All walkthroughs · Paper briefs

How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI Agreements

Raymond Koopmanschap and Otto Barten (Existential Risk Observatory)
arXiv 2607.22619, version 1 (16 June 2026); accepted at the International Conference on Large-Scale AI Risks 2026, KU Leuven

Paper · Brief and rating · Dashboard entry

About 2 minutes · Download MP3

AI-generated walkthrough with synthesised voices: a host explains the paper and a discussant questions it. It covers claims, methods, key assumptions, citations and use so far, decision relevance, and what an evaluator should check. Every direct quotation was checked word for word against its source. Public sources only. Not an Unjournal evaluation or decision.

Transcript

Host
This is a walkthrough of How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI Agreements, by Raymond Koopmanschap and Otto Barten of the Existential Risk Observatory, a Dutch advocacy and research group. It was posted to arXiv in June twenty twenty-six, is about twenty pages long, and was accepted at the International Conference on Large-Scale AI Risks at KU Leuven. This episode is an AI-generated walkthrough, not an Unjournal evaluation or decision. A GPU is a graphics processing unit, the chip family used to train large AI models; the paper's real object is the narrower class of AI accelerators, chips like Nvidia's H one hundred. The question is whether an international agreement that limits frontier AI development, a pause or a cap on training runs, could actually be enforced, and at what scale enforcement stops working.
Discussant
What is the organizing idea? A lot of papers already list verification tools.
Host
The organizing idea is a single principle, stated in the abstract. The authors write: "wherever sufficient capacity exists to violate an agreement, it must be under a control regime." From that they split compliance into three sub-problems. First, prevent escape from the control regime: chips that are already monitored must not be used for a violation. Second, prevent uncontrolled resource acquisition: newly manufactured chips must flow into monitored facilities. Third, detect hidden capacity: existing chips that were never declared must be found. The paper draws this as a small state diagram. New chips enter monitored facilities through tracking, existing hidden chips enter through detection, and a monitored facility becomes a violation only if escape prevention fails. The split itself builds on a twenty twenty-five agreement proposal by Aaron Scher and coauthors.
Discussant
And the main claim?
Host
The main claim concerns what happens as the compute needed for a dangerous model falls, through algorithmic progress and better hardware. In the introduction they write that "we argue that detection of hidden capacity is the first to become intractable as the compute required for a violation shrinks." The other two sub-problems deal with chips whose existence is known. Detection has to find chips that are not known, and the physical and informational signals that reveal a facility get weaker as the facility gets smaller. Their headline number is that, without deliberate concealment, facilities remain mostly detectable down to roughly ten thousand H one hundred equivalents, and detection degrades sharply below that. In their LessWrong post announcing the paper they draw the policy conclusion more bluntly: a pause seems enforceable as long as more than about ten thousand H one hundred equivalents are needed for a training run.
Discussant
Before methods, what is the scope? International agreements have law, institutions and politics, not just hardware.
Host
They are explicit about that. They separate three components of an agreement: the rules, the institution that enforces them, and the technical mechanisms that verify compliance. The paper covers only the third, and only for agreements that work through hardware governance. The authors write: "Within this scope, the paper analyzes technical feasibility only. Legal, commercial, and sovereignty frictions are not assessed." Consumer GPUs and ordinary processors are also out of scope. The analysis is meant to be agnostic about where the compute threshold is set and which accelerator is used.
Discussant
So what is the method? Is there a model, data, anything an economist would recognize as identification?
Host
There is no formal model and no estimation. The method has two parts. The first is a structured literature review. They take eight proposals for international AI agreements or verification regimes that specify enforcement measures in substantial detail. These include the Scher and coauthors agreement, Anthony Aguirre's Keep the Future Human, A Narrow Path by Andrea Miotti and coauthors, and the Oxford Martin AI Governance Initiative report. They group the individual policies into categories, for example treating visual and infrared satellite surveillance as one, and assign each category to one of the three sub-problems. Three tables mark which proposal includes at least one policy in each category.
