Pith. sign in

REVIEW 3 major objections 4 minor 53 references

International AI agreements will stand or fall on detecting hidden compute facilities.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 11:00 UTC pith:QSHA5ETR

load-bearing objection A useful and honest taxonomy for comparing AI hardware-governance proposals; the core conclusion is plausible but should be explicitly scoped to AI accelerators rather than stated as a global claim. the 3 major comments →

arxiv 2607.22619 v1 pith:QSHA5ETR submitted 2026-06-16 cs.CY

How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI Agreements

Raymond Koopmanschap , Otto Barten This is my paper
classification cs.CY
keywords international AI agreementscompute governancehardware verificationhidden compute facilitiesenforcement breaking pointcompute thresholdsAI accelerator trackingdetection of undeclared data centers
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that international agreements regulating frontier AI by controlling hardware will succeed or fail on a single sub-problem: finding compute facilities that are not declared. It proposes a taxonomy that splits compliance into three sub-problems—preventing monitored facilities from violating the agreement, preventing new chips from escaping the control regime, and detecting hidden capacity—and maps existing policy proposals onto them. Surveying detection methods, it claims that facilities above roughly 10,000 H100-equivalents are still mostly detectable, while below that scale detection degrades sharply, making hidden-capacity detection the first sub-problem to become intractable as the compute threshold for dangerous capabilities falls. The other two sub-problems remain tractable because they verify chips whose existence is already known. A sympathetic reader should take away that hardware governance is not uniformly hard: the binding constraint is finding undeclared compute, not tracking chips or policing monitored facilities.

Core claim

The paper's central claim is that detecting hidden capacity is the sub-problem most likely to become intractable as the compute threshold for violations lowers. Without active concealment, facilities remain mostly detectable down to about 10,000 H100-equivalents—a facility drawing roughly 10 MW with distinctive cooling towers—and detection degrades sharply below that scale, because smaller facilities lose distinguishing physical signatures and blend into the ordinary building stock. With active concealment, hidden clusters of 10,000 to 100,000 H100-equivalents cannot be ruled out. Applying the taxonomy to eight existing proposals shows that most policy effort goes to preventing escape from t

What carries the argument

The taxonomy decomposes compliance into three state transitions: prevent escape from the control regime (monitored facility to violation), prevent uncontrolled resource acquisition (new chips to monitored facility), and detect hidden capacity (existing chips to monitored facility). The central analytic tool is the 'enforcement breaking point'—the FLOP threshold or equivalent metric at which a policy stops solving its sub-problem—evaluated against facility size in H100-equivalents (a unit of compute roughly equal to one NVIDIA H100 accelerator). Detection failure is driven by loss of distinguishing signatures: cooling-tower arrays at the roughly 10 MW scale give way to air-cooled chillers and

Load-bearing premise

The whole framework assumes that only AI accelerators—not consumer GPUs or CPUs—can produce a violation; if ordinary consumer chips ever become powerful enough to cross the dangerous-capability threshold, the control regime cannot track them and the argument collapses.

What would settle it

Detect an undeclared compute facility below 1,000 H100-equivalents (roughly 1 MW continuous draw) using only public satellite imagery and utility-scale power records, without tip-offs or on-the-ground inspection. One confirmed success at that scale, or a demonstration that a 1 MW facility in an ordinary commercial building produces no anomalous external signature, would directly test the paper's claim that detection degrades sharply below 10,000 H100-equivalents.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If detection of hidden capacity is the binding constraint, then hardware-governance agreements are feasible only while the dangerous-capability threshold corresponds to facilities of roughly 10,000 H100-equivalents or larger.
  • Policy attention should shift toward locating undeclared facilities, since the two other sub-problems can be addressed by chip consolidation, on-chip controls, and supply-chain concentration.
  • As algorithmic progress lowers the compute needed for dangerous capabilities, the detection window narrows and enforcement costs rise even though chip tracking and in-regime monitoring stay tractable.
  • The taxonomy gives a structured way to compare proposals: a proposal that lacks hidden-capacity detection measures leaves a gap no amount of chip tracking can close.
  • Independent detection channels, such as satellite imagery combined with utility power monitoring, raise detection probability but do not remove the sharp degradation below 10,000 H100-equivalents.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's exclusion of consumer GPUs and CPUs is load-bearing: if consumer hardware becomes sufficient for dangerous capabilities, the entire hardware-governance framing breaks, since such chips are too numerous to track and lack on-chip security.
  • A natural test of the sharp-degradation claim would be a systematic survey at 1,000 and 100 H100-equivalents using existing open detection methods; the paper notes only one empirical study supports the 10,000-equivalent number.
  • The same taxonomic lens could be applied to non-hardware governance, such as model-weight or algorithmic controls, where the 'hidden capacity' analog may be undeclared algorithmic advances rather than physical facilities.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a taxonomy for evaluating the enforceability of hardware-based international AI agreements, decomposing compliance into three sub-problems: preventing escape from the control regime, preventing uncontrolled resource acquisition, and detecting hidden capacity. It maps eight existing proposals onto these categories, defines an 'enforcement breaking point' as the compute threshold at which a policy loses effectiveness, and analyzes how each sub-problem scales as the threshold falls. The central claim is that detection of hidden capacity is the first sub-problem to become intractable, with the quantitative anchor that, absent active concealment, facilities remain mostly detectable down to roughly 10,000 H100-equivalents and detection degrades sharply below that scale. The paper concludes that the detect-hidden-capacity sub-problem determines whether verification succeeds, while acknowledging several limitations including legal/commercial frictions not analyzed and the single-study basis of the 10,000 H100-equivalent number.

