Compute-Pause Verification

AI governance agreements — a pause or slowdown on frontier training, for instance — are only as good as the ability to verify them without requiring trust in the party being watched. This work covers “Claim A” in that space: no covert frontier training under low-trust conditions, and what's actually technically checkable via hardware and network telemetry.

A briefing maps the public research on verifiable AI slowdown — a datacenter primer, the Cankaya Plan A/B proposals, zkLLM, VerInf, FlexHEG, and open follow-up problems — scoped deliberately to Claim A mechanisms and out of scope for commercial TEE “AI passport” products aimed at model-identity claims.

The flagship experiment, a Seferis & Fist–style detector, asks whether cross-node communication size and shape statistically separates benign pretraining from inference: the hypothesis is that mean cross-node throughput during training exceeds inference under benign configs, tested with a Welch t-test, Cohen's d, and a calibrated separability threshold. Red-team workloads — DiLoCo, KV-cache disguise, column-parallel tensor-parallel inference — are built specifically to try to break the detector, not just confirm it.

Local smoke tests, replicate runs, and grid sweeps are complete offline; the real multi-GPU cloud run (a Terraform-provisioned 2×8 GPU AWS cluster) is scaffolded and waiting on budget. A second, independent track targets single-node detection via NVML telemetry only (no network fabric needed), validated so far against synthetic data and cross-checked against the closest published result — Rahman & Tajdari's zero-overhead single-node detector (ICML 2026 TAIGR workshop, arXiv:2606.19262) — pending GPU quota.

The honest read on pace: verification capability is behind what governance proposals assume. Almost all published detection work, including this project's own, is validated offline or on synthetic telemetry rather than in a live, contested deployment, and no cross-organization verification protocol has been deployed anywhere. If a pause or slowdown agreement needed to be checkable today, most of the tooling to check it doesn't exist yet — this is still a research problem, not an engineering backlog.

Highest-value next directions: (1) cross-pod network limits as an enforcement primitive rather than only a detection signal — rate-limiting or capping inter-pod bandwidth at the network layer could make some covert training configurations structurally harder to run, not just statistically detectable after the fact; (2) adversarial, not just adversarial-workload, red-teaming — DiLoCo, KV-cache disguise, and column-parallel inference are static evasion attempts, not an attacker training against the detector's own feature space the way a real ML adversary would; (3) side-channel signals as a second, independent detection axis — GPU interconnect side-channel leakage (e.g. NVBleed-style power/timing channels, arXiv:2404.03877) is documented as a confidentiality attack surface, but the same physical leakage could in principle supply an additional, harder-to-spoof verification signal, at the cost of being far more invasive.