Discussant
And the second part?
Host
The second part is what they call the enforcement breaking point. The abstract defines it as the compute threshold, or an equivalent metric, at which a policy loses its effectiveness in solving its sub-problem. In practice they work in facility size, measured in H one hundred equivalents, and they reason through each sub-problem at four sizes: one hundred thousand, ten thousand, one thousand and one hundred chips. That reasoning draws on vendor data sheets, Epoch AI's data sets on data centers and chip owners, a twenty twenty-three data center survey by Konstantin Pilz and Lennart Heim, United States energy statistics, and a satellite classifier released by Joshua Clymer. The output is a table that rates each detection measure, with and without active concealment, on a five-step scale from works to fails at each facility size.
Discussant
Take the first sub-problem. Why do they think stopping monitored chips from being misused is the easy part?
Host
They adopt the regime from Scher and coauthors and treat it as technically sufficient. Every chip sits in a monitored facility. Inspectors initially have ongoing physical access. Workloads are monitored by tamper-proof cameras, by off-chip measurement of power and networking, by on-chip hardware-enabled mechanisms, meaning features built into the chip that can report or restrict what it does, and by rerunning declared training workloads to check they match. Where verification cannot give assurance, the hardware is powered off and kept off under verification, and as a last resort the facility is shut down. Their summary judgment is short. They write: "We expect this regime is sufficient to solve the sub-problem." And because each chip is monitored individually, a lower compute threshold does not by itself weaken it; it raises enforcement costs because more actors can breach.
Discussant
That is a strong claim resting on another paper's design. Has any of that hardware been built and attacked?
Host
The paper does not test it, and it flags two conditions: the restriction to AI accelerators, and the open question of whether chip-agnostic off-chip measures can cover chips without built-in security. The fallback of complete shutdown is what carries the sufficiency claim. The more elaborate mechanisms are presented as ways to make shutdown unnecessary, lowering costs. An evaluator would want to separate the claim that a shutdown backstop is technically reliable from the claim that the regime as a whole would be adopted and sustained.
Discussant
Second sub-problem, new chips. Why is that tractable?
Host
Because of supply-chain concentration. TSMC, the Taiwan Semiconductor Manufacturing Company, fabricates almost all advanced logic and dominates the advanced packaging step used for frontier accelerators. Only three firms, SK Hynix, Samsung and Micron, make high-bandwidth memory, the stacked memory these chips need. ASML alone makes extreme ultraviolet lithography machines. The regime has three elements: track every in-scope chip from fabrication through packaging to installation; presume any transfer outside the regime is denied; and halt production at any fab that cannot be tracked. They write: "The sub-problem's solution is therefore in principle threshold-agnostic." Fab controls are the weak element: today covert fabs cannot make frontier chips, but as the threshold falls, older and simpler processes become good enough. Even then, they argue, a covert fab is larger and easier to find than the compute facilities that the detection sub-problem must find at the same threshold.
Discussant
Now the core: detection. Walk through the numbers.
Host
They start with information gathering. Epoch AI's chip-owner data traced fifteen point seven million of an estimated twenty point two million frontier AI chips to an owning company. Of the remaining four and a half million, about one point one million are attributed to China and about three point four million to a mix of smaller known companies and unknown owners. So hundreds of thousands to millions of chips have no known owner. Then physical detection. The key discriminating feature of a data center from orbit is its cooling plant. At ten thousand H one hundred equivalents, a facility draws about ten megawatts and rejects that heat through ground-mounted cooling-tower arrays or large water-cooled chiller plants, which look anomalous on a building of roughly two thousand square meters. At one thousand chips, about one megawatt, vendor reference designs use air-cooled chillers of the kind found on hospitals, hotels and supermarkets. At one hundred chips, the whole facility fits in a twelve-meter shipping container with condensers like ordinary commercial air conditioning. Their summary sentence for that endpoint is: "Without a distinguishing feature, detection becomes infeasible."
