The claim is that a party controls no AI-relevant computing hardware or facilities, above an agreed threshold, beyond those it has declared.
Every other check on declared hardware can be sidestepped if a party runs prohibited work on hardware it never declared. Verifying that no such compute exists is therefore central to many proposed AI agreements. It is also among the hardest claims to establish, because it asserts an absence across a whole country or organisation, and demonstrating non-existence is generally harder than demonstrating existence.
No single technique establishes it. Proposals combine tracking chips from manufacture, so that the declared stock is complete; searching for undeclared facilities with satellite imagery, energy data, customs and financial intelligence; and human sources such as whistleblowers and inspections. Each has documented evasions, and the achievable assurance depends on how much compute a meaningful violation would require.
This claim concerns undeclared clusters. No single verification method is foolproof for this broadest of negative claims 5, so draft agreements pair technical measures with intelligence, challenge inspections and whistleblowers 6. The only mechanism mapped primarily to this claim, remote detection of data centres, is proposed (R1), as are the chip registries and location checks that support it. The broader goal in RAND's verification framework also covers undeclared use of declared clusters, which reduces to claims such as idle declared hardware and inference, not training 1.
One strategy, which Scher and Thiergart favour, makes the declared stock complete from the start through chip registries and location verification 4. The other searches for what was missed, through remote detection of data centres and other national technical means 5. Satellite imagery, permits and utility filings already track the construction of known large facilities, but automated data-centre detection remains primarily conceptual, according to a Federation of American Scientists report 9. Proofs of useful work would leave declared hardware little spare capacity, but cannot find a facility that was never declared 10.
Chips sold before tracking began may not be locatable 3, facilities can be hidden underground or camouflaged 5, and it is unclear how small undeclared compute can be and still matter 1 7.
On this page
Why it matters
Checks on declared hardware say nothing about hardware that was never declared.
- RAND's verification framework gives this its own goal: verifying that there are no undeclared uses of large-scale AI compute 1. It splits the goal into no undeclared use of declared clusters, and no undeclared clusters, whether inside known data centres or standalone 1.
- Shavit's compute-monitoring framework depends on the same property. Without chip-ownership verification, a prover might covertly acquire a large quantity of chips and train on them without ever notifying the verifier 3.
- Wasil and colleagues list unauthorised data centres as one of two main violation types 5.
- A draft international agreement relies on a combination of supply-chain tracking, mandatory reporting, state intelligence, open-source intelligence, power monitoring, challenge inspections and whistleblowers to locate chips 6.
Why it is hard
The claim asserts absence. The Oxford Martin AI Governance Initiative's verification report observes that demonstrating the existence of an object or process is often straightforward compared with demonstrating its non-existence 2.
- Hidden facilities. Scher and Thiergart judge that detecting covert data centres may be difficult, because AI compute may be hidden among other compute or in secret facilities 4. They see whistleblowers and intelligence as possible means of detection 4. Sastry and colleagues note that large training facilities are visible because of their size and power demands, and that hiding them underground would likely increase cost significantly 7.
- Limits of each detection method. Wasil and colleagues note that data centres could be concealed underground or camouflaged from satellite imagery, and that energy use can be disguised as other high-energy activity 5. Customs data is less useful against domestic chip production, and financial intelligence must separate illicit purchases from many legitimate ones 5. Whistleblowers may be deterred by fear of retaliation 5.
- The existing stock. Shavit notes that many chips already sold lack the security features his framework needs and may not be locatable by governments 3. A 2026 analysis of monitoring with trusted execution environments notes the difficulty of verifying that workload declarations are complete and of forming tight bounds on unknown compute 8.
- The threshold. RAND's verification framework focuses on clusters with the computing power of thousands of high-end chips, while noting it is not clear that frontier AI deployment must happen at scale to be dangerous 1. Sastry and colleagues caution that low-compute narrow models can have dangerous capabilities, and that more viable decentralised training could undermine the detectability of compute 7. In a paper on distributed training and compute governance, Rahman estimates that the 10^24, 10^25 and 10^26 floating-point operation (FLOP) thresholds could be evaded with $1.6 million, $31 million and $3.8 billion of hardware respectively, arranged in clusters smaller than any proposed registration requirement 11. The estimate assumes distributed training over consumer-grade internet, nodes of at most 16 H100-equivalents and a run of up to about two years 11.