Throttling mechanisms would let the hardware itself enforce limits on AI computation.
One proposal is offline licensing: a chip runs at full speed only while it holds a valid license for a set amount of work. Another is a set of throttles in the chip's microarchitecture that, when triggered, shrink L2 cache capacity, add cache latency, cap cache bandwidth or limit shared-memory access. A 2026 simulation of an NVIDIA A100 found that cutting the available resource to one-eighth could reduce the performance of large-language-model kernels by up to 80%, with each throttle costing under about 10,000 flip-flops.
No proposed throttle has been evaluated on real chips. For verification, throttling matters only if a verifier can confirm the limit is in place and cannot be bypassed, which depends on attestation, tamper resistance and a secure trigger or licensing path. RAND judges that a determined, well-resourced adversary could overcome anti-tamper protection.
The designs are published, but the only quantitative results are kernel-level simulations and the only public code is a simulated proof of concept.
Assessed use: performance limits a verifier can rely on, against an operator trying to bypass them
On this page
How it works
Two families of throttling are proposed.
Licensing. Several designs gate performance on a license:
- RAND's offline licensing. A renewable license temporarily authorizes certain hardware features. Once the license is used up, the GPU refuses the relevant operations or runs them "at a much lower rate" 2.
- O'Gara et al. They describe licenses as cryptographic keys that unlock "a specified amount of computational work". Throttling could limit one capability, such as memory transfers, or all of them, and meters would track the licensed quantities. They cite Intel On Demand, which unlocks chip features by license, as a commercial precedent 3.
- CNAS. Its proposed security module would enforce up-to-date operating licenses, among other checks 4.
- flexHEG. Periodic licenses could set a minimum firmware version for devices 6. A guarantee processor could also block operations that would take a training run past a threshold 5.
- Petrie's embedded off-switch. Thousands of redundant security blocks spread through an accelerator would each block essential operations unless they have recently received signed authorization 7.
Microarchitectural throttles. Ma et al. add knobs that reduce L2 cache capacity, add L2 latency, cap L2 bandwidth or limit access to shared-memory ports. None of these knobs is visible to software 1. A trigger switches them on. It might come from an on-chip classifier or from an external trusted authority, provided the trigger path stays in the throttle's trust domain 1.
NVIDIA GPUs already throttle their clocks when power or thermal limits are exceeded, and users can set clock speeds through NVIDIA tools 2.
RAND's working paper proposes checking stored license hashes or requiring increasing sequence numbers to prevent reuse 2. AI Security Forum's replay-prevention sketch would bind a license to a fresh device-generated challenge held in nonvolatile memory 11. Replay state must survive power cycles and resist rollback 11.
RAND proposes removing dormant chip features that could be re-enabled by physical edits 2. AI Security Forum's feature-lockout sketch explores physical removal or irreversible disablement of restricted capabilities 10.
What it establishes
Throttling enforces a limit. It does not by itself produce evidence for a verifier. A verifier could rely on a cap only if the throttle state were attested and, for licenses denominated in work, securely metered 3. With both in place, a cap could support claims about compute capacity or about compute used in a license period.
Ma et al. find that memory-side knobs hit LLM kernels selectively, while disabling compute cores slows nearly every workload 1. The throttle does not detect intent. The authors call detection of misaligned behaviour "an active and orthogonal research problem" 1.
Threat model
The sources assume adversaries of different strength:
- Ma et al. The adversary may be an autonomous AI agent, a malicious human, or both. The AI may have broad software access to the host, and a human may also have physical access to the chip, but neither can alter the on-chip hardware 1.
- RAND considers actors up to states, with physical and non-physical attacks. It concludes that anti-tamper protection can raise costs and reveal tampering but is not insurmountable 2.
- CNAS judges that existing on-chip features must be hardened before they can be relied on in adversarial settings 4.
- Petrie designs against a well-funded non-state project trying to unlock chips covertly at scale and, as a more ambitious goal, a state with physical access trying to unlock them overtly 7.
O'Gara et al. ask which quantities should be metered and how to do so securely 3.