Draft complete but not yet reviewed; expect revisions

International Coordination and Verification

The previous chapter ended on a condition: rivals hold back when each expects, firmly enough, that the others are holding back, and seeing is the most direct ground for that expectation (Section 65.6). Between developers in one country a regulator can provide that sight. Between states there is no regulator, so any agreement on AI has to carry its own means of checking compliance, and the history of such agreements is largely a history of what could be checked. This chapter is about that problem. It is the verification problem of the book's loop applied one level up: not whether a model can be checked, but whether a government can check what another government's developers are doing.

The chapter's question is whether what states can verify about one another can carry an agreement about what matters. What can be verified is chiefly the chips, power, and buildings that training consumes; what matters is what the resulting models can do and whether they are safe. Two older fields did most of the thinking about verification between rivals. Arms control built regimes for nuclear and chemical weapons and left a record of which ones held; operations research turned inspection into mathematics, with the tools Section 14.6 teaches for auditing a model. Climate assessment supplies a third thing coordination needs: a way for scientists from rival states to say what is known before anyone agrees on what to do. Most claims here concern the third of the book's relationships, the developer and the public, in its extension to states and the publics they answer to. The training relationship enters only where an agreement would need to verify a property of a trained model, and that is where the chapter's open question lies.

66.1 What could be coordinated #

A common claim is that AI risk is a global externality and so needs global coordination. An externality is a cost one party imposes on others without paying it: a developer that cuts its evaluation short takes the commercial gain, and people in other countries share the risk. The claim leaves open three questions: coordination on what, among whom, and checked how. This section reads what states and scientists have actually agreed and separates agreement on catastrophic capabilities from agreement on values. Two terms recur through the chapter. Verification is checking compliance with an agreement by means the checked party does not control. A regime is the set of rules, norms, and institutions that governs one issue area among states.

66.1.1 The record of agreement #

Section 2.7 tells the history of these years; this section reads the documents for what they commit anyone to. At the first AI Safety Summit, in November 2023, 28 countries and the European Union, the United States and China among them, issued the Bletchley Declaration, which Section 2.7.2 quotes on the potential for catastrophic harm. Its operative part is an agenda. The signatories would focus on "identifying AI safety risks of shared concern" and on "building respective risk-based policies across our countries," and they recognized that "our approaches may differ based on national circumstances and applicable legal frameworks." They resolved to support "an internationally inclusive network of scientific research on frontier AI safety" (Summit, 2023). The declaration commits no state to a limit, so it contains nothing to verify (inference).

The commitments made at the second summit, in Seoul in May 2024, were made by firms rather than states, and Section 62.1.3 reports them. Two features matter here. The signatories included Zhipu.ai (Department for Science and Technology, 2024), which Concordia AI's 2025 survey of AI safety in China calls a "Chinese startup" (AI, 2025), so developers from both frontier ecosystems signed. And the commitment on thresholds says that they "should align with relevant international agreements to which their home governments are party" (Department for Science and Technology, 2024), agreements that did not then exist. In Science the same year, Yoshua Bengio, Geoffrey Hinton, and colleagues wrote that "we urgently need national institutions and international governance to enforce standards preventing recklessness and misuse" (Bengio et al., 2024b).

The most specific text agreed across the two ecosystems came from scientists acting as individuals. At the International Dialogue on AI Safety held in Beijing in March 2024, Western and Chinese researchers signed a consensus statement; its signatories include Geoffrey Hinton, Andrew Yao, Yoshua Bengio, and Ya-Qin Zhang. It proposes "red lines in AI development as an international coordination mechanism" (Safety, 2024). The list, which the statement calls non-exhaustive, has five entries. No AI system should be able to copy or improve itself without explicit human approval and assistance, or take actions to unduly increase its power. None should substantially increase the ability of actors to design weapons of mass destruction, or be able to autonomously execute cyberattacks resulting in serious financial losses. And none should be able to "consistently cause its designers or regulators to misunderstand its likelihood or capability to cross any of the preceding red lines" (Safety, 2024).

The statement's roadmap asks for domestic registration of models and training runs above compute or capability thresholds. It asks for globally aligned requirements given force through access to markets, the instrument Section 65.6.1 recalls, and for multilateral institutions "with enforcement mechanisms to ensure red lines are not crossed." It puts the onus on developers to demonstrate that the lines will not be crossed, and it calls on developers and government funders to spend at least a third of their AI research budgets on safety (Safety, 2024). The signatories include the chief executive of Zhipu AI and the head of research of ByteDance, so the statement is partly one by developers (Safety, 2024). It is a consensus among invited individuals, not a position of any government.

In its final report of 2024, the United Nations' advisory body on AI recommended "an independent international scientific panel on AI." It also wrote that it had "considered the possibility of recommending the creation of an international agency for AI," and was "not recommending this action currently" (United Nations High-level Advisory Body on Artificial Intelligence, 2024). Section 66.6 follows the panel, which now exists.

66.1.2 Agreement on catastrophe, disagreement on values #

The states that would have to agree specify their own models differently. Section 17.5.3 reads the two clearest cases. In its reading, China's interim measures for generative AI services (Cyberspace Administration of China et al., 2023) write political content into what a public service may say, while the European Union's AI Act mostly writes obligations of process and a list of prohibitions (European Parliament and Council of the European Union, 2024b). China's 2021 ethical norms, which Section 63.2.4 reports, make controllability one of six basic requirements (National Governance Committee for New Generation Artificial Intelligence, 2021). Its 2023 Global AI Governance Initiative, which Section 65.5.3 reports, supports establishing an international institution to govern AI within the United Nations framework (Ministry of Foreign Affairs of the People's Republic of China, 2023).

Read against these, the five red lines name capabilities and behaviors, not what a model may say, and no line touches the questions on which the two systems' specifications differ (inference). That suggests a hypothesis: agreement on catastrophic capabilities may be reachable across political systems while agreement on values is not (inference). The evidence for it is one statement by individuals, and a declaration by states that names the same kinds of harm, misuse, loss of control, cyber, and biotechnology, without drawing any line (Summit, 2023). The test is whether governments go from naming the harms to signing lines, and the record of 2025 and 2026 shows how far that is. As of 2026 even the venue for agreement was contested: the United States voted against the appointments to a scientific panel established at the United Nations in 2025 with strong Chinese support (Section I.5.2) (AI, 2026).

