The claim is that a declared training run used no more compute than permitted and had its declared properties, such as its training data, settings and resulting weights.
Many proposed rules on frontier AI limit training, often through a threshold on total training compute measured in floating-point operations, sometimes combined with limits on data or methods. Verifying that a run stayed within them would let a regulator or treaty partner rely on something other than self-reporting. It is hard because training is long, distributed and expensive to repeat.
Exact replay is complicated by numerical noise, the data and weights are sensitive, and work could be split across declared and undeclared hardware. Proposals include on-chip logging of weight snapshots with sampled recomputation of training segments, proof-of-learning protocols, zero-knowledge proofs and telemetry-based accounting. Published attacks show that the original proof-of-learning protocol can be spoofed.
Proof-based checks of training remain far below frontier-scale runs. Proof-of-learning and zero-knowledge proofs of training have both reached research demonstration (R2); hardware enforcement remains proposed (R1).
Proof-of-learning and transcript verification (R2) re-runs sampled training segments between logged weight snapshots 1, and zero-knowledge proofs of training (R2) prove that training followed a committed specification without revealing data or weights 13. Guarantee processors such as flexHEG and licensing (both R1) could enforce compute limits in hardware 10 11.
Choi and colleagues report proof-of-training-data experiments on language models of up to 1 billion parameters 12, and Kaizen proves training iterations of a 10-million-parameter image model at about 15 minutes of proving per iteration 13. VeriLoRA proves individual low-rank fine-tuning steps on language models of up to 13 billion parameters 14.
Published attacks spoof the original proof-of-learning protocol, and the attack's authors argue that a provably robust version needs a better understanding of deep-learning optimisation 8. Governance analyses have judged zero-knowledge proofs impractical at frontier scale, and one 2026 zero-knowledge proposal argues this is a limit of current approaches, not a fundamental one 7. A compute limit bounds a run only if all the chips used are known, so this claim depends on a bounded compute stock and no undeclared compute.
On this page
Why it matters
Limits on training are a common rule in compute-governance proposals 5.
- Shavit's compute-monitoring framework aims to give governments high confidence that no actor uses large quantities of specialised ML chips for a training run that violates agreed rules 1. Its example rules include total training compute, properties of the training data, hyperparameters such as the share of reinforcement-learning steps, and combinations of these with benchmark performance 1.
- US Executive Order 14110 required reporting for models trained with more than 10^26 operations 2. It was revoked in January 2025 3.
- The EU AI Act and California's SB 53 both set training-compute thresholds. The AI Act presumes that a general-purpose AI model trained with more than 10^25 FLOP has high-impact capabilities, one of the conditions for classing it as a model with systemic risk 15. Its provider must notify the European Commission within two weeks of meeting the threshold or learning that it will, an obligation that has applied since 2 August 2025 15 16. SB 53, enacted in September 2025, sets transparency duties for developers of frontier models, defined as models trained with more than 10^26 integer or floating-point operations, including later fine-tuning and other material modifications 17.
- A draft international agreement prohibits training runs above 10^24 FLOP and post-training runs above 10^23 FLOP, and requires runs above 10^22 FLOP to be approved and monitored 4.
- Wasil and colleagues treat training above an agreed FLOP threshold as one of two main violation types to be detected 5. RAND's verification framework lists verifying declared training as its own subgoal 6.
Without technical verification, such limits rest on self-reporting, a gap the authors of a 2026 zero-knowledge proposal identify in current frontier AI governance frameworks 7.
Why it is hard
- Training cannot simply be re-run. Shavit gives three reasons: hardware noise makes training irreproducible, the compute cost is very large, and the training data may be confidential 1. His framework instead has chips save weight snapshots at random times, and the verifier re-runs short segments between reported checkpoints, accepting results within a tolerance 1.
- Transcripts can be spoofed. Shavit notes that proving a transcript is the original one is harder than proof-of-learning, because the adversary knows the true transcript and has more compute time to construct a spoof 1. Fang and colleagues introduced spoofing strategies against proof-of-learning that reproduce across verification configurations at a fraction of the cost of earlier attacks 8. They conclude that a provably robust proof-of-learning mechanism cannot be built without further understanding of optimisation in deep learning 8.
- Coverage. A limit on one run means little if other hardware contributes undeclared work, so Shavit pairs run verification with supply-chain monitoring 1. A developer could also split a run into workloads that each stay below a threshold, which Seferis and Fist call compute structuring 18. Training traffic runs over high-bandwidth back-end fabric that is harder to capture than inference traffic 9.
- Open design problems. Shavit lists extending pre-commitment to online reinforcement learning, where training data cannot be known in advance, and choosing principled thresholds when scaling laws do not reliably predict downstream capabilities 1.
- Cryptographic cost. A 2026 zero-knowledge proposal notes that governance analyses judge zero-knowledge proofs currently impractical at frontier scale, and argues that this is a limit of current approaches rather than a fundamental one 7. It sets out an architecture combining a pre-committed training specification, network observations and Merkle commitments, and estimates a proof of concept within about 36 months 7.
- Compute is a proxy. Training compute is only a high-level proxy for capability, and thresholds may need to change as algorithms improve 2.