The claim is that specified AI chips or facilities are not computing, or are powered off, throughout a declared period.
Some agreement designs would use this to pause certain activities, or to hold a reserve of compute verified not to be in use. Verifying idleness would let a party show it is not using hardware it still owns. It is a negative claim, but a comparatively simple one: chips need power to compute, so a facility's power draw, knowledge of on-site generation and possibly thermal imaging could show whether hardware is running.
One analysis expects this to be verifiable with less invasive methods than those needed to check what running chips compute. The difficulties are showing that the monitored facility holds the declared chips, covering every power source, and obtaining reliable power data that cannot be masked. On-chip telemetry and hardware licensing could add chip-level evidence or enforcement.
Idleness is one of the more approachable negative claims, because computing needs power and leaves physical traces. On-chip telemetry and timed challenges have reached research demonstration (R2) as indicators of GPU activity, not as proofs that all declared hardware is idle.
Power draw, knowledge of on-site generation and possibly thermal imaging could show that a facility's chips are unpowered 1, but energy monitoring is unproven in practice and open to masking 2. On-chip telemetry (R2) and timed challenges (R2) could show whether a declared chip is busy, and GPU timing and memory measurements correlate with compute activity even when host and device are untrusted 7. Licensing and throttling (proposed, R1) would make chips refuse or slow work once a licensed budget is spent 5.
A dark facility shows only that the hardware inside it is idle, so the claim depends on knowing where the declared chips are. Where chips must stay powered for permitted work, the claim becomes a bound on use, such as inference only or training within declared limits. Proofs of useful work (R1) would set such a bound. They keep declared hardware busy with agreed work, so little spare capacity remains 8.
On this page
Why it matters
Idleness lets a party show that hardware it still owns is not in use. Proposals use it in three ways:
- Scher and Thiergart observe that a data-centre operator can claim its chips are not being used in a large training run if the chips are not receiving the power they need to operate 1. They add that this can likely be verified with less invasive methods, such as the data centre's power draw, knowledge of on-site backup power generation, or possibly thermal imaging 1.
- The AI 2040 verification plan suggests a small compute bank, verified not to be in use during an agreement, as a way to reduce the incentive to withdraw from it 3.
- Energy monitoring is one of the national technical means Wasil and colleagues consider for detecting unauthorised facilities, by analysing power consumption and converting energy estimates into an approximate count of operations 2.
Why it is hard
The claim is negative: it asserts that no computation takes place.
- Power data describes a facility, not a chip. A verifier must know about every power source, including on-site generation 1. Wasil and colleagues note that energy monitoring is unproven in practice, that energy use may be disguised as other high-energy activity, and that detailed consumption data is hard to obtain 2. They list masking a data centre's energy use and siting a data centre at a power plant as evasion techniques 2.
- Binding. A dark building shows that the chips inside it are idle, but not that the declared chips are the ones inside. The claim therefore depends on verifying chip location and custody.
- Chip-level evidence is immature. RAND's verification framework includes off-chip analog sensors, and lists estimating a workload's utilisation and associated physical signature, such as power, as a research problem 4. Monfared and colleagues report timing and memory measurements on GPUs that correlate with compute activity even when host and device are untrusted 7. One telemetry classifier detects training with 98.2% accuracy across its own corpus, falling to 43–87% on the most challenging disguised workloads held out from its training 6.
- Hardware enforcement. RAND's offline-licensing design grants a chip a compute budget through a renewable licence; once the budget is spent, the chip would refuse the relevant operations or perform them at a much lower rate 5.
Where chips must stay powered for permitted tasks, the claim becomes a bound on use rather than idleness, and the questions of inference-only use and training limits apply.