The case for verification

The trust problem

A verification mechanism is a process or tool that gives one party more confidence that another is following agreed rules, typically by detecting violations ¹.

States are weighing international agreements to manage AI. Harack and colleagues argue that the political feasibility of such agreements can hinge on whether they can be verified, and that without verification states may find otherwise desirable deals unavailable ². Wasil and colleagues suggest that nations might be much more likely to agree to rules they can reliably verify, and that such agreements could help avoid or mitigate a race between nations ³.

What verification enables

• Even rivals could check each other. A RAND working paper by Baker and colleagues asks whether the United States and China could verify each other's compliance with AI guardrails. It concludes that they could eventually do so through six largely independent approaches, although technical research and protections against overreach are needed ⁴.
• Compute is a workable place to check. Sastry and colleagues argue that computing power is a particularly effective point of intervention compared with data and algorithms. It is detectable, excludable and quantifiable, and it comes from an extremely concentrated supply chain ⁵.
• Checks could keep secrets. States limit transparency to protect national security. Harack and colleagues note that a mechanism that shows compliance without revealing anything else may avoid that tradeoff altogether ². Zero-knowledge proofs and trusted execution environments aim at that.
• Evidence has uses beyond treaties. Harack argues that preventing war might require credible evidence that civilian AI resources are not being militarized, and that individuals, companies and countries are less likely to buy products they cannot trust ⁶. The same approaches could also serve domestic regulation of companies ¹.

The cases against verification tech

Verification could give more confidence than its coverage warrants. No single proposed mechanism is foolproof, and checking declared facilities is easier than establishing that no undeclared work exists ^{2 3}. RAND's six-layer study says its on-chip and off-chip approaches will likely remain open to circumvention until substantial research and infrastructure work is done ⁴. Scher and Thiergart note that many ideal verification mechanisms are not yet technically feasible, and that more access, such as physical inspection of data centres, can often substitute for them ¹.

Verification can burden parties that comply. Harack and colleagues identify financial costs, security risks, implementation delays and slower AI computations as possible costs of greater certainty ². Sastry and colleagues warn that poorly scoped compute governance can harm privacy and concentrate power ⁵.

International verification may be less necessary under some assumptions. Scher and Thiergart describe a scenario in which a sustained US lead, strong chip export controls and very strong security for model weights allow domestic regulation to control frontier AI development in the short term ¹. Pursuing a greater relative advantage also carries risks: Harack and colleagues warn that shifts in military power can create incentives for preventive war ².

Nuclear precedents

Nuclear arms control faced the same problem and built tools for it. Baker's study of that history finds that, with some preparation, the main foreseeable challenges of verifying a hardware-based AI treaty would be ones that nuclear arms control managed ⁷.

• Satellites came first. The 1972 SALT I interim agreement and ABM Treaty formally authorized only "national technical means", state-owned technologies such as satellites that check compliance from a distance ⁷. Each side undertook not to interfere with the other's means ⁸. The AI counterpart is remote detection of data centres.
• On-site inspection followed. At the signing of the 1987 INF Treaty, Reagan quoted the Russian maxim "trust, but verify" and described inspection teams living on each other's territory ⁹. Harack and colleagues write that new ways to verify missiles widened the realistic political options for arms control and helped make that treaty possible ².
• Safeguards count and seal. IAEA safeguards rest largely on nuclear material accountancy, supported by containment and surveillance such as tamper-proof seals and cameras ¹⁰. The AI counterparts are chip registries and tamper evidence for verifier devices.
• Test-ban monitoring listens from afar. The International Monitoring System for the Comprehensive Nuclear-Test-Ban Treaty will have 337 facilities using seismic, hydroacoustic, infrasound and radionuclide sensors. It detected all six nuclear tests North Korea declared between 2006 and 2017 ¹¹. Workload classification from side channels applies the same idea at closer range, inferring what a chip is doing from indirect signals such as its power draw.
• Warhead checks could keep designs secret. Inspectors need confidence that a submitted warhead is authentic while learning nothing about it. Glaser, Barak and Goldston proposed a zero-knowledge protocol for this, based on neutron measurements ¹². Zero-knowledge proofs of training constraints pursue the same goal for AI.

The analogy has limits. Baker expects states to be less willing to accept costly verification for AI treaties, because AI security is currently a relatively low priority ⁷.

Other precedents

• Under the Chemical Weapons Convention, the OPCW had verified the destruction of 72,304 tonnes of declared chemical weapons by July 2023, covering every stockpile declared up to then ¹³. Declarations can be incomplete. In May 2026 an OPCW team in Syria found dozens of chemical munitions that Syria's former government had never declared ¹⁴.
• The Biological Weapons Convention has no verification mechanism, unlike the Non-Proliferation Treaty and the Chemical Weapons Convention. Revelations in the early 1990s of non-compliance by Iraq and the former Soviet Union exposed that gap ¹⁵. NTI noted in 2024 that the convention still has no mechanism to monitor and enforce compliance or verify adherence ¹⁶.
• Computer security supplies further tools. Remote attestation lets one end of a network exchange check whether the other end is in an intended operating state ¹⁷, and attestation for AI workloads builds on it.

Lead times

• Monitoring can be built before a treaty takes effect. The Comprehensive Nuclear-Test-Ban Treaty opened for signature in 1996 and has not yet entered into force ¹⁸. About 90 percent of its 337 planned monitoring facilities are already running ¹¹.
• Baker argues for preparing before the political will arrives. That means developing privacy-preserving, secure and affordable ways to verify hardware compliance, given inspection access, and building an initial, incomplete verification system whose gaps can be closed quickly ⁷.
• Harack and colleagues judge that if key states get serious, combined efforts should be enough to create "a robust verification system within a few years" ². Harack argues that serious efforts need to begin now if society wants the benefits of verification ⁶.

Further reading

• Nuclear Arms Control Verification and Lessons for AI Treaties (Baker, 2023) compares three kinds of nuclear agreement and draws lessons for AI.
• Verification for International AI Governance (Harack et al., 2025) covers what verification needs, technically and politically.
• Verification methods for international AI agreements (Wasil et al., 2024) sets out ten methods, each with historical precedents and ways to evade it.
• Verifying International Agreements on AI: Six Layers of Verification (Baker et al., 2025) describes how rival states could check each other's compliance.
• Mechanisms to Verify International Agreements About AI Development (Scher and Thiergart, 2025) works through verification for three example policy goals.
• Open Problems in Technical AI Governance (Reuel et al., 2025) maps the open research questions, verification among them.