Discussant
You said ten thousand chips is ten megawatts. Where does that conversion come from?
Host
It is the one quantitative relationship that carries the detection argument, so this is key equation one in the transcript. The intuition: power draw is what makes a facility visible, and power is roughly proportional to chip count. Let N be the number of H one hundred equivalents, and P the facility's continuous power draw. The paper uses P equals N times about one kilowatt. So one hundred chips is about one hundred kilowatts, one thousand chips is about one megawatt, and ten thousand chips is about ten megawatts. They cite Nvidia's data sheet for an eight-GPU server rated at roughly ten kilowatts, so one kilowatt per chip is a round, slightly low figure.
Discussant
So the detection threshold is really a power threshold. How does power monitoring do on its own?
Host
It degrades along the same path. Power monitoring means looking at utility records for high, flat, continuous load with little daily variation. At ten megawatts, Pilz and Heim estimate between three hundred thirty-five and one thousand three hundred twenty-five data centers worldwide, a seventy percent interval, and the reference class also includes cryptocurrency mines, smelters, fabs, paper mills and big hospital campuses. The authors write that "load magnitude alone does not identify a facility as AI-specific." At one hundred kilowatts the load sits among millions of ordinary commercial customers in the United States alone. Power monitoring also needs utility cooperation, and an actor can simply generate its own power. They write: "Active concealment is relatively straightforward at any scale." Satellite imagery, by contrast, can be used unilaterally, which is why they treat it as the first filter. Aerial surveillance needs airspace access, which a state can deny.
Discussant
What is the actual evidence that satellites work at ten megawatts and fail below?
Host
One open-source classifier. In Clymer's results, every facility above ten megawatts was detected, and all four false negatives were below ten megawatts, at one point two, half a megawatt, three point two and half a megawatt. The authors are candid about this in their limitations section. They write: "One such study suffices to demonstrate that detection is possible at that scale. However, it does not establish a lower bound on the smallest detectable facility." Intelligence agencies may do much better than open research.
Discussant
And with active concealment?
Host
Then the number moves the other way. They write: "Active concealment makes detection harder." With deliberate hiding, they say, facilities of ten thousand to one hundred thousand chips cannot be ruled out with full confidence, though hiding one hundred thousand is hard. Their rough upper bound on the largest hidden cluster comes from the production figures: if most of the untraced four and a half million chips can eventually be traced, something on the order of a million chips remains unaccounted for. Their conclusion on why detection is the binding constraint is put this way: "If hidden facilities cannot be found, the regime monitors only the compute that actors choose to show."
Discussant
Doesn't that imply all research money should go to detection?
Host
They explicitly deny that. They write: "However, this does not imply that research should concentrate on detection, since traction there may be harder to gain than on the other two sub-problems." Their stated gap finding, from the policy tables, is that existing proposals put more weight on preventing escape and less on resource acquisition and detection.
Discussant
How has the paper been used or cited so far?
Host
Very little that we could find, which is unsurprising for a paper a few months old. OpenAlex lists no citing works as of early October twenty twenty-six. The authors announced it on LessWrong and cross-posted to the Effective Altruism Forum at the end of July. The LessWrong post had a score of thirty-two and one comment, which quoted the concealment caveat back and noted that some pause advocates would still permit inference on existing models, which would make monitoring harder because some activity stays legal. The dashboard brief records an Altmetric attention score of four. We found no policy documents, press coverage or published critiques citing it. That is a search miss, not proof of no use.
Discussant
Who would make decisions differently because of it?
Host
Funders deciding between detection methods, chip tracking and hardware-enabled mechanisms; officials designing verification for a future agreement or working on chip-location bills; and advocates and labs arguing over whether a pause is enforceable. The ten thousand chip figure is the kind of number that travels, as a rough answer to how long a hardware-based agreement stays verifiable. For an Unjournal evaluation, the value is mostly in checking whether that number and the ranking of the three sub-problems hold up, since the taxonomy itself is a framing device rather than a testable claim.
