Verification is a technical property. Compliance is not.
We identify ambitious hardware-verification proposals, isolate their most load-bearing assumptions, and place both in a professionally typeset environment.
Figure 01 Conceptual rendering. Governance module shown feeling confident.
Our indicators are independently selected, internally validated, and emotionally robust.
Our working thesis
A recurring genre of AI governance begins with a real problem—smuggling, unverifiable compute, untrusted operators—and ends by assigning constitutional responsibilities to a security module.
If a proposal assumes a hostile operator with physical access, the phrase “the chip reports” is not yet the end of the design review.
The observatory
Each record paraphrases a real proposal, links to the primary source, and adds an editorial finding. A high assumption load is not a technical verdict; it is an invitation to keep reading past the diagram.
Full mechanism reviews, including source caveats, trust registers, and tests that would change the assessment.
Control · Proposed
Workload · Research agenda
Sort by the properties of the claim. No composite badness score is maintained at this time.
Maturity: Proposed · Reviewed 2026-08-22
Distribute thousands of dead-man switches through critical accelerator logic, each requiring fresh cryptographic licenses and halting its local operations when its usage allowance reaches zero.
Replaces one remotely governed kill switch with a small on-die civilization of them, each waiting for permission to add.
Maturity: Research agenda · Reviewed 2026-08-22
Log every prompt, output, seed, model release, and code version, then have an isolated trusted server re-run a random sample to detect model weights hidden steganographically in responses.
Secures a compromised inference stack with an honest twin, a perfect diary, trusted randomness, and a strict rule that stolen weights may leave only through the chat window.
Maturity: Research agenda · Reviewed 2026-08-22
Estimate where an accelerator lives by timing cryptographic challenges between the chip and trusted landmark servers.
The smuggled object is invited to participate in the investigation of where the smuggled object is.
Maturity: Proposed · Reviewed 2026-08-22
Require a periodically renewed operating license before a data-centre AI chip is allowed to function.
Turns the accelerator into enterprise software, then gives the license server a foreign-policy portfolio.
Maturity: Proposed · Reviewed 2026-08-22
Hard-code a fixed set of chips that may communicate with one another at high bandwidth.
A cluster topology, a supply chain, and international order are all frozen into one tasteful whitelist.
Maturity: Proposed · Reviewed 2026-08-22
A hardened module checks that firmware and policy are current, blocking operation when they are not.
A security update mechanism is promoted to constitutional law, with uptime determined by successful compliance.
Maturity: Speculative · Reviewed 2026-08-22
Meter computation on-chip so regulated training runs can be identified and reported against thresholds.
Counts the arithmetic with great ceremony while capability, efficiency, fine-tuning, and distributed work move around it.
Maturity: Research agenda · Reviewed 2026-08-22
Verify properties of training or inference workloads from inside trusted hardware while preserving data and model secrecy.
The verifier learns just enough to be confident, while trusting a stack large enough to contain several conferences.
Maturity: Speculative · Reviewed 2026-08-22
Use cryptographic proof-of-training so a verifier can establish that a declared training computation occurred.
A proof of execution begins a rewarding second career as a proof of intent, provenance, and safety.
Maturity: Research agenda · Reviewed 2026-08-22
Add flexible hardware guarantees that can meter compute, enforce limits, gate deployment, and automate safety protocols.
The chip becomes auditor, regulator, border officer, safety case, and—if there is room left—matrix multiplier.
Maturity: Deployed-ish · Reviewed 2026-08-22
Use CPU and GPU trusted environments to issue hardware-rooted certificates for AI processes throughout runtime.
The certificate is tamperproof. The platform, verifier, policy, firmware, operator, and meaning of ‘compliant’ remain available separately.
Our methodology
Find the cryptographic key, timing protocol, TEE, counter, or licensing mechanism doing the actual technical work.
Technical layerFollow the argument from “can attest this state” to “can enforce this policy against a motivated sovereign adversary.”
Narrative layerRecord the hidden dependencies, define the claim boundary, and identify what evidence would falsify the assessment.
Institutional layerPatterns in the literature
A signed statement about machine state quietly expands into a conclusion about workload, operator, and policy compliance.
Remote licenses and mandatory updates gain enforcement power; outages, capture, and common-mode failure receive an appendix.
FLOPs are countable, so FLOPs become governance—even as capability migrates across algorithms, inference, and distributed systems.
The attacker has a lab, a budget, and the package in hand, but continues to interact with the protocol through the documented API.
“Our mission is not to oppose technical governance. It is to ensure every enormous institutional claim receives the tiny hardware root of trust it deserves.”
— The Consortium Charter, provisionally attested
Open docket
Submit a source, the relevant passage, and the claim you believe deserves closer inspection. Strong nominations distinguish what the mechanism establishes from what the policy argument requires.
Institutional engagement
Private sessions for policymakers, labs, funders, and accelerators currently unsure which country they are in.