Researchers and leaders at frontier labs are increasingly calling for the collective development of governance tools to pace the frontier of AI development.
Current on-chip GPU telemetry could provide a starting point towards an international standard for compute verification. GPUs already expose telemetry signals that can distinguish training from inference with high accuracy. The main limitation is trust: in an adversarial setting, these signals can still be manipulated, forged, or replayed.
I argue that publicly funded compute clusters around the world could start publishing labelled telemetry from real training runs now, creating a large, openly available measurement layer. Researchers could build on this shared database to develop classifiers, compare measurements across hardware, red-team attacks, and eventually work towards common verification standards.
This first layer would be imperfect, but that is part of the point. Creating it now could demonstrate that large-scale international measurement and coordination is possible, build technical and institutional momentum around a common standard, and provide the empirical basis for developing harder-to-forge verification tools later.
Intro
I am currently working on an inspection tool (verifier) able to distinguish training from simply 'using the AI model' (inference), to help in AI compute verification. I'm new to the field, so feedback is especially appreciated.
The hope is that these tools could help policymakers and governments regulate AI training. It may particularly help with pacing the frontier: if large-scale training can be detected and monitored, it would be clear who is doing what, so a broad agreement across frontier labs may be easier to achieve.
This post explores telemetry counters, which already exist on current hardware. Their presence and availability suggest that a first layer of technical AI governance (Baker et al., 2025) could be built around open, crowd-based GPU telemetry: on-chip telemetry first and off-chip monitoring later. Public compute clusters around the world could start contributing measurements, establishing a shared metrological baseline on which researchers and, eventually, policy could build.
And, most importantly, we can start building it now, without waiting for verification hardware that does not yet exist.
This first thin verification layer could start by making it possible to distinguish between three categories of compute: training (building the model), inference (running it), and non-AI compute. This distinction is key, as any future agreement on large-scale training runs or slowing down AI development would be difficult to verify without an agreed way of telling these three apart.
A quick analogy borrowed from satellite navigation
In July 2019, the entire Galileo constellation went down for about a week, and the official channels were almost silent about what was happening. According to Bert Hubert, during the outage, there was no public, independent way to see what the constellation was doing (more can be read here and here). Within roughly two months, he and a group of volunteers built Galmon, an independent, crowd-sourced network of consumer receivers that reconstructs the satellites' clocks and orbits and flags jumps or anomalous behaviour, in public. It soon achieved continuous coverage and expanded to monitor four GNSS constellations. Galmon shows how quickly an independent measurement layer can emerge when the underlying signal is publicly available and interpretable. There was no treaty behind it, and there still isn't.
Two things made this possible. First, the navigation message was broadcast by design: the operator cannot withhold it without switching off the service. Second, it is intelligible because the EU publishes the Galileo Open Service Signal-In-Space Interface Control Document (OS SIS ICD), which specifies the full format of the broadcast signal.
The first is the technical layer. The second is a policy decision.
Why this might be a stepping stone for regulators
The relevant lesson from Galmon is that making a signal public and interpretable allowed an independent measurement ecosystem to emerge around it.
The capability for independent observation must exist before any agreement can even be discussed, because we cannot govern what we cannot measure. Making these data available, at least for public infrastructure, would give the scientific community something concrete to build on: understanding what needs to be measured, developing metrics, and assessing what is actually feasible to determine from the signal. Policy could then build on top of this measurement layer.
There is an important break between the Galmon example and monitoring AI training, and it concerns exactly the adversarial case: nobody was trying to spoof the Galileo signal to actively fool the volunteers. We briefly discuss this in the next section.
What GPU telemetry can already measure and its limitations
Rahman & Tajdari (2026) evaluated the classification task mentioned above using nine different counters from NVML (the NVIDIA Management Library), sampled at a very low frequency (1 Hz). These counters are available on NVIDIA GPUs, have zero overhead on the actual workload, and are content-agnostic, with no access to model weights, training data, or hyperparameters. Their classifier reaches 98.2% binary accuracy at identifying training, pooling data across nine GPU models spanning different architecture generations.