Whose coordination would count is a further question, and Section 17.5 reports the standards for institutions that govern across borders. Allen Buchanan and Robert Keohane stake out a position between legitimacy as state consent and the democratic standards applied to states (Buchanan and Keohane, 2006). Eva Erman and Markus Furendal conclude that much existing global AI governance lacks properties a democratic minimum requires (Erman and Furendal, 2024). Section 16.7.1 reports the warning that appeals to cultural difference can excuse violations of shared values (Wong, 2020), and the argument that practical agreement is sometimes possible "despite disagreement on more abstract values or principles" (ÓhÉigeartaigh et al., 2020). The red lines are a test of the second argument.

66.1.3 The four problems one level up #

Section 65.1.1 applies the book's four problems to developers under competition. Between states they take a concrete form (inference). What states agree to is a specification. How compliance is checked is verification, the subject of most of this chapter. Instillation has a counterpart in the domestic law and administration that make a state's own developers comply. Whether an agreement survives a change of government or a jump in capability is maintenance, and it has a literature of its own. Jane Vaynman's 2026 book, read here from its publisher's abstract, argues that uncertainty from domestic political change, "such as leadership transitions or social unrest," can enable arms control. It names two paths: states that relied on informal understandings hedge with lightly monitored agreements, while those that anticipated deception "take calculated risks through agreements with intensive verification" (Vaynman, 2026).

66.2 Cooperation between rivals, and what verification adds #

From international relations. International relations studies actors who answer to no higher authority. Section 65.3 taught why such actors arm when all would prefer that none did, and why reassurance can work in a trust dilemma but not in a prisoner's dilemma ((65.3)). This section takes the step those models leave open. When the same states meet again and again, under what conditions can cooperation be sustained, and where exactly does verification enter?

66.2.1 Institutions as answers to cooperation problems #

Robert Keohane's 1984 book After Hegemony: Cooperation and Discord in the World Political Economy could be read here only as a catalog record (Keohane, 1984). So could Scott Barrett's 1994 paper on self-enforcing international environmental agreements (Barrett, 1994); neither is summarized here. Section 65.6.1 reports the three factors by which Robert Axelrod and Robert Keohane's 1985 paper explains cooperation under anarchy, among them the shadow of the future (Axelrod and Keohane, 1985). Barbara Koremenos, Charles Lipson, and Duncan Snidal's Rational Design project, read here from its abstract, treats institutions as choices that states make to solve the particular cooperation problems they face. It identifies five features, "membership, scope, centralization, control, and flexibility," and explains their variation by four variables, "distribution, number of actors, enforcement, and uncertainty," from which it derives "empirically falsifiable conjectures" (Koremenos et al., 2001). Kenneth Abbott and Duncan Snidal's account of why actors choose soft commitments, among other reasons because soft law "provides strategies for dealing with uncertainty," is reported in Section 62.5.4 (Abbott and Snidal, 2000).

On compliance itself there are two readings. Abram and Antonia Chayes, by their 1993 abstract, propose that the overall level of compliance with international agreements "is inherently unverifiable by empirical procedures." The beliefs that states generally comply, or that they violate whenever it pays, are then "competing heuristic assumptions." Compliance problems, they argue, "very often do not reflect a deliberate decision to violate." A treaty regime should be held not to strict compliance but to a level of overall compliance that is "acceptable" given what the treaty is meant to safeguard (Chayes and Chayes, 1993). The rival reading treats every violation as a defection to be deterred. The derivation below shows that the choice between them is not only a matter of temperament: a regime that punishes every apparent violation pays for its monitor's false alarms.

66.2.2 What detection and false alarms do to cooperation #

Section 57.2.2 derives when the threat of ending cooperation sustains it if every defection is seen ((57.1)). Verification between states is never that good, and it sometimes accuses the innocent. The derivation adds both.

Each term has a reading for AI (inference). The temptation $\mathrm{T}-\mathrm{R}$ grows with the value a state places on a lead. The continuation probability $\gamma$ falls when a state believes a decisive advantage is near, because it then expects the relationship of equals to end; a smaller $\gamma$ raises the detection rate an agreement needs, and Exercise 66.1 works how fast. Verification's job is to push $1-\beta_{\text{miss}}$ above the threshold.

Equation (66.2) adds that a monitor's false alarms raise the threshold by $\alpha(\mathrm{T}-\mathrm{P})/(\mathrm{R}-\mathrm{P})$, and step 5 adds the larger cost: under a rule that punishes every alarm, even perfect compliance ends after about $1/\alpha$ rounds, if nothing else ends the relationship first. A regime can lower its effective false alarm rate by investigating before it punishes, which is what the consultation and screening procedures of the chemical weapons convention do (Section 66.3). The Chayeses' argument that compliance problems very often do not reflect a deliberate decision is, in this model, an argument for exactly that design (inference).

66.2.3 Where the theory stops #

The derivation assumes that both states know the payoffs and that they stay fixed. A technology whose military value is uncertain and changing shifts $\mathrm{T}$ and $\gamma$ between the negotiation and the implementation of an agreement. A state that expects a jump in capability may sign in good faith and later find violation worth more than it was (inference). The derivation also treats states as single players, while Vaynman's account turns on their domestic politics (Section 66.1.3). And it treats an undetected violation as one round's gain, after which cooperation resumes. A training run that produces a capable model leaves weights that can be copied (Section 66.5), so a single undetected success may yield a lasting advantage rather than one round of $\mathrm{T}$. The detection rate an agreement needs then rises above what (66.1) gives (inference).

66.3 Arms control and its verification regimes #

From arms control. Arms control, the negotiated limitation of weapons between states that cannot compel one another, is the nearest record of rivals verifying each other's restraint. The question here is what made agreements verifiable, what verification cost the inspected party, and whether verified agreements changed what states did. Section 64.3 reports the early nuclear history from its sources. It covers the failure of international control in 1946 (Section 64.3.1), the test ban of 1963 scoped to environments that national systems could monitor (Section 64.3.2), and the testing moratorium of 1958 to 1961 that held on public statements alone (Section 64.8.2). This section teaches the theory that explains that pattern, reads the later treaties from their texts, and asks what the record implies for AI.

