By the end of the core section, you will be able to:
- Bound a hardware claim. Distinguish what a mechanism identifies, attests, measures, classifies, restricts, or reconstructs, then state what remains outside the claim.
- Trace the trust and authority chain. Name who measures, signs, defines acceptable state, updates, revokes, appraises, decides, and enforces.
- Invert the threat model. Reassess the same mechanism when the operator is a cloud customer, a laboratory with physical control, or a state-backed owner.
- Compare trust architectures. Evaluate on-chip, off-chip, and hybrid designs for the same policy claim.
- Recommend a bounded role. State what hardware should carry in a layered regime, what it should not carry, which independent evidence must corroborate it, and what new evidence would change your recommendation.
The compute primer is optional: we assume you are already familiar with FLOP, model parameters, and training compute. If these concepts are new to you—or you are unsure how FLOP differs from FLOP/s—read the primer before continuing.
A watt measures how quickly energy is used: one joule per second. A 2 kW kettle converts 2,000 joules of electrical energy into heat every second. A computing cluster drawing 130 MW consumes 130 million joules per second. Watts describe a rate, not a total amount of energy.
A FLOP is one arithmetic operation, such as an addition or multiplication, on floating-point numbers—the computer’s way of representing values such as 0.25 or −3.7 across a wide range of magnitudes. FLOP count the arithmetic performed; FLOP per second measure how fast it happens.
Think of a language model as an enormous collection of adjustable numbers, called parameters. During pretraining, it processes text divided into tokens—words or pieces of words—and predicts what comes next. Its prediction errors guide small adjustments to the parameters. This process repeats across the training data, teaching the model patterns that help it make better predictions.
Most of the arithmetic involved is matrix multiplication. For a conventional dense transformer, the training cost can be approximated as:
The factor of six accounts for both making predictions and calculating how the parameters should change. It is an approximation, not an exact count for every model architecture.
Kaplan et al., Scaling Laws for Neural Language Models, arXiv, 2020.
This gives two main ways to spend more compute: train a larger model, or train it on more text. More parameters make processing each token more expensive; more tokens mean more processing overall. The 2022 Chinchilla study found that, to get the best performance from a fixed training budget under its experimental conditions, model size and training data should grow in roughly equal proportions. Following that rule, ten times more compute would mean about 3.2 times as many parameters and 3.2 times as many tokens.
Hoffmann et al., Training Compute-Optimal Large Language Models, arXiv, 2022.
The connection to electricity is physical. Arithmetic in a chip requires switching transistors, which charges and discharges tiny electrical capacitances and dissipates energy as heat.
For a rough hardware benchmark, an NVIDIA H100 SXM has a power rating of up to 700 W and a peak throughput of approximately dense, 16-bit floating-point operations per second. Dividing power by throughput gives an energy cost on the order of joules per FLOP. This is a peak-based GPU estimate, not a measurement of an entire training facility.
NVIDIA, NVIDIA H100 Tensor Core GPU Datasheet, 2022.
Using that illustrative efficiency, a training run requiring FLOP would consume:
Spread over three months, that corresponds to roughly 1.3 MW of average power under those assumptions. A facility actually drawing 130 MW for three months would instead consume about 280 GWh—a hundred times as much energy.
The hundredfold gap between the two examples is the difference between a 2023 frontier run and a 2025–26 one. Frontier training compute has grown 4 to 5 times a year, and after efficiency gains and longer runs are netted out, the power a frontier run draws has still grown 2.2 times a year. The signature scales with the run, and the run has been getting bigger faster than the chips have been getting cheaper to feed.
You and Owen, How Much Power Will Frontier AI Training Demand in 2030?, Epoch AI, 2025.
Why Compute
3.B The Feasibility of Compute Governance
Several properties of AI compute suggest it can serve as an effective governance instrument. We focus on four: detectability, excludability, quantifiability, and supply chain concentration.
