I am keeping this draft updated based on the feedback received.
TL;DR:
Researchers at frontier labs are increasingly calling for the collective development of governance tools that could help pacing the frontier of AI.
This attempt will probably require several measurements and verification techniques, built in layers. One possibility is to start with on-chip GPU telemetry (power, clock, temperature, etc.), as chips already expose these signals and it would represent a little/zero overhead during normal operation. While these counters can be manipulated and forged, they could help researcher developing a first shared verification infrastructure.
I argue that publicly funded compute clusters around the world could start building an Open Compute Verification Observatory, meaning a shared infrastructure where measurements and real-time monitoring from AI workloads can be collected and made available for verification research.
This first layer will be imperfect, but that is part of the point. The objective is not to build a complete verification system at day 0, but to create a shared infrastructure on which stronger techniques can be developed and build momentum towards international coordination. Over time, the same Observatory could include several measurements and techniques across shared hardware: network tap, power and (radiative) electromagnetic measurements, and hardware-based attestation, cryptographic hashes and zero-knowledge proofs, leading to a large-scale international measurement body developing a common standard.
Switzerland represents a quite unique spot to do this: Swiss AI initiative is currently developing a full open model (Apertus) on a large-scale infrastructure (Alps), and the country has a long tradition of supporting and leading international cooperation for the common good.
Intro
I am currently working on auditing tools able to distinguish AI/LLM activities on physical GPU, that is, telling apart training from "using the AI model" (referred to as inference). I'm new to the field, so feedback is especially appreciated.
My hope is that these tools could help policymakers and governments regulate AI traning and pacing the frontier: if large-scale training can be detected and monitored, it would be clear who is doing what, so a broad agreement across frontier labs may be easier to achieve.
The challenge is not only to develop one specific verifier, but to create a shared vision and a collective measurement body (something like the International Bureau of Weights and Measures)on which different AI verification techniques can be developed and deployed at scale in a real-world setting.
Here I would consider telemetry counters as a first building block towards a common measurement standard. The main reason is their presence and availability on current GPUs. Making these signals available would require little or no effort from GPU users. A first layer technical AI governance (Baker et al., 2025) could be built around open, crowd-based on-chip GPU telemetry, and later refined with cryptographic proof-based verification and off-chip monitoring (network-tap data, power and electromagnetic emissions).
This could essentially evolve in an "Open Compute Verification Observatory/Body", where different measurement and attestation techniques could be developed and tested on known workloads.
Public compute clusters around the world could already start contributing measurements while they develop their own open models, providing a shared baseline on which researchers and policy could build on.
Most importantly, we can start building it now, without waiting for verification hardware or technique that does not yet exist.
This first thin verification layer could start by making it possible to distinguish between three categories of compute: training (building the model), inference (running it), and non-AI compute. This distinction is key, as any future agreement on large-scale training runs or pacing AI development would be difficult to verify without an agreed way of telling these three apart.
Additional layers could build on the same infrastructure and later answer more fine-grained questions, such as: which model was used for a particular computation or whether the model differs from an approved version.
A quick analogy borrowed from satellite navigation
In July 2019, the entire Galileo constellation[1] went down for about a week, and the official channels were almost silent about what was happening. According to Bert Hubert, during the outage, there was no public, independent way to see what the constellation was doing (more can be read here and here). Within roughly two months, he and a group of volunteers built Galmon, an independent, crowd-sourced network of receivers that reconstructs the satellites' clocks and orbits and flags jumps or anomalous behaviour, in public. Galmon shows how quickly an independent measurement layer can emerge when the underlying signal is publicly available and interpretable. There was no treaty behind it, and there still isn't.
Two things made this possible. First, the navigation message was broadcast by design: the operator cannot withhold it without switching off the service. Second, it is intelligible because the EU publishes the Galileo Open Service Signal-In-Space Interface Control Document (OS SIS ICD), which specifies the full format of the broadcast signal.
The first is the technical layer. The second is a policy decision.
Why this might be a stepping stone for regulators
The relevant lesson from Galmon is that making a signal public and interpretable allowed an independent measurement ecosystem to emerge around it.
