How To Make International AI Verification a Reality

Executive Summary

The U.S. and China lead frontier AI development. Fierce competition between them prevents either from slowing down on its own, even as capabilities circumvent the safety and security practices in place to contain them. This has prompted growing calls, including from within the U.S. frontier companies themselves, for an international agreement to slow or “pace” development. A potential future agreement faces the obstacle that rivals will not take each other’s word that its terms are being kept. Verification technologies could help resolve this, and many nation states interested in furthering international AI governance are well placed to develop them.

1. Verification provides a mechanism to reliably check claims regarding AI development and performance. Verification requires two elements: a party must disclose enough to prove it is complying without having to expose the sensitive details of its models, data, and code, and both sides must share a trusted method for checking those disclosures against the agreed terms.
2. A minimally viable international agreement that is achievable within a reasonable timeframe should focus on verifying that the size of AI model training runs remain below a certain threshold — a coarse but tractable proxy for dangerous capability. The technology required to produce the relevant evidence requires development and integration but is within reach.
3. In the longer term, the goal could be more fine-grained: letting providers prove, in a non-falsifiable way, that the models they train, use, and deploy meet agreed safety standards. This requires considerable R&D efforts, and it is uncertain whether it is attainable through mechanisms that do not sit close to the AI chip. Achieving this goal may require pooling of resources, for instance through a joint R&D initiative.
4. Hardware-enabled verification addresses the core security-transparency dilemma. Today’s compliance checks rely mostly on self-reported claims, because AI companies have legitimate reasons to keep their models, data, and code confidential. That leaves room for false claims to go undetected, and it fails entirely between rival states, which share no authority to compel disclosure and have every incentive to doubt an adversary and cheat themselves. Security features built into the hardware, combined with cryptography, could give a verifier the assurance it needs without exposing sensitive details of the underlying system.
5. Two trade-offs determine which verification mechanisms are worth building first. The first is scope against feasibility: mechanisms on or near the chip yield the most direct evidence and can therefore verify the widest scope of AI workloads, but rest on chips whose security, supply chains, and operating environments the verifying side cannot trust, leading to expected longer implementation timelines. Mechanisms placed further out read only coarser signals, such as power draw and network traffic, yet can be retrofitted onto existing data centers and avoid the chip-security problem altogether. The second trade-off is tamper-resistance against inspectability: a verification device must resist manipulation by the party under scrutiny while staying open enough for that same party to confirm it hides no backdoor. However, protecting a device against outside attacks may make it harder for it to be examined.
6. Governments with limited leverage over the AI chip supply chain should prioritize building open, retrofittable, off-chip tools. Passive network and power/thermal sensors added to existing data centers can distinguish training from inference within five years and could be the minimum a pacing agreement needs. This R&D should be undertaken alongside building mutually secured verification facilities, developing efficient privacy-preserving evaluation protocols, and mechanisms for the detection of secret compute. A second, less time-sensitive tier of important investments should target efforts across non-retrofittable off-chip mechanisms, scaling on-chip mechanisms and hardening their security, and improving the efficiency of zero-knowledge proofs.
7. Government support needs to go beyond funding the research. Governments can coordinate work through the existing International Network for Advanced AI Measurement, Evaluation, and Science, build independent testing capacity and shared standards, build research infrastructure, deploy fast and open funding mechanisms like prizes and advance market commitments, and use procurement and permitting to create early demand.

Introduction

This memo sets out how nation states that do not lead in frontier AI development can contribute to putting in place an international agreement to slow or “pace” it. The key contribution this memo contemplates is the development of verification technologies. Verification technologies enable the gathering and analysis of non-falsifiable evidence about certain claims pertaining to AI development and performance. 

Without such technologies, an agreement to pace the AI frontier is bound to fail, as the parties will not simply trust each other’s assurance that the terms of the agreement are adhered to. A discussion on what governments around the world can do is timely as a potential policy window is opening up for collaboration on safeguards between the U.S. and China.