66.3.1 The transparency-security trade-off #

Andrew Coe and Jane Vaynman's 2020 paper in the American Political Science Review begins from a puzzle. Arming, like war, produces outcomes that could be reached by negotiation without its cost, yet "arms control is exceedingly rare historically" (Coe and Vaynman, 2020). The obvious answer, that states fear secret cheating, does not suffice in their account, because a state "can credibly reveal its compliance with arms control by simply allowing the other side sufficient access to its territory" (Coe and Vaynman, 2020). The question is why it so seldom does.

Their model has a monitoring state and an arming state that bargain over a settlement. The arming state can stay closed, so that the monitor sees only what its own intelligence finds. Or it can open itself to monitoring, which raises the chance that a covert investment in arms is detected (Coe and Vaynman, 2020). A deal must meet two requirements. The transparency requirement is that cheating be detected often enough to deter it, the counterpart of (66.1). The security requirement is that what monitoring reveals must not give the monitor so large a military advantage that it would rather exploit it than keep the deal. Inspections meant to confirm that a base holds no prohibited weapons "may also yield information that makes it easier to effectively attack the base" (Coe and Vaynman, 2020).

Three results follow. If the monitor's unilateral means meet the transparency requirement, a deal can be made without inspections, a closed deal. If opening up costs the arming state nothing in security, a deal is always possible, and perfect monitoring "is never needed." If opening up does cost security, an open deal exists only when the trade-off "is not too severe" (Coe and Vaynman, 2020). The severity depends on the capability and on the state that holds it. A capability that "is smaller, can be produced or deployed more quickly and at more sites, or more closely resembles civilian or other non-restricted capabilities, will require more intrusive inspections," and monitoring at sites that hold other secrets "will entail higher security risks at any given level of monitoring" (Coe and Vaynman, 2020). Their own example sets warships against cyber weapons: warships are easier to limit in a closed deal "because only the former are large physical objects that are easily distinguishable from civilian analogues" (Coe and Vaynman, 2020).

The evidence is three case studies. Iraq obstructed the most intrusive inspections after the Gulf War, in the authors' reading because it expected the transparency to be exploited in American efforts against the regime. Between the world wars the most successful limit governed capital ships, which espionage could verify. The Cold War pattern is the one Section 64.3.2 quotes, agreements limited to what could be monitored unilaterally (Coe and Vaynman, 2020). By the authors' count these arms races account for almost 40 percent of global arming over two centuries (Coe and Vaynman, 2020). The intermediate-range missile treaty shows the way out. Its first round of talks failed over "anytime anywhere" inspections. In the second, the United States devised a sensor that "would reveal whether an exiting missile was of the banned type, but not reveal the technical details of non-banned missiles produced at the same location." Both sides came to judge the trade-off mild (Coe and Vaynman, 2020). The authors name three ways to ease the trade-off: a trusted third-party monitor that reveals only compliance, better sensing technology, and more open societies (Coe and Vaynman, 2020). Their cases were chosen to "vary widely" (Coe and Vaynman, 2020). Cases chosen for breadth show that the trade-off recurs, not how often it decides against rival explanations such as domestic politics, which Vaynman's later book takes up (inference).

66.3.2 What the treaties verify, from their texts #

The treaties built after 1963 carry their verification arrangements in their texts, and Table 66.1 sets four of them side by side.

The Non-Proliferation Treaty divides the world in two. Each non-nuclear-weapon state accepts safeguards, the accounting and inspection of nuclear material, negotiated with the International Atomic Energy Agency (IAEA) "for the exclusive purpose of verification of the fulfilment of its obligations." The nuclear-weapon states, those that had exploded a device before 1 January 1967, accept none. They undertake instead "to pursue negotiations in good faith" on disarmament, and Article IV affirms every party's "inalienable right" to peaceful nuclear energy (United Nations Office for Disarmament Affairs, 1968). Verification is one side of a bargain: access to a dual-use technology, one with both civilian and military uses, in exchange for inspection of its use (inference). The test-ban treaty of 1996 writes its regime into Article IV: an International Monitoring System, consultation and clarification, on-site inspections, and confidence-building measures, with each party free to use information from "national technical means of verification" (Comprehensive Nuclear-Test-Ban Treaty Organization, 1996). Verification is to proceed "in the least intrusive manner possible," and an on-site inspection goes ahead only with "at least 30 affirmative votes" of the 51-member Executive Council (Comprehensive Nuclear-Test-Ban Treaty Organization, 1996). The treaty enters into force only when every state listed in its second annex has ratified (Comprehensive Nuclear-Test-Ban Treaty Organization, 1996), which as of its organization's page has not happened (Ctbto, 1996).

The Chemical Weapons Convention is the most complete written answer to Coe and Vaynman's problem. It establishes the Organization for the Prohibition of Chemical Weapons (OPCW) "to ensure the implementation of its provisions, including those for international verification of compliance with it." It grades verification by the schedule on which a chemical is listed. Schedule 1 chemicals are subject to "systematic verification through on-site inspection and monitoring with on-site instruments," and those on Schedules 2 and 3 to data monitoring and on-site verification (Organisation for the Prohibition of Chemical Weapons, 1993). Any party may request "an on-site challenge inspection of any facility or location" in another party's territory, to be conducted "anywhere without delay." The inspected party keeps "the right to take measures to protect sensitive installations, and to prevent disclosure of confidential information and data, not related to this Convention" (Organisation for the Prohibition of Chemical Weapons, 1993). Parties should first try to clarify doubts through consultation, must "refrain from unfounded inspection requests," and the Executive Council may, within 12 hours and by a three-quarter majority, stop a request it finds "frivolous, abusive or clearly beyond the scope" of the convention (Organisation for the Prohibition of Chemical Weapons, 1993). The text writes the transparency requirement, the security requirement, and a filter on false accusations into law (inference).

The Biological Weapons Convention is the contrast. It prohibits agents and toxins "of types and in quantities that have no justification for prophylactic, protective or other peaceful purposes," a line drawn by purpose, as a line on dual-use AI would have to be (inference). For compliance its text offers national measures (Article IV), consultation among the parties (Article V), and a complaint to the UN Security Council that "should include all possible evidence confirming its validity," with parties undertaking to cooperate in "any investigation which the Security Council may initiate" (Article VI) (United Nations, 1972). The text creates no organization and provides for no inspection. That a prohibition without an inspectorate is the weaker regime is this book's reading of the contrast, not a finding of either text (inference).

