In early 1963, a single number characterized the difference in the positions of the United States and the Soviet Union on a comprehensive nuclear test ban. Nikita Khrushchev had proposed three on-site inspections each year. Washington was asking for seven. Other differences remained, including inspection procedures and treaty language. But the difference mattered: Seismology could not always distinguish an underground test from an earthquake, and inspections created both assurance and opportunities for espionage.
Neither number had been delivered by a technical expert wielding a seismograph. Each represented a political judgment about how much residual uncertainty its government should accept. The negotiations failed to produce a comprehensive ban. The treaty signed later that year excluded underground tests, the very category that required intrusive verification.
That episode should be required study for anyone now designing verifiable limits on advanced AI. The most straightforward of these is monitoring the computing resources used for model training. This is moderately transparent, as data centers and their power sources are visible physical infrastructure that, once identified, could be compelled by agreement to produce logs of how they have been used. A further step is compute hardware that can use cryptographic methods to attest to how it has been used without disclosing the precise, proprietary or secret, training process.
This article considers a conditional, but plausible, world: The competition between Washington and Beijing on frontier AI continues, but both value reciprocal warning enough to accept some limited monitoring. Warning is a weaker bargain than a capability cap, but it is nonetheless useful. It permits continued development and can reduce the cost of surprise without demanding either side abide by imposed limits. It is most plausible when neither side can be certain that a temporary technological lead will become durable.
This is promising, but arms control history suggests that the problem is not simply whether monitoring technology can keep pace with AI capability. Every additional measure of assurance may expose strategically valuable information. Efforts to limit that exposure leave residual uncertainty. Improved AI analytics increase both detection and collateral inference, and domestic opponents can use the resulting uncertainty to demand still more assurance.
This is my central claim: Familiar verification problems interact recursively in AI, so that an improvement in one can worsen another.
To make the problem concrete, consider a deliberately demanding reference case: an agreement between the United States and China requiring advance declaration of any AI training run above a specified quantity of computation performed by covered chips and prohibiting an above-threshold run unless it is declared and monitored. This case is conditional on the assumption that both states share a common interest in reducing strategic surprise. Reciprocal warning is plausibly desirable if both sides expect continued development, neither anticipates a small temporary lead to produce a long-lasting monopoly, and the possible emergency counter-mobilization costs exceed the benefits of concealment. It is, however, also possible that a large enough lead in frontier AI confers a durable and decisive first-mover advantage. In this regime, warning weakens that advantage, and while a prospective laggard may welcome that, the leader would not be incentivized to participate in monitoring.
The bilateral simplification here isolates the reciprocal bargain and verification dynamics. It is not meant as a model for direct implementation. A real regime would depend on cooperation from other states that host relevant chips, cloud services, and distributed training capacity.
In a regime in which reciprocal warning is incentivized, covered laboratories, cloud providers, and operators of large computing clusters would be bound by national law and required to generate tamper-evident records. A jointly governed technical secretariat would receive narrowly specified authentic records or reports of chip use, compare them with chip inventories and other monitoring, and request managed access when evidence suggests noncompliance. The parties would agree in advance on what constitutes a significant breach and what consequences follow.
Verification cannot manufacture a mutual interest in restraint where none exists. The analysis below assumes, but does not establish, a tenable bargaining range. Without this, it is diagnostic rather than prescriptive, clarifying how disclosure costs and technical advances affect the prospects for agreement. The reference case is specific enough to ask what must be observed, who must reveal it, what else is disclosed in the act of observation, and whether detection would come soon enough to be useful.
Arms-control scholarship offers tools for reasoning about observability, intrusive access, intelligence leakage, and politically acceptable uncertainty. The analogy to AI is methodological, not strategic. Some strategic arms-control agreements rest partly on acceptance of parity and mutual vulnerability. An AI race that potentially yields a durable monopoly may offer no comparable basis for restraint. In AI verification, the following three warnings compound.
The Signal and the Secret Travel Together
The first warning comes from Andrew Coe and Jane Vaynman’s account of why arms control is so rare. States need enough transparency to judge whether an adversary is complying, but the access that creates assurance can also reveal vulnerabilities the adversary could exploit in a later crisis or war. The problem is most severe when unilateral monitoring is insufficient and cooperative access reaches into facilities where prohibited and permitted activities coexist.
