By the end of this lesson, you will be able to:
- Separate how much compute occurred, what kind of workload it was, and whether it was authorized.
- Evaluate compute accounting across devices, sites, restarts, and reporting periods.
- Explain what telemetry-based workload classification measures and what its errors mean for verification.
- Distinguish promising component demonstrations from end-to-end verification under an adversarial threat model.
Allow approximately 10 minutes for required external reading, 25 minutes for the lesson, and 25 minutes for the exercise and answer review. A separate optional critical-reading activity takes approximately 20 additional minutes and is not required to complete the lesson. No code, software installation, GPU access, or execution of the linked examples is required. Read the excerpts where their cards appear. Inline references are supporting sources, not additional assignments.
Three Questions, Three Different Kinds of Evidence
Return to the pause example from 2.1.1: a covered party must not conduct an unlicensed training run above threshold T. In 2.1.3, we asked which devices the regime could account for. Suppose, for this lesson, that the relevant devices are known. What would establish whether their use broke the rule?
| Question | Relevant evidence | Tempting but invalid shortcut |
|---|---|---|
| How much compute occurred? | Defined operation counts or bounded estimates, with device and time coverage | A busy GPU must have performed its advertised maximum FLOP rate |
| What kind of workload was it? | Workload measurements, classification, and corroborating execution records | A large workload must be training |
| Was that use authorized? | The applicable rule, an authentic authorization, and evidence tying its scope to the actual work | An operator called the job “safety evaluation,” so it was permitted |
An answer to one question does not answer the others. A large inference workload may be permitted. A genuine safety evaluation may include a specifically approved training procedure. A smaller training run may fall below a licensing threshold. “Training” is a technical classification; “prohibited” is a conclusion under a rule.
The Chip Security Act claim from the preceding sections remains separate: evidence that hardware is in an allowed jurisdiction does not establish allowed use. Here we develop the pause agreement’s use claim. Keep both claims in your notebook rather than letting one stand in for the other.
What Does a Compute Number Count?
A FLOP is a floating-point operation. FLOP/s measures a rate; a total over a run is measured in FLOP. A GPU-hour measures time allocated to or used by a GPU, depending on the accounting convention. None of these terms alone specifies the legal counting rule.
An agreement needs to say which operations count. Does a multiplication followed by an addition count as two operations? How are different numerical precisions treated? Are operations repeated after a failed attempt included? What about computations repeated to avoid storing intermediate results? Is the limit attached to a run, a model-development project, a customer, or a period?
These choices should be explicit before comparing a measurement with T. Two exact counters can disagree without either being broken if they count different things.
Feature Overview: Profiling Metrics
Required reading 1 — Read a metric definition, not a dashboard label. Vendor documentation for deployed monitoring tools.
Read: Under “Profiling Metrics” → “Metrics,” read the definitions of Graphics Engine Activity, SM Activity, and Tensor Activity. Skip field identifiers, commands, installation instructions, and all other sections.
Reading focus: What does “active” mean in each definition? Which quantities are averaged over a time interval?
Here, DCGM is NVIDIA’s Data Center GPU Manager. An SM is a processing unit within a GPU; Tensor Cores are specialized arithmetic units. You do not need their implementation details, and you do not need to run anything.
NVIDIA | DCGM documentation | 4 min
NVIDIA defines these activity metrics in terms of time or cycles, not a direct total of floating-point operations. Its SM Activity definition includes work waiting for memory. Tensor Activity is an interval average and can correspond to different distributions of activity across the chip and time.
Thus “80% utilization” is not sufficient evidence that the GPU performed 80% of its peak advertised operations. The conversion would require a validated model of the specific metric, hardware, instructions, and workload. Power consumption is also a signal, not a universal FLOP meter.
There are several ways to produce a compute estimate, each with a different dependency:
| Approach | What must be established |
|---|---|
| Count execution events and convert them into operations | That relevant events are captured, their conversion is defined, and the counting path cannot be bypassed |
| Infer operations from the declared model and execution plan | That the declaration matches execution, including repetitions, variants, and relevant additional work |
| Bound work using hardware capacity and elapsed time | A valid maximum rate for the actual hardware and counting convention; this is a bound, not a measured total |
| Estimate work from activity or physical measurements | A validated relationship with operations and an uncertainty range for the relevant operating conditions |
This is an analytic comparison, not a claim that every approach is already available as a tamper-resistant regulatory product.
