RAND

RAND describes itself as a nonprofit, nonpartisan research organization that provides leaders with the information they need to make evidence-based decisions S-3607. Its reports on verification include:

• Six layers of verification. Baker et al. set out six layers of verification for rules on large-scale AI development and deployment S-0002. They describe an AI chip registry with sampled chain-of-custody checks (Chip registries and manufacturing records), and list satellite imagery among supplementary mechanisms that they call "less robust" than their main layers (Remote detection of data centres) S-0002.
• Hardware-enabled governance mechanisms. Kulp et al. define such mechanisms as controls built into AI hardware that enable "enforcement and compliance verification" S-0057. They analyse offline licensing, which lets a GPU run a set amount of work before it refuses or slows further work, and a "fixed set" that limits high-bandwidth links to a pod of pre-authorized chips S-0057. See Hardware performance throttling and licensing, Hardware-enabled guarantees (flexHEG) and guarantee processors and On-chip telemetry from timing, memory and performance counters.
• Secure inference data centres. A report by RAND's Center on AI, Security, and Technology designs a highly secure, vertically integrated inference data centre S-1510; see RAND secure inference data center (SIDC) design.
• Model-weight security. Nevo et al. identify 38 attack vectors against model weights and define five security levels, for defending against actors up to well-resourced nation-states S-1610; see Model weights have not left the facility.
• Field listing. The AI Futures Project's verification page lists RAND's Center on AI, Security, and Technology as doing "foundational technical and policy research on AI verification" S-1511.