, networks, cryptography, hardware, and physical infrastructure.
Conclusion: Boundaries Are Not AI’s Weakness—They Are the Starting Point of Security
The central message of Andrew Yao’s WAIC speech can be summarized in one sentence:
AI is powerful, but mathematics and physics are more fundamental than AI.
Cryptography shows that computational complexity can be used to establish provable security boundaries.
Quantum key distribution shows that physical laws can be used to expose attempts at interception.
AI may optimize attacks, accelerate vulnerability discovery, and automate cyber operations. But it cannot arbitrarily overturn a rigorously defined mathematical proof, nor can it instruct the quantum world to violate its own laws.
This does not mean that humanity has already solved the AI safety problem.
On the contrary, it suggests that the most important future research direction is not to imagine that we can train a superintelligent model that will never make mistakes.
Instead, the goal should be to place AI inside an architecture where even if the model fails, it cannot easily cause a systemic catastrophe.
The first half of the AI era has focused on continuously expanding the capabilities of machines.
The second half will be defined by humanity’s ability to establish boundaries around those capabilities.
As models become increasingly autonomous and deeply integrated into the physical world, the factor that ultimately determines whether AI can earn long-term social trust will not simply be how intelligent it becomes.
It will be whether humans can use mathematics, cryptography, engineering, and physical laws to clearly define the security boundaries that AI must never be allowed to cross.
On July 16, 2026, 29 countries signed an agreement in Shanghai to establish the World Artificial Intelligence Cooperation Organization, an initiative led by China. The founding members are primarily from Asia, Africa, and Latin America, with a combined population of approximately 3 billion. This indicates that China is attempting to build a new platform for AI governance and technological cooperation based on the Global South.
However, population size does not necessarily translate into strength in the AI industry. The organization currently lacks major AI and semiconductor economies, including the United States, the European Union, Japan, South Korea, and India. More importantly, political alignment and corporate procurement decisions may diverge. Even if Western governments do not join a China-led organization, some companies may still adopt Chinese open-weight models such as DeepSeek, Qwen, or Kimi because of their cost, performance, and on-premises deployment advantages. It should also be noted that not all Chinese models are open source. Seed and certain commercial versions are still primarily offered through APIs.
PreviousNext