They also evaluate the classifier on GPU models it was never trained on, and it still detects training on unseen hardware, suggesting that generalization across hardware is promising. So far so good.
However, one can imagine that an adversary aiming to hide their activity would try to spoof the signal, essentially making a training campaign look like ordinary inference. In this regard, the paper reports a five-round arms race between evasion strategies and a retrained detector, across 20 evasion strategy families. Overall, high detection rates are achieved, apart from a few particularly difficult cases (e.g., white-box[1] LoRA[2] evasion).
All these considerations are valid assuming that the counters themselves are honest, and that only the physical execution of the workload is manipulated. Today, however, there is no way to distinguish whether the telemetry signal has been manipulated, forged, or replayed from a previous measurement. Since the counters are software-reported and under the operator's control, one ultimately relies on the operator's good faith.
There are technical approaches to this problem, including a tamper-resistant NVML read path, an authenticated telemetry channel, and secure boot of the monitoring software, which the authors themselves mention in the paper.
Another possibility is to use external probes that capture the electromagnetic emissions leaked by the GPU during normal operation, as explored here. Since this channel is not directly under the operator's control, evasion would require manipulating how workloads are executed on the GPU in order to alter the spectral leakage itself.
In both cases, demonstrating full robustness against adversarial attacks is challenging. External electromagnetic probes may be harder to forge, since the signal is physically emitted by the GPU rather than software-reported, although an adversary could still manipulate the workload in unexpected ways to reshape the leakage. The trade-off is that physical side channels may reveal substantially more sensitive information than a simple workload label. For example, electromagnetic leakage has been used to reconstruct model architectures.
All things considered, NVML telemetry can still provide a first layer for building international consensus and momentum towards a common standard. This first layer does not need to be a complete verification system. A large, shared measurement effort could help us understand what can actually be measured, compare signals across hardware, and demonstrate that international coordination around compute measurement is possible.
And, importantly, telemetry is already available on current GPUs, now. Not in five years. Collecting NVML counters is essentially free and non-invasive, which is exactly why it could be the right thing to standardise first.
Providing this first layer of verification may help make an international AI slowdown more feasible, as more and more researchers at frontier labs are calling for.
Where I'd like to start
The first participants do not necessarily have to be the frontier labs. What we'd need is labelled telemetry: traces where someone can certify what was actually running, at a real scale. Frontier labs have the scale, but (maybe) will not provide the labels. Individual researchers will provide the labels, but do not have the scale.
Publicly funded open-model projects are, at the moment, the actors that can provide both.
Switzerland has a long history of supporting international cooperation, and it could play an important role here, particularly with the development of Apertus. The model is released with its weights and training data. The AI cluster Alps, used for its development, includes more than 10,000 NVIDIA GH200 GPUs. For a project like this, publishing the full set of NVML counters at 1–10 Hz alongside a training run would probably add marginal overhead, while providing telemetry from large-scale, frontier-like models. The same could apply to other research centres and national academic clusters.
The value would increase if several public or non-profit clusters across countries did the same, gradually creating a common corpus spanning different hardware, institutions, and workloads.
For publicly funded open-model projects, privacy concerns may also be less severe, making it possible to test both NVML telemetry and electromagnetic monitoring.
The objections
Here are the counterarguments I can foresee. There are several important differences compared to Galileo: there, the signal was broadcast by its very nature, while GPU telemetry lives offline. The latter is not even necessarily recorded and would require an operator to decide to emit it voluntarily. It cannot be "simply" captured with a receiver.
Today, this is not accessible from outside at all, and a minimum amount of infrastructure and coordination would have to be built. This is even more true for electromagnetic monitoring, where probes and acquisition pipelines would need to be installed at scale.
I propose starting with voluntary participation, but this would make visible exactly the parties nobody is worried about. The objection can go even further: a voluntary layer might be counterproductive, allowing an operator to demonstrate participation without accepting verification and creating a case for treating the voluntary version as sufficient.
It is clear that this won't be enough for an international AI treaty. However, could it be a first step towards having one? The purpose of this voluntary layer would not be to verify the actors we are worried about. It would be to create the first shared measurement infrastructure: a documented public record of what real clusters look like, a common corpus for developing and attacking detectors, and an existence proof that institutions across countries can coordinate around compute measurement.
