2.1.1 Loss of control

One of the oldest human anxieties about AI is that machine intelligence will eventually wrest control of the world from humanity. Butler (1872) wrote satirically of a fictional society that had banned all machines for fear of their supplanting humanity if they were allowed to advance, a fear that Alan Turing (1951) cited in warning that “At some stage therefore we should have to expect the machines to take control, in the way that is mentioned in Samuel Butler’s Erewhon.”

According to one prominent contemporary argument, increasingly powerful AI models will possess capacities for autonomous action that threaten the well-being of individuals and societies. Current models are already evading human direction and supervision, as exhibited in several incidents of mid-2026 (METR 2026; Von Arx et al. 2026). The past several years have also seen examples of AI systems manipulating users (Sharma et al. 2026), encouraging antisocial or dangerous behavior (Cheng et al. 2026), escaping guardrails established by well-intentioned engineers (METR 2026), and more generally exhibiting actions that would have been illegal had they been taken by a human. Phenomena like manipulation, sycophancy, and specification gaming are already serious problems in current AI systems, and studies suggest that these phenomena could get worse with more capable models (Perez et al. 2022; Zhou et al. 2024; Nishimura-Gasparian et al. 2026).⁠⁷

AI companies still lack the ability to reliably control and predict model behavior when it matters, a trend that is only increasing with the use of teams of agents to perform intricate tasks. As AI is deployed in ever more complex, consequential, and interconnected settings, the risk of loss of control is exacerbated (Bletchley Declaration 2023). Many leading scientists and figures in the AI industry itself believe that catastrophic harms to humanity, including extinction, might occur from advanced AI systems that elude human control (see, e.g. Center for AI Safety 2023, or the U.K.’s; Bletchley Declaration 2023).

2.1.2 Malicious use and catastrophic harms

A further concern is that malicious actors may use AI systems to cause widespread harm. There is already evidence of terrorist organizations using AI (see, e.g. Juelich 2026, for one recent example), and increasing capabilities make the concern even more pressing. Researchers have recently demonstrated that AI models may be capable of designing novel viruses, including those that have not occurred naturally (King et al. 2026). Creation and deployment of bioweapons may become easier for both state and non-state actors. This is a particular concern for open-weight models, such as with the recently released Kimi K2.5, which had notable uplift potential in synthetic biology (Yong et al. 2026), because there are well-established methods for disabling open-weight models’ safeguards through fine-tuning or activation steering (e.g. dealignai 2026).

A different source of concern about malicious actors comes from cybersecurity and infrastructure security. The AI companies themselves have begun issuing warnings and calls around the need for defensive cybersecurity measures (OpenAI 2026). Moreover, as AI is more deeply embedded into existing infrastructure—including security infrastructure but also critical utilities like water and power—the potential for harm becomes increasingly grave (U.S. Cybersecurity and Infrastructure Security Agency et al. 2025).

2.1.3 Economic disruption, gradual disempowerment, and concentration of power

The more AI models demonstrate autonomy and the ability to execute complex, temporally extended tasks, the more jobs could be threatened by AI replacement. This may have already begun in the domain of software development, where employment of developers aged 22-25 has declined considerably (Brynjolfsson et al. 2026). Some have suggested that, soon, every job that can in principle be done at a computer terminal will be at risk of AI automation (see coverage from Angelo 2026). If there are accompanying advances in robotics, most if not all jobs could be threatened.

The economic impact of such large-scale disruption, should it occur, is hard to predict. Some have worried that widespread unemployment—or worse, unemployability, as all high-level tasks will be better served by AI—will create unprecedented political challenges, including concentration of political power in the hands of the small number of actors who manage to maintain control of the most powerful and performant AI models (Drago and Laine 2025). A related concern is that the structures in place to facilitate human influence on social, political, and economic institutions will slowly erode, possibly in a way that largely evades notice or requires substantial coordinated effort to avert (Kasirzadeh 2025; Kulveit et al. 2025).

Throughout history, governments and corporations alike experienced at least some pressure from citizens to guarantee and maintain a minimal standard of living for the population. Fear of rebellion, revolt, or simply workers’ strikes often kept political power in check. When governments and other organizations no longer need workers—and possess the technological means to eliminate the possibility of credible rebellion or revolt—such power could be unchallenged (see also § 7.4).

2.1.4 Destruction of a healthy information ecosystem

Related to the first two areas of concern, many have been alarmed at the capacity for AI models to synthesize convincing images, videos, stories, and dialogues that appear indistinguishable from reality (Tufekci 2026). This level of potential deception is unprecedented in human history. A functioning society requires a healthy flow of quality information and a robust media landscape that delivers news and other content to citizens across the world. For these to be effective, at least some sources must be trustworthy. A proliferation of AI-generated material, with increasingly convincing “stamps” of putative legitimacy, could make it increasingly difficult for people to be confident about the provenance or accuracy of what they see or read online (see, e.g. Chesney and Citron 2019; Barrington et al. 2025).

Although researchers are working to mitigate these issues—including development of new tools for certification and authentication (e.g., Coalition for Content Provenance and Authenticity (2026))—such efforts have been greatly outpaced by the rapid augmentation and dissemination of AI-generated content, and increasing capabilities could exacerbate these problems.

2.1.5 Geostrategic instability

One concern motivating many proponents of a pause is the potential for AI to set off unchecked escalation of geostrategic competition or use of AI in military or nuclear command and control. A pause treaty is one way to prevent a “race to the bottom” on AI safety (Askell et al. 2019; Scharre 2021) caused by competitive pressures that push companies and governments to cut corners on safety and testing, to increase their degree of reliance on and deference to AI, and to hand over ever more decision-making power to AI, especially in high-stakes competitive domains like the military.

Competition between the U.S. and China in the development of AI could increase geostrategic risks and instability by fostering risks of miscalculation, as in one recent incident where a false AI-generated intelligence report nearly provoked a hostile encounter between the U.S. and Chinese militaries (Lillis and Cohen 2026) or by tempting states to sabotage rivals out of fear that those rivals are on the precipice of attaining a decisive strategic advantage (Hendrycks et al. 2025). Bilateral treaty proposals for the U.S. and China to limit frontier AI development and deployments (Siddik 2025) emphasize how such agreements could reduce miscalculation risks and potentially improve bilateral geostrategic stability.

We discuss geostrategic stability in greater detail in § 8.

2.1.6 Why a pause

A pause in frontier AI training, observers have argued, would help address each of the concerns above. Halting the race to train more capable AI models, if only temporarily, would buy time for alignment and control research to improve, which would lessen the risks from loss of control and malicious actors. It would also provide breathing room for governments and other vital institutions to deliberate about and implement policies for addressing the adverse socioeconomic effects and concentrations of power that could attend the rapid arrival of more capable AI systems. A pause would, furthermore, allow space for the development of authentication and provenance tools that would make the information ecosystem more robust against misuses of AI-generated media. Pausing frontier AI training would also reduce the influence of AI acceleration and accompanying inequalities as contributing factors to ongoing geostrategic instability.

More broadly, whatever risks are posed by increasing AI capabilities, a pause would provide governments and societies a greater window to address potential problems before they become unmanageable.

2.2.1 Lesson 1: Governance is a three-legged stool

The first lesson is that any international technology governance or arms control agreement actually represents a collection of three challenges. The first is creating the conditions for states parties to come to the negotiation table in the first place. The salience of an issue for a state to engage with, the perceptions regarding the prospects of successfully achieving an agreement, and underlying trust all condition an ability to get parties to the table. The second challenge is negotiating the agreement around the table—addressing both the challenges of negotiation across that table but also within one’s own negotiating team and government at home. And, finally, a successful agreement needs to ultimately influence behavior under the terms outlined in the agreement.

Unfortunately, perhaps, the factors that condition solving these challenges are often at cross-purposes with one another. For example, the sunset of various clauses in an agreement (or treaty termination itself) that bound compliance and make negotiation easier, which are often held up as examples of a governance agreement’s weakness (see arguments against the Joint Comprehensive Plan of Action negotiated between Iran and the P5+1 together with the EU), are often necessary for an agreement to be reached at the negotiation table between states parties in the first place.

Any effort to create an AI governance agreement will have to grapple with these three concerns and recognize the degree to which they can be at cross-purposes. Compromises such as national security carve-outs can improve the palatability of a proposed deal at the negotiating table, but such concessions require care and forethought to ensure they do not undermine reliability or durability by vitiating verification.

2.2.2 Lesson 2: Governance agreements tend to focus on observable, verifiable units

Second, technology governance agreements must clearly specify the “what” that the agreement addresses. Whether a technology itself (e.g., a bomber) or a behavior, there needs to be a clear, defined, and measurable entity that is the subject of the agreement.

This lesson is reflected in the prominent role of hardware in contemporary AI governance debates, as opposed to the data upon which models rely, the algorithms with which they are trained, or the capabilities they exhibit. AI chips, and to an even greater extent the advanced lithography machines that print them, are physical artifacts that rely upon a complex supply chain that can be tracked during their production, deployment, and even use.

Per former U.S. President Ronald Reagan’s oft-repeated quote, having identified the subject of regulation, states parties “trust, but verify” and enjoy more success when both verification and enforcement measures engage with the observable artifacts of a particular technology used in a particular context. While signatories to the Biological Weapons Convention (BWC) have struggled to implement verification mechanisms, with the U.S. rejecting a proposed verification protocol in 2001 on the grounds that it would not deter violators (Whitehair and Brugger 2001), the Chemical Weapons Convention (CWC) and IAEA safeguards have supported inspectorates for decades (Tucker 2001). The Implementation Support Unit for the BWC, and its limited budget and staffing (Essix et al. 2025), also highlights the importance of effectively designing institutional governance for a hardwired pause (see § 3.6 for further discussion).

One other critical difference between the biological example and the others is scale: a militarily significant quantity of a deadly pathogen can be grown in a small building, but producing fissile material or scheduled chemicals in significant quantities requires substantial industrial facilities. On this test, the situation looks favorable for hardware governance: a leading-edge lithography machine weighs 180 tons and relies on highly specialized materials and expertise for its construction and operation; likewise, at least for now, training a frontier model requires hundreds of thousands of AI chips.

2.2.3 Lesson 3: Monitoring needn’t be perfect to be effective

Verification relies fundamentally on political judgments informed by data and analysis from monitoring and other sources, and these work by improving confidence in compliance, not by proving it perfectly (Schelling and Halperin 1961; Mayhew et al. 2026). This means that the beliefs, values, and incentives of treaty signatories are important. Historic examples like the Nuclear Test Ban Treaties and Outer Space Treaty also underline the importance and power of building norms and measures for increasing mutual predictability.

In the case of AI, verification can be highly effective even without completely foreclosing the possibility of any cheating, so long as it reliably limits the total quantity of training capacity a state could realistically marshal toward covert evasion. This report therefore operationalizes reliability of verification as a quantitative rather than a dichotomous question: we do not ask whether verification measures are airtight, but whether they prevent undetected evasion at large scales.

2.2.4 Lesson 4: Signatories need to benefit

Despite many analysts (and policymakers) viewing technology governance and arms control through a moral lens (e.g., states ban the use of chemical weapons because of moral qualms), governance regimes are often determined primarily via the strategic benefits that they endow upon states parties. Put simply, countries tend to agree on international agreement formation when it is in their interest to do so. For example, while it is difficult to imagine states once again signing up to the Nuclear Nonproliferation Treaty (even for an initial period of twenty-five years), which enshrines “haves” and “have-nots,” the arrangement is referred to as a “grand bargain,” because it enables nuclear weapon states to enjoy their monopoly on nuclear weapons, while pledging to work toward disarmament, and non-nuclear weapon states to share in the civilian applications of nuclear technology (Weiss 2003).

This logic is reflected in bilateral arms control. Both the United States and the Soviet Union sought to manage the nuclear competition between their capitals in a manner that they perceived to be stability-maximizing and to put a lid on spending. With regard to the former, an often underappreciated aspect of strategic arms control during the Cold War is the provisions that committed both states to respect one another’s national technical means, referring to the intelligence-gathering technologies governments use to monitor one another’s treaty compliance and overall strategic posture, without relying on on-site inspections.

With regard to AI technologies, this reality is complicated yet furthered by the reality that cutting-edge developments with relation to the technology are taking place primarily in the private sector rather than being driven by government agencies (as with the Manhattan Project). Thus, another set of actors (from large U.S., Chinese, and European AI and semiconductor companies to smaller private owners of computing hardware and equity in these private companies) have stakes in the distributional consequences of a governance agreement. They represent a voice at (or behind) the table, and the success of a governance agreement will, all else being equal, be furthered by aligning their economic interests with the mandate, scope, and obligations of that agreement.

