Computing power is what to verify, not human behavior
For US-China AI slowdown deals to work, the core challenge is trust; verification technology turns it into engineered proof. The engineers building it today could be counted on single-digit teams worldwide.
The video won't play here. Listen to the audio instead:
The argument · timestamps estimated from transcript position
Computing power is what to verify, not human behavior
Breaking down AI development inputs reveals three categories: staff, algorithms and data, and computing power. Milton selected computing power as the focus because it's uniquely specialized for AI, requires thousands of chips, and currently must be physically concentrated in one location—making it far simpler to verify than monitoring employee actions or auditing code. This is why computing power would be the first and most easily verifiable component if the US and China negotiated an AI slowdown agreement.
— Tom MiltonInference re-execution lets GPUs prove they only run predictions
Amodo's prototype places a network splitter at a data center's edge, copying traffic to verification servers that re-run identical input tokens and compare outputs (using the DiFR algorithm to handle model randomness). If all network traffic can be explained by this re-execution, the compute is provably running only inference; unexplained network signals reveal a hidden training job. This deterministic replay technique makes it nearly impossible to disguise what a GPU is actually doing without getting caught.
— Tom MiltonPower consumption signatures expose model architecture and size
The episode demonstrates wrapping an inductor around a GPU power supply, connecting it to an oscilloscope, and running nanoGPT training. The power curve clearly shows forward pass, backward pass, and idle periods—and the small spikes between layers even reveal the model has 12 layers. These ‘side channels,’ traditionally exploited by attackers to steal secrets, can be repurposed as surveillance tools to see what compute is doing. That said, achieving GPU-level precision across an entire data center is extremely difficult; the best you can do is capture signatures that can be partially obfuscated, but only at the cost of efficiency.
— Tom MiltonBoth sides must test verification systems in each other's data centers
Before signing the Partial Nuclear Test Ban Treaty, the US and USSR didn't rely on faith. They ran a joint verification experiment: Soviet scientists went to the US, American scientists went to the USSR, and each tested their own seismic monitoring equipment on the other's ground. Milton argues AI verification needs the same path. Before any agreement takes effect, each party's red teams should attempt to break—or verify—the other side's verification systems in real data centers or test environments. This is how you build confidence that the system actually works.
— Tom MiltonConfidential inspection results let verification work without exposing trade secrets
Under the Chemical Weapons Convention, inspectors bring mass spectrometers into chemical plants, but the instruments run in ‘confidential mode’—they output only pass or fail, not the full chemical spectrum, safeguarding corporate trade secrets. Milton hopes AI verification follows the same path: proving compliance with international rules without disclosing model weights or user data. But he emphasizes this isn't a perfect parallel. AI moves faster than the arms-control systems that took decades to negotiate, and some verification techniques may not transfer as cleanly.
— Tom MiltonStarting today, a skilled researcher could rank among the world's top five by year-end
Milton's assessment: if major labs have truly committed only one or two people to this work, a genuinely talented AI safety researcher beginning to focus on compute verification now could easily be among the five most consequential people globally doing this by year's end. He frames it as extraordinarily consequential: if you're a safety or security engineer at a lab, the nearest path to getting credit for ‘putting AI on the right track’ and eventual recognition might be developing the verification infrastructure that could underpin an international agreement.
— Tom MiltonEven the experts admit verification might be optional, not necessary
Pressed on whether verification technology is truly mandatory, Milton's answer is measured. He doesn't pursue a theoretically perfect, formally-proved ‘cheat-proof’ system—international coordination has always mixed trust, espionage, and eyeballs, much like arms-control treaties that count bombers with satellites. He positions verification as an ‘option’. A year ago almost nobody mentioned it; today researchers and governments are calling for it, so it increasingly looks like it will be deployed. But he admits nobody can definitively prove it's necessary.
— Tom MiltonLosing AI access for one day exposed Britain's core vulnerability
Milton describes three days of using Claude to design hardware circuits in one continuous session—until a Saturday morning when he typed ‘continue’ and got an error: the US government had enacted export controls on Fable, cutting off his access. This visceral jolt made him understand Britain's precarity: during compute scarcity, the US will likely prioritize domestic supply, potentially locking out countries like Britain that rely on cutting-edge foreign models unless they build sovereign compute infrastructure with sufficient security classification. This poses a real threat to company productivity and national research capability.
— Tom MiltonIn their own words · checked verbatim
You can see all of these little spikes, the really small ones — that happen at the start of each layer, and you can actually tell this is a 12-layer model from those spikes.
Tom Milton15:55
Before deals happened, before the US and the Soviet Union agreed they trusted that this would work, they ran a Joint Verification Experiment, in which Soviet scientists went to the US, US scientists went to the Soviet Union, and ran tests on one another’s infrastructure.
Tom Milton27:58
we would need to retrofit every single data centre in China and every data centre in the US. It just seems to me like it would require a level of cooperation that’s completely impossible.
Tom Reed39:37
So maybe only 50 engineers in the world are working on AI verification right now, on compute verification.
Tom Milton44:17
I think if you are a safety researcher, a security researcher in a lab, your most likely route to the Nobel Prize for making AI go well is that you are the one who develops the verification tools that enable a deal.
Tom Milton57:22
We might be in the world where we win because there are warning shots and we want to slow down. And in that world we might need verification technology. Perhaps we get away without it. But I would be much more happy if it did exist.
Tom Milton1:03:28
And then it was a Saturday morning, I woke up, I said to Fable 5, “Keep going.” It returned an error. I said, “Keep going” again; it returned an error. I went on Twitter: Fable access had been cut off.
Tom Milton1:44:14
Figures
| Amodo demo cluster size | ~30-32 H100/H200 GPUs | 11:15 |
| Global AI compute verification engineers | ~50 | 44:17 |
| UK Research and Innovation annual R&D funding | ~10 billion pounds/year | 1:30:34 |
| Amodo hardware projects delivered over four years | ~100 | 1:28:27 |
| Amodo hardware team size | 60 mechanical/electrical/firmware/software engineers | 1:09:08 |
| Manual GPU power monitoring board design time | 10-30 hours | 1:10:52 |
| Fable 5 hardware task time horizon | 10-100 hours | 1:14:42 |
| Model layers identifiable from power spike analysis | 12 | 15:55 |
| Zero-knowledge proof sampling verification rate | ~0.1% of packets | 12:36 |
Glossary
- zero-knowledge proof
- A cryptographic technique proving a claim without revealing underlying data like model weights
- flexHEG
- Verification hardware embedded in GPU chips that physically enforces usage restrictions on compute
- FPGA
- A reconfigurable chip reprogrammed here to record network traffic in encrypted logs
- side channel
- System information leaking through unintended paths like power or electromagnetic emissions; traditionally exploited by attackers to steal secrets
- OPCW
- The Organisation for the Prohibition of Chemical Weapons, based in The Hague and responsible for on-site inspections under the Chemical Weapons Convention
- national technical means
- Satellites, human intelligence, and signals intelligence—traditional state-to-state surveillance capabilities
How to listen
Researchers in AI safety and international governance mechanism design, policy practitioners, and engineering entrepreneurs working on AI-driven hardware development
If you only care about verification mechanisms, skip the personal hardware project story after 1:07