I recently finished Lens Academy's Compute Verification course, which lays out the technical, supply-chain and political components a verification regime would need, and left me with one question it didn't answer.
Polish and EU national the question I kept coming back to is what would be the role of middle powers in the regime proposed by the course? It is my opinion that middle powers could be its enforcement backbone, and here’s how and why.
A middle power in the context of the “AI race” would be a country just like Poland, one where there are no frontier labs or large advanced fabs to regulate or inspect. Still, a country that holds a seat in the EU, has a growing data-centre sector and is in some capacity involved in advanced chip transit. In the defined regime, the role of such a power is unclear. However, in this post I will argue that such countries could become crucial intermediaries for the enforcement and legitimacy of a long-standing regime through 3 distinct mechanisms:
Neutral licensing and key custody,
Independent audit of the verifier, and
Arbitration.
These mechanisms could not only improve the functioning of the regime, eliminate incentives to cheat and ensure longevity, but also drag middle powers into the regime, making it a truly global cooperative effort.
I believe the best course of action for middle powers, which don’t have an economic or political incentive for the regime to fail, is to unite under a single ‘coalition’ to ensure all of the mechanisms described below function correctly.
Mechanism 1: Neutral licensing and key custody
Within the course, one potential verification mechanism was chip licensing. A licensing mechanism grants an AI chip a cryptographically signed, limited allowance for work, whether that’s cumulative compute FLOPs or compute hours. This licensing could also be location-bound, ensuring the chips only function in declared data centres. This process is controlled via a license token, a protected in-chip meter which counts the processing work down, and once the allowance is used up or the license revoked, the chip throttles or shuts down until a new license is issued. (The full technical explanation of how it works is beyond this post; see this paper)
The authority that issues these licenses is as important, if not more important than the technical implementation. An authority that is incentivised to defect and issue licenses to actors which don’t follow the regime would compromise the integrity of the whole coalition.
This is why I believe the best issuing authority for such licenses would be this “coalition of the willing middle powers“. Those states, with no frontier capacity and no fabs are the actors which have the strongest interests in the regime holding up and preventing potential negative externalities of further unregulated AI development. These powers have nothing to gain and everything to lose from over-licensing a lab, so a license stamped by middle power-based authority is more credible than a Washington or Beijing one. Why I specifically talk about the concept of a “Coalition of the willing“ instead of an already existing institution such as the EU or WTO is due to geopolitical interests, for this coalition to function properly as authority, it would need to be composed of both states that are geopolitically aligned with China and the US, acting as counterweights to each other’s geopolitical interests.
However, the only way such an authority can function is if its power comes directly from the treaty establishing the regime. If Washington decides to ignore a Coalition-issued license, the coalition can’t do anything. The authority’s power comes from the treaty’s enforcement provisions, not from the host state. This means that the middle powers provide only legitimacy, not force.
Mechanism 2: Independent auditor of the verifier-supplied hardware
In the proposed regime, verifier-supplied hardware is defined as equipment the inspecting party installs inside the operator’s facilities. This could be equipment such as network taps, sensors or monitoring boxes. This equipment will enable the collection of measurements which don’t depend on the operator’s own records. (More technical details in this paper.)
The problem with imposing such hardware modifications is the possibility of them being used as backdoors to allow an interested party to read traffic that is not covered in the agreement or probing the facility. Such attacks could break the trust needed for the regime to operate, potentially collapsing the entire regime.
This is where the coalition comes into play, functioning as an independent auditor with dedicated secure facilities used for auditing and verifying these components’ compliance with the rules of the regime.
There’s historical precedent for such a function. When IAEA inspectors take environmental samples at a nuclear facility, the samples are not analysed by the inspected state, nor at the IAEA’s lab in Austria. These samples are split apart and sent, blind-coded, to a Network of Analytical Laboratories. Around two dozen member-state labs around the world in countries such as Hungary, Brazil or Australia then receive the samples. No single state knows where the sample came from, and no single state can fabricate a result, because another lab will catch the discrepancy and inform the central IAEA authority. The credibility of the finding comes from distribution and the trust put into the “middle powers” which play a crucial verification role.