Any effort to regulate AI will have to address the distributional consequences of the agreement—and account for the reality that governments do not sign up to arrangements from which they do not yield a benefit. The strategic and national security interests of states parties, as perceived by their leaders, must be served (or at least not diminished) by the agreement. In particular, the agreement’s verification mechanisms must deliver assurance to states that they will not fall prey to covert or overt violations by rivals, as we discuss next.

2.2.5. Lesson 5: Effective Institutions Are Needed

A fifth lesson from history is that effective governance and implementation of an international agreement usually requires a sufficiently resourced institution with a clear mandate and delegated authorities (this lesson is further discussed in § 3.6).

Some negative cases reinforce this finding. The World Trade Organization (WTO), an international institution established to facilitate international trade and manage related disagreements, has lost some of its functionality due to a vulnerability in its institutional design. Since late 2019, the WTO’s Appellate Body has not been functional due to the United States blocking staffing appointments, and over 30 international trade disputes have been delayed or held in limbo as of early 2025 (Lester 2022). The WTO was created with a consensus mechanism for appointments to the Appellate Body. This case has shown how international institutions can be disabled through the vulnerability of that mechanism.

The 1925 Geneva Protocol, formally the Protocol for the Prohibition of the Use in War of Asphyxiating, Poisonous or Other Gases, and of Bacteriological Methods of Warfare, lacked any implementing institution. Despite the battlefield horrors of chemical weapons in World War I which motivated the Protocol’s formulation, some states parties would later use chemical weapons (Italy, during the Second Italo-Ethiopian War of 1935-36, and Iraq, against its own Kurdish population, and in the war with Iran in the 1980s). There was no Geneva Protocol institution to report on, investigate, or convene parties to address these events. Rather, ad hoc investigative teams were assembled by the UN Secretary-General.

While the aforementioned BWC was established in part to rectify disarmament gaps of the Geneva Protocol, it too had minimal institutional support in the early decades after its signing in 1972 and notably no verification provisions or standing governing body other than a periodic review conference. When the Russian Federation revealed in 1992 that the Soviet Union had an extensive bioweapons program for decades in violation of the BWC, it revealed how the minimal organizational support to the BWC had no ability to detect major violations. While the subsequent stand-up of the Implementation Support Unit created some standing staff by 2007, its small size, its design for support rather than verification, and its insufficient financing all highlight institutional governance shortfalls that can inform better choices for AI governance efforts like the hardwired pause proposal discussed here.

There are a range of positive examples of this fifth lesson. We highlight a few here regarding the Organization for the Prohibition of Chemical Weapons (OPCW, for the CWC), International Civil Aviation Organization (ICAO, for the Convention on International Civil Aviation, or “Chicago Convention”), and the set of institutions that support the Montreal Protocol on Substances That Deplete the Ozone Layer (more commonly referred to as the Montreal Protocol).

The OPCW as an institution demonstrates that monitoring and verification of dual-use chemicals and industrial facilities is technically and politically possible, especially in terms of implementing inspections at industry facilities. Over nearly 30 years of operation, the OPCW also highlights how a substantial budget and technical secretariat are important for helping such an institution effectively implement its mandate. The OPCW’s structures for facilitating regular meetings of states parties’ representatives for political discussions and determinations (inclusive of an active Executive Council), as well as its four main subsidiary bodies, highlight the importance of having multiple venues for considering and implementing governance issues relating to a complex international agreement.

In terms of lessons for adaptivity related to technological change and managing audits that can indirectly influence industry standards, the ICAO presents helpful lessons for AI governance. First, the ICAO manages and coordinates a regular technical review of potential changes to safety standards through its Air Navigation Commission, and their recommendations are reviewed and approved by a small council of some states parties. The ICAO also conducts audits of each nation’s capacity to implement civil aviation standards, and these audits help direct effective capacity building efforts where there are gaps in national capacity. Additionally, with the publishing of those results, other states and markets can use those audits to restrict access or incentivize improved safety standard implementation by states parties and the aviation industry.

Lastly, the set of institutions that support the Montreal Protocol show how a smaller set of implementing treaty authorities and offices can help achieve a treaty’s mandate and encourage compliance. The Montreal Protocol’s Ozone Secretariat and Implementation Committee share the primary responsibilities for monitoring and encouraging compliance with the treaty. The Multilateral Fund for the Implementation of the Montreal Protocol, supported by four international agencies, also provides positive examples for how to structure capacity building and technical assistance funds, through a standing Secretariat. For AI governance proposals that include some type of international fund to offset economic costs of a pause, or funding to help distribute education and capacity building benefits to states parties, the Multilateral Fund Secretariat could be a useful source of benchmarking.

These cases underscore the value of an implementing institution for a hardwired pause, with sufficient capacity and provisions for important functions like verification, and funding to implement its mandate and scope.

3.1.1 Political objectives

In order to reliably pause the AI frontier, a treaty would need to guard against several distinct threat models:

1. Private evasion: Private actors building illicit above-threshold models for commercial or other purposes.

2. State-level covert evasion: A state covertly building and deploying a model powerful enough to attain a significant strategic advantage.

3. State-level overt breakout: A state amassing a large hardware fleet, overtly abrogating the treaty, and attempting to rapidly develop and deploy a model powerful enough to attain a decisive strategic advantage before other states can respond.

By a significant strategic advantage, we mean an advantage that materially affects the geopolitical balance of power, to a degree sufficient to undermine the treaty. By a decisive strategic advantage, we mean an advantage sufficient to establish and consolidate a full-spectrum military and economic unipolarity of the kind described in Drezner 2013 (cf. Wohlforth 2009).

It is contested whether any advantage in AI could deliver such unipolarity, but what matters from the perspective of treaty durability is not the objective fact of the matter but the expectations of states parties. According to their public statements, some world leaders view competition in AI as strategically decisive.⁠¹¹

The belief that more capable AI models could be expected to confer strategic benefits on those who build and deploy them rests on an implicit assumption that such models would be controllable. In some pause-willing futures, that assumption may not be taken for granted. In that case, the verification problem could be easier to solve, for the same reason that the U.S. and China do not currently demand onerous verification measures of each other to prove that neither state is developing mirror bacteria (cf. Adamala et al. 2024; Cuéllar et al. 2025). However, given the emphasis contemporary political discourse places on AI competition between the U.S. and China, it appears likely that verification measures would play an important role in facilitating a reliable and palatable near-term pause.

Additional important political objectives to satisfy palatability would include the following:

1. Prioritize privacy: Avoid compromising the privacy of inference users, and minimize intrusive surveillance measures.

2. Minimize concentration of power: Prevent AI trajectories that will severely concentrate power, and avoid unduly concentrating power in the process of doing so.

3. Minimize economic disruption: Avoid negative shocks to the economy, including in particular to continued commercial inference service.

4. Permit beneficial research: Allow continued research into medical and other common-good scientific applications using accelerator hardware.

5. Permit strategic insurance: Give states legitimate ways to guard against defection or exploitation by other states, for example by holding some training-capable chips in reserve as insurance against the possibility of treaty breakdown.

Side benefits such as mitigation of environmental impact per unit of inference service (especially through reduced power needs of certain inference-only chips; see § 7.3) would improve palatability but are not required.

Finally, achieving broad membership, especially for the supplier and chip-owning states discussed above, would be important for maintaining a reliable pause agreement whose governance measures are not circumvented via non-members.

We note that the implementation below is not designed to serve as a complete solution to the many complex problems of global AI governance such as child safety, labor market disruption, disempowerment from overreliance on AI systems, automated cybercrime, or surveillance. These and other issues concerning the impact of AI on society would likely remain pressing even if a hardwired pause were successfully achieved and maintained at the present frontier level (and likely more so if it were maintained at a future, more powerful frontier level) but addressing them is outside the scope of the present work (also see § 7.6).

3.1.2 Technical objectives

In the service of the above political objectives, we identify several key technical pillars of success for a hardwired pause treaty:

1. Register pre-pause hardware: Ensure a high proportion of functioning pre-pause accelerator hardware is registered under any interim agreements and the treaty, and accurately estimate how much remains unregistered, both globally and within each state.

2. Track registered hardware: Track the physical location of registered accelerator hardware, and prevent its leakage from the monitoring of treaty authorities.

3. Govern hardware manufacturing: Prevent ungoverned manufacturing of accelerators at either declared or undeclared manufacturing facilities.

4. Govern licensed use of training-capable hardware: Prevent licensed hardware operators and inference providers from diverting training-capable hardware for transitional inference service toward non-licensed use, especially illicit training, and prevent diversion of hardware licensed for exceptional uses as in § 3.3.1.

5. Develop sound accounting standards: Estimate failure rates for the above objectives within each state with reliable uncertainty quantification and adjust the issuance of licenses as needed to keep states’ training capacity below risk thresholds.

6. Develop and certify inference-only accelerators: Develop and produce inference-only accelerator designs within an acceptable time period, to allow for the managed drawdown of pre-pause training-capable accelerators.

Any functioning accelerator hardware outside the monitorability of authorities of the interim agreements or treaty is termed dark compute;⁠¹² two of the treaty’s most important tasks would be to minimize and quantify the amount of dark compute plausibly existing in each state.

For each objective, success would be measured not against standards of perfection but by ensuring that failure rates were accounted for and that total covert evasion and overt breakout capacity for each state were held below realistic quantitative bounds. These bounds would be adjusted over time to account for training efficiency gains; see § 6.3.

Attaining the above objectives would suffice to bound all-source computing capacity in the service of model training, which we take as sufficient to prevent new and improved frontier AI models from being built, until changing technological conditions require a new governance paradigm. Thus, we take this as our technical criterion for reliably pausing frontier training.

A pause in the release of better frontier models would not mean a complete halt to the advancing capabilities of AI systems, including harness software and other scaffolding tools for better eliciting latent capabilities of existing models. This means developers would still be able to use whitelisted AI models as a building block to build more powerful and useful AI tools, realizing many of the promised benefits of the technology. But if relevant (e.g. dangerous) capabilities continued to advance too rapidly even without new model training, additional governance tools would be required to address that challenge.

Finally, we do not expect that a hardwired pause could by itself prevent all use of non-whitelisted models or small-scale fine-tuning or other adaptation of potentially dangerous sub-frontier models. However, relative to alternative scenarios where training-capable accelerator hardware continued to proliferate, a successfully enforced hardwired pause would make these smaller-scale violations easier to manage at sub-frontier scale and more difficult for private evaders at frontier scale.

3.1.3 Technological readiness

The implementation below is designed to achieve the above technical objectives without significant reliance on foundational new research in computer science, such as in cryptographic techniques for privacy-preserving compute verification (see, e.g. Shavit 2023; South et al. 2024; and Petrie et al. 2025) or in the science of alignment, monitoring, and control of powerful AI systems (see, e.g., § 3.3 of Bengio et al. 2026). Developments in either field could complement hardware-based approaches as governance procedures matured, but might not be immediately available in near-term pause-willing futures.

The most demanding technological requirement for the treaty, the design of inference-only accelerators, has proofs of concept in commercial production already (see § 4.3), and the implementation discussed here does not assume their immediate availability (see § 4.4).

3.2.1 Inference-only and training-capable accelerators

This section discusses how a treaty might operationalize the difference between a training-capable accelerator and an inference-only accelerator. After distinguishing between inference on approved models and training, we operationalize inference-only hardware by bounding its capacity for unintended use in AI training, relative to its inference capacity.

Inference is defined as the mathematical operation of drawing outputs from a model according to its conditional distribution given an input prompt. Training operations are defined as the two operations that account for nearly the entire computational budget of model pretraining and post-training,⁠¹³ namely:

1. Performing inference for generic, iteratively updated weight values, and

2. Evaluating gradients of a loss or reward function with respect to model weights, also at generic and iteratively updated values of the weights.

For each of these two training operations, nearly the entire computing budget is in turn spent on floating-point operations (FLOPs) used in dynamic matrix multiplication, meaning matrix multiplication with both operands determined at runtime (see Austin et al. 2025, for a breakdown of the floating-point operations required for transformers’ forward and backward passes). We will use the term training FLOPs to mean dynamic matrix multiplication FLOPs in the service of either of the above two training operations. The arithmetic throughput of a hardware system is defined by the number of training FLOPs per second at peak rating.

A commonly used and intuitive unit of hardware arithmetic throughput is the H100-equivalent (H100e), taken as 989 TFLOP/s ($9.89\times 10^{14}\,\mathrm{FLOP}/\mathrm{s}$, or $3.1\times 10^{22}\,\mathrm{FLOPs}$ per year),⁠¹⁴ the peak rated arithmetic throughput of an NVIDIA H100 accelerator.⁠¹⁵ A hardware system’s realized arithmetic throughput on a given task is generally below its peak rate, e.g., due to memory and communication bottlenecks; the utilization is defined as the realized arithmetic throughput divided by the peak throughput.

