Skip to main content
Scrutica
Sources checked 11 Sep to 15 Oct 2026

Compute verification

The Verification Field

The corpus’s most cited work, Sastry et al. (February 2024), appears in the references of at least 32 of the 100 works published after it.

The corpus is 158 works on verifying AI compute and governing it through hardware, dated 2016 to October 2026.

The 100 works published after Sastry et al., by topic

  • Cites it · 32
  • Reference list not read · 7
  • Does not cite it · 61
Foundations: 7 of 10 cite it; 3 do not.
Hardware-enabled mechanisms: 8 of 16 cite it; 7 do not; 1 reference list was not read.
Location verification: 0 of 4 cite it; 4 do not.
Workload and training verification: 6 of 31 cite it; 22 do not; 3 reference lists were not read.
International agreements and inspection: 10 of 16 cite it; 6 do not.
Confidential computing: 0 of 17 cite it; 15 do not; 2 reference lists were not read.
Security analyses: 1 of 6 cites it; 4 do not; 1 reference list was not read.

Which works cite which, 2016 to 2026

Each circle is one of the 158 works, placed by date in one of seven topics; the lines are the 966 citations among them.

  • Sastry et al. 2024, selected
  • Works it cites · 20
  • Works citing it · 35
  • Cites it and is cited by it · 2 (counted in each)
  • Not linked to it · 104
  • Cited by 0, 10 or 35 works in the corpus
  • 2016 to 2021, each year at a quarter of the width
Citations among 158 works on compute verification, by date and topic; selected: Sastry et al. 2024, Computing Power and the Governance of Artificial IntelligenceFoundations · 24Hardware-enabled mechanisms · 21Location verification · 4Workload and training verification · 43International agreements and inspection · 24Confidential computing · 36Security analyses · 6Hwang 2018, Computational Power and the Social Impact of Artificial IntelligenceDafoe 2018, AI Governance: A Research AgendaKhan and Mann 2020, AI Chips: What They Are and Why They MatterBrundage et al. 2020, Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable ClaimsTrask et al. 2020, Beyond Privacy Trade-offs with Structured TransparencyWhittlestone and Clark 2021, Why and How Governments Should Monitor AI DevelopmentAvin et al. 2021, Filling gaps in trustworthy development of AISevilla et al. 2022, Compute Trends Across Three Eras of Machine LearningShavit 2023, What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute MonitoringAnderljung et al. 2023, Frontier AI Regulation: Managing Emerging Risks to Public SafetyEgan and Heim 2023, Oversight for Frontier AI through a Know-Your-Customer Scheme for Compute ProvidersPilz and Heim 2023, Compute at Scale: A Broad Investigation into the Data Center IndustryPilz et al. 2023, Increased Compute Efficiency and the Diffusion of AI CapabilitiesSastry et al. 2024, Computing Power and the Governance of Artificial IntelligenceHeim et al. 2024, Governing Through the Cloud: The Intermediary Role of Compute Providers in AI RegulationHeim and Koessler 2024, Training Compute Thresholds: Features and Functions in AI RegulationHooker 2024, On the Limitations of Compute Thresholds as a Governance StrategyReuel et al. 2024, Open Problems in Technical AI GovernanceErdil and Besiroglu 2024, Introducing the LLM distributed training simulatorPistillo and Villalobos 2025, Defending Compute Thresholds Against Legal LoopholesCasper et al. 2025, Practical Principles for AI Cost and Compute AccountingPilz et al. 2025, Trends in AI SupercomputersBarnett 2025, Compute Requirements for Algorithmic Innovation in Frontier AI ModelsBrundage et al. 2026, Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI CompaniesAllen et al. 2022, Improved Export Controls Enforcement Technology Needed for U.S. National SecurityGrunewald and Aird 2023, AI Chip Smuggling into China: Potential Paths, Quantities, and CountermeasuresFist and Grunewald 2023, Preventing AI Chip Smuggling to ChinaAarne et al. 2024, Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced ComputingKulp et al. 2024, Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090Petrie 2024, Near-Term Enforcement of AI Chip Export Controls Using A Firmware-Based Design for Offline LicensingClifford et al. 2024, Locking Machine Learning Models into HardwarePetrie et al. 2024, Interim Report: Mechanisms for Flexible Hardware-Enabled GuaranteesGupta et al. 2024, Whack-a-Chip: The Futility of Hardware-Centric Export ControlsFist et al. 2024, Technology to Secure the AI Chip Supply Chain: A Working PaperPetrie et al. 2025, Flexible Hardware-Enabled Guarantees for AI ComputePetrie and Aarne 2025, Part II: Technical Options for Flexible Hardware-Enabled GuaranteesAarne and Petrie 2025, Part III: International Security Applications of Flexible Hardware-Enabled GuaranteesO’Gara et al. 2025, Hardware-Enabled Mechanisms for Verifying Responsible AI DevelopmentGrunewald and Fist 2025, Countering AI Chip Smuggling Has Become a National Security Priority: An Updated Playbook for Preventing AI Chip Smuggling to the PRCKulp et al. 2025, Insights from a Workshop on Hardware-Enabled Governance MechanismsReber 2025, No Backdoors. No Kill Switches. No