In the proposed system, the verifier hardware would act as the compute regime’s swipe samples. If the hardware that inspects a lab’s chips is itself designed, built and audited only by the US or China, every finding is contestable and affected by bias. Distribute the audit of the verifier across middle-power coalition labs and the same logic holds. Once again it is important to mention that for any such a regime to work, the coalition would need to include states aligned with each side, not one.
The key danger here comes from the question whether such a network of specialised and secure facilities, none of which exist today, can be constructed in a short timeframe of one or two years required for the implementation of a regime. For reference, the construction of the IAEA’s network of independent auditors took decades. A potential solution would be to repurpose certain national facilities to serve this function; however, the time and feasibility of such a retrofit is still an open question.
Mechanism 3: Arbitration
Attestation in this regime is defined as a device that produces cryptographically signed claims about its own identity, state or internal state. For attestation to mean something, these values/claims need to be compared against a pre-defined set of allowed values known as “reference values”. These could check things such as expected firmware hashes, boot measurements or configuration fingerprints. The issue arises in how and by whom these values are decided and updated. A state being verified might distrust a regime where a foreign and potentially adversarial company or state decides and unilaterally controls what counts as passing measurement.
This is where the coalition could function as an arbitrator and controller of these values. The coalition here could receive proposed reference values provided by all interested parties and reach a compromise that protects the integrity of the regime.
I believe that this coalition would be the best actor to be given this function as they are the party with the strongest interest in the regime holding, and they have the most to lose if it collapses.
This approach has a potential failure, this failure mode is related to speed of updating the reference values, with every potential firmware update comes new values, and a multinational compromise process could take weeks while labs wait. The fix to this could be pre-agreed update procedures with time limits, however constructing these procedures could take time as well. Another potential fix is arbitration only for contested cases where one of the frontier countries raises an objection.
All of these mechanisms also provide a de-escalation pathway for both the US and China. Both of these states benefit from a stable regime, but also want to appear strong to their population in the AI race dynamic. This neutral coalition provides these states with a pathway to achieve both of these.
Open Questions
These mechanisms all assume the coalition itself is stable. I’m not sure it is. Four questions arise:
Can a coalition stay neutral as alignment shifts?
How does it resist pressure from a frontier state?
What are the entry requirements, and who decides them?
What happens to a member caught colluding with one side?
If you work on verification and have views on any of these, I’d like to hear from you.
I recently finished Lens Academy's Compute Verification course, which lays out the technical, supply-chain and political components a verification regime would need, and left me with one question it didn't answer.
Polish and EU national the question I kept coming back to is what would be the role of middle powers in the regime proposed by the course? It is my opinion that middle powers could be its enforcement backbone, and here’s how and why.
A middle power in the context of the “AI race” would be a country just like Poland, one where there are no frontier labs or large advanced fabs to regulate or inspect. Still, a country that holds a seat in the EU, has a growing data-centre sector and is in some capacity involved in advanced chip transit. In the defined regime, the role of such a power is unclear. However, in this post I will argue that such countries could become crucial intermediaries for the enforcement and legitimacy of a long-standing regime through 3 distinct mechanisms:
These mechanisms could not only improve the functioning of the regime, eliminate incentives to cheat and ensure longevity, but also drag middle powers into the regime, making it a truly global cooperative effort.
I believe the best course of action for middle powers, which don’t have an economic or political incentive for the regime to fail, is to unite under a single ‘coalition’ to ensure all of the mechanisms described below function correctly.
Mechanism 1: Neutral licensing and key custody
Within the course, one potential verification mechanism was chip licensing. A licensing mechanism grants an AI chip a cryptographically signed, limited allowance for work, whether that’s cumulative compute FLOPs or compute hours. This licensing could also be location-bound, ensuring the chips only function in declared data centres. This process is controlled via a license token, a protected in-chip meter which counts the processing work down, and once the allowance is used up or the license revoked, the chip throttles or shuts down until a new license is issued. (The full technical explanation of how it works is beyond this post; see this paper)
The authority that issues these licenses is as important, if not more important than the technical implementation. An authority that is incentivised to defect and issue licenses to actors which don’t follow the regime would compromise the integrity of the whole coalition.