Conclusions
In a cooperative environment, a useful first step for technical AI governance could be publicly funded compute clusters publishing labelled telemetry from real runs into a shared public archive. A crowd-sourced collaboration could then build on those data: analysis, classifiers, red-teaming, comparison across hardware, and eventually measurement standards.
A more complete solution, including trustworthy measurement channels and adversarial robustness, does not yet exist and will probably require years of hardware development. Building the first measurement layer does not have to wait for it.
We can make the measurement available, learn what it can actually tell us, demonstrate that coordination is possible, and build trustworthiness on top of it.
I used GPT to polish the English and improve the fluency and readability of this post. The ideas and arguments are my own.
I would also like to thank Lynette Bye for her comments on this post, which helped improve the directness of my message.
References and further readings
Rahman, R. & Tajdari, S. (2026). Detecting Hidden ML Training With Zero-Overhead Telemetry. Workshop on Technical AI Governance Research (TAIGR), ICML 2026. arXiv:2606.19262
Baker, M., Kulp, G., Marks, O., Brundage, M. & Heim, L. (2025). Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment. RAND. arXiv:2507.15916
Petrie, J., Aarne, O., Ammann, N. & Dalrymple, D. (2025). Flexible Hardware-Enabled Guarantees for AI Compute. arXiv:2506.15093. See also the companion technical report: Petrie, J. & Aarne, O. (2025), Technical Options for Flexible Hardware-Enabled Guarantees, arXiv:2506.03409
O'Gara, A., Kulp, G., Hodgkins, W., Petrie, J., Immler, V., Aysu, A., Basu, K., Bhasin, S., Picek, S. & Srivastava, A. (2025). Hardware-Enabled Mechanisms for Verifying Responsible AI Development. ICML 2025. arXiv:2505.03742
Aarne, O., Fist, T. & Withers, C. (2024). Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI and Advanced Computing. Center for a New American Security. Link to the PDF
Monfared, S. K., Ganji, F., Holcomb, D. & Tajik, S. (2026). Timing and Memory Telemetry on GPUs for AI Governance. arXiv:2602.09369
Maia, H. T., Xiao, C., Li, D., Grinspun, E. & Zheng, C. (2022). Can One Hear the Shape of a Neural Network? Snooping the GPU via Magnetic Side Channel. USENIX Security 2022. Link to the PDF.
Gargiulo, S. & Kulp, G. (2026). Workload Identification with Physical Side Channels for AI Governance. arXiv:2609.00309.
Xiao, R., Feng, S., Ramesh, S., Han, J. & Han, J. (2026). Peering Inside the Black-Box: Long-Range and Scalable Model Architecture Snooping via GPU Electromagnetic Side-Channel. Network and Distributed System Security (NDSS) Symposium 2026. Paper.
The white-box scenario is one where the adversary knows the internals of the verifier. This may or may not be a requirement for international policy. If governance pushes towards a public verifier (features and weights that anyone can inspect), these evasion strategies must be considered in more detail.
LoRA stands for Low-Rank Adaptation. It is a fine-tuning technique in which the majority of the original model weights are kept frozen while only small low-rank matrices are trained alongside them. The number of parameters updated is much smaller (~few %) compared with full fine tuning. The white-box LoRA case is quite evasive because it combines LoRA’s small training footprint with heavy dilution, which makes the training signal particularly difficult to detect, but also means that only a small fraction of the workload is actually spent on training.
Intro
I am currently working on an inspection tool (verifier) able to distinguish training from simply 'using the AI model' (inference), to help in AI compute verification. I'm new to the field, so feedback is especially appreciated.
The hope is that these tools could help policymakers and governments regulate AI training. It may particularly help with pacing the frontier: if large-scale training can be detected and monitored, it would be clear who is doing what, so a broad agreement across frontier labs may be easier to achieve.
This post explores telemetry counters, which already exist on current hardware. Their presence and availability suggest that a first layer of technical AI governance (Baker et al., 2025) could be built around open, crowd-based GPU telemetry: on-chip telemetry first and off-chip monitoring later. Public compute clusters around the world could start contributing measurements, establishing a shared metrological baseline on which researchers and, eventually, policy could build.
