1.0 Introduction: What Kind of Policy Are We Trying to Verify?

Now that we have a grasp of the motivations and big-picture qualities of an AI verification regime, it’s time to turn to the specifics. What could a verifiable treaty actually look like—what provisions, requirements, suggestions, agreements should there be? Who are the relevant actors that the treaty depends upon, affects, constrains, and authorizes as verifiers?

The Building Blocks of a Policy

Each policy has an ultimate goal, whether it be to slow global warming or pace the development of premature ASI. These goals are often abstract and intractable on their own. By themselves, they don’t answer the most important questions of how—how do you reduce emissions or regulate advanced AI? For a policy to be workable, decisionmakers must translate goals into concrete rules and claims, with specified actors, objects, activities, and conditions.

First, let’s look at operationalization: how a broad goal narrows to verifiable and checkable claims.

1. The underlying goal is what the policy exists to achieve: for instance, prevent premature ASI.
2. The legal rule is the obligation actually written into the treaty. It is the proxy for measuring achievement of a goal. For example: no party shall conduct, or permit within its jurisdiction, a training run above an agreed compute threshold without prior notification.
3. The verification claim is a proposition that parties are following the rule, and needs to be verified with evidence. For example: no cluster of covered chips on the party's territory ran an unreported workload above the threshold during the reporting period.

Each claim and rule combines the following four ingredients:

• Actors: who the claim is about. States, AI companies, cloud providers, individual researchers.
• Objects: the things involved. Chips, clusters, models, weights, facilities.
• Activities: what actors do with objects. Acquisition, training, research, deployment, transfer.
• Conditions: the qualifiers that make the claim precise. Thresholds, locations, purposes, exceptions, time periods.

Each rule and claim is inherently a proxy: a workable but imprecise substitute for an unworkable but precise goal. The imperfection of proxies, however, risks losing specificity, coverage, and nuance. Motivated actors can exploit loopholes in rules, such that they technically present verifiable claims while actually undermining its underlying goal. The goal may erode the rule itself: see Goodhart’s Law. A lab could train a frontier model under a specified compute threshold, but have innovated enough algorithmic efficiency gains such that the model has dangerous capabilities anyway.

Here’s a historical example from nuclear nonproliferation of such proxy exploitation.

1. The goal of the Non-Proliferation Treaty was to prevent the spread of nuclear weapons.
2. The rule bound non-weapon states not to divert nuclear material to weapons.
3. The claim the IAEA could actually test was whether declared nuclear material at declared facilities matched the state's declarations.

What the claim missed, however, was undeclared nuclear material; a gap that Iraq exploited. Iraq’s declared facilities passed inspection through the 1980s, while an undeclared weapons program ran alongside them. After the 1991 Gulf War, the IAEA discovered this covert program, and in response, created the Additional Protocol, which widened the claim to cover undeclared sites. This is why carefully thinking through the evidentiary claims and rules—and all possible backdoors and loopholes—is integral. The instinctual rule is often not the truly comprehensive one.

Candidate Verifiable Agreements

Given these building blocks, what could a verifiable AI treaty actually look like? There is far from a consensus; the same goal of pacing AI development to benefit humanity has a vast array of operationalized legal rules, each of which generates different verification claims. A paper from the Oxford AI Governance Initiative taxonomizes all the candidate verifiable agreements as such:

• Transfer knowledge: parties share research, development knowledge, and safety-enhancing technologies.
• Transfer resources: parties share chips, compute access, completed models or API access, or benefits such as cash and AI-enabled aid.
• Pool resources: parties build jointly toward a shared goal, such as defensive AI, or confine systemically risky development to a single international project.
• Prepare for emergencies: parties jointly detect and respond to computational emergencies.
• Regulate: parties bind themselves to rules on AI development and deployment, from data-center training runs down to fine-tuning, inference, and sensitive AI-enabled devices.

Confirming that a party shared the research it promised, a pooled project has no covert rival, or that no data center crossed a compute threshold are separate problems that require different mechanisms, levels of cooperation, evidence, timelines, and more. Each type of agreement buys a different amount of risk reduction at a different price. It’s easy to verify transferred knowledge, but mere information sharing realistically can’t do much to deter capability development for self-interested parties. On the other hand, it’s incredibly difficult to verify that zero illicit training runs are happening within a given nation, but successfully doing so will significantly increase the safety and predictability of model development. When weighing different policy options throughout this module, consider: how much risk does this agreement actually remove, and at what cost?