Spyware.Ammann and Dalrymple 2025, Faster AI Diffusion Through Hardware-Based VerificationAarne and Grunewald 2026, Export Auditors as Market-Powered Export EnforcementAnsari 2026, Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty VerificationAvellar and Grunewald 2026, Near-Term Verification Methods for AI Chip ExportsBrass and Aarne 2024, Location Verification for AI ChipsBrass 2025, Location Verification for AI Chips (issue brief)Tee and Happel 2026, GPU Fingerprinting for Location VerificationFeldgoise et al. 2026, Tracking AI Chips: Assessing Location Verification as an Export Control Enforcement ToolGhodsi et al. 2017, SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted CloudJia et al. 2021, Proof-of-Learning: Definitions and PracticeWeng et al. 2021, Mystique: Efficient Conversions for Zero-Knowledge Proofs with Applications to Machine LearningZhang et al. 2021, “Adversarial Examples” for Proof-of-LearningLiu et al. 2021, zkCNN: Zero Knowledge Proofs for Convolutional Neural Network Predictions and AccuracyTang et al. 2022, The MIT Supercloud Workload Classification ChallengeFang et al. 2022, Proof-of-Learning is Currently More Broken Than You ThinkKang et al. 2022, Scaling up Trustless DNN Inference with Zero-Knowledge ProofsChoi et al. 2023, Tools for Verifying Neural Models’ Training DataSun et al. 2023, zkDL: Efficient Zero-Knowledge Proofs of Deep Learning TrainingGarg et al. 2023, Experimenting with Zero-Knowledge Proofs of TrainingSouth et al. 2024, Verifiable evaluations of machine learning models using zkSNARKsSrivastava et al. 2024, Optimistic Verifiable Training by Controlling Hardware NondeterminismWaiwitlikhit et al. 2024, Trustless Audits without Revealing Data or ModelsChen et al. 2024, ZKML: An Optimizing System for ML Inference in Zero-Knowledge ProofsSun et al. 2024, zkLLM: Zero Knowledge Proofs for Large Language ModelsSun et al. 2024, SVIP: Towards Verifiable Inference of Open-source Large Language ModelsZhang et al. 2024, Hardware and Software Platform InferenceAbbaszadeh et al. 2024, Zero-Knowledge Proofs of Training for Deep Neural NetworksTan et al. 2025, Founding Zero-Knowledge Proofs of Training on Optimum VicinityOng et al. 2025, TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable InferencePeng et al. 2025, A Survey of Zero-Knowledge Proof Based Verifiable Machine LearningArun et al. 2025, Verde: Verification via Refereed Delegation for Machine Learning ProgramsAlmusaddar et al. 2025, ShadowScope: GPU Monitoring and Validation via Composable Side Channel SignalsRinberg et al. 2025, Verifying LLM Inference to Detect Model Weight ExfiltrationKarvonen et al. 2025, DiFR: Inference Verification Despite NondeterminismNVIDIA Newsroom 2025, Opt-In NVIDIA Software Enables Data Center Fleet ManagementMonfared et al. 2026, Timing and Memory Telemetry on GPUs for AI GovernancePal et al. 2026, Privacy-Preserving Mechanisms Enable Cheap Verifiable Inference of LLMsCankaya 2026, Bit-Exact AI Inference Verification Without Performance TradeoffsPeigné et al. 2026, Zero knowledge verification for frontier AI training is possibleCankaya et al. 2026, Fingerprinting All AI Cluster I/O Without Mutually Trusted ProcessorsRahman and Tajdari 2026, Detecting Hidden ML Training With Zero-Overhead TelemetrySu et al. 2026, OVIG: Optimistic Verification of AI Training Integrity via Gradient SignalsAlpay and Alpay 2026, Unprivileged Topology Certificates for Cloud GPU AttestationCankaya 2026, A System Overview for Near-Term, Low-Trust AI Compute VerificationScher et al. 2026, De-risking Interconnect Limits for AI VerificationAbdelghafar and Kulp 2026, Privacy-Preserving AI Verification via Minimal Information DisclosureWilding et al. 2026, Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM VerificationGargiulo and Kulp 2026, Workload Identification with Physical Side Channels for AI GovernanceAnsari 2026, Beyond Training: A Feasibility Taxonomy for Inference-Time AI GovernanceDonaghy et al. 2026, OPEN-1B: A Fully Auditable Training RunKimpson et al. 2026, Can Power Draw Constrain Covert Compute? Limits of Analogue Verification for AI GovernanceMittelsteadt 2021, AI Verification: Mechanisms to Ensure AI Arms Control ComplianceScharre and Lamberth 2022, Artificial Intelligence and Arms ControlBaker 2023, Nuclear Arms Control Verification and Lessons for AI TreatiesHo et al. 2023, International Institutions for Advanced AIShoker et al. 2023, Confidence-Building Measures for Artificial Intelligence: Workshop ProceedingsTrager et al. 2023, International Governance of Civilian AI: A Jurisdictional Certification ApproachHausenloy et al. 2023, Multinational AGI Consortium (MAGIC): A Proposal for International Coordination on AIMiotti 2023, An international treaty to implement a global compute cap for advanced artificial intelligenceWasil et al. 2024, Verification methods for international AI agreementsWasil et al. 2024, Governing dual-use technologies: Case studies of international security agreements and lessons for AI governanceScher and Thiergart 2024, Mechanisms to Verify International Agreements About AI DevelopmentHendrycks et al. 