Undeclared compute

RAND's verification framework separates two cases: undeclared uses of declared clusters, and undeclared clusters, whether inside known data centres or standalone ¹. The problem is sharpest for hardware that predates tracking. Shavit notes that hundreds of thousands of ML chips had already been sold, many lacking the security features his framework needs ², and Scher and Thiergart write that millions of AI-relevant chips exist and that, to their knowledge, no central tracking of them has taken place ³. They judge that searching for secret data centres may help but is unlikely to carry a verification regime, because it will likely be too easy to hide AI compute among other compute or to build secret data centres ³. Sastry and colleagues caution that more efficient algorithms and more viable decentralized training could reduce how much compute, or how concentrated, a prohibited activity needs ⁴. Proposed responses include:

• Tracking hardware. Monitoring the chip supply chain and keeping a directory of chip owners ², as in chip registries and manufacturing records.
• Finding facilities. National technical means such as remote sensing, energy monitoring, customs data and financial intelligence, alongside whistleblowers ⁵, as in remote detection of data centres.
• Bounding declared capacity. Wiping memory to remove residual capacity for hidden workloads on declared hardware ⁶, as in memory wiping and proofs of secure erasure.