And, most importantly, we can start building it now, without waiting for verification hardware that does not yet exist.
This first thin verification layer could start by making it possible to distinguish between three categories of compute: training (building the model), inference (running it), and non-AI compute. This distinction is key, as any future agreement on large-scale training runs or slowing down AI development would be difficult to verify without an agreed way of telling these three apart.
A quick analogy borrowed from satellite navigation
In July 2019, the entire Galileo constellation went down for about a week, and the official channels were almost silent about what was happening. According to Bert Hubert, during the outage, there was no public, independent way to see what the constellation was doing (more can be read here and here). Within roughly two months, he and a group of volunteers built Galmon, an independent, crowd-sourced network of consumer receivers that reconstructs the satellites' clocks and orbits and flags jumps or anomalous behaviour, in public. It soon achieved continuous coverage and expanded to monitor four GNSS constellations. Galmon shows how quickly an independent measurement layer can emerge when the underlying signal is publicly available and interpretable. There was no treaty behind it, and there still isn't.
Two things made this possible. First, the navigation message was broadcast by design: the operator cannot withhold it without switching off the service. Second, it is intelligible because the EU publishes the Galileo Open Service Signal-In-Space Interface Control Document (OS SIS ICD), which specifies the full format of the broadcast signal.
The first is the technical layer. The second is a policy decision.
Why this might be a stepping stone for regulators
The relevant lesson from Galmon is that making a signal public and interpretable allowed an independent measurement ecosystem to emerge around it.
The capability for independent observation must exist before any agreement can even be discussed, because we cannot govern what we cannot measure. Making these data available, at least for public infrastructure, would give the scientific community something concrete to build on: understanding what needs to be measured, developing metrics, and assessing what is actually feasible to determine from the signal. Policy could then build on top of this measurement layer.
There is an important break between the Galmon example and monitoring AI training, and it concerns exactly the adversarial case: nobody was trying to spoof the Galileo signal to actively fool the volunteers. We briefly discuss this in the next section.
What GPU telemetry can already measure and its limitations
Rahman & Tajdari (2026) evaluated the classification task mentioned above using nine different counters from NVML (the NVIDIA Management Library), sampled at a very low frequency (1 Hz). These counters are available on NVIDIA GPUs, have zero overhead on the actual workload, and are content-agnostic, with no access to model weights, training data, or hyperparameters. Their classifier reaches 98.2% binary accuracy at identifying training, pooling data across nine GPU models spanning different architecture generations.
They also evaluate the classifier on GPU models it was never trained on, and it still detects training on unseen hardware, suggesting that generalization across hardware is promising. So far so good.
However, one can imagine that an adversary aiming to hide their activity would try to spoof the signal, essentially making a training campaign look like ordinary inference. In this regard, the paper reports a five-round arms race between evasion strategies and a retrained detector, across 20 evasion strategy families. Overall, high detection rates are achieved, apart from a few particularly difficult cases (e.g., white-box[1] LoRA[2] evasion).
All these considerations are valid assuming that the counters themselves are honest, and that only the physical execution of the workload is manipulated. Today, however, there is no way to distinguish whether the telemetry signal has been manipulated, forged, or replayed from a previous measurement. Since the counters are software-reported and under the operator's control, one ultimately relies on the operator's good faith.
There are technical approaches to this problem, including a tamper-resistant NVML read path, an authenticated telemetry channel, and secure boot of the monitoring software, which the authors themselves mention in the paper.
Another possibility is to use external probes that capture the electromagnetic emissions leaked by the GPU during normal operation, as explored here. Since this channel is not directly under the operator's control, evasion would require manipulating how workloads are executed on the GPU in order to alter the spectral leakage itself.
In both cases, demonstrating full robustness against adversarial attacks is challenging. External electromagnetic probes may be harder to forge, since the signal is physically emitted by the GPU rather than software-reported, although an adversary could still manipulate the workload in unexpected ways to reshape the leakage. The trade-off is that physical side channels may reveal substantially more sensitive information than a simple workload label. For example, electromagnetic leakage has been used to reconstruct model architectures.