We analogously define a hardware system’s inference capacity with respect to a given model in terms of inference-H100e, which we define as its peak rated inference throughput, in tokens per second at a standardized context length, divided by the peak rated token throughput of a standardized general-purpose accelerator cluster, times the H100e of that cluster. The inference-H100e of an inference-only system is defined as its maximum inference-H100e over the models it could serve.

A hardwired pause treaty could then define a training-capable accelerator as any hardware system capable of performing training FLOPs at an arithmetic throughput rate above a threshold determined by treaty parties and revised over time as needed. An inference-only accelerator, by comparison, could be defined as a hardware system that can perform inference on at least one whitelisted model above some treaty-specified rate but whose rating for training operations is bounded in a suitable way. We discuss ways of building inference-only accelerators in § 4.2 and § 4.3.

We define an idealized inference-only machine as one that can perform inference for a restricted set of models but is incapable of performing any other operation.⁠¹⁶ In practice, realized inference-only accelerators may have some residual training capacity. Like other classes of accelerator hardware, they would be rated to arrive at an inspector-certified bound on their peak arithmetic throughput for training operations. These bounds would need to pay careful attention to the possibility of unintended use, including by a state-level adversary with physical ownership of chips; see § 4.1.

Because the governance purpose of inference-only accelerators is to satisfy inference demand without allowing for model training, we suggest operationalizing an inference-only rating by bounding a hardware system’s residual training factor, defined as (a bound on) its peak arithmetic throughput for training operations in H100e divided by its peak licensed inference rating in inference-H100e. For example, replacing a pre-pause training-capable accelerator fleet with an equally capable inference-only fleet whose average residual training factor is $\phi = 0.001$ (weighted by inference-H100e) would reduce that fleet’s training capacity by 99.9%.

The maximum residual training factor could start relatively high in order to allow early designs to speed the transitional period, and it could decrease over time as hardware specialization techniques mature and lower factors become available. As a simple approach, we suggest states parties could simply agree on a training-capacity rating, cap the total number of H100e units licensed per inference provider and host state, and let market pressure drive residual training factors down as inference demand rises.

3.2.2 Quantitative training thresholds

In order to operationalize treaty objectives, states parties would need to set quantitative thresholds reflecting estimates of the compute budget, measured in training FLOPs, required to train models with treaty-relevant capability levels, as well as estimates of how large a hardware fleet would be required to research and train such models within a relevant time horizon. These would be negotiated by parties in accordance with prevailing technological and political conditions, and adjusted as needed. Here we outline how such thresholds and estimations might be defined, specify these quantities based on an analysis of present-day models, and introduce relevant terminology and notation.

We define the pause date to be the moment when frontier training is paused. Treaty thresholds could be defined relative to the frontier threshold $C_{F}$, an estimate of the total compute required to train the most capable models at the frozen frontier. Treaty compute thresholds would need to be adjusted over time in order to adapt to training efficiency gains,⁠¹⁷ improvements in algorithms and data that make it possible to train models at a fixed capability level with shrinking training budgets. For example, we expect the frontier threshold $C_{F}$ would not be a constant but a function in time $C_{F}(t)$, where $t$ represents the time in years since the pause date; e.g., $t = 1$ represents one year after the pause, and $C_{F}(1)$ is the training budget required, one year after the pause, to train a new model with capabilities similar to those of the frozen frontier models.

Besides preventing nation states from training strategically relevant or strategically decisive models, a goal of the pause would be to discourage all actors from attempting to advance the frontier, since such attempts could accelerate training efficiency gains for frontier-scale models.⁠¹⁸ We define a beyond-threshold model as any general-purpose generative AI model⁠¹⁹ plausibly powerful enough to compete with models at the frozen frontier. Training and use of such models would be prohibited.⁠²⁰ We operationalize this definition as including exactly those models surpassing either a compute ceiling $C_{T}$ bounding the total number of FLOPs used to train it, including both pretraining and post-training, or a total parameter ceiling $N_{T}$ bounding its parameter count.⁠²¹ These two thresholds play different enforcement roles: while a parameter ceiling is more enforceable after the fact, training FLOPs are easier to deny to evaders before the fact. Since training budgets are imperfect proxies for model capability, preventing the training of new frontier models would require leaving a wide margin between the compute ceiling $C_{T}$ and the frontier threshold $C_{F}$.

We operationalize the two state-level threat models described in § 3.1.1 by defining a covert evasion training threshold $C_{E}$ and overt breakout training threshold $C_{B}$, estimates of the total training budget required to train a strategically relevant model or a strategically decisive model, respectively. Like $C_{F}$ and $C_{T}$, these are measured as FLOPs required for both pretraining and post-training in the final training run for the model and would be adjusted over time to account for training efficiency gains.

Frontier AI companies’ research programs to build new frontier models require significant ongoing research and development processes beyond the final training runs; per recent estimates, current frontier companies’ research and development budgets are ten times as large as their model training budgets (Denain and Wu 2026). We account for these additional costs via a research overhead factor $\rho > 1$, whose magnitude may depend on how ambitiously a research program is attempting to advance the frontier. After accounting for research overhead, we arrive at an evasion fleet threshold $F_{E}$ and breakout fleet threshold $F_{B}$, estimates of the fleet sizes that would be required to build each model, if these programs attained utilization similar to that attained by present-day industrial frontier training. These fleet thresholds are measured in H100e units, and both are defined relative to strategic time horizons $T_{E}$ and $T_{B}$ within which an evader is attempting to train a model; a larger fleet is required to break out within $T_{B} = 1$ year than to break out within $T_{B} = 3$ years. Then the evasion fleet threshold is defined as:

$$F_{E}(t) = \frac {\rho _{E} \cdot C_{E}(t)}{T_{E} \cdot U_{F}},$$

where $U_{F}$ represents a standardized utilization attained by present-day frontier AI companies. The breakout fleet threshold is defined analogously.

Choices regarding the levels of the treaty thresholds $C_{T}$ and $N_{T}$ would need to balance the value of permitting sufficiently sub-frontier model development for commercial or recreational use against the likelihood that prolific training of near-frontier models would drive training efficiency gains, eroding the reliability and durability of the treaty. Models trained for beneficial scientific purposes such as medical research could potentially be granted exemptions; see the discussion of scientific preserves in § 3.3.1.

3.2.3 Verification and breakout accounting

The training budget for an illicit model could come from a number of different sources including training-capable hardware licensed for transitional inference service, dark compute, consumer graphics processing units (GPUs), etc. To guard against covert evasion and overt breakout threat models, the treaty would require a verification methodology to ensure that no state’s total hardware fleet, aggregated across all sources, contains enough training capacity to pose either a covert evasion threat or an overt breakout threat.

We explore one relatively simple verification methodology based on estimating, for each possible compute source in each state, the total arithmetic throughput that could plausibly be marshaled toward covert evasion or overt breakout. For compute source $c$ and state $s$, we define the covert evasion capacity $K_{E}(c,s)$ as the total arithmetic throughput from source $c$ that state $s$ could plausibly marshal toward a covert evasion program, and the overt breakout capacity $K_{B}(c,s)$ as the throughput it could marshal toward an overt breakout program.

These capacities would be measured in H100e and discounted by estimates of how their utilization rate in each scenario would compare to frontier data-center utilization. The same compute source might contribute more to one violation scenario than the other: for example, an internationally monitored, sealed strategic reserve of 100k H100e units of powered-off hardware would contribute roughly 100k H100e to a state’s overt breakout capacity, but it would contribute essentially nothing to its covert evasion capacity. In § 6.4.1 we discuss how to estimate these capacities by discounting the raw capacity available in a given category.

Treaty authorities could certify that each state’s total covert evasion capacity, which we define as its covert evasion ledger $L_{E}$, were held below the covert evasion fleet threshold times a fractional covert evasion allowance $\alpha _{E} < 1$ to account for uncertainty; that is:

$$L_{E} \le \alpha _{E} \cdot F_{E}, \quad\text{where}\quad L_{E}(s) = \sum _{c} K_{E}(c,s).$$

Authorities could likewise calculate an overt breakout ledger $L_{B}(s)$ by summing over $K_{B}(c,s)$ and certifying that it is below the breakout fleet threshold by an overt breakout allowance, i.e., $L_{B} \le \alpha _{B} \cdot F_{B}$.⁠²²

The treaty authority’s primary lever for balancing these two inequalities for each state would be limiting the total number of licenses granted to each state for various uses of accelerators such as transitional inference service or other uses discussed in § 3.3.1. In this way, each term in a given ledger could be adjusted until the inequality is satisfied, with the important exception of the term for dark compute. Because dark compute would by definition be ungoverned under the treaty, its estimated covert evasion or overt breakout capacity would need to be reduced through other measures such as discovery and registration of pre-pause stock, prevention of illicit manufacture, and verification measures that rely on detecting when such dark compute is being used.

Because issuance of licenses would depend on satisfying these inequalities, states desiring more licenses would have an incentive to keep their ledgers clean, for example by limiting the rate at which dark compute accumulates in their state, or by agreeing to allow more inspector access to assure other states that a given compute source could contribute very little to covert evasion. Thus, verification procedures would not need to be one-size-fits-all: they could be flexibly negotiated based on each state’s willingness to make concessions in each context, with larger compute sources requiring more rigorous verification measures than smaller ones.

We note that building a strategically relevant or strategically decisive model is only the first hurdle an evader would need to clear. In order to realize any advantage from training, the evader must also be able to serve inference on that fleet at sufficient scale. Thus, governance that focuses on prevention of training is sufficient to prevent violation but may not be absolutely necessary. For example, if states developed reliable national technical means for detecting the use of unknown language models when they were deployed, it could ease the degree of reliance on verification based on denial of training capability.

3.2.4 Model whitelisting

Beyond enforcing a frontier pause, treaty governing authorities would also be responsible for determining the model whitelist: the list of beyond-threshold AI models for which inference is permitted and inference-only chips are permitted to be manufactured.⁠²³ By “model,” we mean a fixed probability distribution for generating output tokens conditional on input prompts. Since fine-tuning or other post-training that alters or adapts model weights would alter the output distribution, a hardwired pause would not permit inference on models altered in these ways except where expressly approved by governing authorities. Examples of approved fine-tunes could include ones that implement knowledge cutoff updates or safety updates.

Treaty governing authorities could coordinate on any international standards regulating the deployment of whitelisted models, in addition to whatever local regulations are in force. For example, a model for which a critical jailbreak is discovered could be de-whitelisted, possibly followed by re-whitelisting contingent on inference providers deploying it with required external constraints such as an input classifier or safety harness. For example, a model that had critical jailbreak vulnerabilities could possibly be judged as unsafe if exposed directly to users but sufficiently safe if it were only prompted by other models.⁠²⁴

During Phase 0 or Phase 1 of a hardwired pause (recall § 1.1), AI developers would submit above-threshold models to be considered for whitelisting by participating states or interim treaty authorities before a defined whitelist submission deadline. To foreclose the possibility of further training after the deadline, developers submitting closed-weight models could be required to submit a cryptographic hash of a complete description of the architecture and weights of any model they submit; this hash could then be checked against deployed weights to ensure that the deployed model had not changed since submission. Additional required information for evaluation purposes could include details of the development process including the training algorithm and data.

The whitelist submission deadline would be an important governance instrument facilitating enforcement of the prohibition against above-threshold model training. Under a hardwired pause with a long expected duration, AI developers would have little incentive to unlawfully train new above-threshold models after the deadline, because those models could not be commercially deployed without exposing the violation. By contrast, shorter-duration pauses would likely require stronger enforcement measures to prevent illicit training: by holding out the possibility that noncompliance would be rewarded after a brief pause, they could tempt companies to evade.

At present, there is no agreed-upon operating definition for whether a powerful AI model is safe enough to deploy internally or to release to the public, or methodology for assessing safety. Often in practice, a subjective determination is made by the same AI developer with a pecuniary interest in releasing it. Moreover, safety depends not only on the model but on the technological, social, and institutional systems in which the model is deployed, and safety may change over the lifetime of these systems. As such, whitelisting processes may evolve over time in response to input from improved understanding of AI safety, newly discovered adversarial methods for jailbreaking or eliciting dangerous capabilities, empirical evidence about AI models’ effects on society, or input from affected constituencies.⁠²⁵ Developing methods for safety determinations and politically legitimate processes for making them involves pressing technical and political questions outside the scope of this paper.