66.3.3 Whether verified agreements work #

Whether the treaties changed what states did is harder to show. Matthew Fuhrmann and Yonatan Lupu's study of the Non-Proliferation Treaty, whose title asks whether arms control treaties work, could be read only as a catalog record (Fuhrmann and Lupu, 2016), and so could Scott Sagan's paper on why states build nuclear weapons (Sagan, 1996). The readable evidence asks a narrower question: whether verification caught the violations attempted. Mauricio Baker's 2023 preprint, written at Stanford University and, by its acknowledgments, mainly as an independent contractor with OpenAI's policy research team, reviews verification across nonproliferation treaties, American and Soviet or Russian arms limitation treaties, and test bans (Baker, 2023). The strongest system in each category, he reports, "has had zero known major failures," in the context of "(up to) a few known attempts at serious violations," all of which it detected. The IAEA's earlier safeguards, designed around declared facilities, "repeatedly failed to detect undeclared ones" (Baker, 2023). He names the limit himself: "The public would not know about any nuclear weapons development activities that were sufficiently well-kept secrets" (Baker, 2023). A regime that missed a well-hidden program would leave the same record (inference).

66.3.4 Lessons drawn for AI #

Baker's conclusion for AI concerns training on large numbers of specialized chips, verified through mechanisms built into them. With certain preparations, he argues, "the foreseeable challenges of verification would be reduced to levels that were successfully managed in nuclear arms control." One preparation is privacy-preserving, secure, and affordable methods for verifying hardware given inspection access. The other is "an initial, incomplete verification system, with authorities and precedents that allow its gaps to be quickly closed," a step he grounds in the record: "All the strongest nuclear M&V systems succeeded weaker systems" (Baker, 2023). He also lists differences that cut the other way. Centrifuges scatter particles detectable at a distance, and "there are no obvious analogues for AI"; and nuclear verification "has not had to" verify the use of information technology (Baker, 2023).

Others draw narrower lessons. Matthijs Maas's three lessons for military AI are reported in Section 64.3.4 (Maas, 2019), and Edward Geist and Andrew Lohn's assessment of AI and nuclear stability in Section 59.6 (Geist and Lohn, 2018). Andrew Imbrie and Elsa Kania's 2019 policy brief proposes measures between great powers to "prevent or correct misperceptions, enhance mutual transparency on policies and capabilities." It also names the difficulty: collaboration on AI safety "may improve the reliability of machine learning techniques and therefore enable strategic competitors to deploy AI/ML-enabled military systems more quickly and effectively" (Imbrie and Kania, 2019). That is Coe and Vaynman's trade-off in another form: what reassures a rival can also strengthen it (inference). The likeliest near-term form of agreement may need no verification at all. Section 58.8 reports the voluntary norms that govern cyber operations between states, from Joseph Nye's four mechanisms of dissuasion to a 2015 report by UN governmental experts (Nye, 2017; Finnemore and Hollis, 2016; United Nations General Assembly, 2015). Such norms can form among rivals because no one has to open anything, and for the same reason they constrain least (inference).

66.3.5 Where the analogy stops #

Section 64.3.4 draws the main disanalogy: fissile material is scarce and countable, while a trained model is a file that copies at no cost, so verification of the treaty kind points to compute and not to models. Coe and Vaynman's determinants add two more (inference). The prohibited activity, a training run beyond agreed limits, uses the same chips as permitted work, which puts it at the far end of their scale of resemblance to civilian capabilities. And the sites that would be inspected hold secrets other than compliance, chiefly the developers' models and methods, so the security requirement protects commercial as well as military information. Both make the trade-off more severe than for warships or fissile material, and both are what the hardware designs of Section 66.5 try to ease.

66.4 The operations research of verification #

From operations research. Arms control asks whether states will accept inspection; operations research asks how a limited inspection effort should be spent and what it buys. Section 14.6 introduced the founding works and taught the inspection game. In its mixed equilibrium a harsher penalty changes how often the inspector looks rather than how often the inspectee cheats, and an inspector that commits to its rate in advance can deter violation. This section adds what treaty verification needs beyond that game: sampling from a declared inventory, and testing declared data against independent measurement.

66.4.1 Sampling against an inspectee who can tamper #

Melvin Dresher's 1962 RAND memorandum, read here from page images of the scan, starts from what separates arms control from ordinary statistics. "In sampling for disarmament (or arms-control) verification, we must assume that the statistical universe can be tampered with to conceal a violation" (Dresher, 1962, p. 1). One of his examples is a ban on underground tests verified by on-site inspection of seismic shocks "that cannot be identified by seismology to be earthquakes." Another is "a prohibition of the production of certain military equipment to be verified by a limited number of inspections per year of the production of related civilian equipment" (Dresher, 1962, pp. 1-2). He solves a game of timing: an inspector with a fixed number of inspections to spread over a sequence of events, and a violator who chooses when to commit at most one violation. In his table, an inspector with one inspection left and ten events to go inspects the next event with probability 0.091 (Dresher, 1962, p. 17).

Rudolf Avenhaus, Bernhard von Stengel, and Shmuel Zamir's chapter in the Handbook of Game Theory traces the applications to arms control through three phases (Avenhaus et al., 2002). The first, from about 1961 to 1967, concerned test-ban inspection; the second, from about 1968 to 1985, safeguards under the Non-Proliferation Treaty; the third, the treaties that followed the Cold War (Avenhaus et al., 2002). The IAEA's verification principle, they write, is material accountancy, "the comparison of book and physical inventories for a given material balance area at the end of an inventory period." Operators report their data, and inspectors verify them "with the help of independent measurements on a random sampling basis" (Avenhaus et al., 2002). Two kinds of sampling serve it. In attribute sampling the attribute "is usually if a safeguards measure has been violated," such as "a broken seal of a container." Variable sampling tests "an average or total value of material," as with the total of material unaccounted for, the gap between what the books say and what is measured. The inspector must decide whether a gap is diversion or measurement error, a decision that "depends on the probability of a false alarm chosen by the inspector" (Avenhaus et al., 2002).

