In a recent BLOG@CACM post, authors Mallik Tatipamula and Vinton G. Cerf call for the development of shared tools and interoperable infrastructure. Their goal is to enable the evolution of AI/ML to mimic the growth of the Internet. In particular, they call for the creation of an AI/ML stack which defines a layer of standard services. They also call for the application of a principle similar to the end-to-end principle which guided the development of the Internet.

I have been working for 25 years to understand the role of the end-to-end principle (also known as end-to-end arguments) in the evolution of Internet-delivered services, and I have sought a way to extend that success to a more general class of services. This led me to consider other standards-based resource stacks, including process management and storage, such as Unix/POSIX. Any AI/ML common services stack would have to go beyond networking to include these resources. The result of my work has been the principle of minimal sufficiency and a unified model of Information and Communication Technology infrastructure called the Exposed Buffer Architecture.

As was argued in the classic 1982 paper “End-to-End Arguments in System Design” by J.H. Saltzer, D.P. Reed, and D.D. Clark, those arguments apply to layered systems in a variety of domains. Tatipamula and Cerf (T&C) highlight the example of the Internet protocol suite (variously referred to as the network layer, the internetworking layer, or simply Layer 3). The definition of this common service layer, evolving at a glacial pace from IPv4 to IPv6, has been the basis of stable interoperability since the Internet’s earliest days.

In the POSIX stack, the service analogous to the internetworking layer is the kernel interface, including system calls and the observable behavior of the operating system. Support within POSIX for communication across nodes is limited to socket calls which allow access to the network stack. However, applications still benefit from the existence of a well-defined standard for process management and storage. Outside of communication between nodes, the role of interoperability is to ensure the portability of applications among different implementations of other core services.

The principle of minimal sufficiency is expressed in the language of formal reasoning systems. The idea is that any set of services such as the Internet protocol suite or the POSIX kernel interface can, in principle, be expressed in formal terms. More specifically, for any real system there is some system of logic which can be used to describe its specification. The full formal specification of a real system would be very detailed and difficult to write out. Nonetheless, we can use the properties common to all such logical systems to guide our rigorous design and analysis processes.

If we consider the specifications of two different logical theories (sets of statements) A and B, we can compare them in terms of “logical strength”:

• If every statement of theory B is a consequence of theory A, then we say that A is “no weaker than B.”
• If A is no weaker than B and B is no weaker than A, then A and B are “equivalent.”
• If A is no weaker than B, but not equivalent to it, then we say A is “stronger than B.”

This technical definition corresponds to some intuitive notions of ‘strength’:

• A stronger theory may have more consequences.
• A service with a stronger specification may make more guarantees to its clients.

The principle of minimal sufficiency can be stated in a manner analogous to Occam’s Razor:

• Given two logical theories that can both be used to prove the same consequence, the proof that begins with the weaker assumptions is generally preferable.
• Corollary: Given two services that can both be used to implement the same set of applications, the service that has the weaker specification is generally preferable.

The preference for weakness holds only generally, because real-world considerations such as performance or security are often omitted from formal specifications.

The principle of minimal sufficiency has been proven in the form of the Hourglass Theorem (“On The Hourglass Model,” Beck, Communications, July 2019), a result that explains why a weak common layer in the middle of a service stack can result in widespread voluntary adoption. The assertion by T&C that simple services tend to be ubiquitous can be thought of as analogous to the Hourglass Theorem. But T&C’s informal claim does not always hold—it is a “rule of thumb.”

While minimal sufficiency can be a useful tool, it is not a complete one. If we think of service specifications as logical statements ordered by the “no weaker than” relation, it is a partial order, not a total one. That means that many theories are not directly comparable, and some are equivalent. Also, some of the desirable characteristics of the Internet referenced by T&C are not explained by “logical weakness.” An example is simplicity, which is a vague notion with no precise definition. Simplicity only sometimes corresponds to logical weakness. Some statements that seem to be very complex are logically weak, and some statements that seem to be very simple are logically strong.