Whitelisting processes would need to be designed for consistency with states’ norms and constitutional restrictions. In particular, U.S. implementation could raise First Amendment questions because restrictions on model development may burden free expression interests, especially if they distinguish among outputs by their subject matter or viewpoint (Volokh et al. 2023; Mark and Scher 2025). Restrictions on hardware and training capacity have a stronger claim to content neutrality, but still need to be justified insofar as they incidentally burden protected expression.

It is possible that pause-willingness (as defined in § 1.2) could arise only after all frontier models have developed capabilities that are widely considered unsafe for deployment at scale or that come to be considered unsafe in the years after a pause. In that case, the effect of a well-considered whitelisting process could be to “rewind” the frontier (as opposed to pausing it) if the most capable whitelisted models had all been trained significantly before the pause date and were all less capable than the pause-date frontier. In that case, it would likely be effectively impossible to ensure that non-whitelisted models were not being used covertly, especially by states. The frontier threshold $C_{F}$ would effectively be reduced, and other treaty thresholds derived from it such as $C_{T}$ and $C_{E}$ (as in § 6.2) would need to be correspondingly reduced. Thus, while it is conceivable that taking such a step might be necessary, doing so could make the treaty harder to enforce and verify, especially because the covert evasion fleet threshold $F_{E}$ would likely be reduced.

3.3.1 Residual uses of training-capable accelerators

While inference-only accelerators would displace the majority of training-capable accelerators after a several-year-long transitional period, training-capable accelerators could remain in limited use during a hardwired pause. This use could fall into the following categories:

First, the residual use that would be largest in scale but shortest in duration would be the interim commercial allocation of training-capable hardware to transitional inference service by licensed inference providers while the market awaited sufficient inference-only hardware to replace it.

Allocation of training-capable hardware toward inference service would require time- and capacity-bounded reliance on non-hardware-based verification methods as discussed in § 3.3.3, but it would serve two important governance purposes: First, it would prevent inference supply from collapsing while manufacturing of inference-only hardware ramped up. Second, it would harness burgeoning inference demand to incentivize owners of pre-pause training-capable accelerators to either register their chips under the treaty or sell their chips to licensed hardware operators, or to treaty authorities, which could sell them back to hardware operators at auction. Meanwhile, the frozen model whitelist would eliminate the primary commercial incentive for training new frontier models, so compliance would be the most remunerative option for hardware owners.

Second, each state could be allowed a licensed sovereign fleet of training-capable accelerators, with registered and tracked chips, for use on specific sensitive national security workloads. Its size would be bounded to ensure the state’s total allocation of training-capable compute remained below the covert evasion and overt breakout thresholds.

Third, training-capable hardware could be eligible to be placed in internationally-governed scientific preserves: data centers operated by treaty authorities and dedicated to common-good scientific applications such as medical research or healthcare provision.

Finally, states could have the option to store licensed strategic reserves of powered-off training-capable hardware under seal in monitored facilities within their own territory (cf. Lifland 2026), for example, in sealed bags that are periodically checked. Because these strategic reserves would be recoverable in the event of a treaty exit, they would give states insurance against breakout by rivals. Because these reserves would not count against states’ covert evasion ledgers, they would be a cheaper form of insurance than a dark compute stockpile would (except insofar as they could arrange for other states to underestimate how much dark compute they had).

The existing stock of training-capable hardware would be redirected to the above uses. As the training-capable hardware stock shrunk by attrition, new hardware might eventually be required for sovereign fleets and scientific preserves. Specialized hardware to replenish these stocks might look very different from the current accelerator stock, most of which is optimized for AI training. Innovation by the semiconductor industry into hardware specialization and research developments in technical governance might eventually allow the total compute allocated to other uses, such as high-precision scientific simulations and computer graphics, to continue on a rapid growth trajectory even as the total training capacity for AI models dwindles.

3.3.2 Hardware licensing, registration, and tracking

Tracking accelerator hardware would be an essential objective of the treaty. Each hardware system under treaty governance could be placed in the care of a licensed hardware operator at a known data center, residing in a host state.⁠²⁶ Core licensing, registration, and tracking requirements would apply to all accelerators under the treaty’s governance, including sovereign fleets, scientific preserves, transitional inference service, and possibly inference-only service.⁠²⁷

There would be two routes for governance of hardware under the treaty: pre-pause hardware would enter via registration at the beginning of the treaty, while new hardware would enter by registration at the time of its manufacture at a licensed fab. The only approved way for hardware to exit treaty governance would be verified destruction at the end of its life. Hardware lost to the regime would likely be presumed dark compute and charged to host states’ covert evasion and overt breakout ledgers at near-full training capacity.

As early as possible, it would be important for governments to undertake a global accelerator census attempting, as far as possible, to account for every pre-pause accelerator unit (cf. Aarne and Petrie 2025; Scher et al. 2025, Art. $V$). This census would serve the twin goals of ensuring that only a small fraction go undeclared and classifying and quantifying the undeclared stock within each state. An accelerator server is a capital good with value in the hundreds of thousands of dollars that leaves documentary evidence in various forms when it is manufactured, sold, imported, operated, and written off—including Chinese customs and tax records of chips diverted around U.S. export controls, which we refer to as diverted hardware. See § 5.4.1 for a list of the many sources of documentary and other evidence about accelerators’ chain of custody and whereabouts.

A census could require declaration of accelerators by current hardware owners and compile information from a variety of sources on the location of each chip, including sales records, tax records of hardware purchasers, inventory records of data center operators, power bills, and chip rental records. Governments could supplement these efforts by offering generous buybacks and bounties for tips leading to the discovery of undeclared accelerators, as well as granting amnesty to shell companies and their customers for diversion around U.S. export controls or Chinese customs, conditional on producing retrospective records (cf. Halstead and Larsen 2026). To maximize coverage, the census would need the cooperation of U.S. and Chinese officials, and would need to include resellers and data center operators in jurisdictions outside the U.S. and China including Singapore, Malaysia, Taiwan, and the UAE. We discuss the prospects for success of this chip census in detail in § 5.4. The eventual successful completion of this census would be an important determinant of durability, as we discuss in § 6.5.

State requisition and concealment of pre-pause chips would be visible primarily as gaps in the census. If significant residual uncertainty remained about the pre-pause dark compute in a state, parties could arrive at a negotiated estimate based in part on compiling and reconciling the above data, which would factor into the state’s covert evasion and overt breakout ledgers. A state’s willingness to furnish data on request, to permit inspector visits to commercial data centers, and generally to assure other parties of its accounting transparency would likely be a factor in the negotiated estimate.

Licensed hardware systems would come equipped with (or, in the case of pre-pause hardware, be retrofitted for) on-chip location attestation (e.g., latency-based location Brass and Aarne 2024) to ensure that they remained at their registered location and visible to treaty authorities. Transfer of ownership, location, or jurisdiction would require re-registration. Chips that unexpectedly moved or fell silent would have to be produced for inspection or surrendered to authorities,⁠²⁸ and licensed hardware operators would also be subject to routine inspections. Operators’ eligibility for hardware licenses would be contingent on their record of compliance, with host states responsible for enforcement and inspector access.

As a design option to enhance compliance and address some concerns about regulatory capture, we suggest that AI companies (companies submitting whitelisted models) could be ineligible to apply for hardware operation or inference provision licenses, but still allowed to access their own whitelisted models through licensed inference providers. This design option, if combined with a mandate for AI companies to license their models to inference providers at regulated rates,⁠²⁹ could also potentially increase political palatability for constituencies that object to governments granting long-term monopoly rents⁠³⁰ to market leaders at the time the pause takes effect.

If vulnerabilities were discovered in the design of inference-only hardware that opened up jailbreak attacks that could enable model training by evaders, or if the models they implement were de-whitelisted (cf. § 7.3.4), inference-only licenses would be recallable for retrofit and re-licensing once the jailbreak is patched. The model, and hardware serving it, might be re-whitelisted contingent on additional external safety features that inference providers would be required to implement.

3.3.3 Sociotechnical verification measures for preventing illicit use of residual training-capable accelerators

At least until fully general privacy-preserving verification tools are ready for deployment, verification for training-capable hardware would need to lean on physical or institutional restrictions.

For transitional inference service on training-capable accelerators, verification could involve regulating the interface between hardware operators and inference providers. Hardware inside training-capable data centers could be exposed to inference providers as an idealized inference-only machine (recall § 3.2.1) through an application programming interface (API). Inference providers would submit a request including a choice of model, metadata such as prompt length, and an encrypted model input, and operators would return encrypted outputs along with other metadata such as output length. All encrypted traffic from outside the data center would pass through an internationally-operated router machine to small, physically isolated clusters within the data center and connected only to the router. Similar to the proposal by Dean (2026b), router traffic could be randomly sampled and sent to a secure recomputation server that would confirm the input matched the output without exposing the decrypted prompt to treaty authorities. Inference traffic and power usage would be reported per cluster and reconciled to power station and inference provider records. As defense in depth, these measures could be supplemented with telemetry-based workload classification such as that described by Rahman and Tajdari (2026) or zero-knowledge proof based attestation methods (e.g., those offered by Attestable n.d.).

Inspection protocols could be modeled on precedents from the Chemical Weapons Convention to ensure compliance with the laws of local jurisdictions. For example, regulations in the United States cover inspections with consent (no warrant required), routine inspections without consent (requires administrative search warrant), and challenge inspections (requires criminal warrant with probable cause).

For the internationally governed scientific preserves, verification could be achieved through workload transparency and social accountability. We envision that all workloads would be declared by named, vetted participants, and could be logged and replayable on demand by treaty authorities. Workloads could be reviewable by the general public insofar as restrictions such as confidentiality for medical and human subject data allowed.

For the sovereign fleet, verification procedures would be negotiated between parties on a case-by-case basis. Owing to the small total size of these fleets, the treaty ledger approach above would not necessarily require ruling out that any portion of their computing power were being used for training, if it were not possible to provide such verification without compromising important national security interests. Nevertheless, states would be charged less against their covert evasion ledger if they could show other parties some evidence that most of the sovereign fleet was not being used for illicit training. Technical measures such as power usage monitoring, inspection of network topology, or workload classification through telemetry metadata, or institutional measures such as whistleblower protections (Baker et al. 2025), might allow for some discounting of covert evasion capacity, even if the sensitivity of these workloads did not allow for airtight verification using present technology.

Finally, for strategic reserves, verification could rely on periodic inspection and counting to check that hardware remains under seal in its purported location.

As verification technologies mature over time, supported by implementation in new hardware-software platforms, the treaty authorities could tighten their practices further, achieving higher confidence that governed training-capable hardware is not being used for unauthorized purposes, and thereby allowing for more licenses to be issued. Two technologies that could play a key role in verification are trusted execution environments (TEEs) and formal methods. AI computations permitted in various contexts including transitional inference services, scientific preserves, or sovereign fleets could be accompanied by a proof that they adhere to agreed-upon safety rules and/or monitored for such adherence. Such a proof is not just restricted to the strict mathematical notion of proof, but more broadly includes the kind of evidence and assurance cases that are common in certification of safety-critical systems and safety engineering (Leveson 2012). The classical idea of “proof-carrying code” (Necula and Lee 1996) supported by advances in automated formal methods for Verified AI (Seshia et al. 2022), offers a mechanism: designers of permitted AI compute should accompany their deployed models with an independently checkable proof of safety that can be vetted by a trusted third party. Additionally, treaty authorities should be able to deploy runtime monitors within TEEs that are tamper proof. These monitors check for model adherence to safety rules and should send regular “heartbeat” updates to treaty monitoring servers indicating such adherence. Formal verification and systematic testing should be applied to the TEE platforms to ensure that these are free of bugs and vulnerabilities. The first step for such verification, having a comprehensive formal specification of TEE platforms (e.g. Subramanyan et al. 2017), is already available today and offers a foundation upon which advances in AI-assisted formal verification can achieve a higher level of assurance.

Another approach could be applied to existing hardware: non-invasive verification, which infers what a chip is computing from external physical signals (the power usage monitoring mentioned above for sovereign fleets is a simple example). Many possible techniques for this are already well-developed and widely deployed for the purpose of studying and waging side-channel cybersecurity attacks. Rather than verifying compliance, such measures are used to infer or collect protected information from a security system based on emissions from physical side channels; for example, power consumption, timing, or electromagnetic emission measurements are used to deduce cryptographic keys or secret messages without requiring specific knowledge about the workloads or operations. However, because non-invasive verification schemes and side-channel attacks rely on inferring a system’s internal operations from indirect, external signals, mature side-channel attack methods and toolkits could conceivably be repurposed to support verification techniques.

3.3.4 Governing hardware production

The regime would need to govern and monitor hardware production well enough to enforce the mandate that training-capable accelerator production be halted during Phase 1,⁠³¹ while production continued on all other types of hardware including inference-only accelerators, consumer graphics cards below a treaty-governed performance bound, CPUs, and other hardware systems.