Significance. The taxonomy is a useful organizing device: it makes explicit that three distinct enforcement tasks are often conflated, and the policy mapping across eight proposals is a valuable synthesis for the verification literature. If the central scaling analysis is accepted, the paper would redirect attention toward hidden-capacity detection as the likely bottleneck in hardware governance agreements. The authors are appropriately candid in the Limitations section about the fragility of the quantitative anchor and the exclusion of consumer GPUs/CPUs. The significance is therefore real but contingent: the paper's central claim is stated more strongly than its scope and evidence support, and the comparative ranking among sub-problems is not established for the full hardware landscape the agreements would need to govern.

major comments (3)
  1. [§2 and §6] The central conclusion in §6 is stated without qualification—'Detect hidden capacity is the sub-problem most likely to become intractable'—but the analysis in §2 explicitly restricts scope to AI accelerators and leaves consumer GPUs and CPUs to future research. This exclusion is load-bearing: §5.1's threshold-agnosticism for prevent-escape relies on AI accelerators having built-in security, and §5.2's tractability for prevent-uncontrolled-resource-acquisition relies on supply-chain concentration (TSMC, ASML, HBM vendors) that does not hold for consumer chips. The paper itself notes in §8 that low-bandwidth training can run on consumer GPUs and distributed hardware. If consumer GPUs/CPUs can be aggregated to cross the thresholds in Appendix A, the escape-prevention regime weakens and the resource-acquisition regime loses its concentration rationale; the comparative ranking could then brea
  2. [§5.3.1, Table 5, and §6] The quantitative anchor 'roughly 10,000 H100-equivalents' rests on a single open-source satellite-detection classifier (Clymer 2025). The text reports that all four false negatives in that classifier were below 10 MW and that the classifier achieved a 100% true-positive rate above 10 MW in the available sample, but the sample size and coverage are not described, and no uncertainty or confidence interval is attached to the 10,000 H100-equivalent threshold. This is acknowledged in §7 as a limitation, yet §6 restates the number as a near-definite 'mostly detectable' boundary. Since the policy conclusion depends on this threshold, the paper should either add the underlying evidence (sample size, precision/recall, geographic coverage) and quantify uncertainty, or reformulate the finding as a conditional statement about current open-research detection capability rather than an empirical bounda
  3. [§5.1 and §6] The robustness of prevent-escape is asserted as threshold-agnostic, but §5.1 itself identifies two conditions for that conclusion and then says the second is 'an open question': off-chip, chip-agnostic measures may be able to verify chips that lack on-chip security, but 'whether such methods cover every case is an open question.' The conclusion in §6 does not carry this caveat. If such methods cannot cover legacy and general-purpose chips, then prevent-escape is not fundamentally threshold-agnostic and the claimed gap between the robustness of escape-prevention and the fragility of hidden-capacity detection narrows. The manuscript should either resolve this open question or explicitly state that the threshold-agnostic ranking is conditional on the same accelerator-only scope and on successful on-chip or equivalent off-chip verification.
minor comments (4)
  1. [Table 5] The legend of Table 5 is garbled in the manuscript (' = measure fails = measure mostly failsG #=...'), making the table difficult to read. The symbols and their meaning should be rendered clearly.
  2. [§8] Future work says 'the same quantity of compute... runs on consumer GPUs and distributed hardware,' which directly concerns the excluded scope from §2. This tension should be flagged earlier, for example when the scope is introduced, so the reader knows the conclusion is provisional with respect to this trend.
  3. [§5.3.2] The 'rough upper bound' on hidden cluster size derived from 'on the order of a million chips unaccounted for' is presented informally. Consider stating the arithmetic and the assumptions (e.g., per-chip performance, grouping efficiency) so the bound is reproducible.
  4. [§7] The Limitations section is well structured, but the 'single analysis behind the 10,000 H100-equivalent number' limitation would be more useful if it appeared together with §5.3.1, where the number is first introduced, rather than only at the end.