The capability for independent observation must exist before any agreement can even be discussed, because we cannot govern what we cannot measure. Making these data available, would give the scientific community something concrete to build on: understanding what needs to be measured, developing metrics, and assessing what is actually feasible to determine from the signal. Policy could then build on top of this measurement layer.
There is an important distinction between Galmon and monitoring AI use and concerns exactly the adversarial case: nobody was trying to spoof the Galileo signal to actively fool the volunteers, which in this case were acting as auditors.
What GPU telemetry can already measure and its limitations
Rahman & Tajdari (2026) classified LLM activities using different counters from NVML (the NVIDIA Management Library), sampled at a very low frequency (1 Hz). These counters include information such as temperature, clock frequency, power draw, memory usage, data trasnfered over the PCIe. These signals are already available on NVIDIA GPUs, have zero overhead on the actual workload (meaning they don't introduce any penalties in the execution of the workload), and are content-agnostic, with no access to model weights, training data, or hyperparameters. Their classifier reaches 98.2% binary accuracy at identifying training across different hardware when the operator is acting in 'good faith'. They also explored the adversarial case, where the operator manipulates the training workload to evade detecion.
Today, however, there is no way to distinguish whether the telemetry signal has been manipulated, forged, or replayed from a previous measurement. Thus these signals alone are not trustworthy. The counters are, in fact, software-reported and under the operator's control. There are technical proposals to this inconvenience, including a tamper-resistant NVML read path, an authenticated telemetry channel, and secure boot of the monitoring software, which the authors mention in the paper.
Another possibility is to use external probes that capture the electromagnetic emissions leaked by the GPU during normal operation, as explored here. This channel is not directly under the operator's control and evasion may be harder, as it would require manipulating the workload's physical execution on the GPU to alter the spectral leakage.
In both cases, demonstrating full robustness against adversarial attacks is challenging. . An adversary could still manipulate the workload in unexpected ways to reshape the electromagnetic leakage, though this will probably introduce severe performance degradation. The trade-off is that physical side channels may reveal sensitive information about the model itself. For example, electromagnetic leakage has been used to reconstruct model architectures.
Other approaches, such as off-chip network monitoring or hardware-based attestation, could provide complementary verification layers and potentially answer more fine-grained questions about the workload or model being used while preserving model and user privacy.
The point of an Open Verification layer would be to provide a common body for developing and comparing all these approaches, while also helping build international consensus around what should eventually be measured and standardised.
Where I'd like to start
The first participants do not necessarily have to be the frontier labs. What we'd need is labelled data from real runs at a real/meaningful scale. Frontier labs have the scale, but (probably) will not provide the labels. Individual researchers will provide the labels, but do not have the scale.
Publicly funded open-model projects are, at the moment, the actors that can provide both.
Switzerland has a long history of supporting international cooperation, and it could play an important role here, particularly with the development of Apertus. The model is released with its weights and training data. The AI cluster Alps, used for its development, includes more than 10000 NVIDIA GH200 GPUs.
For me this is an interesting place where to start the Observatory. As initial step one could start publishing the full set of telemetry counters alongside a labelled AI runs. Once the data collection and synchronization infrastructure exists, additional measurements could be added gradually.
Swiss infrastructure is essentially already in place and it could provide a neutral setting where the US and China might find common ground around an open-source verification layer to help pace AI development.
This initiative could also drive several other public or non-profit clusters across countries to do the same, gradually creating a common corpus spanning different hardware, institutions, and workloads. This is in general a great opportunity for middle powers to contribute to a safe AI development and AI verification in particular.
For publicly funded open-model projects, privacy concerns may also be less severe, making it possible different kind of monitoring.
The objections
Here are the counterarguments I can foresee. There are several important differences compared to Galileo: there, the signal was broadcast by its very nature, while GPU telemetry lives offline. The latter is not even necessarily recorded and would require an operator to decide to emit it voluntarily. It cannot be "simply" captured with a receiver.
Today, this is not accessible from outside at all, and a minimum amount of infrastructure and coordination would have to be built. This is even more true for other kind of monitoring, that could require probes or where acquisition pipelines would need to be installed at scale.
