The case for verification

The trust problem

Verification mechanisms are "processes or tools that give one party greater confidence that another is following the agreed-upon rules, typically by detecting violations" ¹.

States are weighing international agreements to manage AI, and "the political feasibility of such agreements can hinge on their verifiability" ². Without verification, "states may find that otherwise desirable deals are unavailable" ². Wasil and colleagues suggest that nations "might be much more likely to form international agreements around rules that they can reliably verify", and see such agreements as a way to avoid or mitigate a race between nations ³.

What verification enables

• Verification can make deals possible. "Effective verification mechanisms can transform strategic deadlocks into viable compromises" ².
• Even rivals could check each other. A RAND working paper by Baker and colleagues asks whether the United States and China could verify each other's compliance with AI guardrails. It concludes that nations "could eventually verify compliance via six largely independent approaches", although technical research and protections against overreach are needed ⁴.
• Compute is a workable place to check. Sastry and colleagues call computing power "a particularly effective point of intervention" compared with data and algorithms: it is "detectable, excludable, and quantifiable, and is produced via an extremely concentrated supply chain" ⁵.
• Checks could keep secrets. States limit transparency to protect national security, but "a verification mechanism that could demonstrate compliance without revealing any extraneous information may face no transparency-security tradeoff at all" ². Zero-knowledge proofs and trusted execution environments aim at that.
• Evidence serves both peace and markets. Harack argues that "preventing war might require credible evidence that civilian AI resources are not being militarized", and that "individuals, companies, and countries are less likely to buy products that they cannot trust" ⁶. The same approaches could also serve domestic regulation of companies ¹.

Verification has costs and limits. Sastry and colleagues warn that "naive or poorly scoped approaches" to governing compute "carry significant risks in areas like privacy, economic impacts, and centralization of power" ⁵. Scher and Thiergart note that "many of the ideal solutions for verification are not yet technologically feasible" ¹.

Nuclear precedents

Nuclear arms control faced the same problem and built tools for it. Baker's study of that history finds that, "with certain preparations, the main foreseeable challenges of hardware-based AI treaty verification would be ones that were manageable in nuclear arms control" ⁷.

• Satellites came first. The 1972 SALT I interim agreement and ABM Treaty relied only on "national technical means", state-owned technologies such as satellites that check compliance from a distance ⁷. Each side undertook not to interfere with the other's means ⁸. The AI counterpart is remote detection of data centres.
• On-site inspection followed. At the signing of the 1987 INF Treaty, Reagan quoted the Russian maxim "trust, but verify" and described inspection teams "actually residing in each other's territory" ⁹. New ways to verify missiles "expanded the set of realistic political options for arms control" and helped make that treaty possible ².
• Safeguards count and seal. IAEA safeguards rest largely on "nuclear material accountancy, complemented by containment and surveillance techniques, such as tamper-proof seals and cameras" ¹⁰. The AI counterparts are chip registries and tamper evidence for verifier devices.
• Test-ban monitoring listens from afar. The International Monitoring System for the Comprehensive Nuclear-Test-Ban Treaty will have 337 facilities using seismic, hydroacoustic, infrasound and radionuclide sensors. It detected all six nuclear tests North Korea declared between 2006 and 2017 ¹¹. Workload classification from side channels applies the same idea at closer range, inferring what a chip is doing from indirect signals such as its power draw.
• Warhead checks could keep designs secret. Warhead inspectors need "high confidence in the authenticity of submitted items while learning nothing about them". Glaser, Barak and Goldston proposed a zero-knowledge protocol for this, based on neutron measurements ¹². Zero-knowledge proofs of training constraints pursue the same goal for AI.

The analogy has limits. Baker expects that "states are likely less willing to accept costly verification for AI treaties, as AI security currently tends to be a relatively low priority" ⁷.

Other precedents

• Under the Chemical Weapons Convention, the OPCW had verified the destruction of 72,304 tonnes of declared chemical weapons by July 2023, covering every stockpile declared up to then ¹³.
• The Biological Weapons Convention has no verification mechanism, unlike the Non-Proliferation Treaty and the Chemical Weapons Convention. Revelations in the early 1990s of non-compliance by Iraq and the former Soviet Union exposed that gap ¹⁴. NTI noted in 2024 that the convention still "lacks mechanisms to monitor and enforce compliance or verify adherence" ¹⁵.
• Computer security supplies the rest of the toolkit. Remote attestation lets one end of a network exchange check "whether the other end is in an intended operating state" ¹⁶, and attestation for AI workloads builds on it.

Lead times

• Monitoring can be built before a treaty takes effect. The Comprehensive Nuclear-Test-Ban Treaty opened for signature in 1996 and has not yet entered into force ¹⁷. About 90 percent of its 337 planned monitoring facilities are already running ¹¹.
• Baker argues for preparing before the political will arrives. That means "developing privacy-preserving, secure, and acceptably priced methods for verifying the compliance of hardware, given inspection access", and "building an initial, incomplete verification system" whose gaps can be closed quickly ⁷.
• Harack and colleagues judge that if key states get serious, combined efforts "should be sufficient to enable the creation of a robust verification system within a few years" ². Harack argues that if society wants the benefits of verification, "serious efforts need to begin now" ⁶.

Further reading

• Nuclear Arms Control Verification and Lessons for AI Treaties (Baker, 2023) compares three kinds of nuclear agreement and draws lessons for AI.
• Verification for International AI Governance (Harack et al., 2025) covers what verification needs, technically and politically.
• Verification methods for international AI agreements (Wasil et al., 2024) sets out ten methods, each with historical precedents and ways to evade it.
• Verifying International Agreements on AI: Six Layers of Verification (Baker et al., 2025) describes how rival states could check each other's compliance.
• Mechanisms to Verify International Agreements About AI Development (Scher and Thiergart, 2025) works through verification for three example policy goals.
• Open Problems in Technical AI Governance (Reuel et al., 2025) maps the open research questions, verification among them.

On this site, Claims lists what one party might want to check about another. Mechanisms shows how each claim could be checked, and each mechanism's readiness level says how far it has got.