Accounting Means Reconciling Observations With Uses
Verifying International Agreements on AI
Required reading 2 — Can the declared work explain the observed activity? Working paper, arXiv:2507.15916v1.
Read: Appendix A.6, “Compute Accounting via Analog Sensors”: the opening “Background” discussion, ending before Table 13. Skip the table, equations, and detailed implementation options.
Reading focus: Why do the authors compare sources of compute with declared uses, rather than simply seek one total?
Mauricio Baker et al. | RAND (2025) | 6 min
Baker and colleagues propose comparing observed compute activity with verified declared uses. Their discussion distinguishes operations required by a model from extra operations actually executed, including recomputation. They also identify the difficulty of deriving an operation rate from physical measurements. This is an accounting proposal with implementation challenges, not a demonstrated universal sensor-to-FLOP conversion.
Consider an operator who explains every observed hour of GPU activity as permitted inference. The explanation is useful only if the declared inference really occurred and its claimed compute cost is credible. Inflating the declared cost could make unreported work appear accounted for. Conversely, a mismatch may reflect a poor cost model or equipment inefficiency rather than prohibited work.
A useful report therefore preserves both the evidence and the uncertainty. “Between 81 and 93 units under convention C” may be a more defensible statement than “87 units,” particularly when the legal threshold is 90.
A Restart Is Not a New Legal Run
Counter readings belong to a device, a time interval, and a counting convention. They also need continuity information. If a counter restarts from zero after reboot, its latest reading does not include earlier execution. Resetting the device does not erase that execution from the agreement’s accounting.
For a period with uninterrupted evidence, compute can be summed over disjoint intervals and devices. The harder cases are bookkeeping and scope:
- Restarts: retain the last authenticated pre-reset value and identify the new counter epoch, meaning the period since its initialization. A gap between them remains a gap.
- Overlapping records: do not add both raw interval counts and a cumulative total covering the same intervals.
- Work spread across sites: combine records belonging to the same legally defined run even if they have different local job identifiers.
- Shared devices: distinguish the device’s total work from the portion attributable to the relevant job. A whole-device counter alone does not assign operations to a tenant.
- Changing conventions: record which counting rule produced each value. Do not add incompatible units or silently apply a new conversion to old evidence.
Evidence linking jobs may include authenticated scheduler records, checkpoint lineage, and transfer records. A checkpoint is a saved model state from which work can continue. Such evidence needs its own trust and confidentiality protections. Merely asserting that two jobs are unrelated should not determine whether their compute is aggregated; neither should the verifier aggregate unrelated jobs solely because they shared a building.
Distribution does not make compute disappear. It makes the relationship between records harder to establish. Work on distributed-training governance examines why large-cluster assumptions can miss activity spread across smaller installations; it is a reason to define the accounting boundary carefully, not evidence that every distributed evasion is feasible.
Rahman, Does Distributed Training Undermine Compute Governance?
Recognizing a Workload From Telemetry
Telemetry is a sequence of measurements such as power draw, memory use, utilization, and data movement. A classifier uses patterns in those measurements to assign a label, such as training or non-training.
In conventional neural-network training, the system computes outputs, calculates how parameters should change, and updates them. Inference uses a model to compute outputs. Those activities can produce different patterns, but both involve arithmetic and memory access. Batching, model size, optimization, hardware, and mixtures of work can change the observed pattern. No single “high utilization” label identifies training.
For policy purposes, the useful question is not whether a classifier’s headline accuracy sounds high. It is which errors remain, under which conditions, and what decision the evidence will support. The framework below can be applied to any proposed classifier; completing this lesson does not depend on accepting a particular recent research result.
Four Questions to Ask About a Classification Result
1. What was the unit of evaluation? An accurate label for a short observation window is not automatically an accurate label for an entire run. Nor is the fraction of windows labeled training the fraction of operations spent training: windows may contain very different amounts or mixtures of work.
2. Which errors matter? A false negative misses training. A false positive flags non-training. Overall accuracy combines both and depends on the mix of examples. Even a modest false-positive rate can create many alerts when almost all observed activity is permitted. An alert is evidence to appraise, not a legal finding.
3. Was the test meaningfully new? Measurements from the same run can look similar. Holding out some nearby windows is a weaker test of generalization than holding out entire workloads, hardware configurations, or attack strategies. Performance after learning a particular evasion shows successful adaptation to that evasion; it does not establish resistance to the next one. Repeated windows also need not provide independent evidence.