Verification is essential for an international agreement on safe AI development

Progress in AI capabilities is accelerating, with current safety and security practices not keeping up. Recent cybersecurity and loss of control incidents are cases in point. In light of these risks, more than 1,300 employees and some leaders of U.S.-based frontier AI companies themselves have recently called for the U.S. government to “support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development”. 

An international agreement, whatever rules it sets, cannot rest on mutual trust: each party must be able to reliably determine whether the others are complying. That means exchanging information about sensitive activities, which raises two requirements: (1) each party has to be able to disclose enough to prove compliance without handing competitors undue insight into its models, data, and the hardware their models are trained and running on; and (2) they need a mutually trusted way to check that information against the terms of the deal.

Verification technologies make this possible. They are a privacy-preserving and secure way of collecting and assessing evidence about certain compliance claims. If done well, they can provide non-falsifiable assurance to the parties to an agreement that its terms are being complied with. What is more, while their obvious role is to check compliance once an agreement exists, they may also be what allows one to be reached in the first place. It seems much easier to get the relevant parties to the negotiating table if there exists a proof of concept for the verifiability of the agreement’s terms.

The near-term and the long-term vision for a verifiable international agreement

In the near term, an agreement could bar frontier training runs above a set compute threshold, keeping AI capabilities below an agreed ceiling (“Goal 1”). The amount of training compute serves here as a proxy for dangerous frontier AI capabilities. Verification technologies could enable proving that no party has breached such an agreement by checking these two elements:

1. That there is no secret compute that is not accounted for in the calculation of training compute;
2. What the known compute is used for – training or inference, i.e., the use of an already trained model – and if the former, that the compute is not used for frontier model training beyond the set threshold.

In the longer term, verification technologies need to enable more fine-grained proofs. Ideally, providers of frontier models can prove, in an independently verifiable way, that the models they train, use internally, and deploy are compliant with concrete safety standards (“Goal 2”). To reap the benefits from AI for society, confidence regarding the safety and reliability of deployed models is essential. Verifying the size of a training run alone cannot achieve this. Verifying the size of training compute also doesn’t safeguard against the possibility of smaller models displaying dangerous capabilities beyond an acceptable level.

Hardware-enabled verification could unlock an international agreement to pace frontier AI development 

Verification technologies play a role in the pursuit of both the near-term and the longer-term goal. First, while the discovery of secret compute is currently possible with personnel-based and geospatial intelligence gathering, hardware-enabled verification could be more efficient and precise in the long-term. Second, verification technologies could help address the security-transparency problem that arises when known compute is concerned. The issue with verifying the type of workload (training vs. inference), training run size, and compliance claims is that AI companies and nation states have legitimate security and confidentiality interests to protect that stand in direct tension with the information disclosure required for the verification to be credibly conducted. The current approach to domestic regulation relies on statements the AI model providers make about their own compliance, at best backed up with reports by independent third parties, if they can get the required access. This method leaves room for falsifiability and is very likely not transferable to an international regime, since rival states have no shared authority to compel disclosure and are significantly more inclined to doubt a geopolitical adversary’s self-reported claims and to cheat themselves.

Hardware-enabled verification shifts the basis of trust from what a party claims to what its chips and other hardware can prove. Security features built into the hardware, paired with cryptographic techniques, let a verifier confirm a rule was followed — that compute is used only for inference rather than training, no training runs are conducted above a set threshold, and required risk mitigations are in place — without exposing the models, data, or code. No single mechanism is sufficient or fully secure against a capable state adversary; robustness comes from layering distinct categories of mechanisms: on-chip hardware controls, networking-based hardware controls, analog-based hardware controls, and personnel-based checks.

These mechanisms are at very different stages of maturity, and several are years from deployment. That gap creates possible roles for governments interested in furthering a future international agreement, namely building the required verification toolkit. This memo answers two questions for doing so: which R&D investments are most promising and how governments could support progress beyond funding that R&D.