Discussant
Let me give the critiques. First, the breaking point is defined as a compute threshold, a quantity of floating-point operations, but the analysis is done in facility size, chips running at once. Those are not the same thing. A smaller facility can reach the same total compute by running longer.
Host
That is the most important gap, so here is a worked number. This is key equation two in the transcript. The intuition: total training compute equals how fast the cluster computes times how long it runs. Let N be the number of H one hundred equivalents, r the peak speed of one chip, u the share of peak speed actually achieved, and T the training time in seconds. Total compute is N, times r, times u, times T. Take r as about ten to the fifteenth operations per second, roughly an H one hundred's dense sixteen-bit peak, and u as forty percent. Ten thousand chips for one hundred days gives roughly three times ten to the twenty-fifth operations. One thousand chips for a full year gives a bit over ten to the twenty-fifth. Those numbers are our illustration, not the paper's. But several proposals in the paper's own appendix set strict training thresholds around ten to the twenty-fifth. So a facility below the paper's detection breaking point can cross a common threshold if it is willing to train for a year.
Discussant
So the claim that a pause is enforceable as long as ten thousand chips are needed has to be read as ten thousand chips running at once, for a normal training duration.
Host
Yes. Distributed and low-bandwidth training, which the authors mention under future work, pushes in the same direction: a violation could be spread across many small sites, each below every detection threshold.
Discussant
Second critique: the gap finding is a count of dots. Eight proposals, policies grouped into categories by the authors, and a dot means at least one policy in that category. There is no weighting by detail or feasibility. Is that enough to say the literature neglects detection?
Host
It supports a descriptive claim about where proposals list measures, and the inclusion rule, proposals with substantial enforcement detail, could itself shape the result. An evaluator should check whether different groupings or a broader proposal set would change the picture.
Discussant
Third: the sufficiency judgments for the first two sub-problems are asserted rather than shown. Tamper-proof cameras, hardware-enabled mechanisms and rerunning workloads are mostly proposals, not deployed systems tested against a motivated state adversary.
Host
The paper leans on the shutdown backstop and on supply-chain concentration. Both are plausible today, but the concentration argument depends on Taiwan, South Korea and the Netherlands remaining cooperative and on no rapid diversification of advanced packaging or memory. The paper also does not model mutual verification. The authors write that it does not cover "how the US and China would verify that the other party's domestic enforcement is executed correctly." For a United States and China agreement, that may be where the hard problems are.
Discussant
Fourth: some small numerical looseness. They bracket the number of facilities above one megawatt between roughly one thousand three hundred twenty-five and thirty thousand, using the top of the ten megawatt interval as the floor. The logically safe floor is the ten megawatt count, which could be as low as three hundred thirty-five.
Host
That does not change the qualitative conclusion, but it is the sort of thing an evaluator should note. Similarly, the upper bound of about a million unaccounted chips is so loose that it says little about the largest plausible hidden cluster; an evaluator could ask whether better use of Epoch's data, or of smuggling estimates, would tighten it.
Discussant
What should an evaluator check, in order?
Host
First, whether the detection threshold survives a sensitivity analysis on the satellite evidence: more than one classifier, larger samples, and how detection rates change with deliberate design choices such as dry coolers, underground siting or co-location in existing industrial buildings. Second, the mapping from facility size to the training-compute thresholds in actual proposals, including training duration and distributed training. Third, whether the sufficiency claims for escape prevention and supply-chain tracking hold under a state adversary and under supply-chain change. Fourth, robustness of the policy-gap tables to the choice of proposals and categories. And fifth, the missing costs: false positives in detection, verification cost per facility, and what response follows a detected violation, which the paper explicitly leaves aside. The paper's useful contribution is a clear statement of where an enforcement regime is likely to fail first, with a rough number attached.

Key equations

Sources