Vaynman and Tristan Volpe offer a useful illustration in comparing fixed ballistic missiles and biological weapons. Silo-based forces create large, geographically stable infrastructure that is comparatively distinguishable and observable through accessible technical means. Biotechnology is both harder to distinguish and deeply integrated into legitimate industry: A fermenter may produce beer, vaccines, or biological agents, and the surrounding facility may contain commercially valuable processes wholly unrelated to weapons. This is not the sole reason the Biological Weapons Convention still lacks a standing international verification regime. Its protocol negotiations also failed through ordinary politics, including disputes over commercial confidentiality, biodefense, and export controls. But Vaynman and Volpe’s work on distinguishability and integration helps explain why the physical structure of the technology made those politics harder.
Frontier compute sits uneasily between the cases because a training cluster comprising thousands of advanced chips is a physical industrial installation. It consumes power, moves data, requires networking and cooling, and depends upon a concentrated and often brittle semiconductor supply chain. Those are promising features for monitoring. Yet the same cluster may serve permitted research, commercial products, intelligence analysis, and military programs. To determine whether a declared training run remained below a threshold, a monitor might seek information about chip inventories, how the chips are interconnected, utilization, network traffic, and the training workload itself. In doing so, it could learn how quickly a state can mobilize compute, where its bottlenecks lie, which facilities support national-security work, and how a frontier laboratory organizes its most valuable industrial process.
The engineering task here is to separate the compliance signal from the secret.
Vaynman calls the underlying concern demonstrable control over collected information. This article extends that concern into a regime-level design requirement: filterability. Cooperative monitoring channels should not merely promise that inspectors will ignore collateral information. They should make the compliance claim technically and institutionally separable from it and allow the inspected party to verify what was collected, what was retained, and what was disclosed through those channels. Whether frontier-compute monitoring can truly do this against a nation-state adversary remains conjecture.
Better Monitoring Can Still Mean Better Spying
The optimistic position is that new technology lets states verify more while intruding less. Commercial satellites, remote sensors and automated analysis can reveal activity without putting inspectors inside sensitive facilities. That is true. It is also only half of the ledger.
The same analytic systems that detect a prohibited training run can draw collateral inferences from ostensibly innocuous compliance data. A sequence of aggregate attestations may reveal the cadence of a laboratory’s experiments. Chip availability and outage patterns may reveal the reliability of a national computing base. Correlated with power consumption, satellite imagery, hiring, publications, and supply-chain movements, even a narrow compliance output can become evidence about model-development schedules or strategic mobilization capacity. The monitored party must price not only what an adversary can infer today, but what it may infer from stored data using tomorrow’s systems.
AI is an object of the agreement, an instrument used to monitor the agreement, and a source of improved evasion. These effects should not be collapsed into one category because they are different sorts of problems: A clandestine cluster is a detection problem. Distributing a run across firms or jurisdictions is an accounting and attribution problem. Algorithmic efficiency is different again: It changes the relationship between compute and capability, potentially allowing a compliant run to produce an outcome the threshold was meant to prevent. Moreover, improvements in the capabilities of AI models alter the strategic incentives surrounding any agreement. Changes in how decisive states expect a race to the frontier to be can alter whether disclosure is reassuring or destabilizing.
Together, these effects begin the feedback loop. Fear of collateral inference leads a party to restrict the data it will provide. Restricted data leaves more uncertainty about compliance. Better analytics may recover some detection capacity but also make collateral inference harder to bound. The inspected state then prices access in the worst case, while the monitoring state asks for even more access to reduce the uncertainty. A technically stronger monitor can therefore narrow the space for agreement.
“Adequate” Verification Is a Political Settlement
The third warning comes from Nancy Gallagher’s history of the politics of nuclear verification. Monitoring capability does not, by itself, determine what counts as adequate verification. Technical evidence constrains the plausible range: Instruments have detection limits, evasion techniques have costs, and false alarms have measurable rates. Political actors decide how much of the remaining risk is tolerable.
Sometimes they also use genuine uncertainty strategically. Cavity decoupling (the reduction of a nuclear explosion’s seismic signal by detonating it in a sufficiently large underground cavity) was real, not invented. But its practical implications depended on uncertain assumptions about geology, construction, containment, and the other signatures an evader would produce. Opponents of a comprehensive test ban could emphasize the most permissive assumptions and insist that any residual possibility was disqualifying. Supporters could emphasize the difficulty of executing the evasion and the consequences of being caught. Both arguments contained technical claims. Neither side’s preferred standard followed simply and mechanically from the science.
The same contest will occur around a compute threshold. How large an undeclared run must the regime be able to detect? With what probability, and how quickly? How should a distributed run be aggregated? When does an advance in training efficiency make the agreed compute proxy obsolete? Some challenges will expose real defects. Others will become killer amendments masquerading as engineering requirements. The political advantage lies with the actor who can describe every hypothetical evasion as proof that the whole agreement is unverifiable.
