The AI 2040 verification plan from the AI Futures Project proposes checking that retrofitted data centres run only inference, not training or experiments.
Removing much of the back-end network between GPU servers would split data centres into isolated inference units. Passive taps would copy all front-end traffic to a recomputation server, which re-runs random samples of workloads organized into reproducible packets. Strong physical security would protect the equipment.
Side-channel limits and periodic memory wiping are meant to leave verified inference outputs as the only results that persist. As of July 2026, passive optical tap components were reported to work at 400G and recomputation schemes were being tested, but the integrated stack had not been built. Amodo Design, which works on the components, says nothing is past a proof-of-principle prototype.
The obstacles are reproducible inference and networking, securing the recomputation server, and scaling side-channel defences. It does not verify that spare compute is unused.
The six-layer design, its claim and its assumptions are published, but the integrated stack has not been built.
Assessed use: showing that retrofitted data centres run only inference
On this page
What it is
The AI 2040 verification plan, written by Romeo Dean and published by the AI Futures Project, includes a technical stack for verifying that retrofitted data centres run only inference workloads, not training or experiments 1 2. The plan calls it an inference-only retrofit and lists six layers 1. It is a proposal: the plan's companion page tracks which components exist and which are still open problems 2.
How it works
The six layers, as the plan lists them 1:
- Isolated inference units. Data centres are split into groups of isolated inference units by removing much of their back-end (east–west) networking 1. The plan argues that inference needs much less scale-out interconnect than training, so the overhead is relatively small 1. See Bandwidth limits and compartmentalization.
- Passive taps. Simple, passive taps on the front-end (north–south) network copy all input and output traffic to a recomputation server 1. The plan favours optical splitters, "essentially a piece of glass", because they are probably the easiest to trust 1. See Network taps and certifiers.
- Reproducible packets. All AI workloads, including agentic tool use, are organized into discrete, reproducible packets that the recomputation server can inspect 1. Inference is not reproducible by default, and achieving it may cost some overhead 1. See Whole-workload recomputation (reproducible packets).
- Partial recomputation. The server recomputes random samples of packets to check their correctness 1. The plan argues that this can verify all outputs with very high probability using a small fraction of the original compute, provided the server can be trusted 1. See Sampled inference recomputation.
- Physical security. Strong physical security protects the verification equipment against tampering 1. See Tamper evidence for verifier devices.
- Completeness. Side-channel communication is bounded, and memory is wiped periodically, probably by forced memorization 1. The aim is that the only results that persist are verified inference outputs 1. See Side-channel suppression for isolated facilities.