All things considered, NVML telemetry can still provide a first layer for building international consensus and momentum towards a common standard. This first layer does not need to be a complete verification system. A large, shared measurement effort could help us understand what can actually be measured, compare signals across hardware, and demonstrate that international coordination around compute measurement is possible.
And, importantly, telemetry is already available on current GPUs, now. Not in five years. Collecting NVML counters is essentially free and non-invasive, which is exactly why it could be the right thing to standardise first.
Providing this first layer of verification may help make an international AI slowdown more feasible, as more and more researchers at frontier labs are calling for.
Where I'd like to start
The first participants do not necessarily have to be the frontier labs. What we'd need is labelled telemetry: traces where someone can certify what was actually running, at a real scale. Frontier labs have the scale, but (maybe) will not provide the labels. Individual researchers will provide the labels, but do not have the scale.
Publicly funded open-model projects are, at the moment, the actors that can provide both.
Switzerland has a long history of supporting international cooperation, and it could play an important role here, particularly with the development of Apertus. The model is released with its weights and training data. The AI cluster Alps, used for its development, includes more than 10,000 NVIDIA GH200 GPUs. For a project like this, publishing the full set of NVML counters at 1–10 Hz alongside a training run would probably add marginal overhead, while providing telemetry from large-scale, frontier-like models. The same could apply to other research centres and national academic clusters.
The value would increase if several public or non-profit clusters across countries did the same, gradually creating a common corpus spanning different hardware, institutions, and workloads.
For publicly funded open-model projects, privacy concerns may also be less severe, making it possible to test both NVML telemetry and electromagnetic monitoring.
The objections
Here are the counterarguments I can foresee. There are several important differences compared to Galileo: there, the signal was broadcast by its very nature, while GPU telemetry lives offline. The latter is not even necessarily recorded and would require an operator to decide to emit it voluntarily. It cannot be "simply" captured with a receiver.
Today, this is not accessible from outside at all, and a minimum amount of infrastructure and coordination would have to be built. This is even more true for electromagnetic monitoring, where probes and acquisition pipelines would need to be installed at scale.
I propose starting with voluntary participation, but this would make visible exactly the parties nobody is worried about. The objection can go even further: a voluntary layer might be counterproductive, allowing an operator to demonstrate participation without accepting verification and creating a case for treating the voluntary version as sufficient.
It is clear that this won't be enough for an international AI treaty. However, could it be a first step towards having one? The purpose of this voluntary layer would not be to verify the actors we are worried about. It would be to create the first shared measurement infrastructure: a documented public record of what real clusters look like, a common corpus for developing and attacking detectors, and an existence proof that institutions across countries can coordinate around compute measurement.
Conclusions
In a cooperative environment, a useful first step for technical AI governance could be publicly funded compute clusters publishing labelled telemetry from real runs into a shared public archive. A crowd-sourced collaboration could then build on those data: analysis, classifiers, red-teaming, comparison across hardware, and eventually measurement standards.
A more complete solution, including trustworthy measurement channels and adversarial robustness, does not yet exist and will probably require years of hardware development. Building the first measurement layer does not have to wait for it.
We can make the measurement available, learn what it can actually tell us, demonstrate that coordination is possible, and build trustworthiness on top of it.
I used GPT to polish the English and improve the fluency and readability of this post. The ideas and arguments are my own.
I would also like to thank Lynette Bye for her comments on this post, which helped improve the directness of my message.
References and further readings
The white-box scenario is one where the adversary knows the internals of the verifier. This may or may not be a requirement for international policy. If governance pushes towards a public verifier (features and weights that anyone can inspect), these evasion strategies must be considered in more detail.
LoRA stands for Low-Rank Adaptation. It is a fine-tuning technique in which the majority of the original model weights are kept frozen while only small low-rank matrices are trained alongside them. The number of parameters updated is much smaller (~few %) compared with full fine tuning. The white-box LoRA case is quite evasive because it combines LoRA’s small training footprint with heavy dilution, which makes the training signal particularly difficult to detect, but also means that only a small fraction of the workload is actually spent on training.