AI Verification LandscapeSearch

Claim · Negative

Communication between compute groups is bounded

Data flowing between specified groups of chips, or out of a facility, stays below a declared rate, so the groups cannot jointly run large workloads.

Large-scale training requires chips to exchange large volumes of data, while serving an existing model needs much less between groups of chips. A verified bound on communication between compute groups could therefore restrict training while allowing inference. A bound on a facility's external links also limits how much weights or data could leave it. The claim is negative: no channel exceeds the bound, including channels outside the monitored network. Proposed designs cap the external bandwidth of small pods of chips or restrict chip networking in hardware, and use network taps to observe the links. The hard parts are finding every path, including physical side channels; choosing bounds that stay meaningful as distributed training methods improve; and monitoring high-speed accelerator fabrics that are difficult to tap.

State of verificationeditors' synthesis

No bandwidth cap that a verifier can check has been built, and the mechanisms aimed at this claim are proposed (R1). Bounds appeal because they constrain a facility without access to its code 1.

Bandwidth limits and compartmentalization (R1) cap or remove the links between groups of accelerators, leaving enough for inference but not for training 1. Hardware versions include RAND's fixed-set design 4 and guarantee processors (R1), and the AI 2040 stack (R1) removes back-end networking 10. Side-channel suppression (R1) addresses paths outside the network 7. Tamper evidence (R2) would protect the enforcing devices, and bounding unexplained information (R2) limits what the permitted bandwidth can carry.

Lucid Computing's pod-cap design is "not yet implemented or red-teamed" 11. Amodo has run rate limiting on 400G links, but for weight security with a cooperating operator 12.

Copper scale-up links and encrypted interconnects are hard to observe 6. The designs aim to cut side channels to low rates, not to eliminate them 5 7. Sastry and colleagues note that decentralised training, if it becomes more viable, might undermine the detectability of training runs 2. Training methods that need less communication could likewise erode a bound that separates training from inference today.

Mechanisms

Why it matters

Distributed training depends on fast communication between chips, so limiting communication limits training 1.

  • Pods with narrow external links. Scher and Thiergart describe pods of chips with high-bandwidth interconnect inside each pod but very low external bandwidth: enough for inference tokens, not for training gradients 1. They suggest this could be implemented with modest changes to existing technology, physical access and monitoring, without access to code 1.
  • Hardware limits on networking. Compute-governance analyses list physical limits on chip-to-chip networking as a way to enforce compute caps 2. RAND's "fixed set" design restricts networking so that small, fixed sets of GPUs cannot be aggregated into large clusters 4.
  • Limits on what leaves a facility. A low-trust system overview assumes that the information bandwidth of inference is not more than two orders of magnitude above expected API traffic at full utilisation 5. It asks how far a facility can be required to make all egress traffic explainable by its ingress 5. Rinberg and colleagues note that egress limits cap theft directly: if only 10 GB leaves a data centre, an adversary cannot steal more than 10 GB 13. This links the claim to Model weights or data have not left the facility.

Why it is hard

The claim requires knowing every path.

  • Taps see only the links they are on. RAND's network-tap layer observes data exchanged between chips 9. The cost and feasibility of tapping differ by link: Cankaya describes front-end links to the outside world as the most viable to monitor, while the back-end compute fabric has far higher bandwidth, is latency-critical, and may require sampling rather than full capture 6.
  • Some links are hard to observe at all. As scale-up domains grow, more traffic runs over copper links that passive optical taps cannot see, and encrypted interconnects complicate inspection 6. Shavit notes that methods for verifiers to confirm, after the fact, the topology in which chips were configured in a data centre were beyond the scope of his work 8.
  • Physical side channels. Data could bypass network monitoring altogether. A MIRI Technical Governance Team post surveys electromagnetic, acoustic, conducted and fibre-optic channels, and proposes shielding, active jamming with sensing, inspection and filtering 7. The system overview's target is to suppress covert side-channel bandwidth to kilobits per second, not to zero 5.
  • Choosing the bound. A threshold that separates inference from training today may not do so later. On the widely used C4 dataset, DiLoCo on 8 workers matched fully synchronous training while communicating 500 times less 3. Sastry and colleagues note that decentralised training across many data centres, or with lower-quality compute, could undermine compute detectability if it becomes more viable 2.

Sources

  1. BA. Scher & L. Thiergart (2025). Mechanisms to Verify International Agreements About AI Development. arXiv. Source recordSupports: pods with high internal and very low external bandwidth; enough for inference tokens not training gradients; implementable with modest changes, physical access and monitoring, without code access · Interconnect bandwidth limits
  2. BG. Sastry et al. (2024). Computing Power and the Governance of Artificial Intelligence. arXiv. Source recordSupports: compute caps via physical limits on chip-to-chip networking; decentralised training could undermine detectability · enforcement; §3.B.1 Detectability
  3. BA. Douillard et al. (2024). DiLoCo: Distributed Low-Communication Training of Language Models. ICML 2024 Workshop on Advancing Neural Network Training (WANT). Source recordSupports: DiLoCo on 8 workers matched fully synchronous training while communicating 500 times less · abstract
  4. BG. Kulp et al. (2024). Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090. RAND Corporation. Source recordSupports: fixed-set HEM restricting networking of small GPU sets · p. viii
  5. BN. Cankaya (2026). A System Overview for Near-Term, Low-Trust AI Compute Verification. Machine Intelligence Research Institute. Source recordSupports: front-end vs back-end bandwidth; inference bandwidth assumption; covert side-channel target in kilobits per second; egress explainable by ingress · inference vs training; open problems
  6. CN. Cankaya (2026). The Fundamentals and Feasibility of Secure Network Taps for Verifying AI Datacenter Use. The Datacenter Lie Detector. Source recordSupports: front-end vs back-end tapping costs and feasibility; copper links and scale-up domains; encrypted interconnect · frontend vs backend; open problems
  7. CN. Cankaya (2026). Suppressing Side Channels in an Untrusted Data Center via Retrofitted Defenses. MIRI Technical Governance Team. Source recordSupports: physical side channels can bypass network monitoring; defences; tolerable low rate · channels of concern; defences
  8. BY. Shavit (2023). What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring. arXiv. Source recordSupports: retroactively confirming data-centre topology is beyond scope · open problems
  9. BM. Baker et al. (2025). Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment. RAND Corporation. Source recordSupports: network taps intercepting inter-chip data · §4.2
  10. CR. Dean (2026). Verification Plan. AI 2040. Source recordSupports: removing back-end networking to create isolated inference units · verification mechanisms
  11. CLucid Computing (2026). Traffic Shaping for Workload Classification. Lucid Computing (Substack). Source recordSupports: pod-level traffic cap design; not yet implemented or red-teamed · summary; status
  12. CAmodo Design (2026). The Tray as a Bandwidth Boundary. Amodo Design. Source recordSupports: DPU-enforced rate limiting on 400G links for weight security, with the limits set by a trusted operator's controller · whole note
  13. BR. Rinberg et al. (2026). Haiku to Opus in Just 10 bits: LLMs Unlock Large Compression Gains. arXiv. Source recordSupports: egress limits cap what can be stolen · §5.1