Machine Intelligence Research Institute

01 / The mechanism and its boundary

What is being described

MIRI describes itself as a nonprofit whose research and public outreach are "intended to help prevent human extinction from the development of artificial superintelligence" S-3609. Its publications on verifying AI agreements, several of them from its Technical Governance Team, include:

Low-trust verification system. Cankaya's system overview combines network taps, sampled recomputation, memory challenges and facility monitoring in one reference architecture for near-term, low-trust compute verification S-0018. See Low-trust AI compute verification system overview, Network taps and certifiers, Sampled inference recomputation and Timed challenge-response and memory-occupation challenges.
Side-channel suppression. A post on suppressing side channels in an untrusted data centre with retrofitted defences sets out channel classes, attenuation targets and costs S-0038; see Side-channel suppression for isolated facilities.
TEEs for monitoring. A post written in MIRI's Technical Governance Fellowship analyses trusted execution environments for privacy-preserving monitoring S-0014. It contrasts the usual confidential-computing adversary, a dishonest operator, with a state that has physical access to data centres S-0014. See TEE remote attestation for AI workloads, Safeguard attestation and Confidential multi-party verification.
Mechanisms survey. Scher and Thiergart survey mechanisms for verifying international agreements about AI development, with a detailed analysis of interconnect bandwidth limits S-0005.
Draft agreement. A draft international agreement would prohibit concentrations of more than 16 H100-equivalents outside monitored facilities and would track new chip production S-0063; see Compute stock is at most a declared amount.
Workshop papers. MIRI reports that six Technical Governance Team papers appeared at the ICML 2026 Workshop on Technical AI Governance Research S-3380. They include bit-exact inference verification, which won the workshop's best-paper award S-3380 S-0020, and detection of hidden training from GPU telemetry S-0037. See Deterministic and bit-exact inference and Workload classification from telemetry and side channels.
Interconnect prototype. A 2026 post reports a prototype, built under Scher's supervision, that monitors inter-node traffic against a threshold on a two-node cluster with four A100 GPUs S-3220. See Bandwidth limits and compartmentalization.

Organization website ↗

Connections in the research map

Related research

mechanism / R2

Bandwidth limits and compartmentalization

Capping or removing network links between groups of accelerators, so that serving within each group still works but large training across groups becomes far slower.

mechanism / R2

Confidential multi-party verification

Lets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.

mechanism / R1

Memory wiping and proofs of secure erasure

Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches.

mechanism / R3

Model identity attestation

Establishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.

mechanism / R1

Network taps and certifiers

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.

mechanism / R2

On-chip telemetry from timing, memory and performance counters

Uses timing, memory-residency and performance-counter signals measured on AI accelerators as evidence about which workloads they are running.

mechanism / R1

Proofs of useful work for capacity accounting

Cryptographic evidence that a given amount of matrix-multiplication work was completed, proposed as one input to accounting for spare capacity on declared hardware.

mechanism / R2

Safeguard attestation

Hardware-signed evidence that an AI service ran its declared safeguards, such as a guardrail classifier or monitor, when producing a given response.

mechanism / R3

Sampled inference recomputation

A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.

mechanism / R1

Side-channel suppression for isolated facilities

Shielding, filtering, jamming and inspecting an AI facility to limit hidden physical communication around monitored network links.

mechanism / R3

TEE remote attestation for AI workloads

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.

mechanism / R2

Timed challenge-response and memory-occupation challenges

A verifier sends unpredictable questions that a device can answer in time only if it holds specified data, or dedicates specified resources, locally.

mechanism / R2

Workload classification from telemetry and side channels

Telling whether chips are training, serving or doing non-AI work from GPU counters or power draw, signals that do not read weights or data.

implementation / R1

Low-trust AI compute verification system overview

A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records.

Sources and provenance

S-3609 / Tier B
About MIRI ↗
· 2026 · Machine Intelligence Research Institute
Supports: nonprofit whose research and public outreach are intended to help prevent human extinction from artificial superintelligence
Version and catalogue details
S-0018 / Tier B
A System Overview for Near-Term, Low-Trust AI Compute Verification ↗
N. Cankaya · 2026 · Machine Intelligence Research Institute
Supports: low-trust compute verification system overview
Version and catalogue details
S-0038 / Tier C
Suppressing Side Channels in an Untrusted Data Center via Retrofitted Defenses ↗
N. Cankaya · 2026 · MIRI Technical Governance Team
Supports: side-channel suppression with retrofitted defences
Version and catalogue details
S-0014 / Tier C
On TEEs for Privacy-Preserving Monitoring in AI Governance ↗
Gloria Z · 2026 · MIRI Technical Governance Team
Supports: analysis of TEEs for privacy-preserving monitoring (Technical Governance Fellowship)
Version and catalogue details
S-0005 / Tier B
Mechanisms to Verify International Agreements About AI Development ↗
A. Scher, L. Thiergart · 2025 · arXiv
Supports: survey of mechanisms to verify international agreements; interconnect bandwidth limits
Version and catalogue details
S-0063 / Tier B
An International Agreement to Prevent the Premature Creation of Artificial Superintelligence ↗
A. Scher, D. Abecassis, P. Barnett, B. Abeyta · 2025 · Machine Intelligence Research Institute
Supports: draft international agreement: monitored facilities and tracking of chip production
Version and catalogue details
S-3380 / Tier C
Summary: TGT's 2026 ICML Papers ↗
Machine Intelligence Research Institute · 2026 · Machine Intelligence Research Institute
Supports: six TGT papers at the ICML 2026 TAIGR workshop; best-paper award for bit-exact inference verification
Version and catalogue details
S-0020 / Tier B
Bit-Exact AI Inference Verification Without Performance Tradeoffs ↗
N. Cankaya · 2026 · ICML 2026 Workshop on Technical AI Governance Research
Supports: bit-exact inference verification paper
Version and catalogue details
S-0037 / Tier B
Detecting Hidden ML Training With Zero-Overhead Telemetry ↗
R. Rahman, S. Tajdari · 2026 · ICML 2026 Workshop on Technical AI Governance Research
Supports: detecting hidden training from GPU telemetry
Version and catalogue details
S-3220 / Tier C
De-risking Interconnect Limits for AI Verification ↗
A. Scher, D. Sarbakysh, A. Moskvin · 2026 · MIRI Technical Governance Team
Supports: interconnect-limit monitoring prototype on two nodes with four A100 GPUs
Version and catalogue details

Source review date: 2026-09-25
Drafted by (source map): ai
Review handles (source map): codex-review