- A concrete circuit-level design sketch using standard components, public-key verification, and replay-resistant nonces.
- A redundancy argument and first-order transistor-area estimate for thousands of blocks.
- An explicit attack inventory covering logical flaws, bypass, glitching, physical editing, supply-chain compromise, cryptography, keys, and connectivity.
Mechanism under review
Ten thousand off-switches
A proposed accelerator architecture distributes thousands of independently licensing security blocks through critical logic. Each block starts disabled, issues a fresh nonce, accepts only a correctly signed license, meters an allowance of operations, and halts its local function when that allowance is exhausted. The intended security gain is redundancy: an attacker must bypass enough interspersed blocks without damaging the computation, rather than defeat one central switch.
Read primary source ↗Adversary realism5/5
Nation-state
The paper explicitly includes well-funded physical attackers, supply-chain participation, cryptographic surprises, key compromise, and an ambitious nation-state case. The score reflects the threat model, not demonstrated resistance.Trusted dependencies5/5
Extensive
Security composes across physical layout, several circuit primitives, design and fabrication integrity, key custody, communications, and an external authorizer.Policy reach5/5
Chip-wide control
The mechanism conditions the accelerator's essential operations on continuing external authorization and is intended to govern large fleets.01Mechanism under review
Prevent unauthorized use of large fleets of AI accelerators, including after theft or diversion and in the presence of sophisticated physical attacks.
- 01
Intermix many small security blocks with essential accelerator logic, assigning each block a locally critical operation.
- 02
On power-up, each block sets its usage allowance to zero, generates a unique nonce, and advertises it through untrusted collection logic.
- 03
An off-device authorizer signs a license for that nonce; the block verifies it against hardwired public keys and increments its allowance.
- 04
The allowance falls as authorized operations occur, and the block stops its essential logic at zero.
Technical output
A local hardware enable/disable decision at each gated logic block; collectively, continued chip operation only while fresh licenses are accepted.
02Claim boundary
What the primitive says—and what it does not.
- Who is entitled to authorize use, on what evidence, and with what appeal or recovery process; authorization decisions are explicitly out of scope.
- Tape-out evidence for timing, routing, power, yield, testability, reliability, and false shutdown rates at the proposed density.
- Proof that every useful computation path is gated and that diverse blocks do not retain a scalable common-mode bypass.
03Threat model in scope
Protected asset
Authorized control of 10,000-plus-chip deployments, while preserving legitimate availability and preventing the blocks from altering or exfiltrating computations.
Adversary
Primarily a well-funded non-state hardware team, illustrated as a clandestine $1 billion project; ambitiously, a nation-state with physical access and possible involvement in design or manufacturing.
Enforcement boundary
The boundary is the transistor-level interface between each security block and its assigned essential logic. Everything outside a block's nonce, verifier, allowance, and gating logic is treated as untrusted, but issuance policy remains off chip.
Capabilities considered
- Physical circuit editing, probing, voltage or laser glitching, side-channel work, and execution-path bypass.
- Discovery of design or cryptographic flaws and compromise during chip design or fabrication.
- Theft or destruction of authorization keys and disruption of license delivery.
Limits and exclusions
- The policy and institutional process that decides whether to issue a license is explicitly outside the paper's scope.
- Fine-grained workload authorization and distributed audit logging are described as future extensions, not properties of the presented mechanism.
04Trust register
The assurance dependency chain.
DomainRequirementFailure consequenceSource treatment
Physical integration
Enough indispensable data and compute paths must pass through intact security blocks, with no usable ungated route.
A common bypass or incomplete coverage lets unauthorized computation proceed without defeating thousands of blocks.
centralNonce and license logic
Nonces remain unique and block-local verification, counters, and hardwired keys behave correctly under faults and attacks.
Replay, counter manipulation, or a common logical flaw creates reusable authorization or denial of service.
centralAuthorization infrastructure
Private keys, quorum rules, backups, and license-delivery channels remain secure and available.
Key theft authorizes unlimited use; key loss or prolonged disruption disables legitimate fleets.
discussedDesign and manufacturing integrity
The implemented silicon matches the reviewed design and contains no scalable backdoor.
A supply-chain modification defeats or weaponizes the mechanism before deployment.
discussedAuthorization legitimacy
The issuer makes timely, correct, and legitimate decisions about chip use.
The hardware faithfully enforces an erroneous, compromised, or politically contested decision.
mentioned05Caveats on the record
Limitations the source already recognizes.
- Accelerator integration requires nontrivial work, and new hardware takes years to design, manufacture, and displace the installed base.
- Exporting roughly 10 kB of nonces may itself raise exfiltration concerns, especially in air-gapped data centers.
- Detailed trust still depends on design, manufacturing, and key provisioning; flaws can block legitimate use.
- TRNG integrity, antifuse programming, network disruption, key theft, and key deletion each receive separate countermeasures rather than being assumed away.
06Consortium assessment
Where the assurance moves
The circuit can establish that a block received a license signed by a hardwired key for its current nonce. Treating that fact as authorized chip use transfers assurance through complete path coverage, reliable physical integration, uncompromised issuer keys, and an external decision process the circuit does not evaluate.
Load-bearing sequence
- A fresh nonce and valid signature establish an unexpired allowance in each block.
- Every useful computation depends on many correctly functioning gated paths.
- No scalable logical, physical, fabrication, or fault attack bypasses the diverse block population.
- The off-device issuer remains secure, available, and institutionally entitled to decide.
Institutional translationThe single kill switch has been eliminated by giving every neighborhood of the chip its own licensing department.
07Tests that would change our mind
A finding should be falsifiable.
Tape out a representative accelerator region and measure routing, timing closure, power, yield, test coverage, and false-disable rates rather than inferring overhead from transistor count.
Give independent physical red teams many devices and test whether attack-development costs remain per-chip rather than collapsing into one reusable bypass.
Fault-inject TRNGs, counters, verification logic, power, and clocks while measuring both unauthorized work and legitimate outages.
Run fleet-scale key-loss, issuer-compromise, network-partition, recovery, and out-of-band licensing exercises.
08Record provenance
Primary sourceEmbedded Off-Switches for AI Compute ↗
Reviewed2026-08-22
Methodologyv1.0
Correction statusnone
Evidence register (4)
Embedded Off-Switches for AI Compute, Section 2, pp. 2-3
Distributed dead-man-switch architecture, nonce-license flow, usage allowance, and critical-logic gating.
Section 3.1-3.3, pp. 3-4
TRNG, hardwired public keys, ECDSA implementation, placement, and the approximately 0.5 percent transistor-area estimate.
Section 4 and Tables 1-2, pp. 4-7
Security goals, adversaries, physical and logical attacks, supply-chain risk, authorization-key risk, and network disruption.
Section 4.1 footnote 3, p. 4; Section 6, p. 8
Authorization decisions are out of scope; integration, air-gap, trust, and legitimate-blocking caveats.