Their general framework splits the inspection problem in two. A game between the parties sets the false alarm probability and the probability of violation. Given the false alarm probability, a zero-sum "non-detection" game fixes the best test and the best way to violate. The authors call the first game "of a 'political' nature," because its payoffs "are hard to measure since they are supposed to quantify political effects." The second is "of a technical nature, devoid of political considerations" (Avenhaus et al., 2002). The derivation below works inside the technical game.

The defaults of Figure 66.1 are 1,000 declared items, a violation the size of 20 of them, a sample of 100, and a measurement error of a tenth of an item's declared amount. The concentrated violation is then caught with probability 0.88. Spread over every item, the same total is caught with probability 0.64 at a false alarm rate of 0.05, so the inspectee spreads it. Halving the measurement error raises detection of the spread violation to 0.99, and the inspectee's better choice becomes concentration, caught with probability 0.88. Neither kind of sampling suffices alone (inference). Together they bound only these two ways of hiding a violation. A party can also overstate some items by more than others, and the authors call "a theoretical analysis of the general case" of such falsification "very difficult" (Avenhaus et al., 2002). For material accountancy over several periods, the same authors show that the best test is the overall balance. Its detection probability "does not depend on the diversion vector" so long as the total is fixed (Avenhaus et al., 2002), so a balance taken over a whole period catches a total however it was timed.

66.4.2 The same arithmetic applied to chips #

A declared chip inventory, a declared set of training runs, or a declared list of data centers is a declaration of the same kind, and checking it is material accountancy for compute (inference). Yonadav Shavit's design for verifying rules on large training runs, whose parts Section 66.5 reports, already sets its sample this way. A verifier samples a party's chips, and a sampled chip that took part in a prohibited run and holds a logged snapshot of its weights proves the violation. His sampling rate is the bound of (66.3) with one substitution. The share falsified becomes the share of the party's chips that a prohibited run of a given size must use, multiplied by the chance that a sampled chip holds a snapshot (Shavit, 2023). He makes what he calls the conservative assumption that training parallelizes perfectly, and assumes that the violator uses the fewest chips that can finish the run in time (Shavit, 2023).

Applied to the whole world, the numbers are of a familiar size. Shavit assumes $10^{7}$ chips, each three times as fast as NVIDIA's H100 data-center chip and, as in his table of sample sizes, logging 0.1 weight snapshots a day on average. To catch a training run of $10^{25}$ operations anywhere within 30 days of its completion with probability 0.9, he estimates "roughly 232,000 worldwide chip samples per year." At a thousand chips per inspector per year, that is about 232 inspectors, "slightly smaller than the 280 active IAEA inspectors as of 2021" (Shavit, 2023). Two qualifications travel with the estimate. Several parties that each contribute a small share of their chips to one run would evade an audit of any one of them. An international verifier would then have to treat all of them as one party, at a much larger sample (Shavit, 2023). And "as individual chips become more powerful," and as algorithms grow more efficient, "the number of required samples would need to grow in order to verify rules on a fixed-capability training run" (Shavit, 2023).

66.4.3 Where the theory stops #

The theory assumes an inspectee that cannot see which items will be sampled, and Section 14.6.2 found no model of an inspectee that learns the sampling distribution from the inspections themselves. It also assumes that the declaration covers the items that matter. An undeclared facility lies outside every sample. That is how the IAEA's early safeguards, built around declared facilities, missed undeclared programs (Section 66.3.3), and it is why designs for compute verification monitor the chip supply chain as well as the declared sites (Section 66.5). And both sides may have secrets to keep. Section 38.8 reports the case that external evaluation needs mutual privacy, since evaluators too must protect their test sets (Bucknall et al., 2025); an inspector's sampling plan is a secret of the same kind (inference).

66.5 Compute as the verification base #

The arms control record says that agreements attach to what can be detected without the other side's cooperation, and Section 64.3.4 concluded that for AI that points to compute. This section assesses the proposal that computing hardware is what international agreements on AI can verify: the case for it, the designs, what thresholds add, and what compute cannot see.

66.5.1 The case for compute #

The fullest statement of the case is a 2024 preprint by Girish Sastry, Lennart Heim, Haydn Belfield, and colleagues, whose authors include researchers at OpenAI, the Centre for the Governance of AI, and the University of Cambridge (Sastry et al., 2024). Relative to data and algorithms, they argue, "AI-relevant compute is a particularly effective point of intervention: it is detectable, excludable, and quantifiable, and is produced via an extremely concentrated supply chain." Policymakers could use it "to facilitate regulatory visibility of AI, allocate resources to promote beneficial outcomes, and enforce restrictions." They warn that "naïve or poorly scoped approaches to compute governance carry significant risks in areas like privacy, economic impacts, and centralization of power" (Sastry et al., 2024). For agreements between states, they suggest that compute tracking, inspections, and other means "could help navigate the transparency-security trade-off" of Section 66.3.1, by analogy with the "information barriers" of nuclear verification (Sastry et al., 2024). They describe technologies that could give a regulator "perhaps just a single bit of information that indicates compliance" (Sastry et al., 2024). That is the missile-exit sensor of the intermediate-range treaty in another material (inference).

The same concentration makes compute an instrument of coercion. Henry Farrell and Abraham Newman, by their abstract, argue that states with jurisdiction over the central nodes of global networks can use a "panopticon effect" to gather information and a "chokepoint effect" to deny access to adversaries (Farrell and Newman, 2019). The American export controls on advanced chips, which Section 65.1.2 reports (Bureau of Industry and Security, 2022; Bureau of Industry and Security, 2025), use the chokepoint unilaterally, within the multilateral tradition of the Wassenaar Arrangement that Section 64.7.2 reports (Arrangement, 1995). A control imposed on a rival and a verification regime accepted by a rival are different instruments resting on the same chokepoint (inference).

66.5.2 Designs #

Shavit's 2023 preprint, written at Harvard University, is the most specific design (Shavit, 2023). Its goal is to give governments "high confidence that no actor uses large quantities of specialized ML chips to execute a training run in violation of agreed rules," without curtailing consumer devices and while keeping practitioners' models, data, and settings confidential. It has three parts. Firmware on each chip occasionally saves snapshots of the weights in its memory for an inspector to retrieve. Records kept for each run suffice to prove to inspectors what training run produced those weights. And monitoring of the chip supply chain is meant "to ensure that no actor can avoid discovery by amassing a large quantity of un-tracked chips" (Shavit, 2023). The sampling arithmetic of Section 66.4.2 sets how many chips inspectors must check. Shavit presents the work as "a high-level solution design" whose contribution is "isolating a set of open problems." "If these problems prove unsolvable, the system's design will need to be modified, or its guarantees scaled back" (Shavit, 2023).

