Compute verification
How inspectors could check limits on AI training, from a cluster’s power connections to records of its jobs.
Verifying a compute agreement
MIRI’s draft agreement would prohibit training above 10²⁴ FLOP and post-training above 10²³ FLOP, with continuous checks of chip use. When those checks cannot give enough assurance that prohibited work has stopped, the chips must be switched off. Operating limits and workload records offer different ways to investigate whether work can continue.
Initial arrangement; the current evidence is described below.
Each feed into the cabinet is disconnected, and the disconnect is sealed. A monitor with its own power supply watches the seals and the cabinet.
The monitor records a broken seal or movement of the cabinet. Inspectors investigate either event before accepting that the chips stayed off.
MIRI draft, Article VII VII.3 powered off and verified · VII.4 operating limits · VII.1 continuous on-site verification
What is being verified
Switched off
The chips must stay off. The drawing adapts containment and surveillance practice: disconnect both feeds, seal the disconnects, and monitor for tampering. Investigating equipment omitted from declarations also requires outside information, including imagery, signals and reports from people with access.
Running under limits
Network limits target the communication required for distributed training. A four-GPU experiment distinguished its training workloads from inference, including a low-communication training attempt. The software monitor was spoofable; reinforcement learning, low-rank fine-tuning and training within each permitted group remain unresolved.
Checking running jobs
Inspectors compare declared jobs with independently obtained records of hardware activity. Re-running a job can check the submitted account; unreported jobs still have to be found. Reinforcement learning complicates classification: generating answers can use one GPU pool while another updates the model, so inference can contribute to further training.
Interconnect experiment: Scher, Sarbakysh and Moskvin, 2026 · telemetry: Rahman and Tajdari, 2026 · disaggregated RL: Chen et al., 2026 · six layers: Baker et al., RAND, 2025
Six things an inspector has to establish
- Power stays disconnected · inspection practice · seals, surveillance and investigation of interruptions.
- Listed chips are present · sampling method · compare chip identities with the inventory (the sampling tool).
- Chip movements are recorded · administrative records · customs and export-control data.
- The links between nodes stay under the limit · prototype · two nodes, four GPUs.
- Job records match hardware observations · research proposals · activity records, re-execution and attestation check different parts of the account.
- Undeclared clusters are found · unresolved · imagery, signals and reports can direct investigations; the draft identifies secret projects as a significant challenge.
Sources page for each row