2.1.4 Measuring and Classifying Use

The working rule for the paradigmatic compute governance treaty prohibits unlicensed training above some threshold, not inference. But how do you distinguish a training from an inference run? In this section, you'll explore how a protected counter can measure training-specific compute, how far current telemetry can tell training from inference, and which attacks target the classifier, the evidence channel, or the legal definition of a run.

The working rule prohibits unlicensed training above threshold T while permitting inference and approved safety evaluations. Verifying that rule requires answers to three separate questions:

1. How much counted compute occurred?
2. What kind of workload was it?
3. Was that workload authorized?

A system may answer one and fail the others.

Compute Accounting

Training thresholds are usually expressed in total operations, commonly total training FLOP. Throughput, such as FLOP per second, is a different quantity.

A treaty-grade accounting rule must define:

• Which operations count
• Whether low-precision, sparse, skipped, duplicated, or recomputed operations count differently
• Where counting occurs in the hardware or software stack
• How per-device records aggregate across a run, customer, cluster, facility, site, and time window
• How interrupted, resumed, sequential, or distributed runs are joined
• How counter resets, rollbacks, overflow, missing records, and clock changes are handled
• How the verifier detects padding or deliberately inefficient work intended to distort the count

Existing performance counters and management telemetry can measure useful quantities, but ordinary counters are not automatically suitable for adversarial verification. Hardware-mechanism surveys note that users can reset or control some existing counters. A stronger design needs a protected measurement path, secure state, authenticated reporting, freshness, and aggregation rules that the operator cannot silently rewrite.

O’Gara et al., Hardware-Enabled Mechanisms for Verifying Responsible AI Development — arXiv:2505.03742, 2025; the sections on compute accounting, workload classification, cluster configuration, location verification, and offline licensing.

Even perfect accounting verifies the threshold, not the policy goal. Algorithmic, architectural, and data improvements can produce more capability at the same counted compute. A fixed threshold therefore has an update condition.

Workload Classification

A compute counter cannot determine whether the operations were training, inference, evaluation, fine-tuning, or another permitted activity. Workload classification uses additional signals, such as temporal GPU telemetry, memory behavior, communication patterns, or authenticated code and configuration.

A June 2026 preprint by Rahman and Tajdari tested whether temporal GPU telemetry could detect hidden machine-learning training. Across its full corpus, the study reported 98.2 percent binary classification accuracy over nine NVIDIA GPU models and twenty evasion families. The result is important evidence that training leaves detectable temporal patterns under tested conditions.

M. S. Rahman and M. Tajdari, Detecting Hidden ML Training With Zero-Overhead Telemetry — arXiv:2606.19262, June 2026. A preprint, to be presented as a component demonstration.

The limitations are equally important:

• Difficult previously unseen adversarial workloads produced materially lower performance, reported in the study as 43–87 percent for the hardest cases.
• Experiments were limited to single-node systems of up to eight GPUs.
• The study did not test frontier-scale multi-node clusters.
• The study did not exhaustively cover custom low-level kernels.
• The experiments used NVIDIA hardware.
• Treaty relevance depends on a tamper-resistant telemetry source, an authenticated channel, and protected monitoring software.
• Simple static heuristics are inadequate, because some inference configurations occupy the same basic utilization or arithmetic-intensity range as training.

This is an empirical component demonstration, not an end-to-end verification regime.

Separate Attacks by What They Target

A verifier should not treat every weakness as a classifier problem.

Activity: From Result to Policy Claim

For the telemetry study, write four statements.