Page 326 - CyberSecurityEssentialsEnglish

general sentence “AI raises productivity”, but it is stronger as research, because it states
what we know, what we do not, and what the next fair test of the hypothesis would be.

7.7 AI in Quantitative and Qualitative Analysis and Research Programming

◆ Key idea: analysis needs testing, not convincing prose.
AI can shorten the time spent writing code, organizing data, and performing an initial
coding, but it does not guarantee the correctness of the model, the assumptions, or the
interpretation of the results. Every step must be tested on known data, the code and its
versions must be kept, and the tool must never fabricate or alter data without a record.

In quantitative analysis, AI may help write code to clean data, compute descriptive statistics,
draw a figure, or explain an error message. These are real benefits, especially for someone

who understands the goal but does not memorize the syntax of every library. But convincing
code may be silently wrong: it may use the wrong column, handle missing values in an
undeclared way, choose a test unsuited to the design, or treat a probability value as an

estimate of effect size.

Work begins before the code with a data dictionary defining the units, the permitted values,
the missing codes, and the derived variables. Then checks are run on the number of rows,
the duplicates, the ranges, the distributions, and the links between tables. The cleaning steps

must be re-executable through code or a log, not undocumented manual edits in a
spreadsheet.

When asking a tool for code, describe the structure of the data, the objective, the
constraints, the version, and the expected output, and ask for simple tests. Run the code on

a safe copy or on synthetic data, and read each step. Do not accept a function merely
because it runs; compare its output with a small manual calculation or a documented

example. And when using a library that changes, consult the official documentation.

Three Rules for Testing Code and Data
1. A model does not create real data. Synthetic data may be used for testing or teaching, but
it may not be presented as data that was actually collected. Fabricating data or results, and
recording or reporting them, lies at the heart of research misconduct [11].

2. Generated code is not correct because it runs. Test it on a small example whose result you
know, and write pre-checks: the number of rows, the column names, the missing values, and
the variable ranges. Then compare the output with a manual calculation or a documented

function.
3. Analysis is not interpretation. Code may produce a probability value, a coefficient, or a
qualitative theme, but the meaning of the result depends on the design, the measurement,

325