AI Verification LandscapeSearch

Claim · Mixed

A training run stayed within declared limits

A declared training run used no more compute than permitted and had its declared properties, such as data, hyperparameters and resulting weights.

Many proposed rules on frontier AI limit training, often through a threshold on total training compute measured in floating-point operations, sometimes combined with limits on data or methods. Verifying that a run stayed within them would let a regulator or treaty partner rely on something other than self-reporting. The claim is mixed: the declared run happened as described, and it did not exceed its limits. It is hard because training is long, distributed and expensive to repeat. Exact replay is complicated by numerical noise, the data and weights are sensitive, and work could be split across declared and undeclared hardware. Proposals include on-chip logging of weight snapshots with sampled recomputation of training segments, proof-of-learning protocols, zero-knowledge proofs and telemetry-based accounting. Published attacks show that the original proof-of-learning protocol can be spoofed.

State of verificationeditors' synthesis

Training limits can so far be checked only far below frontier scale. The two proof-based mechanisms, both demonstrated (R2), have results on models of at most 1 billion parameters, and hardware enforcement is proposed (R1).

Proof-of-learning and transcript verification (R2) re-runs sampled training segments between logged weight snapshots 1. Zero-knowledge proofs of training (R2) prove that training followed a committed specification without revealing data or weights 13. Guarantee processors such as flexHEG and licensing (both R1) could enforce compute limits in hardware 10 11.

Choi and colleagues report proof-of-training-data experiments on language models of up to 1 billion parameters 12. Kaizen proves training iterations of a 10-million-parameter image model, at about 15 minutes of proving per iteration 13.

Published attacks spoof the original proof-of-learning protocol, and the attack's authors argue that a provably robust version needs a better understanding of deep-learning optimisation 8. Governance analyses have judged zero-knowledge proofs impractical at frontier scale; one 2026 proposal argues this is a limit of current approaches, not a fundamental one 7. A compute limit bounds a run only if all the chips used are known, so this claim depends on Compute stock is at most a declared amount and There is no undeclared relevant compute.

Mechanisms

Why it matters

Limits on training are a common rule in compute-governance proposals 5.

  • Shavit's framework aims to give governments high confidence that no actor uses large quantities of specialised ML chips for a training run that violates agreed rules 1. Its example rules include total training compute, properties of the training data, hyperparameters such as the share of reinforcement-learning steps, and combinations of these with benchmark performance 1.
  • US Executive Order 14110 required reporting for models trained with more than 10^26 operations 2. It was revoked in January 2025 3.
  • A draft international agreement prohibits training runs above 10^24 FLOP, and requires runs above 10^22 FLOP to be approved and monitored 4.
  • Wasil and colleagues treat training above an agreed FLOP threshold as one of two main violation types to be detected 5. RAND lists verifying declared training as its own subgoal 6.

Without technical verification, such limits rest on self-reporting, a gap the authors of a 2026 zero-knowledge proposal identify in current frontier AI governance frameworks 7.

Why it is hard

  • Training cannot simply be re-run. Shavit gives three reasons: hardware noise makes training irreproducible, the compute cost is very large, and the training data may be confidential 1. His framework instead has chips save weight snapshots at random times, and the verifier re-runs short segments between reported checkpoints, accepting results within a tolerance 1.
  • Transcripts can be spoofed. Shavit notes that proving a transcript is the original one is harder than proof-of-learning, because the adversary knows the true transcript and has more compute time to construct a spoof 1. Fang and colleagues introduced spoofing strategies against proof-of-learning that reproduce across verification configurations at a fraction of the cost of earlier attacks 8. They conclude that a provably robust proof-of-learning mechanism cannot be built without further understanding of optimisation in deep learning 8.
  • Coverage. A limit on one run means little if other hardware contributes undeclared work, so Shavit pairs run verification with supply-chain monitoring 1. Training traffic runs over high-bandwidth back-end fabric that is harder to capture than inference traffic 9.
  • Open design problems. Shavit lists extending pre-commitment to online reinforcement learning, where training data cannot be known in advance, and choosing principled thresholds when scaling laws do not reliably predict downstream capabilities 1.
  • Cryptographic cost. A 2026 proposal notes that governance analyses judge zero-knowledge proofs currently impractical at frontier scale, and argues that this is a limit of current approaches rather than a fundamental one 7. It sets out an architecture combining a pre-committed training specification, network observations and Merkle commitments, and estimates a proof of concept within about 36 months 7.
  • Compute is a proxy. Training compute is only a high-level proxy for capability, and thresholds may need to change as algorithms improve 2.