This is why I believe the best issuing authority for such licenses would be this “coalition of the willing middle powers“. Those states, with no frontier capacity and no fabs are the actors which have the strongest interests in the regime holding up and preventing potential negative externalities of further unregulated AI development. These powers have nothing to gain and everything to lose from over-licensing a lab, so a license stamped by middle power-based authority is more credible than a Washington or Beijing one. Why I specifically talk about the concept of a “Coalition of the willing“ instead of an already existing institution such as the EU or WTO is due to geopolitical interests, for this coalition to function properly as authority, it would need to be composed of both states that are geopolitically aligned with China and the US, acting as counterweights to each other’s geopolitical interests.
However, the only way such an authority can function is if its power comes directly from the treaty establishing the regime. If Washington decides to ignore a Coalition-issued license, the coalition can’t do anything. The authority’s power comes from the treaty’s enforcement provisions, not from the host state. This means that the middle powers provide only legitimacy, not force.
Mechanism 2: Independent auditor of the verifier-supplied hardware
In the proposed regime, verifier-supplied hardware is defined as equipment the inspecting party installs inside the operator’s facilities. This could be equipment such as network taps, sensors or monitoring boxes. This equipment will enable the collection of measurements which don’t depend on the operator’s own records. (More technical details in this paper.)
The problem with imposing such hardware modifications is the possibility of them being used as backdoors to allow an interested party to read traffic that is not covered in the agreement or probing the facility. Such attacks could break the trust needed for the regime to operate, potentially collapsing the entire regime.
This is where the coalition comes into play, functioning as an independent auditor with dedicated secure facilities used for auditing and verifying these components’ compliance with the rules of the regime.
There’s historical precedent for such a function. When IAEA inspectors take environmental samples at a nuclear facility, the samples are not analysed by the inspected state, nor at the IAEA’s lab in Austria. These samples are split apart and sent, blind-coded, to a Network of Analytical Laboratories. Around two dozen member-state labs around the world in countries such as Hungary, Brazil or Australia then receive the samples. No single state knows where the sample came from, and no single state can fabricate a result, because another lab will catch the discrepancy and inform the central IAEA authority. The credibility of the finding comes from distribution and the trust put into the “middle powers” which play a crucial verification role.
In the proposed system, the verifier hardware would act as the compute regime’s swipe samples. If the hardware that inspects a lab’s chips is itself designed, built and audited only by the US or China, every finding is contestable and affected by bias. Distribute the audit of the verifier across middle-power coalition labs and the same logic holds. Once again it is important to mention that for any such a regime to work, the coalition would need to include states aligned with each side, not one.
The key danger here comes from the question whether such a network of specialised and secure facilities, none of which exist today, can be constructed in a short timeframe of one or two years required for the implementation of a regime. For reference, the construction of the IAEA’s network of independent auditors took decades. A potential solution would be to repurpose certain national facilities to serve this function; however, the time and feasibility of such a retrofit is still an open question.
Mechanism 3: Arbitration
Attestation in this regime is defined as a device that produces cryptographically signed claims about its own identity, state or internal state. For attestation to mean something, these values/claims need to be compared against a pre-defined set of allowed values known as “reference values”. These could check things such as expected firmware hashes, boot measurements or configuration fingerprints. The issue arises in how and by whom these values are decided and updated. A state being verified might distrust a regime where a foreign and potentially adversarial company or state decides and unilaterally controls what counts as passing measurement.
This is where the coalition could function as an arbitrator and controller of these values. The coalition here could receive proposed reference values provided by all interested parties and reach a compromise that protects the integrity of the regime.
I believe that this coalition would be the best actor to be given this function as they are the party with the strongest interest in the regime holding, and they have the most to lose if it collapses.
This approach has a potential failure, this failure mode is related to speed of updating the reference values, with every potential firmware update comes new values, and a multinational compromise process could take weeks while labs wait. The fix to this could be pre-agreed update procedures with time limits, however constructing these procedures could take time as well. Another potential fix is arbitration only for contested cases where one of the frontier countries raises an objection.
All of these mechanisms also provide a de-escalation pathway for both the US and China. Both of these states benefit from a stable regime, but also want to appear strong to their population in the AI race dynamic. This neutral coalition provides these states with a pathway to achieve both of these.
Open Questions
These mechanisms all assume the coalition itself is stable. I’m not sure it is. Four questions arise:
If you work on verification and have views on any of these, I’d like to hear from you.