Before judging any hardware mechanism, we need to first establish and clarify what exactly it's being asked to prove.
By the end of this section, you will be able to:
- Separate a policy goal, a legal rule, and a verification claim.
- Distinguish authenticity, correctness, and completeness.
- Explain what a piece of hardware evidence establishes and what requires additional evidence or assumptions.
Why the Claim Comes First
Suppose an operator gives you a signed report showing how much computation its chips performed. Would that establish compliance with a training limit?
You would first need to know what the counter measures, which devices it covers, and how their activity is assigned to training runs. You would also need to know what the agreement limits. A limit per device, per facility, and per training run would each require different evidence.
Confidentiality makes this harder. Operators may have legitimate reasons to protect their models, code, and data, while verifiers need evidence that does not depend entirely on operators' declarations. Hardware mechanisms can help by producing protected measurements of specified properties. Whether those measurements establish compliance depends on the rule and the assumptions connecting the measurement to it.
Before considering a mechanism, distinguish three things:
| Layer | Question |
|---|---|
| Policy goal | What outcome are we trying to achieve? |
| Legal rule | What conduct is required, permitted, or prohibited, and for whom? |
| Verification claim | What proposition do we need evidence for to assess compliance? |
A useful verification claim specifies what is being checked and its scope: the relevant devices or activities, the applicable time interval, and the definitions that determine the result.
Worked Example: A Limit on Training
MIRI's draft international agreement proposes restrictions on training compute alongside restrictions on dangerous research. It distinguishes a Strict Threshold, above which the agreement prohibits training, from a lower Monitored Threshold, above which training requires approval and monitoring. Here we focus on the upper limit. Scher et al., sec. 4.
- Policy goal: prevent the premature development of artificial superintelligence.
- Proposed legal rule, simplified: parties must prohibit training runs above the Strict Threshold.
- Verification claim: no training run subject to this prohibition exceeded the Strict Threshold, counting the operations attributable to that run across devices, sites, and reporting periods under the agreement's accounting rules.
The unit of compliance is a training run. Evidence about an individual device must therefore be connected to the run and combined with other relevant records. A reporting period does not reset a limit that applies to the whole run.
The phrase "under the agreement's accounting rules" also matters. Those rules must determine which operations count and which activities belong to the same run. Without these definitions, even an accurate measurement may not settle whether a run exceeded the limit.
What a Counting Rule Captures, and Leaves Out
New START illustrates the distinction between a policy goal and a legal rule. Its central limits included a ceiling of 1,550 deployed strategic warheads under the treaty's accounting rules. For deployed intercontinental and submarine-launched ballistic missiles, the count reflected the actual number of reentry vehicles fitted to each missile. Each deployed heavy bomber equipped for nuclear armaments, however, counted as just one warhead, although it could carry multiple nuclear weapons. Bomber weapons were normally stored separately rather than loaded onto aircraft, and the parties adopted a fixed attribution rule for them. The treaty thus combined actual counts for deployed missile warheads with an agreed attribution for bombers. Arms Control Association, "New START at a Glance," Articles II-III.
A verifier applying that rule correctly could establish compliance with the numerical limit. That finding would not establish that the parties possessed only 1,550 nuclear weapons or that their bombers could deliver only the number attributed to them. Assessing the strategic significance of compliance required understanding what the accounting rule left out.
A training limit raises a similar question. Even if every relevant operation were counted accurately and every run stayed below the threshold, policymakers would still need to assess how effectively the restriction constrained dangerous capability development.
There are therefore two judgments to make: does the evidence establish compliance with the rule, and does the rule adequately serve the policy goal? A gap between the rule and the goal may be an acceptable compromise, or it may undermine the agreement. Making that gap explicit allows it to be evaluated.
Authenticity, Correctness, and Completeness
Use three questions to assess the relationship between evidence and a verification claim. These are working distinctions for this course.
Authenticity. Did the evidence come from the claimed source, and has it been altered?
Check freshness separately: a report signed today may contain measurements collected earlier. RFC 9334 explicitly distinguishes the age of the reported values from the time they are signed. The relevant question is whether the evidence covers the time specified in the verification claim. RFC 9334, sec. 10.4.
Correctness. Does the evidence accurately establish the property being tested, using definitions that match the rule?
A counter might accurately measure a class of operations that differs from the agreement's definition of training compute. A classifier might assign a workload label that does not capture what the agreement defines as training.
Completeness. Does the evidence cover all devices, activities, and time periods relevant to the claim?
Reports may accurately describe every registered device while omitting an undeclared cluster. A complete device inventory may still leave gaps in the activity recorded over time.
These questions interact. Preventing omissions within a device may require a protected measurement path. Establishing whether relevant devices are missing altogether may require inventory records, inspections, or other evidence.
What Does a Counter Establish?
Consider this hypothetical report:
Device 4471's protected counter increased by counted operations between 1 March and 31 May.
Assume that the report is authentic, its dates are reliable, and the counter accurately records all operations within its specified measurement scope.
Under those assumptions, the report establishes that device 4471 performed that quantity of counted operations within the stated interval and measurement scope.
To assess compliance with a training limit, however, the verifier needs several additional connections:
| Missing connection | Why it matters |
|---|---|
| Accounting definition | The counter's units and included operations must match, or be validly translated into, the agreement's accounting rules. |
| Workload attribution | The measured activity must be assigned to the relevant training run or runs, distinguishing other activity where required. |
| Aggregation across devices | A run may distribute computation across many chips and sites. |
| Continuity across time | A run may begin before March or continue after May. |
| Coverage of undeclared activity | Reports from registered devices do not establish that all relevant devices and runs were registered. |
An accurate count can therefore be useful without being sufficient for a compliance finding.
The direction of the inference also matters. An incomplete count below a threshold cannot establish that the full run stayed below it. A reliably attributed count already above the threshold could establish an exceedance even if additional computation remained unobserved.
Exercise: Break Down the Chip Security Act
The training example began with a proposed rule and worked toward a verification claim. Now apply the same approach to a different policy.
Read the source summary below. Answer using the text provided, and distinguish the proposal's explicit provisions from your own interpretation.
Source. The following is an abridged paraphrase of the introduced House version of the Chip Security Act, H.R. 3447, dated 15 May 2025. It describes proposed requirements.
A — Purpose, section 2. Security mechanisms are intended to improve export-control compliance and help address diversion, theft, and unauthorized use of exported advanced computing hardware.
B — Definition, section 3(2). A chip security mechanism may use software, firmware, hardware, or physical security.
C — Requirements, section 4(a). Within 180 days of enactment, Commerce would have to require location-verification mechanisms before specified foreign exports, reexports, or transfers of covered products. It would also have to require authorization holders to report credible information about a location differing from the application, diversion to another user, or tampering.