2025, Superintelligence Strategy: Expert VersionScholefield et al. 2025, International Agreements on AI Safety: Review and Recommendations for a Conditional AI Safety TreatyBucknall et al. 2025, In Which Areas of Technical AI Safety Could Geopolitical Rivals Cooperate?Barnett and Scher 2025, AI Governance to Avoid Extinction: The Strategic Landscape and Actionable Research QuestionsAl Ramiah et al. 2025, Toward a Global Regime for Compute Governance: Building the Pause ButtonHarack et al. 2025, Verification for International AI GovernanceBelfield 2025, Domestic frontier AI regulation, an IAEA for AI, an NPT for AI, and a US-led Allied Public-Private Partnership for AI: Four institutions for governing and developing frontier AIBarnett et al. 2025, Technical Requirements for Halting Dangerous AI ActivitiesBaker et al. 2025, Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and DeploymentScher et al. 2025, An International Agreement to Prevent the Premature Creation of Artificial SuperintelligenceKoopmanschap and Barten 2026, How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI AgreementsScher 2026, Verifying Restrictions on Frontier AI ResearchTeague et al. 2026, Could Underwater Data Centers Pose a Risk to AI Treaty Verification?Costan and Devadas 2016, Intel SGX ExplainedTramèr and Boneh 2018, Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted HardwareVolos et al. 2018, Graviton: Trusted Execution Environments on GPUsJang et al. 2019, Heterogeneous Isolated Execution for Commodity GPUsZhu et al. 2019, Enabling Rack-scale Confidential Computing using Heterogeneous Trusted Execution EnvironmentHunt et al. 2020, Telekine: Secure Computing with Cloud GPUsVaswani et al. 2022, Confidential Machine Learning within Graphcore IPUsMo et al. 2022, Machine Learning with Confidential Computing: A Systematization of KnowledgeIvanov et al. 2022, SAGE: Software-based Attestation for GPU ExecutionJiang et al. 2022, CRONUS: Fault-isolated, Secure and High-performance Heterogeneous Computing for Trusted Execution EnvironmentDeng et al. 2022, StrongBox: A GPU TEE on Arm EndpointsBluemke et al. 2023, Exploring the Relevance of Data Privacy-Enhancing Technologies for AI Governance Use CasesSridhara et al. 2023, ACAI: Protecting Accelerator Execution with Arm Confidential Computing ArchitectureMai et al. 2023, Honeycomb: Secure and Efficient GPU Executions via Static ValidationNertney 2023, Confidential Compute on NVIDIA Hopper H100 (WP-11459-001 v1.0)Apsey et al. 2023, Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AIDhanuskodi et al. 2023, Creating the First Confidential GPUsFuture of Life Institute 2023, Exploration of secure hardware solutions for safe AI deploymentWang et al. 2024, CAGE: Complementing Arm CCA with GPU ExtensionsDuddu et al. 2024, Laminator: Verifiable ML Property Cards using Hardware-assisted AttestationsDhar et al. 2024, Ascend-CC: Confidential Computing on Heterogeneous NPU for Emerging Generative AI WorkloadsWang and Oswald 2024, Confidential Computing on Heterogeneous CPU-GPU Systems: Survey and Future DirectionsZhu et al. 2024, Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark StudyWang et al. 2024, Fastrack: Fast IO for Secure ML using GPU TEEsTan et al. 2024, PipeLLM: Fast and Confidential Large Language Model Services with Speculative Pipelined EncryptionLee et al. 2025, Characterization of GPU TEE Overheads in Distributed Data Parallel ML TrainingFan et al. 2025, XpuTEE: A High-Performance and Practical Heterogeneous Trusted Execution Environment for GPUsPattern Labs and Anthropic 2025, Confidential Inference Systems: Design principles and security risks (Version 1.0)Schnabl et al. 2025, Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution EnvironmentsGu et al. 2025, Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential ComputingWang et al. 2025, ccAI: A Compatible and Confidential System for AI ComputingChantasantitam et al. 2026, PAL*M: Property Attestation for Large Generative ModelsPark et al. 2026, SCALE: Tackling Communication Bottlenecks in Confidential Distributed Machine LearningThijsman et al. 2026, Two-Way Confidential VMs (2cVM): Collaborative Confidential Computing for Mutually Distrustful PartiesLindenmeier et al. 2026, WarpGuard: Towards Control-Flow Attestation for Heterogeneous CPU-GPU ExecutionAsad and Grunseid 2026, Benchmarking Confidential Computing Performance on NVIDIA Blackwell GPUsNevo et al. 2024, Securing AI Model Weights: Preventing Theft and Misuse of Frontier ModelsLong 2024, Protocol Learning, Decentralized Frontier Risk and the No-Off ProblemKryś et al. 2025, Distributed and Decentralised Training: Technical Governance Challenges in a Shifting AI LandscapeGrunewald and Asher Brass Gershovich 2025, Accelerating AI Data Center SecurityChuang et al. 2025, TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus InterpositionRahman 2026, Does Distributed Training Undermine Compute Governance?Sastry et al. 2024Aarne et al. 2024Kulp et al. 2024Shavit 2023Heim et al. 2024Jang et al. 2019Jia et al. 2021Scher and Thiergart 2024Volos et al. 2018Brass and Aarne 202420162018202020222023202420252026