Training compute remains defensible as a near-term verification object because a large frontier run is a reasonably visible industrial event: It demands chips, power, and coordination, and can generate evidence before the model is complete and deployed. It is not, however, a permanent proxy. Inference-time scaling with reasoning models, for example, can add genuinely new capabilities absent a new training run. The proposed regime governs a feasible warning indicator, not capability itself, and the nature of what is monitored will need to dynamically evolve with the technology.
This completes the loop. Concern about espionage restricts monitoring access. Reduced access preserves uncertainty. Domestic political, security, and bureaucratic actors, whose assent is required, invoke that uncertainty to raise the standard of adequacy. Meeting the higher standard requires more intrusive monitoring, which intensifies the original concern about espionage. AI-assisted inference and rapid algorithmic change accelerate the cycle from both directions.
An Agenda for a Verification Settlement
The first distinctive requirement is filterability. Under an explicit threat model, the technical body should specify what designated mechanisms can reveal beyond the compliance claim, test leakage under repeated queries and data fusion, limit retention, and give the inspected party auditable evidence of how information within those channels was handled. Recent work on minimal disclosure demonstrates a method for measuring and reducing leakage in six bounded verification tasks. It does not establish filterability across a regime facing a state adversary. Nor can cooperative safeguards bind what national intelligence systems may infer from other sources. Some leakage is irreducible, but “trust the inspector” is not a security architecture.
The second distinctive requirement is to red-team doubt without publishing an evasion manual. Tests should use pre-agreed threat models, disclosed funding, independent replication, and confidence intervals. Some work can be public. More sensitive assessments will require an appropriately cleared or jointly trusted panel, with methods protected but conclusions and uncertainty ranges released. This will not remove politics from verification. If the parties do not trust the panel, its custody of their information, or how it characterizes outcomes, it will not be possible to create shared assurance. The complete elimination of these tensions is not possible, but this approach offers a management tool to make it harder to manufacture an engineering controversy anew each time agreement comes within reach.
These measures are meant to slow the feedback loop, not to fully break it. Filterability is itself a form of monitoring. Leakage is unavoidable and no procedure can remove the politics of adequacy. The aspiration here is narrower: Reduce avoidable disclosure, make residual uncertainty explicit, and require new access demands to be based on tested evidence.
Joint testing should build a shared technical baseline before treaty positions harden. The work of the Group of Scientific Experts, which spent two decades developing and testing concepts later incorporated into the Comprehensive Nuclear-Test-Ban Treaty’s verification system, offers evidence that shared technical testing can indeed precede political agreement. It is, however, an imperfect model: Its work took two decades within an already-established arms-control infrastructure.
An AI counterpart cannot afford to operate on decadal timescales. It would require short, revisable cycles which might begin through parallel national or unofficial exercises. Agencies, labs, hardware security experts, chip makers, cloud hyperscalers, and independent scientists should test what candidate systems can detect, what they leak, and how quickly they provide warning.
The implementation coalition and the response to violations remain clear requirements. States would make the international commitment, but laboratories, cloud providers, chip manufacturers, export-control authorities, and intelligence agencies would carry much of it out. Each has different secrets and incentives. A regime that detects a prohibited run only after the model has been trained and then copied provides information, not a warning. Continuous or in-training attestation, a rapid challenge process, and graduated consequences, such as enhanced inspection or suspension of reciprocal market access, must be part of the design. Otherwise, verification risks detecting breakout only after the most consequential step has occurred.
Schelling and Halperin described arms control in 1961 as an enlargement of military strategy. The lesson for AI is that verification is continuous with security engineering, but cannot be reduced to it. A well-specified zero-knowledge protocol can bound what its transcript reveals under stated assumptions. It cannot decide what residual risk Washington, Beijing, or any other capital should accept, who is trusted to adjudicate ambiguous evidence, nor what coalition will sustain restraint when accessible advantage tantalizingly appears.
We will not prove the negative. We need to make consequential cheating detectable early enough to answer, monitoring safe enough to accept, and residual uncertainty explicit enough that the finish line becomes harder to move opportunistically.
This complexity is a necessary cost of AI arms control. If we design only the sensor, the feedback loop will design the agreement.
Mark Daley is the chief AI officer and a professor at Canada’s Western University. He also serves as the Natural Sciences and Engineering Research Council of Canada’s Scholar in Residence in AI. His recent work examines how machine intelligence shapes the foundations of strategy and diplomacy, including verification, deterrence, and the assumptions about cognition embedded in international relations theory.
Image: Rsparks3 via Wikimedia Commons