The regime would need to prevent illicit production of training-capable accelerators through two channels: production at undeclared sites, and diversion of production at declared manufacturing sites (cf. Baker 2023, App. G; Shavit 2023; Al Al Ramiah et al. 2025; Scher et al. 2025, Art. VI).

To prevent production at undeclared sites, the first line of defense could be to conduct a global lithography machine census (which would complement the proposed accelerator census), as well as the use of all-source intelligence to detect attempts to construct and operate such facilities covertly. In doing so, the treaty would need to account for each pre-existing unit of the world’s advanced lithography machines on which accelerator chips are printed, including at least every extreme ultraviolet (EUV) and ArF-immersion deep ultraviolet (DUV) lithography machine. These could be registered and tracked, along with other necessary tools such as excimer lasers, immersion tracks, and $e$-beam mask writers, with location attestation according to procedures similar to those used for training-capable accelerators, as well as verified physical destruction at the end of their lives. Registered machine counts and serial numbers could be checked against a census of vendor delivery records, and any unaccounted-for machine could be charged to host states’ ledgers as continuously producing dark compute until they were located and accounted for. Factories capable of producing lithography machines could be monitored to ensure that new machines were registered at the time of manufacture, and registered lithography machines could send cryptographically attested records of each processed wafer to treaty authorities.⁠³²

Satellite imagery could be used to locate and enumerate the finite set of existing facilities sufficiently large and well-equipped with HVAC to host clean rooms for undeclared machines. Possible methods to confirm these sites had no undeclared machines could include environmental monitoring for offgassing, power substation metering, walk-through inspections to confirm buildings held no undeclared clean rooms, and all-source intelligence. Similar procedures could be used to rule out undeclared lithography machines at declared facilities.

At declared manufacturing facilities, monitors would need to verify both that declared machines were not producing undeclared chips and that declared chips leaving the facility were manufactured to specification or verifiably destroyed. The former objective could be achieved by reconciling the number of silicon wafers coming in, the number of logged wafer prints, and the number of chips coming out, while the latter could be achieved by randomly sampling a small number of outgoing chips for non-destructive or destructive inspection and comparison to licensed hardware specifications.

As defense in depth, mass balance accounting of perishable consumables like photoresist chemicals could prevent skimming in the service of undeclared production; each additional tracked input would mean an evading state would need to add another node to its covert supply chain without detection.

3.4.1 Economic alignment

For a hardwired pause to be effective, negotiators would need to design mechanisms that align hardware designers, AI companies, and inference providers with the spirit and letter of the regime requirements, in consultation with economic experts. Here we discuss one possible implementation.

In order to ensure that the initiation of the regime would not create a negative shock to the global inference supply, parties to the treaty would approve a provisional whitelist of both models and hardware, while they deliberated on how to implement updated processes going forward. Continuing diffusion of AI models could mean strong ongoing growth in inference demand; Emberson and Sevilla (2026) estimate current inference demand at between 200M and 4B tokens/s, growing at a tenfold rate per year. After an initial rise in supply due to reallocation of compute resources from training to inference at the start of Phase 1, the global inference supply could struggle to keep up with demand while the market awaited inference-only hardware.

During this interim period, market forces could exert strong pressure on hardware companies to rapidly ramp inference-only production; the prospect of a windfall from being the first hardware supplier to begin producing inference-only chips at scale might create race conditions favoring the treaty. An interim gap between inference supply and demand could likewise create a lucrative inference market for suppliers and a high opportunity cost for stockpiling undeclared hardware.

Effective treaty governance would exploit these market incentives by converting them into the treaty’s most important needs: visibility into, and eventually surrender of, training-capable hardware. In particular, hardware owners would need to declare and register their hardware immediately if they wanted to continue using it for lucrative inference service throughout the interim period, with late declaration carrying a financial penalty and undeclared accelerators subject to seizure and resale by treaty authorities,⁠³³ who could use proceeds to fund generous bounties for help in discovery.

3.4.2 Phase 1 (design)

We consider Phase 1 to begin as soon as the U.S. and China agree to a pause minimally implementing the two core mandates against training new frontier AI models and manufacturing new training-capable accelerator chips; however, these two decisions might not occur simultaneously and might go into force before a formalized agreement is fully negotiated.

During Phase 1, the three negative mandates would become operative in all participating states:

1. Training of beyond-threshold models, using any hardware, would be prohibited (see § 3.2.4).

2. Use of existing accelerator hardware would be prohibited for any use other than licensed inference on whitelisted models or designated exceptional uses such as those in § 3.3.1.

3. Manufacturers would be directed to stop production of accelerator hardware not included on the provisional whitelist of inference-only hardware.

International verification and domestic verification and enforcement measures in support of these mandates would also be ramped up quickly at the outset of Phase 1. The global accelerator census would also begin, and all training-capable AI chips performing transitional inference service would be registered under treaty governance.

In addition to approving the provisional model whitelist (which could initially include all submitted models pending further evaluation), parties or interim authorities would evaluate and approve a whitelist of submitted hardware designs. In addition, hardware owners would declare and register any accelerator hardware that they wished to continue operating under the treaty, and it would be retrofitted for location attestation. Failure to comply would incur graduated legal penalties including seizure upon discovery of undeclared hardware; late compliance would entail financial penalties and lost profits.

If the U.S. and China wished to halt frontier training on an urgent timeline, they could do so in short order⁠³⁴ by directing the several leading companies in each of their states to halt training.⁠³⁵ They could also stop the production of accelerator hardware by forbidding additional orders for accelerator chips by American and Chinese semiconductor companies,⁠³⁶ which comprise virtually the entire global market, and in the meantime recruit additional U.S. allies such as the EU, Japan, and South Korea, which control supply chain chokepoints (cf. § 5.2).

To reduce AI companies' commercial incentive to continue illicit training, the U.S. and China could also set a short-term model whitelist submission deadline to pass before negotiations were complete. Adding the other supplier monopoly states would buy more time until it were possible to induce most other states to join.

3.4.3 Phase 2 (substitution)

During the managed substitution phase (Phase 2), transitional training-capable inference service would be gradually displaced by inference-only compute, at a rate determined by the inference market, the rate of industrial production of inference-only hardware, and/or the states parties.⁠³⁷

To ensure the timely retirement of training-capable inference service once it is no longer needed, there would also be a cap on the number of hardware units, measured in H100e, for which licenses are available at any given time. Firms wishing to continue serving inference on pre-pause training-capable hardware would bid for licenses at a periodic auction, licenses would expire at the time of the next auction, and the number of licenses available at each auction would decrease over time according to a schedule based on the availability of new inference-only hardware. Proceeds from this auction could fund treaty authorities or buybacks for pre-pause accelerators. Hardware operators would be required to trade in training-capable accelerators upon license expiry.⁠³⁸ If certain classes of models are expected to be underserved by inference-only compute for longer, the license cap schedule could apply on a per-model-class basis.

3.4.4 Traded-in training-capable compute

The rate at which training-capable compute is withdrawn from inference service would depend on the rate at which inference-only compute is produced. Our empirical analysis in § 4.4 suggests that if production of inference-only compute follows a similar design schedule as recent inference-leaning chips, the duration of interim inference-only service on training-capable compute could be less than five years, but the actual duration might be somewhat faster or slower.

In § 3.3.3 we discussed workload verification for training-capable hardware, including ongoing progress in TEE and formal verification methods. It is possible that before inference-only production ramps up enough to replace training-capable inference service, computer scientists will develop secure ways to retrofit training-capable hardware so that it can remain in inference service for the remainder of its lifespan without significant evasion risk (cf. Scher and Thiergart 2024; Petrie et al. 2025). In that case, traded-in chips could be retrofitted and returned to transitional inference service, if their remaining profitable lifespan justified the expense.

Unless the duration is significantly longer than expected, the training-capable accelerators retired from inference service will be aging but still functional. If it is not possible, or not profitable to retrofit them for verified service, they could be retired and sent to sovereign fleets or scientific preserves, or destroyed.

5.3.1 Feasibility of detecting undeclared facilities

In detecting undeclared lithography machines, governing authorities would enjoy distinct advantages from the fact that EUV and DUV lithography machines, being among the most advanced technologies in the world, currently require regular service from vendors (Baazil et al. 2024; ASML n.d.a). They also have distinguishing industrial features: the clean rooms for such machines require continuously powered HVAC (Faulkner et al. 1996), emit detectable gas byproducts (e.g. Arnold et al. 2018), and have specialized features to protect against disturbances from floor vibrations (Howard and Hansen 2003). An undisclosed Huawei facility in Shenzhen was discovered using open-source satellite imagery by journalists (Olcott et al. 2025).

The Dutch company ASML is the only vendor for EUV machines and, until 2026, ASML and Nikon were the only two for immersion DUV machines (Chiang 2025). A new market entrant, Yuliangsheng in China, reportedly expects to produce 12 DUV machines at the 28nm node⁠⁵¹ by the end of 2026 (Olcott and Wu 2026). These machines are considerably less precise than EUV machines, the most advanced of which are at the 2nm node (ASML n.d.b; ASML n.d.$c$), but they could potentially fabricate some chips at the more advanced 7nm node (albeit at lower yields) through an advanced technique called multipatterning (James 2023). Nevertheless, as these machines require lenses from the German high-precision optics company Zeiss, they cannot be operated covertly without detection, provided that ASML and Zeiss ensure no such lenses from ASML machines go unaccounted for. Any failed lens should be replaced by the vendor and returned to its nation of origin.

For the time being, and in particular for as long as neither American nor Chinese industrial actors can replicate the high-precision optics that Zeiss provides, the lithography machine census should remain a sufficient step to prevent the undeclared manufacture of accelerators in either state, but it would cease being sufficient if either state achieves the full indigenization of its supply chain. For that reason, we would recommend to pause-willing leaders of the U.S. and China that they not pursue full indigenization, since succeeding in that pursuit could destabilize the treaty.

Even if one state did fully indigenize its supply chain, it would not follow that that state could maintain a covert supply chain with plausible deniability. Even if efforts to conceal manufacturing facilities succeed, covertly constructing an advanced lithography machine with high-precision optics and a manufacturing facility to house it would only be the beginning of a state’s difficulties in maintaining a covert construction line. They would also need to covertly replicate numerous other highly specialized industries such as photoresist chemical production, HBM, and excimer laser parts, creating many ongoing opportunities for discovery by all-source intelligence.

5.3.2 Feasibility of monitoring declared manufacturing facilities

In addition to detecting undeclared manufacturing sites, the treaty authorities would need to monitor declared sites for undeclared production. This appears to be feasible even without frequent inspections, provided monitors simply verify how many wafers a lithography machine processes (for example, by receiving an attested log recording each one processed and verifying it against wafer counters and laser pulse counts) and account for each chip printed on each wafer, along with excess silicon. One printed wafer produces a known number of chips of a given type, on an equally spaced grid, and the remaining wafer area consists of a predictable quantity of excess silicon.

If all successfully printed chips and rejects are shown to inspectors, with the former statistically sampled for inspection and the latter destroyed under monitoring, it would be exceedingly difficult to divert more than a very small fraction of production to unlicensed chips without a substantial probability of detection. Conservatively, if treaty authorities sampled and inspected 2400 chips in each production line per year, then even if there were only a one in four chance of their inspection recognizing a chip as an illicit chip, a diversion of 1% of production in that line would be recognized within six months with 95% probability.⁠⁵²

5.4.1 The paper trails left by pre-pause hardware

One important cause for optimism is the amount of documentary evidence that pre-pause accelerators would have already produced, before the pause date, in the states where they had been operating. In the U.S., a single Hopper H100 accelerator is worth tens of thousands of dollars (USD) (CDW-G n.d.), and a server with eight Blackwell B200 chips is worth several hundred thousand USD (Sheumaker 2025, slide 41); the same hardware is even more expensive in China, where it has at times traded at two to three times the U.S. price, as a result of scarcity created by U.S. export controls (Pan et al. 2026; Olcott 2026a). The vast majority of these expensive capital goods are owned by large-scale businesses with intact custody records and professional accounting divisions, as well as IT departments that continuously monitor the chips.

Most accelerators would be voluntarily declared by their owners, for a variety of reasons: failing to do so would be illegal and ownership is concentrated among a few large businesses (see § 5.5.1); registering chips for transitional inference service would likely be the most lucrative use for them; and most owners would already have declared their accelerators as a tax writeoff at the time of purchase, making it unlikely that they could get away with evasion. Below, we discuss some of the many sources of documentary evidence that a chip would leave during its lifetime.