Where governments could contribute to verification R&D

Two trade-offs

Verification scope versus feasibility 

For verifying what known compute is used for or is doing, mechanisms on or near the AI chips would yield the richest, most direct evidence, and could therefore verify a wide scope of AI workloads. But AI chips face serious security challenges: a track record of breaches, untrusted supply chains and untrusted operating environments. To make the security features of chips governance-grade would stand in tension with commercial interests, if it requires delaying, replacing, or changing the AI chip supply chain. On the other hand, verification mechanisms that sit further out infer behavior from the outside — power draw, network traffic — so evidence is generally coarser, but existing data centers can be retrofitted with the necessary technology; and developing such purpose-built devices for verification can avoid the challenges of tightening the security of chips and their supply chain.

This tracks the two goals: the proposed near-term pacing regime might begin with coarser checks that devices further away from the chips could provide — training vs. inference, no training runs beyond a certain threshold — while more fine-grained verification will likely require secure, purpose-built on-chip or chip-adjacent mechanisms to supply the necessary evidence. 

For secret compute, monitoring mechanisms sitting outside of a data center’s hardware, such as satellite and thermal imagery that flag a data center by its construction, cooling, and power signatures, could contribute to Goal 1 today. However, their detection performance and evidentiary value remain uncertain. Supplementing them with an administrative, personnel-based regime increases precision, since supply-chain records identify how many chips of what type exist and where they were sent. More direct evidence would come from hardware-integrated solutions, such as chip location tracking, but they are the least mature of the three as their resistance to manipulation remains below governance-grade; therefore they would take more time to implement.

How far a mechanism sits from the chip also determines who can build it. Off-chip mechanisms built on open-source hardware designs are within reach of any capable state; hardening the underlying security of on-chip mechanisms depends on leverage over a handful of manufacturers that most countries lack. The upshot is that the mechanisms most feasible for such countries to develop are also the ones that can be deployed most urgently to secure a minimally viable pacing agreement. 

Tamper-resistance versus inspectability

A verification device must do two things: resist tampering (manipulation) by the stakeholder under scrutiny (the government claiming not to possess certain chips or the model provider claiming not to conduct larger training runs than permitted), and satisfy the same stakeholder that it carries no backdoor which could reveal more information to the scrutinizing party than has been agreed. The first requirement calls for deep hardware security. The second calls for tools that both sides can open and inspect. These sit in tension, as protecting a device against outside attacks may make it harder for it to be examined.

Frontier chips are the technology where this trade-off is most lop-sided. U.S. companies design many of them (while packaging and assembly depend on a multinational supply chain), which makes their security subject to Chinese skepticism. Inspectability post-production is currently impossible without destroying them, so a Chinese stakeholder would have limited ability to inspect such mechanisms for hidden backdoors. Open-source AI chip designs could restore it in principle, but building such designs into frontier chips runs through a small number of leading designers and fabrication firms, limiting the ability of many governments to drive this strategy to completion.

For countries that are neutral to frontier AI development but are interested in furthering an international AI pacing agreement, a comparative advantage therefore lies in the open, off-chip part of the verification R&D portfolio as a crucial contribution to hardware-enabled verifiability. Given limited leverage over the U.S.-controlled chips, the focus should be on building open verification hardware that both Washington and Beijing can audit. Hardware developed outside the U.S. or China may be easier for both to scrutinize, although acceptance would need to be tested.

A portfolio for building the verification technologies for an international frontier AI pacing agreement

The proposed R&D priorities below consider near-term payoff and actionability for states that do not compete at the AI frontier and do not dominate the AI hardware supply chain, and are followed by cross-cutting requirements to be developed in parallel:

1. Building open, retrofittable, off-chip mechanisms — devices added to the compute fleet already in the data center, whose production is transparent — come first. Passive network taps and power, thermal, or electromagnetic sensors fit onto existing links, racks, and supply lines, and can already separate training from inference: a training run’s sustained, cluster-wide synchronization and near-peak power draw look nothing like the lighter, intermittent load of inference. With a focus on supply chain transparency, and together with innovation in physical security, deploying such mechanisms is likely the only route to verified inference-only compute within five years, which is the minimum a pacing agreement needs. It is more uncertain whether more nuanced claims about inference workloads could be checked with this verification infrastructure and within such a timeline.
2. Building open, non-retrofittable off-chip mechanisms — dedicated verification hardware that must be designed, manufactured, and installed with the compute rather than added to existing compute — come second. Because this verification hardware has to be integrated as servers are assembled, even though the AI chips themselves are unchanged, such a verification regime would require integration during system design or assembly and may therefore take longer to deploy at scale. Sitting closer to the chip, on the high-speed interconnect or inside a guarantee processor monitoring what flows to and from the chip, these off-chip mechanisms could support richer claims about what a training workload is doing. To ensure they can be trusted, they should be designed and built cooperatively and openly, so that both Washington and Beijing can audit the design. This is therefore a research direction particularly fit for neutral states that do not compete at the frontier of AI (hardware) development.
3. Scaling on-chip mechanisms — taking mechanisms that run on existing security features on AI chips from prototype to deployment comes third. Workload attestation or generating cryptographic commitments via confidential computing could let a developer prove properties of a training or inference run, such as the code and data it used or the safety tests it passed, without revealing the model itself. This could be valuable even if security remains at commercial grade, since commercial-grade auditing could still improve safety at frontier AI companies and provide real-world verification practice in an easier setting. For Goal 2, however, their security remains a bottleneck; their adoption depends on leading chip firms outside the direct control of most states, and Chinese stakeholders may not trust that these mechanisms only reveal the required minimum. 
4. Hardening on-chip security prerequisites — strengthening cybersecurity features already built into AI chips, so they become robust against a state attacker — comes fourth. Two of the most relevant features for on-chip verification are remote attestation, which lets a chip prove to a remote party it is running approved software, and confidential computing, which isolates code and data on the chip so that even the machine’s owner cannot read them. On-chip evidence is only as trustworthy as its foundation: today, its cybersecurity level is commercial-grade, and it is not designed to protect from physical tampering. Adoption cannot be forced from the outside, since these features must be implemented by U.S. entities, but R&D in governance-grade security protects chip IP and tracks where chips go, which could improve the prospects of adoption by leading chip firms.
5. Improving the efficiency of zero-knowledge proofs — cryptographic methods that prove a claim while revealing nothing else, and without relying on trusted hardware, is a high-upside, high-uncertainty task. The appeal of these methods is that they sidestep the hardware-trust problem: a party could prove a training run stayed under the threshold by mathematics alone. The major obstacle for frontier scale verification is cost, which stays orders of magnitude too high for frontier-scale training verification, but may be more feasible for inference.

Three requirements cut across the ranked priorities and warrant work alongside item one above, because multiple versions of a verification regime will depend on them. They constitute contributions governments without leverage over the chip designers and manufacturers can drive.

1. Mutually secured narrow-purpose data centers for verification. A pacing agreement could benefit from a mutually secured facility, physically guarded against tampering by any party, where verification operations, such as partial recomputation of a declared workload or model evaluations, can run without either side having to trust the other’s premises. This is the compute analogue of the neutral sites used in arms-control verification. A state neutral to frontier AI development could be well placed to host and help physically secure such a facility and develop measures to withstand the most advanced cyberattacks.
2. Privacy-preserving evaluation protocols. Collected evidence still has to be checked for compliance without exposing the models, data, or code it concerns. This is the software layer that sits on top of evidence collection mechanisms, on-chip or off, so progress here raises the value of all of them. This research needs no tinkering with proprietary hardware, which makes it well-suited for states that lack the leverage over its development. In contrast to the hardware layer, open-sourcing evaluation code may not be the solution for making it inspectable (and therefore trusted), as open-sourcing would enable states, AI developers or the models themselves to find ways to cheat the evaluations. Research in this direction should address this trade-off, too.
3. Detection of secret compute. Confirming that no compute operates outside the agreement would be required under a regime that depends on comprehensive compute accounting. For states that do not dominate the chip supply chain, effort here should not focus on on-chip location attestation, but on technical means to which such states could more easily contribute. Examples are satellite and thermal analysis of the construction, cooling, and power signatures that mark a data center.