Others propose other points of control. Lennart Heim, Tim Fist, Janet Egan, and colleagues argue in a 2024 preprint that cloud compute providers can act as "securers," "record keepers," "verifiers of customer activities," and "enforcers." Non-confidential information that providers largely already hold, they write, can reveal a workload's type, such as large-scale training or inference, and the amount of compute it consumed. They add that "internationalization will be key to effective implementation" (Heim et al., 2024). A RAND working paper by Gabriel Kulp and colleagues, known here from its publication page, introduces "hardware-enabled governance mechanisms" and analyzes the threats they face, the attack vectors that might compromise them, and protective measures (Kulp et al., 2024).

Akash Wasil, Tom Reed, Jack William Miller, and Peter Barnett's 2024 preprint catalogs ten methods that could detect two violations: "unauthorized AI training (e.g., training runs above a certain FLOP threshold) and unauthorized data centers." For each it gives a precedent and possible evasions (Wasil et al., 2024). Table 66.2 sorts them as the authors do, starting with national technical means, the satellites, intelligence, and records a state can use without the other side's cooperation.

The authors cite the IAEA's routine use of satellite imagery as precedent for remote sensing. They propose combining methods so that "the weaknesses of one method are covered by the strengths of others," and recommend red-team exercises in which analysts try to hide an unauthorized run from the methods and then strengthen them (Wasil et al., 2024). Their list of open directions includes verifying agreements about deployment and about model evaluations, which none of the ten methods addresses (Wasil et al., 2024).

66.5.3 Thresholds and their erosion #

A compute-based agreement needs a line. As of October 2026 the domestic thresholds were $10^{25}$ training operations in the European Union's AI Act and $10^{26}$ in the revoked American order (Table I.1) (European Parliament and Council of the European Union, 2024b; Executive Office of the President, 2023). Section 63.2.6 reports the debate over them: Heim and Koessler's case for compute as an initial filter that triggers scrutiny, against Hooker's argument that the relation between compute and risk is uncertain and changing (Heim and Koessler, 2024; Hooker, 2024). Section 65.5 reports Pilz and colleagues' finding that falling compute costs let more actors reach a given capability over time (Pilz et al., 2023). Internationally the erosion compounds (inference). A threshold fixed in operations covers more actors each year, and Section 66.4.2 gives the cost to the verifier: catching a run of fixed capability takes more samples as chips and algorithms improve. Sastry and colleagues draw the distinction that decides how much this matters. The compute needed for a given capability falls over time, while the compute needed for frontier capability rises, so "the highest-capability models are likely to be developed by a small number of actors" as long as scaling pays (Sastry et al., 2024). Compute verification can therefore hold the frontier in view while losing sight of capabilities that were once at the frontier.

66.5.4 Verifying what ran, not what was bought #

A count of chips says what a party could do; an agreement may need to know what it did. Cryptography offers proofs about computation. Section 28.6.3 reports a zero-knowledge proof, one that convinces a verifier of a statement while revealing nothing else, that a specific model produced an output while keeping its parameters private (Sun et al., 2024b). It belongs to a line of work on verifiable computation that includes the system of Bryan Parno and colleagues, cited here for its existence (Parno et al., 2013). A review by Michael Walfish and Andrew Blumberg describes that line, in its abstract's words, as moving "from theoretical possibility to near practicality" (Walfish and Blumberg, 2015). A proof that one output came from one model is a long way from a proof that no prohibited training run happened (inference). Weight security sets the stakes from the other side. Section 59.3 reports RAND's catalog of attacks on model weights, about a dozen of which it judges infeasible for nonstate actors but feasible for state actors (Nevo et al., 2024). An agreement among states is an agreement among the best-resourced attackers that catalog considers.

66.5.5 What compute cannot see #

Compute is an input. Sastry and colleagues say that compute governance "will be less effective at governing small deployments, especially when model weights are readily available." They also note that "computationally cheap post-training interventions can also meaningfully change model behavior, including by making it less safe" (Sastry et al., 2024). They add that consumer hardware and concerning computation may "become less separable over time," and that decentralized training across many sites, "currently technically infeasible" in their account, would weaken detectability (Sastry et al., 2024). Shavit names the hardest limit himself: once a model is produced by a prohibited run, "that model's weights may from then on be copied undetectably" (Shavit, 2023).

An agreement about what a model can do, or whether it is aligned, needs evaluations (Chapter 36), audits (Chapter 38), and safety arguments (Chapter 52). Each requires access to the model that Coe and Vaynman's trade-off makes costly, since the secrets colocated with a model are the model itself (inference). As of October 2026 we found no field test of any compute verification design against a motivated state evader, and no method for verifying a model property, rather than a training input, between states. The designs are designs.

66.6 International scientific assessment #

From climate assessment. Rivals cannot agree on what to do before they agree on what is known, and on AI they do not yet agree on what is known. Climate science built an institution for that problem, and the AI institutions of 2024 to 2026 were modeled on it. The calibrated vocabulary of climate assessment, which keeps confidence in a finding apart from the likelihood of an outcome, is taught in Section 4.6.1, and Section 4.6 reports that neither edition of the International AI Safety Report adopts it. This section is about the institution: who writes the assessment, who reviews it, and what governments do with it.

66.6.1 Why assessment bodies matter #

The mechanism is the one Peter Haas's 1992 introduction describes, and Section 2.1.4 introduces its term. An epistemic community is a network of knowledge-based experts, and the introduction's abstract describes such networks articulating "the cause-and-effect relationships of complex problems." How states define their interests on technical issues, it argues, "can be a function of the manner in which the issues are represented by specialists to whom they turn for advice in the face of uncertainty." Control over knowledge and information "is an important dimension of power," and the diffusion of new ideas can be "an important determinant of international policy coordination" (Haas, 1992). On this account an assessment does not need binding force to matter; it shapes what states take their interests to be. The same account says why rival states contest who sits on the panel (inference).