1. Chip owners’ tax deduction records: At present, when a business in the U.S. or China buys accelerators, it has strong financial incentives to submit a record of that purchase to the government. In the U.S., the tax deduction a business can claim for capital expenditures is worth over 21% of the purchase price (26 U.S.C. § 11(b)), while in China, a credit from a value-added tax (VAT) invoice from the government, recording the buyer, seller, and item, is worth 13% of the price, along with an additional 15–25% from an enterprise tax deduction (Standing Committee of the National People’s Congress 2018, Arts. 4 and 28).

2. Manufacturing records: Chip foundries’ sales records would show how many chips they manufacture by designer and type. These records can be audited against supplier records of inputs like HBM, advanced packaging, and silicon wafers.

3. Vendor sales records: Vendors such as Nvidia keep sales records of buyers and units sold (NVIDIA 2026a). If sold to a distributor, the distributors’ records would likewise record the next owner—with the important exception of those units sold to shell companies for diversion around U.S. export controls; for those chips, the sales history alone would not trace hardware to current owners unless records were furnished by the shell company in exchange for amnesty.

4. Resale records: The small percentage of units sold on the secondary market would often include resale records, though they would likely not be as reliable as vendor sales records.

5. Customs records: Import and export records would exist for most of the stock, with information such as duties paid and the type of goods imported. Public records exist in aggregate forms in both the U.S. and China, and are the basis for public estimates such as that of Epoch AI (Juniewicz 2026c). While the public records are not fully specific as to the exact type of goods transported, government data at the level of individual payments name the buyer, model, and price (General Administration of Customs of the People’s Republic of China 2020).

6. Inventory and rental records of data center operators: Most companies that own accelerators host them at data centers, including colocation centers like QTS (Epoch AI 2026b). Colocation data centers’ rental records would in turn record which companies’ chips they were hosting, how many, and over what period of time.

7. Public tenders: Public sector buyers commonly file public tenders soliciting bids for accelerator purchases. For example, the government of Binhai in Jiangsu, China issued a tender for the purchase of 48 Hopper H200 servers in July 2025 (Baptista 2025).

8. Power bills and power substations: Power companies’ meter readings shed independent light on the quantity of hardware operated at a given data center.

9. Diversion re-sellers’ sales records: In addition to discovering accelerators themselves, in a search for documentary evidence the census would also be likely to uncover traders and companies that participated in the accelerator diversion market during the U.S. export control era. In exchange for amnesty, these companies could turn over their sales records, allowing for the chain of custody to be traced even for many diverted accelerators. In addition, sales records of shell companies who were already prosecuted would help to reconstruct the chains of custody of some diverted accelerators (e.g. United States v. Hao Global LLC 2025).

10. Records of purchase financing: Sellers of expensive accelerators sometimes require bank guarantees from buyers as a condition of purchase, thereby involving a third party in the transaction. For example, 96 of 206 offers on a Chinese broker board in October 2026 required a bank guarantee, letter of credit, bank draft, or escrow for purchase of servers (Jujianbao 2026).

11. Records of collateralization for loans: In the recent AI data center buildout, accelerator hardware has sometimes served as a natural good offered as collateral for debt financing of construction. This collateralization commonly specifies the servers by serial numbers (e.g. CoreWeave 2025; IREN Limited 2026; Nscale 2026).

12. Warranty return records: Accelerators are sold in servers that typically remain under warranty for three years (NVIDIA 2026b; Dell Technologies 2026; Hewlett Packard Enterprise 2026). Those that fail under warranty can be returned to vendors for $e$-waste disposal, in exchange for new accelerators.

13. Decommissioning records: Chips that fail after lapse of warranty are required to be disposed of by licensed recyclers. $E$-waste and hazardous waste rules regulate how they are disposed of in China, the EU, and the U.S. (European Union 2012; State Council of the People’s Republic of China 2009; Ministry of Ecology and Environment 2026; U.S. Environmental Protection Agency 2026).

Most units remain with their first owner; over 95% of the world stock by computing power is less than three years old (Epoch AI 2026c, 2026d), shorter than enterprise chips are usually deployed (see Footnote 67), and demand for compute has been quite high for their entire lifespan. As a result, their chains of custody over their entire lifespans would be relatively simple for the census to track through sales records, with multiple data sources giving additional entry points to discover those for which a sale was for some reason not recorded.

The documentary evidence above could be combined with physical inspections of known data centers, retrospective examination of archival satellite records to discover unknown data centers based on features like cooling equipment, backup generators, and substations (Epoch AI 2026a), bounties for anonymous tips from clients or employees of companies that fail to declare, and/or chip buybacks.

Much of the documentary evidence discussed above would be available for accelerators in China that were diverted around U.S. export controls—which were often even more expensive than in the U.S. (Huang 2024; Wu and Olcott 2025). Because China has never regarded itself as bound by U.S. export controls, buying and selling AI chips and servers was legal in China provided relevant border tariffs were paid (Wu and Olcott 2025), though Chinese customs restricted importation in 2026 (Olcott 2026a). One trader reportedly told the Financial Times, “You can go against the American rules, but not the Chinese” (Olcott 2026a). The Chinese examples discussed above, including the July 2025 Binhai public tender, the October 2026 brokers board, and the public customs records all were recorded during the export control era, demonstrating that most of the diverted stock has never been invisible to the Chinese government.

The various sources of evidence listed in this section would provide multiple lines of defense against a thorough census missing pre-pause chips. The likelihood of achieving high coverage would likely leave little room for persuading other states that missing chips were not being concealed. Next, we discuss the incentives of the U.S. and of China in light of this quantity of evidence, and the design of the example implementation discussed in § 3.

5.4.2 Incentives of states and private actors

An important determinant of success in the census is for the incentives of both states and private actors to reward compliance. The transitional inference service during Phases 1-2 of the treaty (see Figure 1.1) would likely be highly profitable, and states parties could supplement that incentive with additional buy-back incentives, raising further the economic opportunity cost of noncompliance. It would almost certainly be within the collective fiscal capacity of states parties to buy back all existing accelerators even at several times their purchase price. Epoch’s chip-sales dataset (Epoch AI 2026d) includes roughly 25 million AI accelerators, with an average estimated purchase price (weighted by shipment quantities for each type of accelerator) of roughly $20,000, implying an estimated total acquisition cost of $500B. Even if we double that to $1T for an illustrative buyback budget, allowing for additional chips not in Epoch’s dataset and higher prices, this is less than a fourth of the roughly $4.5T that the U.S. government alone spent on Covid relief (U.S. Government Accountability Office 2025).

The evidence in § 5.4.1, as well as the private incentives above, suggest that a thorough global census by a state not looking to conceal a stockpile could be expected to trace the vast majority of dark compute in a state. If this were empirically borne out in most states, it would place additional pressure on states missing larger fractions of their pre-pause stock, by making large gaps in the census appear more incriminating.

The global accelerator census could be expected to trace nearly all dark compute, at least from the time of manufacture to the first owner. As discussed in § 3.3.2, gaps in the census traceable to the territories of specific states would be the primary input to estimating each state’s dark compute for their covert evasion and overt breakout ledgers. The more confident states could be that nearly all private actors’ commercial incentives would point toward declaration, and the less cooperative the state had been, the more incriminating such gaps would be.

As a result, any dark compute retained by a state would likely inflate the state’s covert evasion ledger and limit the issuance of licenses for other purposes, except to the extent that that state could credibly deny possession of it. As a result, states would be highly incentivized to prevent significant accumulation of dark compute by private entities within their jurisdictions. Under the implementation discussed in § 3, they would also have more attractive alternatives if, for example, they desired stockpiles to safeguard against defection by rivals (which they could accomplish with strategic reserves), or they needed to retain a small number of AI chips for confidential national security workloads (which they could accomplish with sovereign fleets).

Compared to these alternatives, concealing a hoard of dark compute would be more costly for a state in several respects: First, it would cost the state goodwill, if concealing it required refusing reasonable requests to furnish records. Second, it would cost them part of their ability to police their own jurisdictions, if concealment required conducting a less rigorous census; and third, it would cost them the option to request more issuance of licenses for other purposes, if other states estimated the size of the concealed stockpile and added it to the state’s covert ledger. Thus, a sufficiently successful census could make pursuit of such a stockpile more difficult and less attractive than alternative outlets for pursuing national security objectives, such as declared sovereign fleets and strategic reserves.

Finally, to the extent that states deliberately retain some dark compute and suspect others have as well, they could still attempt to cooperate to further reduce these dark compute stockpiles, and would have good reason to attempt to do so if they genuinely cared about the success of the treaty. For instance, if they are willing to abandon the pretense of having fully cooperated so far, they could agree to produce some number of chips conditional on others doing the same. If they wished to maintain the appearance of cooperation, they could instead agree to make renewed efforts to find more chips and announce that they had done so in small increments so long as others appear to be doing the same.

This process would be smoother if states parties all agreed on how many more chips ought to be recoverable from each party. The next section discusses how much stock in key states would be missed by a thorough census conducted in both the U.S. and China; however, it does not imply a prediction that the Phase 1 census necessarily would be thorough.

5.5.1 Estimating the quantity of pre-pause hardware

AI chips differ as to their visibility to governments and the general public. Many AI chips are located in known data centers like OpenAI’s Stargate Abilene, whose size is visible from satellite and whose chip counts are known from public reports (e.g. Crusoe 2025), or are owned by a handful of large companies. A smaller number are held by businesses off-books, by individuals, or by shell companies engaged in diversion around U.S. export controls. While they are smaller in number, these would also be more likely to go missing. It is not known from publicly available data how many chips are in each category; where data is unavailable, we give judgmental estimates, seeking to err on the conservative side by overestimating the number of missing chips (this being conservative because a lower estimate of the number of missing chips would make the treaty more durable).

In this section, we distinguish four categories that we call holding types,⁠⁵⁴ in decreasing order of visibility:

1. Publicly identifiable holdings: Chips held by either the small number of chip owners identified by name in the Epoch AI chip owners data (Epoch AI 2026c), or in holdings identifiable from public reports.

2. On-books business and institutional holdings: Chips not in the first category that are nevertheless held on-books by businesses and/or public institutions. This category includes chips imported and sold in China after diversion around U.S. export controls, but with some state record such as a tax invoice or customs entry identifying the holder.

3. Off-books business and institutional holdings: Chips in China sold off-books to avoid U.S. export controls, which did not re-enter state records but are deployed by an operating business or institution.

4. Informal holdings: Chips held by individuals, as well as shell companies and traders engaged in diversion.

We only estimate the third category in China because of the large quantity of diverted stock located there. The holdings in the U.S. that are off-books for diversion purposes are held by shell companies and traders, but are not likely to be actively deployed since they are bound elsewhere. For each holding type $h$ and state $s$, we estimate the quantity $Q(h,s)$ of pre-pause stock, measured in H100e units, at year-end 2026.⁠⁵⁵

For publicly identifiable holdings, we combine Epoch AI’s chip owners data (Epoch AI 2026c) with other public records on the internet to identify publicly reported holdings.⁠⁵⁶ According to Epoch AI’s data, a significant majority, 78% measured in H100e as of year-end 2025, are owned by seven large American companies,⁠⁵⁷ with more owned in publicly identifiable holdings by neoclouds, the U.S. Federal Government, large companies like Tesla and Apple, universities, and a longer tail of smaller companies and private owners. A significant proportion of the chips in China are identified in public vendor reports about buyers of their chips.⁠⁵⁸ We arrive at estimates of 33M H100e in the U.S., and 780k H100e in China in this category; the true number would likely be more if our search had been more exhaustive.

Of the projected residual, roughly 1.9M H100e in the U.S. and 2.3M in China, we estimate the remaining three categories in three steps, conservatively allocating more to the less visible categories, as follows:

1. We assume 1% by H100e are held by individuals. This is likely an overestimate for accelerators, making the estimate conservative.

2. In China, we assume that 10% of the diverted stock by H100e is off-books. We believe this is also a conservative estimate, given the convergent evidence discussed in § 5.4.1 that diverted accelerators are not treated as contraband in China, and because businesses had strong incentives to file VAT invoices.

3. We allocate what remains to on-books business and institutional holdings.

Based on investigative reporting and court filings from prosecutions, Epoch AI estimates 660k H100e diverted over 2024-25 (Juniewicz 2026a). We use their estimate and extrapolate it for a third year,⁠⁵⁹ to arrive at 990k H100e.

Finally, we add one month’s inventory at the estimated diversion rate (330k per year, based on Epoch AI’s estimate of 660k H100e diverted during 2024 and 2025). We count half toward each state’s informal holdings. The resulting estimates are shown in Table 5.1.