I propose starting with voluntary participation, but this would make visible exactly the parties nobody is worried about. A voluntary layer might also be counterproductive, allowing an operator/lab to demonstrate participation without really accepting verification and creating a case for considering the voluntary version as sufficient.
It is clear that this won't be enough for an international AI treaty. However, could it be a first step towards having one? The purpose of this voluntary layer would not be to verify the actors we are worried about. It would be to create the first shared measurement body: apublic record of what real clusters look like and a living example that institutions across countries can coordinate around compute verification.
Conclusions
I believe that useful ("quick and dirty") first step for technical AI governance could be the establishment of a collective and independent compute monitoring infrastructure for public clusters, similar to what Galmon represents for the Galileo constellation. It could start with the publication of labelled telemetry from real runs into a shared public archive. A crowd-sourced collaboration could then build on these dat through analysis, classifiers, red-teaming, comparison across hardware, and eventually measurement standards.
A more complete solution, including cryptographic verification, trustworthy measurement channels, and adversarial robustness, does not yet exist and will probably require years of R&D development. Building the first measurement layer does not have to wait for it.
We can make the measurement available, learn what it can actually tell us, demonstrate that coordination is possible, and build trustworthiness on top of it.
I used GPT to polish the English and improve the fluency and readability of this post. The ideas and arguments are my own.
I would also like to thank Lynette Bye for her comments on this post, which helped improve the directness of my message.
References and further readings
Rahman, R. & Tajdari, S. (2026). Detecting Hidden ML Training With Zero-Overhead Telemetry. Workshop on Technical AI Governance Research (TAIGR), ICML 2026. arXiv:2606.19262
Baker, M., Kulp, G., Marks, O., Brundage, M. & Heim, L. (2025). Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment. RAND. arXiv:2507.15916
Petrie, J., Aarne, O., Ammann, N. & Dalrymple, D. (2025). Flexible Hardware-Enabled Guarantees for AI Compute. arXiv:2506.15093. See also the companion technical report: Petrie, J. & Aarne, O. (2025), Technical Options for Flexible Hardware-Enabled Guarantees, arXiv:2506.03409
O'Gara, A., Kulp, G., Hodgkins, W., Petrie, J., Immler, V., Aysu, A., Basu, K., Bhasin, S., Picek, S. & Srivastava, A. (2025). Hardware-Enabled Mechanisms for Verifying Responsible AI Development. ICML 2025. arXiv:2505.03742
Aarne, O., Fist, T. & Withers, C. (2024). Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI and Advanced Computing. Center for a New American Security. Link to the PDF
Monfared, S. K., Ganji, F., Holcomb, D. & Tajik, S. (2026). Timing and Memory Telemetry on GPUs for AI Governance. arXiv:2602.09369
Maia, H. T., Xiao, C., Li, D., Grinspun, E. & Zheng, C. (2022). Can One Hear the Shape of a Neural Network? Snooping the GPU via Magnetic Side Channel. USENIX Security 2022. Link to the PDF.
Gargiulo, S. & Kulp, G. (2026). Workload Identification with Physical Side Channels for AI Governance. arXiv:2609.00309.
Xiao, R., Feng, S., Ramesh, S., Han, J. & Han, J. (2026). Peering Inside the Black-Box: Long-Range and Scalable Model Architecture Snooping via GPU Electromagnetic Side-Channel. Network and Distributed System Security (NDSS) Symposium 2026. Paper.
Cankaya, N., Kryś, J., Ng, J., Marks, L. & Krückel, F. (2026). Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors. Paper.
Galileo is the global navigation satellite system (GNSS) created by the European Space Agency (ESA) and providing high precision positioning, similar to the USA's GPS system.
I am keeping this draft updated based on the feedback received.
Intro
I am currently working on auditing tools able to distinguish AI/LLM activities on physical GPU, that is, telling apart training from "using the AI model" (referred to as inference). I'm new to the field, so feedback is especially appreciated.