Even accepting the limitations of minimal sufficiency as a tool, it can often be used to compare closely related variants of a service. Using such comparisons, it is possible to seek the weakest service that can implement a given set of goal applications.

It is suggestive that T&C describe a common, interoperable infrastructure service as a “lowest common denominator,” a concept from the theory of partial orders, of which the integers ordered by divisibility are one example. If we think of service specifications as logical statements ordered by the “no weaker than” relation, then the weakest basis for a set of services is in fact analogous to a least common divisor. T&C do not suggest any ordering of services that could be used to formally define their intuitive notion of “lowest common denominator.”

It does not seem right to discuss the intent of the end-to-end principle based on T&C’s informal one-paragraph account. End-to-end has been the subject of controversy and discussion for decades, including a famous Internet Research Task Force working group. Some researchers interpreted the principle in terms of whether the network maintains state on behalf of user applications. This point of view was opposed in Noel Chiappa’s white paper entitled “Will The Real End-to-End Principle Please Stand Up?” The most authoritative source for the “real” end-to-end principle is the aforementioned 1982 paper by Saltzer, Reed, and Clark.

In that paper, the end-to-end arguments are summarized as saying that a function should be implemented in the internetworking layer when:

The function in question can completely and correctly be implemented only with the knowledge and help of the application standing at the end points of the communication system. Therefore, providing that questioned function as a feature of the communication system itself is not possible.

This description is couched in terms that suggest the existence of a specification whose implementation can be evaluated for completeness and correctness. Such an analysis requires a formal framework. Determining which “functions” can be implemented and what is impossible similarly require reference to a formal specification and a model for which such an argument can be made. No such formal framework is suggested in that paper or elsewhere by the authors. It is also noteworthy that the principle of minimal sufficiency is general enough to motivate T&C’s description, the end-to-end arguments, and the minimization of per-flow network state, as described by Chiappa.

The formal framework presented in “On The Hourglass Model” may not capture all aspects of the informal arguments that have surrounded the end-to-end principle. It is not clear that any formalism can. What I am suggesting is that the notions of logical weakness, minimal sufficiency, and the Hourglass Theorem capture an important part of what T&C call simplicity, lowest common denominator, and the end-to-end principle.

The end-to-end arguments, for all their shortcomings, were invaluable guides to the evolution and success of the Internet as a communication infrastructure. Minimal sufficiency helps explain that success in more formal terms. It also points the way to another infrastructure architecture,Exposed Buffer Architecture (EBA), which incorporates storage and processing. These are required to support interoperability in cloud-resident services including AI/ML.

Looking back at the design of the Internet, we can say that it represents a least-common divisor among three different models of wide-area communication: telephone calls, RF media channels (radio and television), and computer-to-computer packet delivery. It is arguable that any minimal service that supports all of these models well will be similar to the Internet. This is analogous to the fact that, considering the integers under divisibility, least common divisors are unique.

Figure 1: Tatipamula and Cerf’s “lowest common denominator”

Taking this analogy further, Exposed Buffer Architecture seeks to support storage and processing along with networking (Figure 1). This means finding commonality within a larger set of services, which may mean factorizing into even weaker components. EBA is the result of applying the Principle of Minimal Sufficiency to obtain a “basis” for this broader set of services. This is also an argument for the natural ubiquity of some aspects of the design of EBA. The properties of partial orders may create a design pressure toward a unique least common divisor.

The end-to-end principle is at best informal and arguably logically invalid. I propose that the cloud ML/AI community consider adopting some form of the principle of minimal sufficiency. Minimal sufficiency may be incomplete as a tool, but it is valid within its formal framework and its applications and limitations can be understood with precision.

Micah D. Beck (mbeck@utk.edu) is an associate professor at the Department of Electrical Engineering and Computer Science, University of Tennessee, Knoxville, TN, USA.

Submit an Article to CACM

CACM welcomes unsolicited submissions on topics of relevance and value to the computing community.

You Just Read

Minimal Sufficiency: A Principle ‘Similar’ to End-to-End

© 2025 Copyright held by the owner/author(s).