66.6.2 The climate model #

The Intergovernmental Panel on Climate Change (IPCC) sets out its procedure in its own rules. A Summary for Policymakers undergoes "simultaneous review by both experts and governments," a government round of written comments, and "a final line by line approval by a Session of the Working Group," a plenary of governmental representatives (Intergovernmental Panel on Climate Change, 2013). Approval "signifies that the material has been subject to detailed, line by line discussion and agreement," and that the summary "is consistent with the factual material" of the underlying assessment (Intergovernmental Panel on Climate Change, 2013). Lewis Ho and colleagues' 2023 preprint, whose authors include researchers at Google DeepMind and OpenAI with political scientists from several universities, proposes an AI counterpart (Ho et al., 2023). The IPCC's recent assessment, in their figures, "was written by 234 scientists from 66 states and drew on 14,000 scientific papers." They warn that an AI commission following that model would have experts nominated by member states, "but there will not be a robust climate science discipline to buffer against political interests" (Ho et al., 2023).

66.6.3 The AI instance #

The International AI Safety Report was created after the 2023 summit "to support an internationally shared scientific understanding of the capabilities and risks associated with advanced AI systems" (Bengio et al., 2026). As of October 2026 it had published full editions in January 2025 and in 2026, and Section I.5.1 sets out their process and membership. Its writers keep full discretion over its content, an advisory panel nominated by governments and international organizations gives technical feedback only, representatives of industry, among them developers whose systems it assesses, review its drafts, and it endorses no policy (Bengio et al., 2025b; Bengio et al., 2026). Between editions it publishes shorter key updates, whose findings on safeguards Section 62.3.2 reports (Bengio et al., 2025c).

Set beside the climate model, the design trades one kind of authority for another (inference). Under the IPCC's procedures, governments approve the summary line by line and so own it; in the AI report, governments nominate advisers who give technical feedback, and the writers keep full discretion. The report gains independence from governments and loses the governments' signature on its conclusions. It also takes review from the developers whose systems are its subject. Neither edition defines a scale of confidence or likelihood of the IPCC kind (Section 4.6). The 2026 edition writes, for instance, that AI systems "are very likely to have contributed" to a rise in phishing and deepfake attacks, without stating what "very likely" means (Bengio et al., 2026). A 2025 consensus on research priorities, posted as a preprint, came from the same community, and Section 2.7.3 reports it (Bengio et al., 2025e).

66.6.4 The United Nations panel #

The UN advisory body's recommendation was for "an independent international scientific panel on AI, made up of diverse multidisciplinary experts in the field serving in their personal capacity on a voluntary basis." Its mandate would include "issuing an annual report surveying AI-related capabilities, opportunities, risks and uncertainties, identifying areas of scientific consensus." The body named the IPCC and the UN Scientific Committee on the Effects of Atomic Radiation as precedents (United Nations High-level Advisory Body on Artificial Intelligence, 2024). As of October 2026 the panel had been established and its members appointed (Section I.5.2) (AI, 2026). Ho and colleagues judge their own proposal, a Commission on Frontier AI, "worthwhile in most circumstances," while warning that representation "may trade off against a Commission's ability to overcome scientific challenges and generate meaningful consensus" (Ho et al., 2023).

Assessment needs measurements, and the states that commissioned it began building their own capacity to make them. The Bletchley agenda included "developing relevant public sector capability" (Summit, 2023). Section 63.2.5 reports the first state body dedicated to evaluating frontier models, which described itself as "not a regulator," and its later finding of vulnerabilities in every system it tested (Department for Science and Technology, 2023; UK AI Security Institute, 2025b). Section 63.2.2 reports the 2026 American order on voluntary pre-release access (Executive Office of the President, 2026).

66.6.5 Where the analogy stops #

Section 4.6.4 draws the scientific disanalogy: climate assessment rests on physical law and long records, AI assessment on a few years of evidence about systems that change between editions. The institutional disanalogy is separate (inference). Much of the evidence an AI assessment weighs comes from developers about their own models (Section 5.6), and the developers also review its drafts. The states whose rivalry the assessment is meant to inform are the homes of those developers, so the assessed, the reviewers, and the audience overlap. And an assessment cannot verify. It can say what the published evidence shows about capabilities and safeguards, but not what any state's developers are doing that is unpublished, which is the question an agreement needs answered.

66.7 International institutions and the regime complex #

If states did agree, what would carry the agreement? This section sets out the institutions proposed for advanced AI, then weighs them against two predictions: that institutional design follows the cooperation problem, and that governance of a sprawling issue fragments into a loose set of regimes rather than one.

66.7.1 The proposals #

Ho and colleagues group the functions an international body might perform into four models with precedents in existing organizations (Ho et al., 2023). The first is "a Commission on Frontier AI that facilitates expert consensus on opportunities and risks from advanced AI." The second is "an Advanced AI Governance Organization that sets international standards to manage global threats from advanced models, supports their implementation, and possibly monitors compliance with a future governance regime." The third is "a Frontier AI Collaborative that promotes access to cutting-edge AI," and the fourth "an AI Safety Project that brings together leading researchers and engineers to further AI safety research" (Ho et al., 2023). On monitoring they lay out a spectrum. At the least intrusive end is self-reporting, "as in the Paris Agreement." The aviation, maritime, and financial-action bodies monitor jurisdictions, and some observers ask about "detection and inspections of large data centers (partly analogous to IAEA safeguards)." They add that "the more intense and intrusive any monitoring, the more challenging it may be to get to consensus" (Ho et al., 2023). They also note the scoping problem particular to AI: "models that were 'frontier' a year ago are now both outdated and widely available" (Ho et al., 2023).

Robert Trager, Ben Harack, Anka Reuel, and colleagues, in a 2023 preprint whose authors include researchers at universities, think tanks, and Microsoft, develop one model in detail (Trager et al., 2023). States would establish "an International AI Organization (IAIO) to certify state jurisdictions (not firms or AI projects) for compliance with international oversight standards." They would give the standards force "by adopting regulations prohibiting the import of goods whose supply chains embody AI from non-IAIO-certified jurisdictions." They could add multilateral controls on exporting AI inputs such as specialized hardware to uncertified jurisdictions. The design borrows from the International Civil Aviation Organization, the International Maritime Organization, and the Financial Action Task Force (Trager et al., 2023). The proposal covers civilian AI because, in the authors' words, "military arms control is also desirable, but progress there will be relatively slow and challenging" (Trager et al., 2023). The organization could also monitor firms directly at the request of the state with jurisdiction over them, doing "the technical heavy lifting" while the home state enforces (Trager et al., 2023). The scientists' roadmap of Section 66.1.1 asks for the same lever, access to markets conditioned on an international audit, and Trager is among its signatories (Safety, 2024).