4. Could the adversary change the evidence rather than the workload? A tenant who controls its application and an operator who controls the host are different adversaries. A classifier may accurately label every trace it receives while the operator supplies a substitute trace or disables collection. A secure design needs to bind measurements to the device, interval, and workload and make missing evidence visible.
This is the direct connection to 2.1.2: attesting the classifier’s code does not establish that its input is genuine. It is also the connection to 2.1.3: a complete trace from one registered machine does not reveal activity on an unregistered one.
The confidentiality trade-off remains. H100 CC-On’s disabled performance counters, discussed in 2.1.2, are a warning to verify the actual measurement path. Do not assume that all low-rate management telemetry and all profiling counters are interchangeable, or that every metric is available in every protected mode. A deployment needs a metric-by-metric compatibility and integrity check.
NVIDIA, “Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AI”
Authorization Is Not Another Classifier Label
Suppose the classifier correctly detects parameter updates. The operator presents a genuine authorization for a safety evaluation. Neither fact settles compliance: the authorization may permit those updates, prohibit them, or allow them only within specified models, procedures, devices, dates, or compute limits.
Likewise, an inference classification is not a safety certificate. Whether inference is allowed follows from the agreement; another agreement might restrict particular inference uses.
For the pause claim, the verifier needs evidence for all relevant elements: the activity falls within the covered training category; its counted compute exceeds the applicable threshold when aggregated correctly; and no applicable authorization permits it. Uncertainty in one element cannot be erased by a confident answer to another.
The appropriate response to an unresolved case might be obtaining additional evidence, applying a separately defined reporting rule, or referring the case for review. Whether suspension is permitted, who can order it, and how it is reversed belong to the authorization framework examined in 2.1.5.
Exercise — Assessing Job J
This is a hypothetical continuation of the pause claim from 2.1.1. The quantities and evaluation results below are invented for the exercise, not findings from the assigned paper.
The rule requires a license for a covered training run exceeding 90 compute units. One unit is 10²⁴ operations under a fixed convention C. All executed operations of a covered training run count under C, including repeated work. A restart, site change, or local job-name change does not create a new run.
For this exercise, independently checked records establish that the following activity belongs to job J and covers all its participating devices. Counter integrity and convention C are accepted except for the explicitly missing interval. The regulator is still investigating the job’s workload type and authorization.
| Evidence | Finding |
|---|---|
| Site A, before restart | Preserved authenticated records establish 32 units |
| Site A, after restart | A new counter epoch establishes another 21 units; no overlap with the first interval |
| Site B | Records establish 28 units, distinct from the A records |
| Missing interval at A | An independently validated capacity-and-duration bound permits between 0 and 12 additional units |
| Workload classification | 80% of observed equal-duration windows are labeled training |
| Authorization | The issuer confirms that the signed authorization is genuine and permits only evaluation of a fixed model, with no parameter updates, during the relevant period |
The operator says:
Our latest counters total only 49 units. Even if you count earlier activity, the classifier proves that only 80% was training. The genuine safety-evaluation authorization settles the rest.
The classifier evaluation used in question 3:
| Actual workload | Labeled training | Labeled non-training |
|---|---|---|
| Training | 90 | 10 |
| Non-training | 45 | 855 |
Carry Forward
At this point, a hardware regime has three separate outputs: an inventory with coverage limits, a compute account with continuity and uncertainty, and an appraisal of workload evidence against the rule. None is yet a decision about who may stop a machine. Section 2.1.5 examines that authority and the safeguards around it.
Optional: What Does This Paper Actually Establish?
This activity is not a prerequisite for the next lesson.
Detecting Hidden ML Training With Zero-Overhead Telemetry
Critical reading. Research paper, version 1.
Read: Abstract; §2.2; Table 3 in §5.2 with its notes; §6.5; and Appendix F. Skip code and algorithm details; nothing here needs to be run.
Purpose: Assess a recent contribution using the lesson’s framework. Inclusion is not an endorsement of its strongest claims or evidence of field-wide consensus.
Robi Rahman and Sabiha Tajdari | arXiv:2606.19262v1 (2026) | 20 min, including reflection
Vocabulary: “hardened” means revised after exposure to attacks; “unseen” means withheld from the relevant classifier training; “white-box” means the attacker can inspect the classifier. A classification window is an interval of observations treated as one input.