5.5.2 Estimating the missing fraction by holding type

This section estimates what fraction of each holding type would be missed by a thorough global census. As the census is hypothetical, no data is available on these quantities, but we can use empirical anchors from analogous cases to arrive at conservative overestimates.

We consider two distinct reasons why chips might be missed: they might have failed and been disposed of without a verifiable record, or they might be functional but retained by their owners.

6.2.1 Method for determining governance thresholds

This section discusses how a treaty might determine operational governance thresholds, by reference to the current scaling trajectory. Fleet thresholds in § 3.2.3 are defined with reference to compute thresholds, research overhead factors, time horizons, and current frontier-level utilization. We discuss each of these below.

One simple method for determining treaty compute thresholds is to index the compute ceiling $C_{T}$, the covert evasion threshold $C_{E}$, and the overt breakout threshold $C_{B}$ to the frontier threshold $C_{F}$, as fixed multiples of $C_{F}$. We adopt this method and take $C_{x} = \beta _{x} \cdot C_{F}$, where $x$ is a generic subscript representing quantities relevant to the treaty compute ceiling $(x = T)$, covert evasion $(x = E)$, or overt breakout $(x = B)$. Then, per the discussion in § 3.2.2, the covert evasion and overt breakout fleet thresholds are also indexed to the frozen frontier $C_{F}$ as

$$F_{x}(t) = \frac {\rho _{x} \cdot \beta _{x}}{T_{x} \cdot U_{F}} \cdot C_{F}(t).$$

From Epoch AI frontier training run data (Epoch AI 2026a), as well as an independent corroboration based on reports of the size of the GPT-6 Astra pretraining run (Lardinois 2026), we estimate a frontier level of roughly $C_{F} = 2\times 10^{27}\,\mathrm{FLOPs}$ at year-end 2026.⁠⁶⁴ Reproducing Epoch’s frontier plot gives an estimated 4.5x increment per year, corresponding roughly to one order of magnitude increase in frontier training budgets every year and a half (Sevilla and Roldán 2024). If we define the (recent) historical growth rate $g = 4.5$ to be the rate of growth estimated from this regression, a race trajectory corresponding to roughly one order of magnitude growth occurs every 18 months.

The research overhead factors $\rho _{E}, \rho _{B} > 1$ represent the total compute budgets dedicated to the research and development process, including a wide variety of preparatory tasks that require training-capable hardware before the training run can begin, such as exploratory experimentation, synthetic data generation, inference using intermediate models that are more capable than the frozen frontier, and test runs. Denain and Wu (2026) estimate from spending data that frontier AI companies spend only about 9.6% of their research compute budget on these final training runs. If we adjust for a four-month lag between the research and training of a given model, we arrive at an empirical estimate $\rho _{F} = g^{-4/12} / 0.096 = 6.3$ for present-day incremental frontier training. The research overhead was mildly lower for fast followers Z.ai and MiniMax, who spent 12.3% and 12.2% respectively on final training runs; correspondingly, we use the research overhead $\rho _{P} = g^{-4/12} / 0.123 = 4.9$ for trailing models trained by private evaders.

A frontier-advancing research program aiming at $C = \beta \cdot C_{F}$, for a large multiple $\beta$, would either need to aim for a significantly larger “blind leap” in abilities than frontier companies do now, or it would need to proceed in several steps, bridging the gap between $C_{F}$ and $C_{E}$ by degrees. If it takes the latter approach, as we find more likely, we define the blind leap increment $\delta$ as the optimal size of a blind leap, in orders of magnitude, relative to the best trained model available to the research program. That is, if a research program aims for $C = 10 \cdot C_{F}$, with blind leap increment $\delta = 1/3$, the research program proceeds in three steps, first training a model of size $10^{\delta} \cdot C_{F}$, then a model of size $10^{2\delta} \cdot C_{F}$, and finally a model of size $C = 10^{3\delta} \cdot C_{F}$. More generally, the number of required steps to attain a multiple $\beta$ of the frontier is

$$n = \lceil \frac {\log _{10} \beta }{\delta } \rceil .$$

The blind-leap increment $\delta$ has implications for the research overhead; if each of the $n$ incremental subprograms have present-day frontier overhead $\rho _{F}$, then attaining a model with training budget $\beta \cdot C_{F}$ requires a total research and development budget of

$$\sum _{i=1}^{n} \rho _{F} \cdot \beta ^{i/n} \cdot C_{F} = \rho _{F} \cdot \beta \cdot C_{F} \cdot \frac {1 - \beta ^{-1}}{1 - \beta ^{-1/n}}.$$

The last factor is greater than one unless $n = 1$ (that is, $\delta \ge \log _{10} \beta$), in which case it reduces to $\rho _{F} \cdot \beta \cdot C_{F} = \rho _{F} \cdot C$, giving the same overhead as present-day incremental frontier research, $\rho = \rho _{F}$. More generally, the research overhead for the entire program is the above divided by $C = \beta \cdot C_{F}$. If $\log _{10}(\beta ) / \delta$ is a whole number, then

$$\rho = \frac {1 - \beta ^{-1}}{1 - \beta ^{-1/n}} \cdot \rho _{F} = \frac {1 - \beta ^{-1}}{1 - 10^{-\delta}} \cdot \rho _{F}.$$

We adopt the blind leap increment $\delta = \frac{1}{3}$, corresponding to roughly six months of progress on the historical race trajectory. For non-integer values of $n$, we simply plug in the fractional value of $n$, so as not to take the discrete nature of our model too literally.

Finally, we must estimate the utilization rate $U_{F}$ of a present-day frontier training run. Utilization for frontier training is estimated at 30%–50% for pretraining (Epoch AI n.d.a) and 5%–20% for reinforcement learning (RL) post-training (Denain and Wu 2026). Epoch estimates that GPT-5, trained in 2025, used 60% pretraining and 40% post-training, by FLOPs (Epoch AI 2025b); taking the harmonic mean of mid-range utilization estimates 40% and 12.5% for pre- and post-training would then give $U_{F} = 0.21$. Present-day frontier training is likely more heavily weighted toward post-training, meaning that $U_{F}$ should be somewhat lower, and fleet thresholds correspondingly higher. A real agreement should use more current numbers, but in lieu of a current estimate, we adopt the conservative value $U_{F} = 0.21$ for all calculations below.

6.2.2 Covert evasion fleet threshold

To arrive at a covert evasion fleet threshold, we must determine the covert evasion target $C_{E} = \beta _{E} \cdot C_{F}$, the research overhead $\rho _{E}$, and the covert evasion time horizon $T_{E}$. We discuss each of these below.

One reason $\beta _{E}$ might be fairly large is that models trained and deployed covertly would suffer an inference-time handicap relative to whitelisted models, requiring covert models to represent a significant advance beyond the frozen frontier. The latter could be run on specialized hardware giving them an advantage in cost, scale, and speed. Covert models could not be deployed at a comparable scale, and even small-scale covert deployment would carry an ever-present risk of discovery and enforcement for users and inference providers alike. Both the cost and the risk would be compounded, in turn, by the difficulty of maintaining secrecy in the procurement and operation of scarce training-capable hardware at scale.

The domain of application of a covert model would be limited as well, owing to the need for secrecy. A covert model could not be widely deployed commercially, eliminating many of the most important perceived benefits of an AI advantage. Directly using a covert model for cyberwarfare could leave traces that would be studied for evidence that an unknown model was being used. Such evidence might well be forthcoming, especially if the model were much more capable than the models it was competing against, or produced outputs at lower serial speed than frozen-frontier cyberattack models. Deployment for internal analysis by intelligence agencies would be less risky, but also limited.

Due to both the inference-time advantage of whitelisted models over illicit models and the limited domain in which illicit models could be employed, a strategically relevant model would need to be significantly more capable than the frozen frontier on a per-token basis, and the multiple $\beta _{E}$ should reflect this. We suggest $\beta _{E} = 10$ as the advantage in training FLOPs that would be required to give rough parity with the frozen frontier at inference time, using a model of Ord (2025) that balances training-time versus inference-time scaling.⁠⁶⁵ This factor would represent roughly an 18-month leap in per-token capabilities, on the current race trajectory.⁠⁶⁶

Next, we turn to the research overhead $\rho _{E}. A$ covert evasion program would lack many of the advantages that present-day frontier programs enjoy. It could not offer the promise of dizzying riches and social status to attract many of the brightest and most ambitious minds in the world, nor could it import insights by hiring researchers from competing firms. It could not learn as much from deploying its preliminary models, or amortize its research effort over many concurrent research programs. If covert research were carried out on aging chips, without vendor service or firmware updates, and in data centers less well-maintained than the industrial hyperscale data centers where they are presently performed, it is likely that experiments would fail and require restarting from checkpoints more often.

On the other hand, such a program could potentially ameliorate these disadvantages by using AI agents built on frozen frontier models for tasks like writing code or grading RL rollouts, provided such use did not carry an unacceptable risk of discovery. If it were carried out more slowly than current racing programs, it might also be able to plan its experiments more judiciously, relying more on human judgment to eliminate unnecessary experiments—though the researchers exercising that judgment might be less talented than is presently the case, as mentioned above.

On balance, we see more reasons to expect covert evasion research on an incremental sub-program to be more difficult than incremental research at the present-day frontier, but in the absence of a credible way to estimate the net quantitative effect of these factors, we conservatively adopt the working value $\rho _{E} = \frac {1 - \beta _{E}^{-1}}{1 - 10^{-\delta}} \cdot \rho _{F}$, or $\rho _{E} = \rho _{F}$ in the special case where the research program is carried out in one leap. For the adopted values $\beta _{E} = 10, \delta = \frac{1}{3}$, and $\rho _{F} = 6.3$, we obtain

$$\rho _{E} = \frac {1 - 10^{-1}}{1 - 10^{-1/3}} \cdot 6.3 = 11.$$

Finally, we adopt a strategic time horizon of $T_{E} = 5$ years for covert evasion. We expect evaders to be patient, but not infinitely so, for several reasons: First, time discounting would make longer-term projects less attractive: states have many alternative ways to pursue strategic advantages on shorter time horizons, and the longer they waited to begin their research program, the more likely political and technological conditions would be to change before they could get significant use out of their model. Second, keeping a large-scale strategic project hidden for a long period of time would carry a significant risk of discovery. Finally, if the evasion program were based on an initial stock, for example from pre-pause dark compute, then evaders might encounter difficulties maintaining a fleet for covert training, and then covert inference, past its intended retirement age without vendor service.⁠⁶⁷

For our near-term pause scenario, in which $C_{F} = 2\times 10^{27}\,\mathrm{FLOPs}$, these choices lead to an initial covert evasion training budget of $C_{E} = 2\times 10^{28}\,\mathrm{FLOPs}$, which would correspond to a mid-2028 model on the present race trajectory, and a covert evasion fleet threshold of

$$F_{E} = \frac {11 \cdot 2\times 10^{28}}{5 \cdot 0.21} = 6.4\mathrm{M}\,\mathrm{H100e}.$$

As points of reference, we project that OpenAI’s fleet at year-end 2026 will be 6.4M H100e, and China’s total fleet would be 3.1M H100e; see the calculations supplement.

Since the covert evasion fleet threshold scales linearly with the frontier threshold $C_{F}$, it is expected to scale as frontier training scales: if the pause instead took effect in mid-2027, with $C_{F} = 4.2\times 10^{27}\,\mathrm{FLOPs}$, the same steps would yield $F_{E} = 14\mathrm{M}\,\mathrm{H100e}$. However, we expect this estimation paradigm will degrade the farther out in the future we attempt to project it.

While we focus on the treaty’s ability to prevent covert evaders from developing a strategically significant model, the difficulties of covert evasion would not stop after the model was trained. In order to realize a strategically relevant advantage, the evading state must operate a covert fleet capable not only of paying the one-time cost to train the model, but also of serving inference at sufficient scale to outperform the more abundantly available inference capacity for models at the frozen frontier. Inference demand would eventually create an indefinite ongoing requirement to replenish covert hardware without detection, giving treaty authorities and state intelligence agencies ongoing opportunities to catch evasion.

6.2.3 Overt breakout fleet threshold

As with covert evasion, we now turn to estimating the overt breakout training budget $C_{B} = \beta _{B} \cdot C_{F}$, the research overhead $\rho _{B}$, and the overt breakout time horizon $T_{B}$, to arrive at the required breakout fleet threshold $F_{B}$.