Foundations

Computing Power and the Governance of Artificial Intelligence

Girish Sastry, Lennart Heim, Haydn Belfield and 16 others

All 19 authors

Girish Sastry, Lennart Heim, Haydn Belfield, Markus Anderljung, Miles Brundage, Julian Hazell, Cullen O’Keefe, Gillian K. Hadfield, Richard Ngo, Konstantin Pilz, George Gor, Emma Bluemke, Sarah Shoker, Janet Egan, Robert F. Trager, Shahar Avin, Adrian Weller, Yoshua Bengio and Diane Coyle

13 Feb 2024 · arXiv

Argues that compute is an effective point of AI governance (detectable, excludable, quantifiable, with a concentrated supply chain) and maps how it can support visibility, allocation and enforcement, including through on-chip licensing.

Cited by at least 35 works in the corpus: 32 of them among the 100 published after it, and 3 dated before it, 2 of which it cites in turn.

Through chains of citations it reaches back to at least 38 works, and at least 64 of the 100 works published after it reach back to it.

Citations in OpenAlex

OpenAlex, an open index of scholarly works, lists at least 22 works citing it, read 7 October 2026.

Its index includes works in this corpus and undercounts citations to preprints and think-tank reports, so its count is a lower bound.

Its OpenAlex record

Sources register

Works it cites (20)
Works citing it (35)
How the map is drawn (7)
  • Each work belongs to one of seven topics, decided by the first subject its record lists. Some topics gather several subjects: Foundations also takes compute accounting and cloud know-your-customer; Hardware-enabled mechanisms also takes flexible hardware-enabled guarantees, offline licensing, chip registries and export controls; Workload and training verification also takes proof of learning and zero-knowledge machine learning; Confidential computing also takes GPU trusted execution.
  • A work is dated by its first public version, the three parts of the flexHEG series by the dates on their covers; one dated only to a month or a year is drawn at the middle of it.
  • A line can run from a work to one dated after it: the citing work lists it as forthcoming, or its reference list was read from a later version of itself, or it cites an earlier version of the cited work (a preprint or a web copy) that came before the date this corpus gives it. The lists of the works it cites and the works citing it give each such citation’s own note where its record has one.
  • Before 2022 a year takes a quarter of the width of a later one, since 19 of the 158 works are dated earlier; the shaded band and the break on the axis mark where the scale changes.
  • A circle’s area grows with the works in the corpus that cite it, from the smallest, for none, to the largest, for 35. The newest works have had the least time to be cited: 19 of the 31 dated 2026 have no citation in the corpus yet.
  • The plate names the selected work and the ten works cited most often within the corpus (the earlier, where two are cited equally often), each inside its own topic and clear of the other marks and the topic names; a name set apart from its mark has a line to it, and a name with no such place is left off (the legend above the map names the selected work as well). A name on a work the selection is not linked to is set in grey. On a phone, a name the window shows only in part appears once the map is moved.
  • A line is drawn where the cited work appears in the citing work’s own reference list, notes or linked endnotes, or in OpenAlex’s record of the citing work alone. OpenAlex undercounts citations to preprints and think-tank reports, so for a work whose reference list could not be read, the lines drawn from it are a lower bound on what it cites.

Organisations by area of work, from the chip up

Companies are 21 of the 35 organisations working on confidential computing and 1 of the 8 working on location verification.

An organisation appears in each area of work where one of its documented activities falls.

  • Companies · 29
  • Standards and consortia · 9
  • Research · 29
  • Government and funders · 6

73 organisations appear 208 times across the ten areas of work.

Choose an area of work to list its organisations, or an organisation to read its record.

All 73 organisations, by area of work (208 entries)

Names run alphabetically within each kind.

Silicon root of trust16
Firmware and attestation21
Confidential computing35
Location verification8
Usage accounting16
Workload verification36
Inspection and audit22

Spanning the areas above

Standards14
Policy and law24
Research synthesis16

The works, newest first

The corpus holds 158 works from 2016 to 5 October 2026; 19 of the 31 dated 2026 are not yet cited by another work in it.