At the centralized extreme, Jason Hausenloy, Andrea Miotti, and Claire Dennis propose a Multinational AGI Consortium that "would be the only institution in the world permitted to develop advanced AI, enforced through a global moratorium by its signatory members on all other advanced AI development." They state that "we do not address the political feasibility of implementing a moratorium" (Hausenloy et al., 2023). Sastry and colleagues suggest a softer form of joint development. In a CERN-like project, countries could build trust by "incrementally ratcheting up investments in a 'tit for tat' manner," and "the larger the scale of the investments, the less likely it is that one of the participants could be hiding a similarly sized project" (Sastry et al., 2024). That is verification by budget: a state that commits most of its compute to a shared project has little left for a secret one (inference). Deterrence by sabotage, the alternative to any institution, is set out and tested in Section 65.3.5 (Hendrycks et al., 2025).

The states' own positions are less developed. The UN advisory body declined to recommend an agency (Section 66.1.1). Concordia AI's survey reports that China proposed a World AI Cooperation Organization in the year to June 2026 (AI, 2026), beside the UN-centered institution of its 2023 initiative. Table 66.3 sets the proposals side by side.

66.7.2 Centralized or fragmented #

Peter Cihon, Matthijs Maas, and Luke Kemp, by their 2020 abstract, draw on other international regimes to weigh centralizing AI governance in one body. Efficiency and political power favor it, while "the risk of creating a slow and brittle institution speaks against it." "Locking-in an inadequate structure may pose a fate worse than fragmentation." They conclude that "for now fragmentation will likely persist," and that it should be monitored to see whether it is "self-organising or simply inadequate" (Cihon et al., 2020). The model behind the prediction is climate governance. Robert Keohane and David Victor's 2011 abstract describes it as "a regime complex: a loosely-coupled set of specific regimes," and argues that "efforts to build a comprehensive regime are unlikely to succeed." A complex that meets certain criteria has advantages, it holds, because "adaptability and flexibility are particularly important." It ends with "little reason for optimism" that the emerging complex will cut emissions fast enough (Keohane and Victor, 2011). Matthijs Maas's 2023 review maps the advanced AI governance literature in three lines of work, problem-clarifying, option-identifying, and prescriptive (Maas, 2023). Section 63.3.5 reports a decentralized route by which one jurisdiction's rules can spread, the Brussels effect (Bradford, 2020).

66.7.3 What design theory predicts #

Koremenos, Lipson, and Snidal's four variables are uncertainty, enforcement, distribution, and the number of actors (Koremenos et al., 2001). Each takes an extreme value for AI (inference). Uncertainty about the technology and about rivals is high, enforcement between states is absent, and the distribution of gains from any agreement is contested. The actors range from two leading states to every state that imports chips. Their abstract does not say which way each conjecture runs. Abbott and Snidal's account does: soft law "provides strategies for dealing with uncertainty" (Section 62.5.4). On that reading, flexible, soft, and decentralized arrangements are what states would choose, and the record matches: declarations without limits, firms' voluntary commitments, advisory assessments, and a UN dialogue (inference).

The match has a second reading. The same record is what one would see if states did not yet rank AI risk high enough to pay for anything harder. Baker names this as a difference from the nuclear case: states are "likely less willing to accept costly verification for AI treaties, as AI security currently tends to be a relatively low priority" (Baker, 2023). The two readings predict different futures (inference). Design under uncertainty predicts that commitments harden as uncertainty falls; low priority predicts that they harden after a salient failure. Baker reports the second pattern in the nuclear record: Iraq nearly developed nuclear weapons despite inspections, which drove policymakers to strengthen nonproliferation verification (Baker, 2023). As of October 2026 the evidence does not separate the two.

66.8 What verification means for delegation #

The book's thesis is that alignment is a delegation problem under an asymmetry of competence and visibility. Between states the asymmetry is doubled. Each public delegates frontier development to firms it cannot easily see into, and each state must judge from outside what a rival's firms are doing. Verification is the visibility half of the problem, and the older fields converged on a structure for it (inference). It has four parts: a declaration by the inspected party, sampling and measurement against the declaration, national means that look beyond it, and procedures that sort accusations before anyone is punished. The proposals for AI rebuild that structure around chips, as Shavit's design and the methods Wasil and colleagues list show, and the theory of Section 66.4 carries over nearly unchanged.

What does not carry over is the object of verification (inference). Fissile material is the weapon's ingredient, and its amount bounds what can be built. Compute is an ingredient whose relation to the capability that matters shifts with every gain in efficiency, and the capability sits in a file that copies freely once made. An agreement on inputs can be verified with the old tools. An agreement on what a model can do, or how it behaves, needs access to the model, which brings back Coe and Vaynman's trade-off at its most severe. A model's behavior can also differ between evaluation and use, which Chapter 37 reports and which the thesis's negative space lists among the results with no older counterpart. A facility hidden from inspectors exists apart from the inspection; a gap between a model's behavior under test and in use is one that no declaration or sample of chips can reveal.

The chapter's claims concern two of the book's relationships. Most concern the developer and the public, extended to states and the publics they answer to: who can see what a developer does, and through whom. Where the evidence about firms is the developers' own, as with the Seoul commitments and the industry review of the international report, the text says so. The training relationship enters only through the open question of whether model properties can be verified at all (Chapter 36; Chapter 38). Between states, any answer would also have to meet the security requirement. The relationship between deployed systems and their users does not enter.

66.9 Settled, contested, missing #

66.10 Exercises #

Further reading #

• Coe and Vaynman (2020): why the transparency that verification needs makes arms control rare, and what eases the trade-off.
• Avenhaus et al. (2002): the theory of inspection, from test bans and safeguards to any inspector with a budget.
• Shavit (2023): a design for verifying rules on large training runs, with its sampling arithmetic and its open problems.
• Sastry et al. (2024): the case for compute as the lever of AI governance, and its limits and risks.
• Ho et al. (2023): the menu of international institutions for advanced AI.
• Bengio et al. (2026): the current international scientific assessment, and its account of its own process.