Circularity Check

0 steps flagged

No significant circularity: the taxonomy and breaking-point analysis are built from external sources and transparently attributed prior work.

full rationale

The paper's central claim—that detect hidden capacity becomes intractable as the compute threshold lowers—does not reduce to its inputs by construction. The three-way decomposition is explicitly credited to Scher et al. (2025) and used as a framing taxonomy rather than derived from the conclusion. The quantitative anchor of roughly 10,000 H100-equivalents comes from external, independent sources: Epoch AI's chip-owner and data-center datasets, Clymer's classifier, and Pilz & Heim's data-center counts. No parameter is fitted to the target claim, and no equation defines the conclusion into existence. The paper itself flags the main epistemic limitations in Section 7: the 10,000 H100-equivalent number rests on a single open-research analysis, and active concealment is under-investigated. These are limitations on evidential strength, not circularity. The scope restriction to AI accelerators in Section 2 narrows the applicability of the conclusion, but it does not make the derivation self-referential. The paper also transparently acknowledges that the sub-problem grouping mirrors prior work, rather than importing a self-citation chain as the load-bearing justification. Overall, the derivation is self-contained in the relevant sense: the conclusion is an interpretation of external evidence, not a renamed or refitted input.

Axiom & Free-Parameter Ledger

0 free parameters · 6 axioms · 0 invented entities

The paper introduces no fitted parameters and no new physical entities. It relies on external empirical estimates (Epoch AI, Pilz & Heim, Clymer) and on stated scope assumptions, most notably the exclusion of consumer GPUs/CPUs and the assumption that technical feasibility is the binding constraint.

axioms (6)
  • domain assumption The compute required for dangerous AI capabilities decreases over time, forcing thresholds lower.
    Stated in Section 1 and Section 8 as a driver of the entire breaking-point analysis. If compute requirements do not decrease, the threshold does not fall and the analysis loses its urgency.
  • domain assumption Only AI accelerators are in scope; consumer GPUs and CPUs cannot produce violations.
    Explicitly stated in Section 2: 'we focus on AI accelerators, while consumer GPUs and CPUs are out of scope.' This is load-bearing because the whole control-regime design assumes violations require a trackable accelerator class.
  • domain assumption The AI chip supply chain remains concentrated enough that production tracking and fab controls are feasible.
    Section 5.2 relies on TSMC/ASML/HBM manufacturer concentration. The paper acknowledges this may change but treats it as a current and near-term given.
  • domain assumption The described control regime (monitored facilities, cameras, off-chip measurements, power-off, and shutdown) is sufficient to prevent violations.
    Section 5.1 states 'We expect this regime is sufficient to solve the sub-problem.' If the regime is not actually sufficient, the comparison of sub-problems is incomplete.
  • domain assumption The Clymer classifier and Epoch AI datasets adequately represent what open-research detection can achieve.
    Section 5.3.1 and the Limitations section state that the 10,000 H100-equivalent figure 'rests on a single open-research analysis.' The conclusion depends on this empirical anchor.
  • ad hoc to paper Legal, commercial, and sovereignty frictions do not bind before technical limits.
    The Limitations section says 'The analysis treats verification as a technical-feasibility question. Legal, commercial, and sovereignty frictions may bind earlier than technical limits.' This is a deliberate scope assumption that could change the policy conclusions.

pith-pipeline@v1.3.0-alltime-deepseek · 11312 in / 8898 out tokens · 85813 ms · 2026-08-02T11:00:25.156090+00:00 · methodology

0 comments
read the original abstract

Several international agreements have been proposed to regulate frontier AI development in response to catastrophic risks. However, there is no structured way to evaluate whether these proposals are enforceable, to assess where they might fail in practice, or to determine which combination of policies is most effective. We propose a taxonomy based on the principle that wherever sufficient capacity exists to violate an agreement, it must be under a control regime. This decomposes the problem of ensuring compliance with the agreement into preventing uncontrolled resource acquisition, detecting all capacity outside the control regime, and preventing escape from the control regime. Existing proposals consist of individual policies that address one or more of these sub-problems. Because the compute required for dangerous capabilities may decrease over time, more actors can violate an agreement and enforcement of these policies becomes harder. We define the enforcement breaking point as the FLOP-threshold or equivalent metric at which a policy loses its effectiveness in solving the sub-problem, and introduce a set of factors to assess how and why this breakdown occurs. This reveals which of the three sub-problems any given proposal adequately addresses, and where enforceability breaks down first. Applying this taxonomy to existing proposals reveals that more focus is placed on preventing escape from the control regime, while preventing resource acquisition and detecting all capacity outside the control regime receive less attention. By making these gaps explicit, this taxonomy can help researchers and policymakers prioritize future enforcement and verification efforts.