3.B.1 Detectability
The physicality and resource intensity of AI supercomputers makes them highly detectable and thereby governable. AI supercomputers consist of tens of thousands of AI chips connected with high-bandwidth networking equipment and consume up to dozens of megawatts of power—equivalent to tens of thousands of U.S. households. They are hosted in large data centers—industrial facilities spanning the equivalent of up to several football fields—that require large-scale cooling and power infrastructure (Figure 9) (Pilz & Heim, 2023). The construction of such a facility costs up to several billion dollars and involves a complex permitting and power allocation process. The visibility of supercomputer use has also been used to quantify the climate impact of modern AI systems (OECD, 2022; Patterson et al., 2022; Patterson et al., 2021; Henderson et al., 2020).
However, there are also challenges to detecting AI training runs by tracking data centers. While most data centers are likely easy to identify on geospatial imagery, some may be concealed underground or hidden within other industrial facilities. Furthermore, even successfully detecting AI data centers is not sufficient for identifying AI models hosted on those data centers. This would require the data center owners to monitor and report information about how their computers are used—which would raise privacy concerns—and to distinguish AI workloads from the non-AI workloads also hosted by the majority of data centers.
3.B.2 Excludability
Compute has a high degree of excludability and rivalry, key attributes of a private good (as distinct from a public good (Samuelson, 1954)). Unauthorized users can be easily excluded from accessing AI chips. Someone wishing to use AI chips—i.e., run desired computations on them—must either possess the chips themselves, or (more commonly) rent the right to use the chips from a cloud compute provider that is in possession of the chips themselves (Pilz & Heim, 2023). In both scenarios, the entity in possession of a chip generally maintains the ability to prevent others from using it. While hackers can theoretically gain access to and exploit an actor’s compute, they can easily be expelled once their intrusion is detected. Therefore, compute can be allocated or withheld from actors or particular use cases.
The excludability and rivalry of compute can perhaps best be understood in contrast to the two other elements of the AI triad: data and algorithms (Buchanan, 2020). Both are intangible. Data and algorithms can be kept private prior to publication, but once published it is difficult to control their use (Arrow, 1996), and they become “digital public goods” with low excludability and rivalry (Gruen, 2017). This has been referred to as the “copy problem” (Trask et al., 2020). Once a paper has been downloaded from the website hosting it, it can be copied and reshared virtually costlessly, even if we remove the original copy from the original host website. By contrast, computing hardware has a finite throughput: if one actor is using some computing power, another actor cannot use that same computing power at the same time.
To prevent the unsanctioned copying of data or ideas, society primarily relies on institutional tools (e.g., intellectual property rights, contracts, criminal law). However, these policies are far from perfectly effective, especially across jurisdictional borders. The ability to reliably exclude people from accessing these informational goods is much weaker than for physical goods, as evidenced by, for example, the history of nuclear technology, discussed further in Appendix A. The U.S. government’s unsuccessful attempts in the 1970s to restrict access to the RSA encryption algorithm serve as an apt example of the challenges inherent in governing algorithms. The risk of cybertheft of organizational internal assets increases the difficulty of regulating algorithms. Thus, the control and tracking of AI capabilities by monitoring where certain AI algorithms are used or whether some actor is using a particular algorithm becomes a complex task.
3.B.3 Quantifiability
The computing power attainable from hardware is also easily quantified. It is generally easier to regulate behavior when it is quantifiable—when we can more precisely measure some activity, it is easier to identify it and promote, limit, or deter it.
Computational resources can be quantified by the quantity and quality of their chips. Most prosaically, chips can be counted. Chips also possess measurable specifications—such as computational performance (in operations/s), chip-to-chip communication bandwidth, memory capacity, and memory bandwidth—that indicate quality. Further, training and deploying advanced AI models typically involves tens of thousands of advanced AI chips, requiring significant amounts of ancillary infrastructure—such as high-speed networking and cooling and energy infrastructure—housed in large-scale data centers. This infrastructure can be used to estimate actors’ computational resources, as well as to verify and set clear thresholds on access.
The quantifiability of compute contrasts strongly with another input to AI progress: human capital or “talent.” Individuals are not as transparent as compute or data (Belfield & Hua, 2022). The governance of talent is rightly limited by civil liberties like privacy, and freedom of association and thought (outside of specific and sometimes contentious cases, such as subsidizing research and education and granting or denying student and work visas). Quantifying and comparing talent directly is difficult, making it a less useful indicator of AI capabilities. For example, while some metrics can be predictive of the high productivity of some scientists over others (e.g., h-index, or citation counts), such measures have significant limitations (e.g., they are field dependent or favor older researchers).