WorkDateTopicCitesCited byShow on the map
Can Power Draw Constrain Covert Compute? Limits of Analogue Verification for AI GovernanceKimpson et al. · arXiv5 Oct 2026Workload and training verificationcites 13cited by 0
Could Underwater Data Centers Pose a Risk to AI Treaty Verification?Teague et al. · arXiv16 Sep 2026International agreements and inspectioncites 2cited by 0
OPEN-1B: A Fully Auditable Training RunDonaghy et al. · arXiv15 Sep 2026Workload and training verificationcites 4cited by 0
Beyond Training: A Feasibility Taxonomy for Inference-Time AI GovernanceAnsari · arXivSources register9 Sep 2026Workload and training verificationcites 17cited by 0
Tracking AI Chips: Assessing Location Verification as an Export Control Enforcement ToolFeldgoise et al. · Center for Security and Emerging Technology (Issue Brief)Sources registerSep 2026Location verificationcites 9cited by 0
Workload Identification with Physical Side Channels for AI GovernanceGargiulo and Kulp · arXiv31 Aug 2026Workload and training verificationcites 9cited by 0
Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM VerificationWilding et al. · arXiv28 Aug 2026Workload and training verificationcites 2cited by 0
Benchmarking Confidential Computing Performance on NVIDIA Blackwell GPUsAsad and Grunseid · arXiv27 Aug 2026Confidential computingcites 1cited by 0
The other 150 works
WorkDateTopicCitesCited byShow on the map
Near-Term Verification Methods for AI Chip ExportsAvellar and Grunewald · Institute for AI Policy and StrategySources register19 Aug 2026Hardware-enabled mechanismscites 6cited by 1
Privacy-Preserving AI Verification via Minimal Information DisclosureAbdelghafar and Kulp · arXiv3 Aug 2026Workload and training verificationcites 27cited by 0
De-risking Interconnect Limits for AI VerificationScher et al. · MIRI Technical Governance Team blogSources register30 Jul 2026Workload and training verificationcites 10cited by 0
WarpGuard: Towards Control-Flow Attestation for Heterogeneous CPU-GPU ExecutionLindenmeier et al. · arXiv15 Jul 2026Confidential computingcites 3cited by 0
Verifying Restrictions on Frontier AI ResearchScher · ICML 2026 TAIGR workshop (per its arXiv record)27 Jun 2026International agreements and inspectioncites 18cited by 0
A System Overview for Near-Term, Low-Trust AI Compute VerificationCankaya · MIRI Technical Governance Team (working paper)Sources register23 Jun 2026Workload and training verificationcites 4cited by 1
Unprivileged Topology Certificates for Cloud GPU AttestationAlpay and Alpay · arXiv22 Jun 2026Workload and training verificationcites 4cited by 0
OVIG: Optimistic Verification of AI Training Integrity via Gradient SignalsSu et al. · arXiv19 Jun 2026Workload and training verificationcites 7cited by 0
Detecting Hidden ML Training With Zero-Overhead TelemetryRahman and Tajdari · ICML 2026 TAIGR workshop (per its arXiv record)Sources register17 Jun 2026Workload and training verificationcites 15cited by 5
How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI AgreementsKoopmanschap and Barten · International Conference on Large-Scale AI Risks 2026, KU Leuven (per its arXiv record)Sources register16 Jun 2026International agreements and inspectioncites 16cited by 0
Fingerprinting All AI Cluster I/O Without Mutually Trusted ProcessorsCankaya et al. · arXiv9 Jun 2026Workload and training verificationcites 8cited by 3
Two-Way Confidential VMs (2cVM): Collaborative Confidential Computing for Mutually Distrustful PartiesThijsman et al. · IEEE Access (accepted, per its arXiv record)9 Jun 2026Confidential computingcites 1cited by 0
Zero knowledge verification for frontier AI training is possiblePeigné et al. · arXiv3 Jun 2026Workload and training verificationcites 10cited by 1
Bit-Exact AI Inference Verification Without Performance TradeoffsCankaya · ICML 2026 TAIGR workshop (per its arXiv record)29 May 2026Workload and training verificationcites 8cited by 2
Does Distributed Training Undermine Compute Governance?Rahman · ICML 2026 TAIGR workshop (per its arXiv record)Sources register28 May 2026Security analysescites 9cited by 1
GPU Fingerprinting for Location VerificationTee and Happel · arXivSources register3 May 2026Location verificationcites 2cited by 0
Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty VerificationAnsari · arXivSources register6 Apr 2026Hardware-enabled mechanismscites 23cited by 3
Export Auditors as Market-Powered Export EnforcementAarne and Grunewald · Institute for AI Policy and Strategy (working paper)20 Mar 2026Hardware-enabled mechanismscites 4cited by 2
Privacy-Preserving Mechanisms Enable Cheap Verifiable Inference of LLMsPal et al. · arXiv19 Feb 2026Workload and training verificationcites 3cited by 0
Timing and Memory Telemetry on GPUs for AI GovernanceMonfared et al. · arXiv10 Feb 2026Workload and training verificationcites 14cited by 4
SCALE: Tackling Communication Bottlenecks in Confidential Distributed Machine LearningPark et al. · IEEE HPCA 202631 Jan 2026Confidential computingcites at least 4cited by 0
PAL*M: Property Attestation for Large Generative ModelsChantasantitam et al. · arXiv22 Jan 2026Confidential computingcites 12cited by 2
Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI CompaniesBrundage et al. · arXiv16 Jan 2026Foundationscites 11cited by 2
Opt-In NVIDIA Software Enables Data Center Fleet ManagementNVIDIA Newsroom · NVIDIA Blog10 Dec 2025Workload and training verificationcites 1cited by 2
DiFR: Inference Verification Despite NondeterminismKarvonen et al. · arXiv25 Nov 2025Workload and training verificationcites 3cited by 6
An International Agreement to Prevent the Premature Creation of Artificial SuperintelligenceScher et al. · arXivSources register13 Nov 2025International agreements and inspectioncites 14cited by 7
Verifying LLM Inference to Detect Model Weight ExfiltrationRinberg et al. · arXiv4 Nov 2025Workload and training verificationcites 4cited by 5
TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus InterpositionChuang et al. · IEEE Symposium on Security and Privacy 202628 Oct 2025Security analysescites 2cited by 4
ccAI: A Compatible and Confidential System for AI ComputingWang et al. · ACM MICRO 202517 Oct 2025Confidential computingcites 13cited by 0
Accelerating AI Data Center SecurityGrunewald and Asher Brass Gershovich · Institute for AI Policy and Strategy9 Sep 2025Security analysescites 3cited by 0