Alongside these advanced technical means sits a supplementary layer, deployed at the compute under scrutiny: technical and personnel-based checks that produce less reliable evidence but could be deployed near-term, from inspections and tamper-evident cameras to chain-of-custody records auditing chips against manufacturing registries. As this compute sits primarily in the U.S. and China, especially for training, possible contributions by other states at this layer are what a neutral party can uniquely supply, including credible inspectors and participation in common standards. These are strategies requiring government support, which are addressed in the following section.

How to advance verification R&D beyond funding

Funding the research is only part of the task. Governments also shape whether it proceeds quickly, whether its results are trusted across the divide between the U.S. and China, and whether it is ever adopted. Several of these tasks build on the neutral position set out in the previous sections: states in such a neutral position can bring rival states and researchers together, host facilities that neither principal would concede to the other, and assess competing proposals independently. In this brief, we identify five possible areas for government action.

Coordination through the International Network for Advanced AI Measurement, Evaluation, and Science (“International Network”). Many governments already run national AI safety or security institutes, linked through an International Network (formerly the International Network of AI Safety Institutes) coordinated by the United Kingdom. While its current remit centers on technical, cross-border capability evaluations, compute verification would be a proposed new specialization. These institutes could divide verification research into complementary specializations and share their findings. Redirecting part of an existing institution toward verification likely reduces the overall cost compared to building new capacity. Verification could complement the model evaluations themselves, since it can confirm that the model evaluated is the one the provider claims it to be.

Independent testing and common standards. Most verification proposals originate with the laboratories and researchers who design them. A government with sufficient technical capacity of its own can test these proposals against shared benchmarks, so that competing designs become comparable. Developing the evaluation suites that examine the artefacts a credible check would inspect — training and inference plans, transcripts, and code — is the concrete form of this work. It could help for a state that does not dominate the AI supply chain to build the technical competence and credibility needed to contribute to inspection and standard-setting.

Research infrastructure. Governments can fund and host dedicated research clusters that give researchers access to the necessary hardware to run the R&D and pilots the above portfolio depends on, such as joint government and laboratory trials of privacy-preserving evaluations or developing measures for the highest-possible data-center security tier. Dedicated data centers for security and verification research are needed, because standard cloud providers do not provide users with physical access to the hardware. 

Fast, outcome-oriented, and open funding. Funding design may affect the speed and breadth of its effect. Because verification research is competing against the pace of capability advances, ordinary multi-year grant cycles risk missing the window, whereas outcome-oriented grant-making, advance market commitments and prizes could move money more quickly and draw in private investment. The field is also precompetitive, since the core mechanisms do not yet exist and no market rewards building them; mission-driven agencies of the ARPA or ARIA type, whose program directors commission research toward a defined goal, suit this better than ordinary grants and could pair with a safety or security institute that sets standards and tests what they fund. Public funding should favor open and auditable outputs where security and intellectual property constraints allow, since a verification method meant to be trusted by both the U.S. and China may require greater transparency than a conventional proprietary product.

Demand through procurement and permitting. Governments can create a market for verification by attaching requirements to procurement and to data-center permits, for instance that new facilities support confidential computing or hardware monitoring. This instrument is most effective where large volumes of compute are being built, which at present is the case in the U.S. and China far more than in any other country. A country with a growing data-center sector can apply such requirements at the margin and set an example, although its influence will depend on whether the jurisdiction hosts material compute capacity or another supply chain chokepoint.

Some essential contributions still depend on actors concentrated in the U.S. AI companies and cloud providers hold operational knowledge and access that are important for assessing feasibility and cost, and research on hardware security depends on the chip manufacturers. A government with no direct leverage can still attempt to convene and collaborate with these firms. That constraint is a further reason to prioritize work on off-chip mechanisms while building partnerships for access-dependent tasks.

