Pacing AI Requires Proof

We don't know yet if we are going to see an AI slowdown. But if we do, how will that look? When a country joins a nuclear treaty, their nuclear sites are physically audited for traces of incompliance. But what traces does a GPU leave?

If an AI lab commits to stop increasing capabilities, how does an auditor know it is keeping that commitment? If two countries agree to restrict certain AI workloads, how does either side know the other is complying? And if a datacenter demonstrates that it is serving an approved model, what proves it is not also training an unapproved one?

These are engineering questions, not just policy questions.

Attestable is building the verification infrastructure that can make AI pacing a practical option. Our approach combines two capabilities: proving that a computation follows an agreed policy, and accounting for enough computational work to bound what could be happening outside that policy.

This establishes both what the verified work is, and how much capacity could remain for everything else.

This offers a path to commitments that other parties can independently check.

The call for pacing has become concrete

The Pacing the Frontier statement now lists >1,300 employees of frontier AI companies. Its central concern is coordination: companies and countries face strong incentives to keep accelerating, while the world lacks the technical and governance tools to deliberately moderate that acceleration.

Recent events have made that concern more urgent. An Anthropic researcher recently announced his resignation while warning about the race toward self-improving superintelligence. Anthropic alignment researcher echoed the seriousness of the risk, while also saying that the company was trying its best to address it.

Dario's We Must Pace the Frontier then proposed a concrete sequence: embedded independent evaluators, coordination among democratic countries, and eventually global coordination. Sam and Elon agreed.

These statements should not be mistaken for an agreed halt to model training. Amodei explicitly distinguishes pacing from stopping technical progress. The policies, scope, and mechanisms are still being debated. But verification is already central to the discussion.

That is the problem Attestable is working to solve.

Start with a rule that can actually be checked

Suppose a government, a group of AI labs, or the parties to an international agreement decide on a temporary constraint:

Existing approved models may continue serving users, but only with safety classifiers. Designated compute must not be used to train newer models.

A different agreement might require inference to use models approved before a particular cutoff date. Another might restrict AI-assisted research and development, allowing inference only on inputs accepted by an agreed policy.

These are examples, not a claim that any particular government or company has adopted them. They are also different policies with different verification requirements. Our near-term proposal focuses on inference using an unchanged model, optionally combined with an agreed input classifier.

First, prove that the workload follows the rules

For supported workloads, Attestable generates a zero-knowledge proof that a specified computation satisfies an agreed statement. Our system is also formally verified, so it can be trusted for the most sensitive situations.

In an inference-only agreement, that statement could bind the computation to an approved model commitment, a defined inference program, and any required input checks. The verifier checks the proof rather than trusting the operator’s description of its software stack. The private model and data need not be revealed beyond the information contained in the agreed statement.

For example, an auditor could verify that an accounted workload used an approved, unchanged model rather than a newly trained replacement. Where an input classifier is required, the proof could establish that the agreed classifier was applied and accepted the input. That goes a long way, but not enough.

A proof of some computation is not a proof of all computation

Imagine a datacenter that produces valid proofs for every customer-facing inference request. Those proofs might all be correct, and the operator could still be using spare capacity to run an unauthorized training job.

Workload compliance and compute coverage are separate problems.

This is the missing piece in a pacing architecture based on zero-knowledge inference alone. Verifying a stream of legitimate activity is not enough. An agreement also needs to constrain the capacity available for activity that never appears in that stream.

Proof of useful work, or PoUW, is designed to connect computational results to evidence of required work. Research on matrix-multiplication-based PoUW, pioneered by Pearl Research Labs, explores how the same operations used in AI can contribute to that evidence, rather than requiring all of the work to be an unrelated puzzle.

In Attestable’s proposed integration, the two components serve different purposes:

Zero-knowledge proofs establish that the credited workload follows the policy.

Proof-of-work accounting establishes, under its assumptions, how much computational effort must have been committed.

Useful, approved inference contributes to the required work budget. When legitimate demand is insufficient, additional protocol-defined work fills the shortfall. This is the structure described in our near-term verification proposal.

A secure implementation must also make the accounting meaningful over time. Old results cannot simply be replayed as new work, the same work cannot be credited twice, and cheap computational shortcuts cannot be allowed to free up a large hidden budget.

The same architecture can support domestic rules and international agreements

Domestically, a regulator or independent evaluator could specify the approved model set and workload policy, then require participating operators to provide compliance and work-accounting evidence.

The evaluator would not have to choose between accepting an operator’s assurance and collecting all of its proprietary model weights and private customer inputs. The proposed verification layer is designed to disclose the agreed evidence while preserving those secrets.

Internationally, the same structure could support reciprocal commitments. Two countries could agree on a workload rule and accounting standard, then independently verify the evidence produced by the other side.

The aim is not to ask either country to trust a foreign company’s claim about its datacenters. It is to give each side a small, auditable verification procedure for an agreed computational statement.

What cryptography does not solve

A credible verification architecture must make its remaining assumptions visible.

Compute inventories remain essential

A proof cannot discover a datacenter that was never declared.

The verifier needs a credible estimate of the compute available to the participating actor, including relevant third-party access. If capacity is underestimated, the residual budget can be larger than the nominal bound suggests.

Our proposal identifies approximate knowledge of total compute as its biggest external dependency. The accompanying assessment discusses inventory tracking, audits, hardware-performance uncertainty, and access to compute in third countries as material concerns.

Inference-only is not automatically research-free

An unchanged model may still help researchers write code, design experiments, or develop ideas that improve future systems.

A restriction on new training and a restriction on AI-assisted R&D are therefore not interchangeable. An agreement that aims to restrict both needs a policy for both.

Our proposal explicitly treats the effectiveness of inference restrictions, and any input classifier used to strengthen them, as an assumption requiring evaluation. A proof cannot establish that the mechanism captures every possible route to capability improvement.

Give the world a verifiable option, fast

Whether to pace AI, which activities to restrict, and how much restraint is necessary are decisions for society and its institutions.

Our role is to make those decisions technically actionable in the near future. A world that decides to preserve existing AI services while constraining further acceleration should have a way to verify that distinction. A lab willing to accept limits should have a way to demonstrate compliance. Countries considering an agreement should have something stronger than reciprocal assurances.

Attestable is building toward that option: approved computation that can be verified, and unaccounted computation that can be bounded.

The choice should not have to be between trusting everyone and turning everything off. If the world chooses to pace AI, it needs the ability to prove that the commitments are being kept.

‍