Epistemic status: I recently started working on compute verification for AI governance. Pointers to any previous relevant literature I have missed are welcome.
Recently, Rahman and Tajdari (2026) showed that NVML telemetry acquired at 1 Hz is enough to classify GPU workloads against a broad set of evasion strategies: 98% binary accuracy at identifying training across the whole corpus, testing twenty evasion families and nine GPU models. The strategies tested include manipulation of GPU utilisation, clock throttling, dilution of training among benign batches (inference), and mimicry of inference and non-ML workloads (cryptomining).
The worst case is whitebox LoRA, where the evader knows the internals of the classifier and can act against it: detection falls to 43% (leave-one-out detection rate). Whitebox full fine tuning instead reaches 88% detection accuracy. These results seems really encouraging towards the adoption of NVML as baseline for workload identification.
The authors describe the whitebox case as
A disaster scenario for governance, equivalent to a developer infiltrating the governing agency, stealing the classifier, and orchestrating their workload in a way that is designed to be maximally undetectable by the classifier's exact algorithm.
However, any verification regime between mutually distrusting states needs a discriminator that is inspectable and, on its own, verifiable by both sides. Here, no infiltration is needed: the detector is given as a condition of the agreement. So whitebox should, in my opinion, be considered the baseline threat model, not an extreme one. The flexHEG proposal already goes in that direction, with a fully open-source hardware-enabled guarantees and privacy-preserving verification (Petrie et al., 2025).
This openness pushes robustness out of "detector" secrecy and into hardwarephysics: into signatures that are hard to spoof and falsify, since evading them would cost real FLOPs.
An evasion tax or performance penalty however may not hold for those actors preparing for catastrophic misuse. With hardware enabled mechanisms (HEMs) in place the evader will face a tremendous cost trade off, whose economics are unfeasible at frontier scale. This holds for bad actors who are economically motivated but not for those moved by non-economic factors: they can pay and they can wait. In this case, I feel that only location verification, GPU ID registries, and kill switches may work. Still, quantifying this penalty with a robust metric might help in comparing different verification systems.
As proposed in the literature (e.g., O'Gara et al., 2025; Baker et al., 2025), robustness can live in overlapping defence layers.
At the moment nobody has demonstrated an end-to-end, adversarially robust and mutually auditable verifier. However, I don't want technological immaturity to be the convenient excuse that gives every actor the permission to wait, until something frightening finally forces us to make the move. I also know the tendency of scientists (I have been guilty of it myself) to chase technical aesthetics: beautiful and novel. While I mostly advocate for good robust solutions, to avoid accumulating technical debt after a few years, I feel this is the time to act as the window of opportunity may not remain open for long.
Without waiting for the perfect technology, we can start building from here:
Auditor-owned high-bandwidth side channels, wall-power meters, network taps, together with telemetry already embedded in GPUs, create a solid baseline for the moment that can be improved in the future, side by side with location verification and GPU registries.
NVIDIA GPUs (most of the market share) already ship attestation and confidential computing, but the telemetry path is not yet protected: an operator with software privilege can forge counter values or inject synthetic telemetry. The missing pieces, per Rahman and Tajdari, are a tamper-resistant read path, a hardware-signed telemetry channel, and secure boot of the monitor itself. Read-only, consent-based attestation of this kind may bring consensus towards workload verification at a broader political and legislative level.
Secret per-audit randomness: the metrics and the algorithm are public, to avoid a single point of failure. The measurement schedule and sampling draws are secret and refreshable.
And for this we need, more than anything, coordination among compute verification players and policymakers.
There is a second half to this, on incentives: off-chip verification instruments sit in auditors' (mainly governments') hands, while Nvidia, and to a lesser extent AMD, concentrate most of the GPUs and production, and nothing at present makes them build any of this.