My hope is that these tools could help policymakers and governments regulate AI traning and pacing the frontier: if large-scale training can be detected and monitored, it would be clear who is doing what, so a broad agreement across frontier labs may be easier to achieve.
The challenge is not only to develop one specific verifier, but to create a shared vision and a collective measurement body (something like the International Bureau of Weights and Measures) on which different AI verification techniques can be developed and deployed at scale in a real-world setting.
Here I would consider telemetry counters as a first building block towards a common measurement standard. The main reason is their presence and availability on current GPUs. Making these signals available would require little or no effort from GPU users. A first layer technical AI governance (Baker et al., 2025) could be built around open, crowd-based on-chip GPU telemetry, and later refined with cryptographic proof-based verification and off-chip monitoring (network-tap data, power and electromagnetic emissions).
This could essentially evolve in an "Open Compute Verification Observatory/Body", where different measurement and attestation techniques could be developed and tested on known workloads.
Public compute clusters around the world could already start contributing measurements while they develop their own open models, providing a shared baseline on which researchers and policy could build on.
Most importantly, we can start building it now, without waiting for verification hardware or technique that does not yet exist.
This first thin verification layer could start by making it possible to distinguish between three categories of compute: training (building the model), inference (running it), and non-AI compute. This distinction is key, as any future agreement on large-scale training runs or pacing AI development would be difficult to verify without an agreed way of telling these three apart.
Additional layers could build on the same infrastructure and later answer more fine-grained questions, such as: which model was used for a particular computation or whether the model differs from an approved version.
A quick analogy borrowed from satellite navigation
In July 2019, the entire Galileo constellation[1] went down for about a week, and the official channels were almost silent about what was happening. According to Bert Hubert, during the outage, there was no public, independent way to see what the constellation was doing (more can be read here and here). Within roughly two months, he and a group of volunteers built Galmon, an independent, crowd-sourced network of receivers that reconstructs the satellites' clocks and orbits and flags jumps or anomalous behaviour, in public. Galmon shows how quickly an independent measurement layer can emerge when the underlying signal is publicly available and interpretable. There was no treaty behind it, and there still isn't.
Two things made this possible. First, the navigation message was broadcast by design: the operator cannot withhold it without switching off the service. Second, it is intelligible because the EU publishes the Galileo Open Service Signal-In-Space Interface Control Document (OS SIS ICD), which specifies the full format of the broadcast signal.
The first is the technical layer. The second is a policy decision.
Why this might be a stepping stone for regulators
The relevant lesson from Galmon is that making a signal public and interpretable allowed an independent measurement ecosystem to emerge around it.
The capability for independent observation must exist before any agreement can even be discussed, because we cannot govern what we cannot measure. Making these data available, would give the scientific community something concrete to build on: understanding what needs to be measured, developing metrics, and assessing what is actually feasible to determine from the signal. Policy could then build on top of this measurement layer.
There is an important distinction between Galmon and monitoring AI use and concerns exactly the adversarial case: nobody was trying to spoof the Galileo signal to actively fool the volunteers, which in this case were acting as auditors.
What GPU telemetry can already measure and its limitations
Rahman & Tajdari (2026) classified LLM activities using different counters from NVML (the NVIDIA Management Library), sampled at a very low frequency (1 Hz). These counters include information such as temperature, clock frequency, power draw, memory usage, data trasnfered over the PCIe. These signals are already available on NVIDIA GPUs, have zero overhead on the actual workload (meaning they don't introduce any penalties in the execution of the workload), and are content-agnostic, with no access to model weights, training data, or hyperparameters. Their classifier reaches 98.2% binary accuracy at identifying training across different hardware when the operator is acting in 'good faith'. They also explored the adversarial case, where the operator manipulates the training workload to evade detecion.
Today, however, there is no way to distinguish whether the telemetry signal has been manipulated, forged, or replayed from a previous measurement. Thus these signals alone are not trustworthy. The counters are, in fact, software-reported and under the operator's control. There are technical proposals to this inconvenience, including a tamper-resistant NVML read path, an authenticated telemetry channel, and secure boot of the monitoring software, which the authors mention in the paper.
