The technology that could make an international AI slowdown possible

• Core Problem: Multilateral AI slowdowns are currently impossible due to a "trust deficit"; actors fear ceding the frontier to rivals (specifically China) if they unilaterally pause while others continue.
• Proposed Solution: Verification tools that allow third parties to mathematically prove that compute resources are being used for specific tasks (e.g., inference only) without needing to inspect source code or model weights directly.
• Target Scope: Verification is focused on "compute" (physical chips in data centers) as the most viable entry point because they are specialized, geographically concentrated, and require massive power.
• Primary Use Case: Enabling international agreements (e.g., US-China) to pause dangerous training runs while allowing less risky activities like inference to continue, reducing the economic cost of a "slowdown."
• Current State of R&D: Only ~50-60 engineers globally are currently working on hardware-based AI verification; the field is in a "prototype/pilot" stage and requires a "moonshot" R&D effort comparable to Project Vela (nuclear detection).
• Immediate Action: Tom Milton predicts a marginal AI safety researcher could become one of the top five global experts in verification within one year by focusing on this specific niche.

Verification Technologies and Methods

• Network Certification (Recomputation):
  • Uses "network taps" to copy traffic between GPUs to an external verifier node.
  • The verifier re-runs the model using the intercepted network data to generate output tokens.
  • Compares the generated tokens against actual traffic to confirm the model has not changed (ruling out training).
  • Currently tested on a cluster of 32 H100/H200 GPUs.
  • Requires the verifier to access the model weights temporarily, creating a security risk.
• Zero-Knowledge Machine Learning (ZKML):
  • The long-term solution to eliminate the need to share model weights with verifiers.
  • Uses cryptographic proofs to verify claims (e.g., "no training occurred") without revealing the underlying data or weights.
  • Currently faces high computational overhead (orders of magnitude slower), but sampling strategies (checking 1 in 1,000 packets) may mitigate this.
  • Teams like Attestable and Future of Life Institute are actively developing ZKML variants.
• Power Fingerprinting (Side Channels):
  • Monitors electrical power fluctuations via inductive loops wrapped around power supplies.
  • Identifies workload types (training vs. inference) by detecting specific power consumption "signatures" (e.g., spikes during backward passes vs. forward passes).
  • Can detect model architecture details (e.g., a 12-layer model) through power spikes.
  • Less precise than network monitoring; susceptible to adversaries "spoofing" power patterns to hide training.
  • Analogous to detecting nuclear tests via seismology or chemical plants via mass spectrometry.
• Hardware Implementation:
  • Uses Field Programmable Gate Arrays (FPGAs) as reconfigurable network certifiers to store cryptographic logs of traffic.
  • Requires significant lead times for design, red-teaming, and manufacturing; cannot be deployed overnight in a crisis.

Future Trajectories and Challenges

• Detection of Hidden Infrastructure:
  • Relying on Open Source Intelligence (OSINT) and national intelligence assets (satellites, hacking) to locate undisclosed data centers.
  • Larger projects are harder to hide; however, small-scale "underground" labs remain a significant risk.
• Unilateral vs. Multilateral:
  • Domestic verification is easier via law enforcement and export controls; international verification requires mutual trust and physical installation of hardware.
  • Analogy to the Chemical Weapons Convention (CPCW): Inspectors use closed-mode mass spectrometers to verify prohibited chemicals without revealing proprietary IP.
• Labor and Industry Involvement:
  • Major AI labs (Anthropic, OpenAI) have minimal internal teams dedicated to verification (single digits), despite senior leaders citing it as a "theory of victory."
  • Verification is critical for labs to verify their own untrusted AI agents (e.g., preventing AI from modifying its own weights to pass safety checks).
• Regulatory and Geopolitical Shifts:
  • The Dutch Prime Minister recently submitted a UN research agenda on compute verification, signaling a shift from voluntary to state-backed efforts.
  • Governments are expected to fund R&D and provide "red-teaming" expertise, leveraging historical experience from nuclear and chemical disarmament treaties.
• Hardware R&D and "Vibe Coding":
  • AI models (e.g., Claude 3.5) are now capable of designing functional, albeit "ugly," hardware schematics (PCBs) in single-shot prompts, though routing remains poor.
  • Emoto Design uses rapid prototyping labs (10-100x acceleration) to test AI-generated hardware, aiming to democratize physical product creation.
  • Risks of automated hardware design include the difficulty of establishing "compilation" checks (unit tests) in the physical world compared to software.

Strategic Outlook

• Critical Path: The development of scalable, non-intrusive verification tools is the "most likely route to the Nobel Prize" for effective AI governance.
• Time Sensitivity: The gap between current prototype capabilities and the scale required for a global deal is significant; long lead times for hardware manufacturing mean R&D must begin immediately.
• Sovereign Compute: Nations (e.g., UK) face existential risks if they lose access to frontier model weights due to export controls; domestic high-security compute infrastructure is a strategic necessity.
• Philanthropic Role: New waves of philanthropic capital must flow into "fit-for-purpose" engineering labs that can rapidly prototype and deploy verification technologies.
• Optimism vs. Pessimism: The field is "tractable but not solved"; success depends on the speed of R&D acceleration and the willingness of labs and governments to collaborate on "red teaming" their own verification systems.