Figures

Figures reproduced from arXiv: 2607.22619 by Otto Barten, Raymond Koopmanschap.

Figure 1
Figure 1. Figure 1: State diagram of the three sub-problem decomposition. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

53 extracted references · 23 linked inside Pith

  1. [1]

    2025 , publisher =

    Eliezer Yudkowsky and Nate Soares , title =. 2025 , publisher =

    2025

  2. [2]

    2023 , howpublished =

    Eliezer Yudkowsky , title =. 2023 , howpublished =

    2023

  3. [3]

    2025 , doi =

    Onni Aarne and James Petrie , title =. 2025 , doi =. 2506.15100 , archiveprefix =

    Pith/arXiv arXiv 2025

  4. [4]

    2024 , url =

    Onni Aarne and Tim Fist and Caleb Withers , title =. 2024 , url =

    2024

  5. [5]

    2025 , doi =

    Anthony Aguirre , title =. 2025 , doi =. 2311.09452 , archiveprefix =

    Pith/arXiv arXiv 2025

  6. [6]

    Toward a Global Regime for Compute Governance: Building the Pause Button , year =

    Ananthi. Toward a Global Regime for Compute Governance: Building the Pause Button , year =. doi:10.48550/arXiv.2506.20530 , eprint =

    Pith/arXiv arXiv doi:10.48550/arxiv.2506.20530

  7. [7]

    2025 , doi =

    Mauricio Baker and others , title =. 2025 , doi =. 2507.15916 , archiveprefix =

    Pith/arXiv arXiv 2025

  8. [8]

    2025 , doi =

    Peter Barnett , title =. 2025 , doi =. 2507.10618 , archiveprefix =

    Pith/arXiv arXiv 2025

  9. [9]

    2025 , doi =

    Peter Barnett and Aaron Scher , title =. 2025 , doi =. 2505.04592 , archiveprefix =

    Pith/arXiv arXiv 2025

  10. [10]

    2025 , doi =

    Peter Barnett and Aaron Scher and David Abecassis , title =. 2025 , doi =. 2507.09801 , archiveprefix =

    Pith/arXiv arXiv 2025

  11. [11]

    TIME , url =

    Otto Barten , title =. TIME , url =. 2024 , month = nov, day =

    2024

  12. [12]

    2024 , url =

    Asher Brass and Onni Aarne , title =. 2024 , url =

    2024

  13. [13]

    2024 , doi =

    Marie Davidsen Buhl and Gaurav Sett and Leonie Koessler and Jonas Schuett and Markus Anderljung , title =. 2024 , doi =. 2410.21572 , archiveprefix =

    Pith/arXiv arXiv 2024

  14. [14]

    2025 , doi =

    Nicholas A Caputo , title =. 2025 , doi =. 2502.15719 , archiveprefix =

    Pith/arXiv arXiv 2025

  15. [15]

    2024 , doi =

    Joshua Clymer and Nick Gabrieli and David Krueger and Thomas Larsen , title =. 2024 , doi =. 2403.10462 , archiveprefix =

    Pith/arXiv arXiv 2024

  16. [16]

    2025 , url =

    Joshua Clymer , title =. 2025 , url =

    2025

  17. [17]

    CNBC , url =

    Nvidia's New Software Could Help Trace Where Its. CNBC , url =. 2025 , month = dec, day =

    2025

  18. [18]

    Alexander DeVolpi and others , title =

  19. [19]

    2025 , url =

    Ben Harack and others , title =. 2025 , url =

    2025

  20. [20]

    2024 , doi =

    Lennart Heim and Leonie Koessler , title =. 2024 , doi =. 2405.10799 , archiveprefix =

    Pith/arXiv arXiv 2024

  21. [21]

    2024 , organization =

    Geoffrey Irving , title =. 2024 , organization =

    2024

  22. [22]

    2021 , url =

    Saif M Khan and Alexander Mann and Dahlia Peterson , title =. 2021 , url =

    2021

  23. [23]

    2024 , doi =

    Gabriel Kulp and others , title =. 2024 , doi =

    2024

  24. [24]