Sources

  1. BY. Shavit (2023). What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring. arXiv. Source recordSupports: goal and example rules; weight snapshots; sampled segment recomputation; reasons full re-run is infeasible; PoTT harder than PoL; open problems (online RL, thresholds) · abstract; §2–§3; open problems
  2. BG. Sastry et al. (2024). Computing Power and the Governance of Artificial Intelligence. arXiv. Source recordSupports: EO 14110 threshold; compute as a high-level proxy; thresholds must change with progress · thresholds; limitations
  3. AExecutive Office of the President (2025). Executive Order 14148: Initial Rescissions of Harmful Executive Orders and Actions. Federal Register, 90 FR 8237 (document 2025-01901, published 2025-01-28). Source recordSupports: revocation of EO 14110 on 20 January 2025 · Sec. 2(ggg)
  4. BA. Scher et al. (2025). An International Agreement to Prevent the Premature Creation of Artificial Superintelligence. Machine Intelligence Research Institute. Source recordSupports: training above 10^24 FLOP prohibited; runs above 10^22 FLOP approved and monitored · §4
  5. BA. R. Wasil et al. (2024). Verification methods for international AI agreements. arXiv. Source recordSupports: unauthorised training above a FLOP threshold as a violation type · What to verify
  6. BM. Baker et al. (2025). Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment. RAND Corporation. Source recordSupports: Subgoal 1.A.1 verifying declared training · §3.2
  7. BP. Peigné et al. (2026). Zero knowledge verification for frontier AI training is possible. arXiv. Source recordSupports: enforcement rests on self-reporting; governance analyses judge ZKPs impractical at frontier scale, which the authors argue is paradigm-bound; proposed architecture; ~36-month estimate · abstract
  8. AC. Fang et al. (2023). Proof-of-Learning is Currently More Broken Than You Think. 8th IEEE European Symposium on Security and Privacy (EuroS&P 2023). Source recordSupports: reproducible PoL spoofing at a fraction of prior cost; provably robust PoL requires advances in understanding deep-learning optimisation · abstract
  9. BN. Cankaya (2026). A System Overview for Near-Term, Low-Trust AI Compute Verification. Machine Intelligence Research Institute. Source recordSupports: monitoring training needs larger perimeters or compute-fabric taps; back-end traffic harder to capture · §5.1.1; inference vs training
  10. BJ. Petrie et al. (2025). Flexible Hardware-Enabled Guarantees for AI Compute. arXiv. Source recordSupports: flexHEG compute limits for training · abstract; Executive Summary
  11. BG. Kulp et al. (2024). Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090. RAND Corporation. Source recordSupports: offline licensing with a compute budget · p. viii
  12. AD. Choi et al. (2023). Tools for Verifying Neural Models' Training Data. Advances in Neural Information Processing Systems 36 (NeurIPS 2023). Source recordSupports: training-data verification experiments on GPT-2 and Pythia models up to 1B parameters · §4
  13. AK. Abbaszadeh et al. (2024). Zero-Knowledge Proofs of Training for Deep Neural Networks. 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS 2024), pp. 4316-4330. Source recordSupports: Kaizen zero-knowledge proofs of training; VGG-11 (10M parameters) at about 15 minutes per iteration · abstract; evaluation