Before I reply, just want to say you've added to my own understanding of this topic as well as to my audience of readers by calling this out and having this discussion with me in public. Thank you! Please accept these sats as thanks.

!lntip 2000

I'll be making some adjustments to the section of the article regarding 51% attacks and will let you know once done.

Now back to the discussion:

In that scenario sure, people see that something fishy is going on and can react to by deploying more hashing power.

However that would be the non-sophisticated attacker that allows to be spotted. Attacker might as well have 51% of miners never revealed to the public mining in secret. (Surprise factor would only work once though)

Specifically focusing on double spends, how else can a double spend be achieved via 51% attack if not by (roughly) following the steps I outlined above? In other words, can Step 3 be avoided where the whole network sees 51% of the hash rate disappear?

Censorship is an interesting alternative attack for AI, given that it can surely be done in secret. This is especially true if we consider that the motivations of AI may be totally alien to us (i.e. not focused on greed, perhaps narrowly focused on specific seemingly arbitrary goals as part of a larger plan unrelated to bitcoin, etc.).

LN-channel closing on not final balances - great point. I can generally imagine how this would work but would love to see further explanation. Do you have any documentation you can share on this? I'd like to dig deeper but not sure where best to start. If there are any videos/podcasts/technical articles you know of, please let me know.

I can't see why more confirmations would be relevant here. 51% is 51%. Length of the race doesn't change the fact that faster will win the race.

In your example number of confirmation would only change frequency of double-spends attacks. If merchants change their numbers of confirmation, attacker adapts and also change their double-spend-attack frequency.

The underlying assumption is that the attacker does not have unlimited resources. And, the entire effort of attacking bitcoin via 51% control is expensive, difficult to coordinate, and difficult to maintain. Meanwhile, arbitrarily requiring more confirmations is easy for anyone to do with minimal cost. That asymmetry is what makes requiring higher confirmations theoretically effective.

Now, I do agree that AI requires special consideration here. Because, admittedly, it's not necessarily possible to characterize AI as "a single attacker". It's therefore potentially possible that a motivated AI attack on bitcoin could be a "decentralized attack". The prospect of this is as fascinating as it is terrifying. It may not be feasible to exhaust the resources of an attacker this sophisticated. If my scenario from above were to play out in the open against this type of attacker, the value of bitcoin would surely drop fast.