    2025 , doi =

    Andrea Miotti , title =. 2025 , doi =. 2311.10748 , archiveprefix =

    arXiv 2025

  25. [25]

    2025 , doi =

    Andrea Miotti , title =. 2025 , doi =. 2310.20563 , archiveprefix =

    arXiv 2025

  26. [26]

    Telecommunications Policy , year =

    Milton L Mueller , title =. Telecommunications Policy , year =

  27. [27]

    2025 , doi =

    Aidan O'Gara and others , title =. 2025 , doi =. 2505.03742 , archiveprefix =

    Pith/arXiv arXiv 2025

  28. [28]

    2025 , doi =

    Toby Ord , title =. 2025 , doi =. 2503.05705 , archiveprefix =

    Pith/arXiv arXiv 2025

  29. [29]

    Inside Climate News , url =

    Charles Paullin , title =. Inside Climate News , url =. 2026 , month = mar, day =

    2026

  30. [30]

    2024 , doi =

    James Petrie , title =. 2024 , doi =. 2404.18308 , archiveprefix =

    Pith/arXiv arXiv 2024

  31. [31]

    2025 , doi =

    James Petrie and Onni Aarne , title =. 2025 , doi =. 2506.03409 , archiveprefix =

    Pith/arXiv arXiv 2025

  32. [32]

    2025 , doi =

    James Petrie and others , title =. 2025 , doi =. 2506.15093 , archiveprefix =

    Pith/arXiv arXiv 2025

  33. [33]

    2024 , doi =

    Girish Sastry and others , title =. 2024 , doi =. 2402.08797 , archiveprefix =

    Pith/arXiv arXiv 2024

  34. [34]

    2025 , doi =

    Aaron Scher and Lisa Thiergart , title =. 2025 , doi =. 2506.15867 , archiveprefix =

    Pith/arXiv arXiv 2025

  35. [35]

    2025 , doi =

    Aaron Scher and others , title =. 2025 , doi =. 2511.10783 , archiveprefix =

    Pith/arXiv arXiv 2025

  36. [36]

    2024 , url =

    Paul Scharre , title =. 2024 , url =

    2024

  37. [37]

    2025 , doi =

    Rebecca Scholefield and Samuel Martin and Otto Barten , title =. 2025 , doi =. 2503.18956 , archiveprefix =

    Pith/arXiv arXiv 2025

  38. [38]

    2025 , organization =

    Jaime Sevilla , title =. 2025 , organization =

    2025

  39. [39]

    2023 , doi =

    Yonadav Shavit , title =. 2023 , doi =. 2303.11341 , archiveprefix =

    Pith/arXiv arXiv 2023

  40. [40]

    2024 , doi =

    Akash Wasil and others , title =. 2024 , doi =. 2408.16074 , archiveprefix =

    Pith/arXiv arXiv 2024

  41. [41]

    2025 , month =

    Andrea Miotti and Tolga Bilge and Dave Kasten and James Newport , title =. 2025 , month =

    2025

  42. [42]

    Pilz and Lennart Heim , title =

    Konstantin F. Pilz and Lennart Heim , title =. 2023 , month =. 2311.02651 , archiveprefix =

    Pith/arXiv arXiv 2023

  43. [43]

    Datacenter Anatomy Part 2: Cooling Systems , year =

  44. [44]

    2025 , month = aug, url =

    2025

  45. [45]

    Chip Security Act , year =

  46. [46]

    2011 , url =

    Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities , number =. 2011 , url =

    2011

  47. [47]

    2022 , url =

    Data Center Noise Study , institution =. 2022 , url =

    2022

  48. [48]

    2023 , url =

    Tim Fist and Erich Grunewald , title =. 2023 , url =

    2023

  49. [49]

    2023 , month = oct, url =

    Commerce Strengthens Restrictions on Advanced Computing Semiconductors, Semiconductor Manufacturing Equipment, and Supercomputing Items to Countries of Concern , institution =. 2023 , month = oct, url =

    2023

  50. [50]

    Allen , title =

    Gregory C. Allen , title =. 2022 , url =

    2022

  51. [51]

    2026 , month = apr, url =

    Naci Cankaya and Jakub Krys and Jonathan Ng and Luke Marks and Felix Krueckel , title =. 2026 , month = apr, url =

    2026

  52. [52]

    2023 , month = oct, howpublished =

    Ajay Kuntamukkala and Anthony Capobianco and Stephen Propst and Josh Gelula and Jane Chen , title =. 2023 , month = oct, howpublished =

    2023

  53. [53]

    2025 , month = jun, url =

    2025