References
Rahman, R. and Tajdari, S. (2026). Detecting Hidden ML Training With Zero-Overhead Telemetry. arXiv:2606.19262. https://arxiv.org/abs/2606.19262
Petrie, J., Aarne, O., Ammann, N. and Dalrymple, D. (2025). Flexible Hardware-Enabled Guarantees for AI Compute. arXiv:2506.03409. https://arxiv.org/abs/2506.03409
O'Gara, A., Kulp, G. et al. (2025). Hardware-Enabled Mechanisms for Verifying Responsible AI Development. ICML. arXiv:2505.03742. https://arxiv.org/abs/2505.03742
Baker, M., Kulp, G., Marks, O., Brundage, M. and Heim, L. (2025). Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment. arXiv:2507.15916. https://arxiv.org/abs/2507.15916
Epistemic status: I recently started working on compute verification for AI governance. Pointers to any previous relevant literature I have missed are welcome.
Recently, Rahman and Tajdari (2026) showed that NVML telemetry acquired at 1 Hz is enough to classify GPU workloads against a broad set of evasion strategies: 98% binary accuracy at identifying training across the whole corpus, testing twenty evasion families and nine GPU models. The strategies tested include manipulation of GPU utilisation, clock throttling, dilution of training among benign batches (inference), and mimicry of inference and non-ML workloads (cryptomining).
The worst case is whitebox LoRA, where the evader knows the internals of the classifier and can act against it: detection falls to 43% (leave-one-out detection rate). Whitebox full fine tuning instead reaches 88% detection accuracy. These results seems really encouraging towards the adoption of NVML as baseline for workload identification.
The authors describe the whitebox case as
However, any verification regime between mutually distrusting states needs a discriminator that is inspectable and, on its own, verifiable by both sides. Here, no infiltration is needed: the detector is given as a condition of the agreement. So whitebox should, in my opinion, be considered the baseline threat model, not an extreme one. The flexHEG proposal already goes in that direction, with a fully open-source hardware-enabled guarantees and privacy-preserving verification (Petrie et al., 2025).
This openness pushes robustness out of "detector" secrecy and into hardware physics: into signatures that are hard to spoof and falsify, since evading them would cost real FLOPs.
An evasion tax or performance penalty however may not hold for those actors preparing for catastrophic misuse. With hardware enabled mechanisms (HEMs) in place the evader will face a tremendous cost trade off, whose economics are unfeasible at frontier scale. This holds for bad actors who are economically motivated but not for those moved by non-economic factors: they can pay and they can wait. In this case, I feel that only location verification, GPU ID registries, and kill switches may work. Still, quantifying this penalty with a robust metric might help in comparing different verification systems.
As proposed in the literature (e.g., O'Gara et al., 2025; Baker et al., 2025), robustness can live in overlapping defence layers.
At the moment nobody has demonstrated an end-to-end, adversarially robust and mutually auditable verifier. However, I don't want technological immaturity to be the convenient excuse that gives every actor the permission to wait, until something frightening finally forces us to make the move. I also know the tendency of scientists (I have been guilty of it myself) to chase technical aesthetics: beautiful and novel. While I mostly advocate for good robust solutions, to avoid accumulating technical debt after a few years, I feel this is the time to act as the window of opportunity may not remain open for long.
Without waiting for the perfect technology, we can start building from here:
And for this we need, more than anything, coordination among compute verification players and policymakers.
There is a second half to this, on incentives: off-chip verification instruments sit in auditors' (mainly governments') hands, while Nvidia, and to a lesser extent AMD, concentrate most of the GPUs and production, and nothing at present makes them build any of this.
References
Related on LessWrong: "Can Hardware Save Us from Software?" (https://www.lesswrong.com/posts/o8JtSgihBbPGkgpdy/can-hardware-save-us-from-software)
"Research Priorities for Hardware-Enabled Mechanisms (HEMs)" (https://www.lesswrong.com/posts/Lnuge6NPwwmoeuBaQ/research-priorities-for-hardware-enabled-mechanisms-hems).