ShadowScope: GPU Monitoring and Validation via Composable Side Channel SignalsAlmusaddar et al. · arXiv30 Aug 2025Workload and training verificationcites 4cited by 3
Faster AI Diffusion Through Hardware-Based VerificationAmmann and Dalrymple · Institute for Progress11 Aug 2025Hardware-enabled mechanismscites 3cited by 0
No Backdoors. No Kill Switches. No Spyware.Reber · NVIDIA Blog5 Aug 2025Hardware-enabled mechanismscites 0cited by 1
Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and DeploymentBaker et al. · arXivSources register21 Jul 2025International agreements and inspectioncites 28cited by 19
Compute Requirements for Algorithmic Innovation in Frontier AI ModelsBarnett · arXiv13 Jul 2025Foundationscites 7cited by 1
Technical Requirements for Halting Dangerous AI ActivitiesBarnett et al. · arXiv13 Jul 2025International agreements and inspectioncites 13cited by 2
Distributed and Decentralised Training: Technical Governance Challenges in a Shifting AI LandscapeKryś et al. · ICML 2025 Technical AI Governance workshop, oral (per its arXiv record)10 Jul 2025Security analysescites 8cited by 3
Domestic frontier AI regulation, an IAEA for AI, an NPT for AI, and a US-led Allied Public-Private Partnership for AI: Four institutions for governing and developing frontier AIBelfield · arXiv8 Jul 2025International agreements and inspectioncites 15cited by 1
Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential ComputingGu et al. · arXiv3 Jul 2025Confidential computingcites 10cited by 5
Verification for International AI GovernanceHarack et al. · Oxford Martin AI Governance InitiativeSources register3 Jul 2025International agreements and inspectioncites 32cited by 10
Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution EnvironmentsSchnabl et al. · arXiv30 Jun 2025Confidential computingcites 7cited by 2
Toward a Global Regime for Compute Governance: Building the Pause ButtonAl Ramiah et al. · arXivSources register25 Jun 2025International agreements and inspectioncites 8cited by 4
Confidential Inference Systems: Design principles and security risks (Version 1.0)Pattern Labs and Anthropic · Anthropic and Pattern Labs (whitepaper)18 Jun 2025Confidential computingcites 1cited by 1
Insights from a Workshop on Hardware-Enabled Governance MechanismsKulp et al. · RAND Corporation, Conference Proceedings CF-A3056-1Sources register12 Jun 2025Hardware-enabled mechanismscites 5cited by 0
Countering AI Chip Smuggling Has Become a National Security Priority: An Updated Playbook for Preventing AI Chip Smuggling to the PRCGrunewald and Fist · Center for a New American Security (working paper)11 Jun 2025Hardware-enabled mechanismscites 8cited by 1
Location Verification for AI Chips (issue brief)Brass · Institute for AI Policy and StrategySources register16 May 2025Location verificationcites 1cited by 4
AI Governance to Avoid Extinction: The Strategic Landscape and Actionable Research QuestionsBarnett and Scher · arXiv7 May 2025International agreements and inspectioncites 19cited by 3
Trends in AI SupercomputersPilz et al. · arXiv22 Apr 2025Foundationscites 4cited by 7
In Which Areas of Technical AI Safety Could Geopolitical Rivals Cooperate?Bucknall et al. · ACM FAccT 2025 (per its arXiv record)17 Apr 2025International agreements and inspectioncites 12cited by 0
XpuTEE: A High-Performance and Practical Heterogeneous Trusted Execution Environment for GPUsFan et al. · ACM Transactions on Computer Systems12 Apr 2025Confidential computingcites at least 6cited by 0
Hardware-Enabled Mechanisms for Verifying Responsible AI DevelopmentO’Gara et al. · arXivSources register2 Apr 2025Hardware-enabled mechanismscites 12cited by 5
Flexible Hardware-Enabled Guarantees for AI ComputePetrie et al. · arXivSources registerApr 2025Hardware-enabled mechanismscites 10cited by 10
Part II: Technical Options for Flexible Hardware-Enabled GuaranteesPetrie and Aarne · arXivSources registerApr 2025Hardware-enabled mechanismscites 12cited by 4
Part III: International Security Applications of Flexible Hardware-Enabled GuaranteesAarne and Petrie · arXivSources registerApr 2025Hardware-enabled mechanismscites 11cited by 4
International Agreements on AI Safety: Review and Recommendations for a Conditional AI Safety TreatyScholefield et al. · arXiv18 Mar 2025International agreements and inspectioncites 11cited by 5
Superintelligence Strategy: Expert VersionHendrycks et al. · arXiv7 Mar 2025International agreements and inspectioncites 4cited by 8
Verde: Verification via Refereed Delegation for Machine Learning ProgramsArun et al. · arXiv26 Feb 2025Workload and training verificationcites 6cited by 1
A Survey of Zero-Knowledge Proof Based Verifiable Machine LearningPeng et al. · Artificial Intelligence Review 59, 157 (2026) (per its arXiv record)25 Feb 2025Workload and training verificationcites 8cited by 0
Practical Principles for AI Cost and Compute AccountingCasper et al. · ICML 2025 TAIG workshop (per its arXiv record)21 Feb 2025Foundationscites 5cited by 3
TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable InferenceOng et al. · arXiv27 Jan 2025Workload and training verificationcites 5cited by 5
Characterization of GPU TEE Overheads in Distributed Data Parallel ML TrainingLee et al. · arXiv20 Jan 2025Confidential computingcites 3cited by 1
Founding Zero-Knowledge Proofs of Training on Optimum VicinityTan et al. · Cryptology ePrint Archive13 Jan 2025Workload and training verificationcites at least 1cited by 0
Defending Compute Thresholds Against Legal LoopholesPistillo and Villalobos · arXiv3 Jan 2025Foundationscites 3cited by 2
Technology to Secure the AI Chip Supply Chain: A Working PaperFist et al. · Center for a New American SecuritySources register11 Dec 2024Hardware-enabled mechanismscites 13cited by 2
Protocol Learning, Decentralized Frontier Risk and the No-Off ProblemLong · arXiv10 Dec 2024Security analysescites 2cited by 1
Zero-Knowledge Proofs of Training for Deep Neural NetworksAbbaszadeh et al. · ACM CCS 20242 Dec 2024Workload and training verificationcites at least 3cited by 7
Introducing the LLM distributed training simulatorErdil and Besiroglu · Epoch AI29 Nov 2024Foundationscites 0cited by 4
Mechanisms to Verify International Agreements About AI DevelopmentScher and Thiergart · MIRI Technical Governance TeamSources register27 Nov 2024International agreements and inspectioncites 24cited by 20
Whack-a-Chip: The Futility of Hardware-Centric Export ControlsGupta et al. · arXiv21 Nov 2024Hardware-enabled mechanismscites 0cited by 0