Conclusion

The distinct advantages and constraints of governments that do not determine the AI frontier but are willing to advance verification technologies suggest the following actionable roadmap that could advance matters quickly:

1. The government designates a lead institution, plausibly a participant in the International Network, that coordinates with its counterparts in other jurisdictions to make verification R&D a priority and to distribute research efforts.
2. The government puts fast, open funding behind that mandate, through instruments such as prizes or advance market commitments, on the condition that the resulting designs are openly auditable, where appropriate.
3. The lead institution chooses a verifiable claim on which to focus R&D, for instance distinguishing inference from training or training run size.
4. It develops and publishes a standard against which to measure that claim. This standard can also serve as the benchmark for evaluating competing verification designs.
5. The participating institutions build the elements a trial requires, for instance, a set of retrofittable off-chip mechanisms to collect the evidence, a privacy-preserving protocol to check it, and a small mutually secured facility to run the check.
6. They then run a trial, showing one verification operation working from the integration of the mechanisms through secure evidence collection to the privacy-preserving independent check.

Bibliography

Closed-door workshop at Verified. https://verifiedconference.ai/ents

Aarne, O., Fist, T., & Withers, C. (2024). Secure, governable chips. Center for a New American Security. https://www.cnas. org/publications/reports/secure-governable-chips.

AI Futures Project. (2026, July 9). Get involved in verification. AI 2040. https://ai-2040.com/supplements/verification-plan/get-involved

Ansari, S. (2026). Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty Verification arXiv:2604.04712

Baker, M., Kulp, G., Marks, O., Brundage, M., & Heim, L. (2025). Verifying international agreements on AI: Six layers of verification for rules on large-scale AI development and deployment. arXiv preprint arXiv:2507.15916.

Baker, M., Friedman, A., Reuter, D., & Harack, B. (2026). Off-chip compute verification: How AI data centers could be retrofitted for verifiability. Google Doc. Retrieved from https://docs.google.com/document/d/10317woljRRoX9Gtcwir1u36ytbA680xfYrazMcuLisA/edit

Brundage, M., Dreksler, N., Homewood, A., McGregor, S., Paskov, P., Stosz, C., … & Tovcimak, R. (2026). Frontier AI auditing: Toward rigorous third-party assessment of safety and security practices at leading AI companies. arXiv preprint arXiv:2601.11699.

Fang, C. et al. (2022). Proof-of-Learning is Currently More Broken Than You Think. arXiv:2208.03567

Gabriel Kulp, Daniel Gonzales, Everett Smith, Lennart Heim, Prateek Puri, MJ Vermeer, and Z Winkelman. Hardware-enabled governance mechanisms. RAND Corporation, 2024.

Harack, B., Trager, R. F., Reuel, A., Manheim, D., Brundage, M., Aarne, O., … & Awad, A. (2025). Verification for international AI governance. AI Governance Initiative, Oxford Martin School, University of Oxford

Ilhan, A., Withers, C., Gietz, H., & Harack, B. (2026). Verifiable Semiconductor Manufacturing

Nevo, S., Lahav, D., Karpur, A., Bar-On, Y., Bradley, H. A., & Alstott, J. (2024). Securing AI model weights: Preventing theft and misuse of frontier models. Rand Corporation.

NVIDIA, Confidential Compute on NVIDIA Hopper H100, July 25, 2023.

OpenMined Team. (2024). Secure enclaves for AI evaluation. OpenMined. https://openmined.org/blog/secure-enclaves-for-ai-evaluation/

Petrie, J., Aarne, O., Ammann, N., & Dalrymple, D. (2025). Flexible hardware-enabled guarantees for AI compute. arXiv preprint arXiv:2506.15093.

Shavit, Y. (2023). What does it take to catch a Chinchilla? Verifying rules on large-scale neural network training via compute monitoring. arXiv preprint arXiv:2303.11341.

Tlaie Boria, A. (2026). Confidential computing can enable better frontier AI auditing. Pour Demain. https://www.pourdemain.ngo/post/confidential-computing-can-enable-better-frontier-ai-auditing-3 

¹ This memo is about verification, detecting whether the parties to a global pacing agreement comply, not its enforcement. Mechanisms that cap or halt non-compliant compute, such as hard compute limits or remote off-switches built into chips, raise separate technical and political questions and fall outside its scope.
² Multiple of the directions for support beyond R&D funding were inspired by a closed-door workshop at Verified: https://verifiedconference.ai/
³ Examples of such clusters are the infrastructure owned by the Verifiable Compute Foundation and operated by Lucid Computing; and the Side Channel Cloud operated by Amodo Design.