Another possibility is to use external probes that capture the electromagnetic emissions leaked by the GPU during normal operation, as explored here. This channel is not directly under the operator's control and evasion may be harder, as it would require manipulating the workload's physical execution on the GPU to alter the spectral leakage.
In both cases, demonstrating full robustness against adversarial attacks is challenging. . An adversary could still manipulate the workload in unexpected ways to reshape the electromagnetic leakage, though this will probably introduce severe performance degradation. The trade-off is that physical side channels may reveal sensitive information about the model itself. For example, electromagnetic leakage has been used to reconstruct model architectures.
Other approaches, such as off-chip network monitoring or hardware-based attestation, could provide complementary verification layers and potentially answer more fine-grained questions about the workload or model being used while preserving model and user privacy.
The point of an Open Verification layer would be to provide a common body for developing and comparing all these approaches, while also helping build international consensus around what should eventually be measured and standardised.
Where I'd like to start
The first participants do not necessarily have to be the frontier labs. What we'd need is labelled data from real runs at a real/meaningful scale. Frontier labs have the scale, but (probably) will not provide the labels. Individual researchers will provide the labels, but do not have the scale.
Publicly funded open-model projects are, at the moment, the actors that can provide both.
Switzerland has a long history of supporting international cooperation, and it could play an important role here, particularly with the development of Apertus. The model is released with its weights and training data. The AI cluster Alps, used for its development, includes more than 10000 NVIDIA GH200 GPUs.
For me this is an interesting place where to start the Observatory. As initial step one could start publishing the full set of telemetry counters alongside a labelled AI runs. Once the data collection and synchronization infrastructure exists, additional measurements could be added gradually.
Swiss infrastructure is essentially already in place and it could provide a neutral setting where the US and China might find common ground around an open-source verification layer to help pace AI development.
This initiative could also drive several other public or non-profit clusters across countries to do the same, gradually creating a common corpus spanning different hardware, institutions, and workloads. This is in general a great opportunity for middle powers to contribute to a safe AI development and AI verification in particular.
For publicly funded open-model projects, privacy concerns may also be less severe, making it possible different kind of monitoring.
The objections
Here are the counterarguments I can foresee. There are several important differences compared to Galileo: there, the signal was broadcast by its very nature, while GPU telemetry lives offline. The latter is not even necessarily recorded and would require an operator to decide to emit it voluntarily. It cannot be "simply" captured with a receiver.
Today, this is not accessible from outside at all, and a minimum amount of infrastructure and coordination would have to be built. This is even more true for other kind of monitoring, that could require probes or where acquisition pipelines would need to be installed at scale.
I propose starting with voluntary participation, but this would make visible exactly the parties nobody is worried about. A voluntary layer might also be counterproductive, allowing an operator/lab to demonstrate participation without really accepting verification and creating a case for considering the voluntary version as sufficient.
It is clear that this won't be enough for an international AI treaty. However, could it be a first step towards having one? The purpose of this voluntary layer would not be to verify the actors we are worried about. It would be to create the first shared measurement body: a public record of what real clusters look like and a living example that institutions across countries can coordinate around compute verification.
Conclusions
I believe that useful ("quick and dirty") first step for technical AI governance could be the establishment of a collective and independent compute monitoring infrastructure for public clusters, similar to what Galmon represents for the Galileo constellation. It could start with the publication of labelled telemetry from real runs into a shared public archive. A crowd-sourced collaboration could then build on these dat through analysis, classifiers, red-teaming, comparison across hardware, and eventually measurement standards.
A more complete solution, including cryptographic verification, trustworthy measurement channels, and adversarial robustness, does not yet exist and will probably require years of R&D development. Building the first measurement layer does not have to wait for it.
We can make the measurement available, learn what it can actually tell us, demonstrate that coordination is possible, and build trustworthiness on top of it.
I used GPT to polish the English and improve the fluency and readability of this post. The ideas and arguments are my own.
I would also like to thank Lynette Bye for her comments on this post, which helped improve the directness of my message.
References and further readings
Galileo is the global navigation satellite system (GNSS) created by the European Space Agency (ESA) and providing high precision positioning, similar to the USA's GPS system.