3.B.4 Supply Chain Concentration
A key factor enhancing the detectability, excludability, and quantifiability of compute is the concentration of the global supply chain for high-end (≤ 7 nm) chips. The large majority of the world’s most advanced AI chips are manufactured by a single company (TSMC), which is critically reliant on extreme ultraviolet (EUV) lithography machines, also only manufactured by a single company (ASML) (Patel, 2023; Tarasov, 2022). Several other links in the supply chain are also dominated by a few providers, including data center GPU design (where NVIDIA has a market share of over 90% (UK CMA, 2021; Nellis et al., 2023)), and cloud compute services (dominated by a few large providers (OFCOM, 2023)). The supply chain is also inelastic, as the entry barriers are high and supply is difficult to increase quickly (OFCOM, 2023). This is especially evident for EUV lithography machines, which took multiple decades and billions of dollars in investments to develop (Miller, 2022). These empirical factors regarding the supply chain could change over time, potentially affecting governability, but examples like the U.S. export controls on semiconductor manufacturing equipment (discussed below) illustrate the existing potential for governance today. Figure 11 illustrates the compute supply chain, whereas Figure 12 focuses on its concentration.
It is not feasible to regulate every instance of AI model deployment, nor is it desirable (as discussed in section 5.A). Today, however, a significant fraction of frontier AI model-related development and deployment compute could be regulated and governed because it is hosted in a relatively small number of data centers housing large numbers of AI chips (Pilz & Heim, 2023).
Sastry, Heim, Belfield, et al. | arXiv (2024)
Reproduced under CC BY 4.0 from Sastry, Girish, Lennart Heim, et al. "Computing Power and the Governance of Artificial Intelligence." arXiv, 2402.08797, 2024, §3.B.
Note that detectability and supply chain are mostly covered in different modules in this course.
Explainer: How AI Chips Are Made
Read it once through before 2.1.2; it is the only reading in this section that is not about verification. Three steps, design, fabrication, packaging, and the payoff for us is where each step touches a small number of firms: EDA software and the fab's process design kit at design; photomasks, lithography tools and 300 mm wafers at fabrication; TSV, CoWoS and high-bandwidth memory at packaging. Every one of those is a place where a device identity can be provisioned, a production count can be recorded, or a shipment can be reconciled. Keep the numbers: 1.5 to 2 million H100s shipped in 2024, NVIDIA at 80 to 95% of the market, chip performance doubling every 28 months. When 2.1.3 asks how a registry could be complete, the answer starts in this post.
Erich Grunewald | The Power Law (Peter Wildeford's blog), adapted from an IAPS report (2025) | 15 min
Optional: Appendix A: The Compute-Uranium Analogy
The paper's own analogy: ore to yellowcake to enriched uranium, materials to chips to a trained model, each step lengthy, expensive and open to monitoring; where it holds, and where it breaks (compute is not radioactive, and model weights have no nuclear counterpart).
Sastry, Heim, Belfield, et al. | arXiv (2024) | 4 min
Test Your Judgement
During a three-month AI pause, a laboratory sends the verification authority a valid cryptographic statement from each of the 20,000 accelerators in its declared cluster. The laboratory says the tokens prove that the cluster complied.
Before reading further, classify each conclusion as supported, possibly supported if the system was designed to measure it, or unsupported by attestation alone.
These are genuine covered devices.
Their certificates and approved configurations were valid when the evidence was checked.
The devices were connected in the declared cluster topology.
They performed inference rather than prohibited training.
Their cumulative training compute remained below the treaty threshold.
No unregistered accelerators ran a separate prohibited workload.
The treaty authority can suspend the devices.
The Central Question
A signed statement can be authentic and still be too narrow, stale, incomplete, or based on a compromised measurement. Hardware becomes useful for verification only when the whole chain is specified: the rule, the measurement, the evidence, the trust assumptions, the decision authority, and the response.