Declared hardware is idle or shut down

Why it matters

Idleness lets a party show that hardware it still owns is not in use. Proposals use it in three ways:

• Pausing large training runs. Scher and Thiergart observe that a data-centre operator can claim its chips are not being used in a large training run if the chips are not receiving the power they need to operate ¹. They add that this can likely be verified with less invasive methods, such as the data centre's power draw, knowledge of on-site backup power generation, or possibly thermal imaging ¹.
• Holding compute in reserve. The AI 2040 verification plan suggests a small compute bank, verified not to be in use during an agreement, as a way to reduce the incentive to withdraw from it ³.
• Monitoring energy use. Energy monitoring is one of the national technical means Wasil and colleagues consider for detecting unauthorised facilities, by analysing power consumption and converting energy estimates into an approximate count of operations ².

Why it is hard

The claim is negative: it asserts that no computation takes place.

• Power data describes a facility, not a chip. A verifier must know about every power source, including on-site generation ¹. Wasil and colleagues note that energy monitoring is unproven in practice, that energy use may be disguised as other high-energy activity, and that detailed consumption data is hard to obtain ². They list masking a data centre's energy use and siting a data centre at a power plant as evasion techniques ².
• Binding. A dark building shows that the chips inside it are idle, but not that the declared chips are the ones inside. The claim therefore depends on verifying chip location and custody, covered under Chips are where they are declared to be.
• Chip-level evidence is immature. RAND's framework includes off-chip analog sensors, and lists estimating a workload's utilisation and associated physical signature, such as power, as a research problem ⁴. Monfared and colleagues report timing and memory measurements on GPUs that correlate with compute activity even when host and device are untrusted ⁷. One telemetry classifier detects training with 98.2% accuracy across its own corpus, falling to 43–87% on the most challenging disguised workloads held out from its training ⁶.
• Hardware enforcement. RAND's offline-licensing design grants a chip a compute budget through a renewable licence; once the budget is spent, the chip would refuse the relevant operations or perform them at a much lower rate ⁵.

Where chips must stay powered for permitted tasks, the claim becomes a bound on use rather than idleness, and the questions of This compute runs inference, not training and A training run stayed within declared limits apply.