A key tension common to any verification mechanism in this module is confidentiality vs. verifiability. Rival states are inherently incentivized to not disclose any information to each other, much less about the development of potentially dangerous and proprietary technologies. The last thing China wants is for the U.S. to steal development secrets through an invasive or insecure audit system. Yet the model of verification relies entirely upon the reliable mutual disclosure of information. Thus arises the verifier’s paradox: how do you gain enough access to confirm compliance, but not enough to enable espionage?
The solution is privacy-preserving verification: mechanisms designed to verify compliance while conveying minimum or zero excess information to verifier parties. Here are a few previews of privacy-preserving mechanisms you will learn about throughout Module 2:
No single mechanism provides complete verification. Hardware attestation and managed access can support bounded claims today. Workload telemetry has promising experimental results. Zero-knowledge proofs and secure multiparty computation are practical for selected tasks, but their use at frontier-training scale remains limited. A strong regime combines them: hardware provides trusted evidence, cloud mechanisms check selected computations, intelligence identifies suspicious activity, and inspectors resolve claims that remote methods cannot settle.
Module 2 begins with the hardware layer. Section 2.1 examines how chips can identify themselves, report their state and location, measure workloads, and produce evidence that later cloud and institutional mechanisms can use.