Hardware and Software Platform InferenceZhang et al. · arXiv7 Nov 2024Workload and training verificationcites 1cited by 0
PipeLLM: Fast and Confidential Large Language Model Services with Speculative Pipelined EncryptionTan et al. · arXiv4 Nov 2024Confidential computingcites 8cited by 2
SVIP: Towards Verifiable Inference of Open-source Large Language ModelsSun et al. · arXiv29 Oct 2024Workload and training verificationcites 3cited by 3
Fastrack: Fast IO for Secure ML using GPU TEEsWang et al. · arXiv20 Oct 2024Confidential computingcites 3cited by 2
Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark StudyZhu et al. · arXiv6 Sep 2024Confidential computingcites 2cited by 4
Governing dual-use technologies: Case studies of international security agreements and lessons for AI governanceWasil et al. · arXiv4 Sep 2024International agreements and inspectioncites 5cited by 1
Verification methods for international AI agreementsWasil et al. · arXivSources register28 Aug 2024International agreements and inspectioncites 9cited by 16
Confidential Computing on Heterogeneous CPU-GPU Systems: Survey and Future DirectionsWang and Oswald · ACM Computing Surveys (accepted, per its arXiv record)21 Aug 2024Confidential computingcites 9cited by 2
Interim Report: Mechanisms for Flexible Hardware-Enabled GuaranteesPetrie et al. · flexHEG projectAug 2024Hardware-enabled mechanismsreference list not readcited by 10
Open Problems in Technical AI GovernanceReuel et al. · Transactions on Machine Learning Research, 2025 (per its arXiv record)20 Jul 2024Foundationscites 31cited by 16
Ascend-CC: Confidential Computing on Heterogeneous NPU for Emerging Generative AI WorkloadsDhar et al. · arXiv16 Jul 2024Confidential computingcites 9cited by 1
On the Limitations of Compute Thresholds as a Governance StrategyHooker · arXiv8 Jul 2024Foundationscites 2cited by 10
Laminator: Verifiable ML Property Cards using Hardware-assisted AttestationsDuddu et al. · arXiv25 Jun 2024Confidential computingcites 14cited by 0
Locking Machine Learning Models into HardwareClifford et al. · arXiv31 May 2024Hardware-enabled mechanismscites 0cited by 3
Securing AI Model Weights: Preventing Theft and Misuse of Frontier ModelsNevo et al. · RAND Corporation, Research Report RR-A2849-130 May 2024Security analysesreference list not readcited by 18
Training Compute Thresholds: Features and Functions in AI RegulationHeim and Koessler · arXiv17 May 2024Foundationscites 10cited by 18
Near-Term Enforcement of AI Chip Export Controls Using A Firmware-Based Design for Offline LicensingPetrie · arXivSources register28 Apr 2024Hardware-enabled mechanismscites 2cited by 8
zkLLM: Zero Knowledge Proofs for Large Language ModelsSun et al. · ACM CCS 2024 (per its arXiv record)24 Apr 2024Workload and training verificationcites 5cited by 14
ZKML: An Optimizing System for ML Inference in Zero-Knowledge ProofsChen et al. · EuroSys 202422 Apr 2024Workload and training verificationcites at least 1cited by 4
Trustless Audits without Revealing Data or ModelsWaiwitlikhit et al. · arXiv6 Apr 2024Workload and training verificationcites 6cited by 4
Location Verification for AI ChipsBrass and Aarne · Institute for AI Policy and Strategy (full report)Sources registerApr 2024Location verificationcites 5cited by 19
Optimistic Verifiable Training by Controlling Hardware NondeterminismSrivastava et al. · NeurIPS 2024 (per its arXiv record)14 Mar 2024Workload and training verificationcites 9cited by 4
Governing Through the Cloud: The Intermediary Role of Compute Providers in AI RegulationHeim et al. · arXivSources register13 Mar 2024Foundationscites 14cited by 22
Computing Power and the Governance of Artificial IntelligenceSastry et al. · arXivSources register13 Feb 2024Foundationscites 20cited by 35
Verifiable evaluations of machine learning models using zkSNARKsSouth et al. · arXiv5 Feb 2024Workload and training verificationcites 8cited by 9
Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090Kulp et al. · RAND Corporation, Working Paper WR-A3056-1Sources register18 Jan 2024Hardware-enabled mechanismscites 6cited by 29
Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced ComputingAarne et al. · Center for a New American Security (in collaboration with IAPS)Sources register8 Jan 2024Hardware-enabled mechanismscites 10cited by 29
CAGE: Complementing Arm CCA with GPU ExtensionsWang et al. · NDSS 20242024Confidential computingcites 8cited by 2
Exploration of secure hardware solutions for safe AI deploymentFuture of Life Institute · Future of Life Institute (with Mithril Security)30 Nov 2023Confidential computingcites 0cited by 0
Increased Compute Efficiency and the Diffusion of AI CapabilitiesPilz et al. · arXiv26 Nov 2023Foundationscites 3cited by 12
Experimenting with Zero-Knowledge Proofs of TrainingGarg et al. · ACM CCS 202315 Nov 2023Workload and training verificationcites at least 2cited by 14
Compute at Scale: A Broad Investigation into the Data Center IndustryPilz and Heim · arXiv5 Nov 2023Foundationscites 0cited by 9
An international treaty to implement a global compute cap for advanced artificial intelligenceMiotti · arXiv1 Nov 2023International agreements and inspectioncites 3cited by 1
Preventing AI Chip Smuggling to ChinaFist and Grunewald · Center for a New American Security (working paper)Sources register24 Oct 2023Hardware-enabled mechanismscites 4cited by 16
Oversight for Frontier AI through a Know-Your-Customer Scheme for Compute ProvidersEgan and Heim · arXivSources register20 Oct 2023Foundationscites 2cited by 10
Multinational AGI Consortium (MAGIC): A Proposal for International Coordination on AIHausenloy et al. · arXiv13 Oct 2023International agreements and inspectioncites 6cited by 8
AI Chip Smuggling into China: Potential Paths, Quantities, and CountermeasuresGrunewald and Aird · Institute for AI Policy and Strategy4 Oct 2023Hardware-enabled mechanismscites 2cited by 9
Creating the First Confidential GPUsDhanuskodi et al. · ACM Queue 21(4); reprinted in Communications of the ACM 67(1)31 Aug 2023Confidential computingreference list not readcited by 10
International Governance of Civilian AI: A Jurisdictional Certification ApproachTrager et al. · arXiv29 Aug 2023International agreements and inspectioncites 7cited by 9
Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AIApsey et al. · NVIDIA Technical Blog3 Aug 2023Confidential computingcites 1cited by 5
