Hardware-enabled mechanism (HEM)

A hardware-enabled mechanism (HEM) is a governance or verification function built into AI chips or hardware attached to them, such as reporting how much compute was used and where, or enforcing limits on use ^{1 2}.

A 2024 RAND report introduced the concept to help achieve US AI governance goals such as export controls, and analysed the threats, attack vectors and protective measures that apply to such mechanisms ¹. CNAS notes that chips sold by several leading firms already have many of the security features HEMs would need ³. Proposed designs include:

• Offline licensing. Use of certain chip features is tied to a renewable licence carrying a compute budget, as in hardware performance throttling and licensing ¹.
• Fixed sets. Networking is restricted so that small, fixed groups of GPUs cannot be combined into large clusters, a form of compartmentalization ¹.
• Guarantee processors. An auditable processor monitors accelerator usage inside a secure enclosure that provides physical tamper protection, as in flexHEG ⁴.
• Verifiable reporting. HEMs could report properties of training, such as the quantity of compute used and the cluster's configuration or location ², the aim of on-chip telemetry and chip location verification.

A central open question is whether HEMs can stay secure when an adversary has the chips in its physical possession ¹.