Confidence-Building Measures for Artificial Intelligence: Workshop ProceedingsShoker et al. · arXiv1 Aug 2023International agreements and inspectioncites 0cited by 2
zkDL: Efficient Zero-Knowledge Proofs of Deep Learning TrainingSun et al. · arXiv30 Jul 2023Workload and training verificationcites 8cited by 8
Confidential Compute on NVIDIA Hopper H100 (WP-11459-001 v1.0)Nertney · NVIDIA whitepaper25 Jul 2023Confidential computingcites 0cited by 14
International Institutions for Advanced AIHo et al. · arXiv10 Jul 2023International agreements and inspectioncites 3cited by 11
Honeycomb: Secure and Efficient GPU Executions via Static ValidationMai et al. · USENIX OSDI 202310 Jul 2023Confidential computingcites 7cited by 7
Frontier AI Regulation: Managing Emerging Risks to Public SafetyAnderljung et al. · arXiv6 Jul 2023Foundationscites 3cited by 17
Tools for Verifying Neural Models’ Training DataChoi et al. · arXiv2 Jul 2023Workload and training verificationcites 4cited by 14
ACAI: Protecting Accelerator Execution with Arm Confidential Computing ArchitectureSridhara et al. · USENIX Security 2024; arXiv copy is the extended version (per its arXiv record)25 May 2023Confidential computingcites 6cited by 3
Nuclear Arms Control Verification and Lessons for AI TreatiesBaker · arXiv8 Apr 2023International agreements and inspectioncites 2cited by 14
What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute MonitoringShavit · arXivSources register20 Mar 2023Foundationscites 9cited by 25
Exploring the Relevance of Data Privacy-Enhancing Technologies for AI Governance Use CasesBluemke et al. · arXiv15 Mar 2023Confidential computingcites 1cited by 2
Improved Export Controls Enforcement Technology Needed for U.S. National SecurityAllen et al. · Center for Strategic and International Studies30 Nov 2022Hardware-enabled mechanismscites 0cited by 7
StrongBox: A GPU TEE on Arm EndpointsDeng et al. · ACM CCS 20227 Nov 2022Confidential computingcites at least 2cited by 9
Artificial Intelligence and Arms ControlScharre and Lamberth · Center for a New American Security, October 2022 (per its arXiv record)22 Oct 2022International agreements and inspectioncites 4cited by 3
Scaling up Trustless DNN Inference with Zero-Knowledge ProofsKang et al. · arXiv17 Oct 2022Workload and training verificationcites 2cited by 9
CRONUS: Fault-isolated, Secure and High-performance Heterogeneous Computing for Trusted Execution EnvironmentJiang et al. · IEEE/ACM MICRO 2022Oct 2022Confidential computingcites at least 2cited by 7
SAGE: Software-based Attestation for GPU ExecutionIvanov et al. · arXiv7 Sep 2022Confidential computingcites 6cited by 6
Machine Learning with Confidential Computing: A Systematization of KnowledgeMo et al. · ACM Computing Surveys (accepted, per its arXiv record)22 Aug 2022Confidential computingcites 8cited by 5
Proof-of-Learning is Currently More Broken Than You ThinkFang et al. · IEEE EuroS&P 2023 (per its arXiv record)6 Aug 2022Workload and training verificationcites 2cited by 12
Confidential Machine Learning within Graphcore IPUsVaswani et al. · arXiv18 May 2022Confidential computingcites 5cited by 2
The MIT Supercloud Workload Classification ChallengeTang et al. · IPDPS ADOPT’22 workshop (per its arXiv record)12 Apr 2022Workload and training verificationcites 0cited by 4
Compute Trends Across Three Eras of Machine LearningSevilla et al. · IJCNN 2022 (per its arXiv record)11 Feb 2022Foundationscites 0cited by 16
Filling gaps in trustworthy development of AIAvin et al. · Science 374(6573)10 Dec 2021Foundationscites 1cited by 1
zkCNN: Zero Knowledge Proofs for Convolutional Neural Network Predictions and AccuracyLiu et al. · ACM CCS 202112 Nov 2021Workload and training verificationreference list not readcited by 12
Why and How Governments Should Monitor AI DevelopmentWhittlestone and Clark · arXiv28 Aug 2021Foundationscites 0cited by 4
“Adversarial Examples” for Proof-of-LearningZhang et al. · IEEE S&P 2022 (per its arXiv record)21 Aug 2021Workload and training verificationcites 1cited by 8
Mystique: Efficient Conversions for Zero-Knowledge Proofs with Applications to Machine LearningWeng et al. · USENIX Security 20212 Jun 2021Workload and training verificationcites 0cited by 4
Proof-of-Learning: Definitions and PracticeJia et al. · IEEE S&P 2021 (per its arXiv record)9 Mar 2021Workload and training verificationcites 1cited by 20
AI Verification: Mechanisms to Ensure AI Arms Control ComplianceMittelsteadt · Center for Security and Emerging Technology (Issue Brief)Feb 2021International agreements and inspectioncites 1cited by 4
Beyond Privacy Trade-offs with Structured TransparencyTrask et al. · arXiv15 Dec 2020Foundationscites 1cited by 6
Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable ClaimsBrundage et al. · arXiv15 Apr 2020Foundationscites 4cited by 14
AI Chips: What They Are and Why They MatterKhan and Mann · Center for Security and Emerging Technology (Issue Brief)Apr 2020Foundationscites 1cited by 6
Telekine: Secure Computing with Cloud GPUsHunt et al. · USENIX NSDI 202025 Feb 2020Confidential computingcites 4cited by 7
Enabling Rack-scale Confidential Computing using Heterogeneous Trusted Execution EnvironmentZhu et al. · IEEE Symposium on Security and Privacy 2020 (preprint arXiv:1904.04782)9 Apr 2019Confidential computingcites 3cited by 11
Heterogeneous Isolated Execution for Commodity GPUsJang et al. · ASPLOS 20194 Apr 2019Confidential computingcites at least 2cited by 21
Graviton: Trusted Execution Environments on GPUsVolos et al. · USENIX OSDI 20188 Oct 2018Confidential computingcites 0cited by 19
AI Governance: A Research AgendaDafoe · Centre for the Governance of AI, Future of Humanity Institute, University of Oxford27 Aug 2018Foundationscites 1cited by 4
Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted HardwareTramèr and Boneh · ICLR 2019 (per its arXiv record)8 Jun 2018Confidential computingcites 2cited by 11
Computational Power and the Social Impact of Artificial IntelligenceHwang · arXiv / SSRN23 Mar 2018Foundationscites 0cited by 5
SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted CloudGhodsi et al. · NeurIPS 2017 (per its arXiv record)30 Jun 2017Workload and training verificationcites 0cited by 12
Intel SGX ExplainedCostan and Devadas · IACR Cryptology ePrint Archive 2016/0862016Confidential computingreference list not readcited by 12