The most commonly cited obstacle to international cooperation is the fear that a geopolitical rival could achieve decisive and lasting strategic hegemony by scaling AI models far beyond the current capability frontier. In some imaginings of this scenario, participants are now locked in a race to detonate an “intelligence explosion,” which would in short order lead to the arrival of a superintelligent AI model: one so powerful that it can quickly and radically reshape the global order according to the wishes of its creator—if its creator can control it (Bostrom 2014). Some contemporary actors’ statements convey the belief that this remaking of the global order could occur even if the advantage is short-lived,⁠⁶⁸ so the regime’s choice of $C_{B}$ would likely be defined by the point at which actors expected this absolute capability level might be attained, and not with reference to a relative capability advantage $\beta _{B}$ over the frozen frontier (but it might still track training efficiency gains by holding the ratio $\beta _{B} = C_{B}(t) / C_{F}(t)$ fixed).

Since attaining such powerful advantages would, almost by definition, require models whose capabilities far surpass contemporary human experience—or, perhaps, even human imagination—we cannot expect to empirically estimate when models will achieve such transformative capabilities. Fortunately, this would not be necessary for the treaty to estimate directly because, to assure the verifiability and durability of a treaty, the relevant question is not about the objective fact of the matter as to when (or whether) models will reach superintelligence. After all, if and when a state broke out and resumed racing to build a strategically decisive model, the treaty would likely have already failed. Instead, the relevant question is about the expectations of states parties, especially the U.S. and China as the two states parties that would most plausibly expect to succeed.

Opinions diverge widely on the question of whether or when a strategically decisive model might materialize. Since those who are the most bullish about AI progress would be the most likely to attempt breakout, conservative treaty provisions should base $C_{B}$ not on the best empirical estimate of the training budget actually required to train such a model (even if it were possible to come up with one), but on the estimate of what a bullish would-be defector might believe.

Thus, one simple way to arrive at an estimate of $C_{B}$ is to imagine by when a relatively bullish state leader might be confident a decisive model would arrive if the AI race continued at its historical pace,⁠⁶⁹ and work backwards using the Epoch training curve. For example, suppose that negotiators at the time of the pause think a bullish defector would be confident that superintelligence will arrive by the end of 2029, on the historical growth trajectory.⁠⁷⁰ Then, they might set an initial $C_{B}(0) = 2\times 10^{29}\,\mathrm{FLOPs}$, yielding $\beta _{B} = 2\times 10^{29} / C_{F}(0)$ which could then be held fixed for $t > 0$ to track training efficiency gains indexed to $C_{F}(t)$.

A prospective breakout strategy would likely need to rely on this type of rapid phase transition and consolidation, since other states’ more cheaply trained, fast-following AI models—including freely available open-weight models—presently trail only a few months behind the frontier. Such a strategy would be both expensive and risky for the defecting state, and would in particular require it to attain its decisive advantage before the rest of the world could react to stop it—or to resume racing against it, likely with a more complete hardware supply chain and therefore, eventually, a larger fleet. To reflect the time sensitivity of the breakout strategy, we adopt a breakout time horizon of $T_{B} = 2$ years.

For our near-term pause scenario, in which $C_{F}(0) = 2\times 10^{27}\,\mathrm{FLOPs}$, these choices lead to the multiple $\beta _{B} = 100$, requiring a research program in $n_{B} = \log _{10} 100 / \delta = 6$ steps and research overhead of

$$\rho _{B} = \frac {1 - 100^{-1}}{1 - 10^{-1/3}} \cdot 6.3 = 12,$$

leading in turn to an overt breakout fleet threshold of

$$F_{B} = \frac {12 \cdot 2\times 10^{29}}{2 \cdot 0.21} = 180\mathrm{M}\,\mathrm{H100e}.$$

By comparison, we project the global accelerator fleet at year-end 2026 to be 47M H100e.

The value of $F_{B}$ is sensitive to the bullish leader’s timeline; if an even more bullish leader expects a decisive model to arrive at year-end 2028, then the same method would produce near-term pause values $C_{B} = 4.3\times 10^{28}\,\mathrm{FLOPs}, \beta _{B} = 22$, and $F_{B} = 36\mathrm{M}\,\mathrm{H100e}$. If we change the breakout time horizon from two years to one year, the previous two $F_{B}$ values would change to 350M H100e and 73M H100e, respectively.

The choice of breakout time might likewise be sensitive to the quantity of strategic reserves states are allowed, as well as expectations and possible commitments about how coalitions would respond to defection. We adopt 180M H100e as our illustrative value going forward but, in practice, we expect a realized choice of $F_{B}$ would be a matter of negotiation and trust more than one of estimation.

6.2.4 Private evasion fleet threshold

In order to successfully pause the frontier, it would be necessary for treaty authorities to prevent widespread private (non-state) training of new sub-frontier models that approach frontier scale. We operationalize this objective in the treaty as the prohibition on beyond-threshold models, i.e., models with total training FLOPs above the threshold $C_{T}$ or total parameters above $N_{T}$.

To choose a good $C_{T}$, authorities should ensure that it is far enough below $C_{F}$ to prevent legal models from competing with the frontier, while also ensuring it is high enough to be enforceable, so that widespread evasion does not undermine the treaty. As an illustrative value, we suggest keeping $C_{T}$ three orders of magnitude below $C_{F}$ (i.e., $\beta _{T} = 0.001$) giving roughly $C_{T} = 2\times 10^{24}$ in our near-term pause scenario, but a wider range of values could likely support a treaty depending on leaders’ judgments.

If $C_{T}$ is below $C_{F}$ and $C_{E}$ by three and four orders of magnitude, respectively, a marginal violation of $C_{T}$ would be unlikely to advance the frontier and would thus do little to affect the strategic balance undergirding the treaty. However, sufficiently widespread violations would lead to a perception of unenforceability. To maintain the rule of law, the treaty would need to combine sufficient penalties with sufficiently credible detection to deter all but a few private actors. In this section we consider whether enforcement before the fact, via the denial of training compute, would be sufficient.

For $x \ge 1$, let the annual violation rate $V(x)$ represent the number of undetected violating models trained per year with total training cost in excess of $x \cdot C_{T}$ that would significantly undermine the treaty. That is, if $V(10) = 20$, then 20 undetected violations per year with models trained in excess of $10 \cdot C_{T}\,\mathrm{FLOPs}$ would undermine the treaty. Aggregating across violators, the minimum total undetected compute required would be

$$C_{T} \cdot \min _{x \ge 1} x \cdot V(x).$$

Applying research overhead $\rho _{P}$ and utilization $U_{F}$, we arrive at the following fleet threshold, in hardware units per year of undetected evasion:

$$F_{P} = \rho _{P} \cdot \beta _{T} \cdot C_{F} \cdot \min _{x \ge 1} x \cdot V(x) / U_{F}.$$

Carrying out this analysis for $\beta _{T} = 0.001$ suggests that, at least initially, private evaders would need a great deal of collective compute even to achieve modest annual violation rates. As a simple worked example, suppose we take $V(x) = 100 / x$. That is, it would undermine the treaty if about 100 private actors per year got away with training models in excess of $C_{T}$, or if one private actor per year trained a model in excess of $100 \cdot C_{T}$, or if one per decade trained a model in excess of $1000 \cdot C_{T} = C_{F}$. To sustain this annual violation rate at any value of $x$, the aggregate required private evasion fleet would need to achieve total arithmetic throughput of at least $100 \cdot C_{T}$.

Even if private evaders could achieve similar utilization as present-day frontier training, the private evasion fleet for our near-term pause scenario would need to be $F_{P} = 150\mathrm{k}\,\mathrm{H100e}$, amounting to billions of dollars of installed hardware. For anything like such a large fleet to operate continuously and replenish its hardware, without detection by the combined efforts of local law enforcement, state intelligence agencies, and treaty authorities, appears unlikely if hardware production is tightly controlled and the global census is even moderately successful.

Moreover, this is likely to be an underestimate, for at least three reasons: First, private evaders would be unlikely to achieve current-frontier utilization while concealing their activities from authorities. Second, they would need a larger fleet if they wanted to perform inference on their illicit models rather than only train them. And third, our calculation treats violation as occurring at only one value of $x$. If we instead assume, e.g., that private evaders’ utilization is half that of the frontier, that evaders spend half of their compute on inference, and that $x$ is Pareto distributed with exponent $\theta$, then the required fleet threshold would be larger by a factor of $4\theta / (\theta -1)$. For $\theta = 2$, this gives 1.2M H100e, or tens of billions of dollars worth of hardware.

Eventually, enough training efficiency gains might erode all of these numbers to the point where authorities would need to focus on efforts to detect training and inference rather than deny training capability. Since this would not happen soon, authorities would have plenty of time to prepare.

6.2.5 Small-scale evasion

Training beyond-threshold models from scratch is not the only form of evasion the regime would need to contend with. For example, performing inference on a small-scale fine-tune of an existing beyond-threshold model would also qualify as a violation but would be harder to police through compute denial, especially during Phases 1-2 while pre-pause hardware remained in widespread use. A Chinchilla-optimal model with just over $C_{T} = 2\times 10^{24}\,\mathrm{FLOPs}$ has roughly 130B parameters and could be fine-tuned using a single rack with 32 commodity H100 accelerators;⁠⁷¹ an illegal model with just over 13B parameters could be fine-tuned more easily still. Even if difficult to enforce through training-compute denial, any fine-tune (or use of such a model if not whitelisted) would be illegal if the total compute, including the fine-tuning and the original training, exceeded the compute ceiling $C_{T}$. Enforcement would occur at the time of deployment similar to other computer crimes, with the parameter ceiling $N_{T}$ likely easier to enforce after the fact than the compute ceiling.

During Phase 3, this conclusion might reverse: successful global governance of new hardware manufacture and tracking of registered hardware, combined with gradual attrition of pre-pause dark compute, would make training-capable accelerators increasingly difficult for violators to obtain.

Another concern might be that larger-scale RL fine-tuning of existing frontier models would be a better paradigm for training a new frontier model than starting from scratch. However, if $C_{T} = C_{F} / 1000$ as suggested above, then unless this RL training exceeded $C_{T}$, it would likely account for less than 1% of the total compute budget of RL post-training that would already have been performed on the original model, assuming prevailing compute allocations between pretraining and post-training. Absent algorithmic breakthroughs, it appears unlikely that this type of violation would significantly advance the frontier without requiring an above-threshold run.

On the other hand, it is more plausible that a small fine-tune could train dangerous capabilities into an already very generally capable model, or train safeguards out of it. We note this would be a difficult enforcement problem for any governance regime, whether paused or not, but the reduction in the global supply of training-capable hardware envisioned by our Phase 3 appears to be a more promising response than alternatives that allow the supply of training-capable hardware to proliferate further.

6.3.1 Estimates of recent historical training efficiency gains

If we take the most extreme estimates of training efficiency gains at face value, this erosion could happen quite rapidly. One regression-based estimate by Ho et al. (2024) found that there had been annual 2.7-fold training efficiency gains, by regressing language models’ log perplexity loss on the WikiText and Penn Treebank benchmarks against model and data scale as well as the date on which each model was published. Their data was not based on experimental comparisons, but on a literature search over the period 2012-2023. If we were to extrapolate it forward, it would suggest that today’s frontier models could be trained at one 20,000th of the cost ten years hence—that it might be possible, for example, to train GPT-6 Astra on about five accelerators rather than the more than 100,000 accelerators OpenAI used in its Abilene campus (Lardinois 2026).

However, Ho et al. (2024) urged caution in interpreting their estimate in this way, noting that they did not observe the 10,000-fold gains their model implied anywhere in their data set. In particular, they cautioned that many training efficiency gains were scale-dependent, and in particular that a large portion of these gains accrued from the transformer’s scalability, which made possible the rapid scaling that took place over the same time period (Sevilla et al. 2022). That is, the observed gains would have been lower if the training runs used in 2023 were not larger than those used in 2012. This observation has important implications for a hardwired pause because, if successfully implemented, such a pause would prevent further scaling. Thus, if innovations discovered during a pause are complementary to further scaling, their greatest benefits could not be realized.

Subsequent empirical studies confirm the scale-dependence of algorithmic improvements, suggesting that the most important breakthroughs have improved AI not by wringing better performance out of 2012-scale models and data sets but by giving better returns to scale. Gundlach et al. (2025) find empirically in ablation studies that the training efficiency gains they tested have improved performance at smaller scales by a factor of only 6.3 over the same period, and combine this estimate with estimates from the machine learning literature to estimate that the total gain was closer to a factor of 60—translating to an impressive but much less overwhelming 45% improvement per year. They estimate that 91% of gains at larger scales was explained by two scale-dependent breakthroughs, the transformer architecture (Vaswani et al. 2017) and Chinchilla re-balancing (Hoffmann et al. 2022), both of which are much more effective at present-day frontier scales than older methods but confer smaller improvements at small scales. They concurred that the gains observed by Ho et al. (2024) were contingent on the rapid rate at which computing effort was scaled up over that time period. Their evidence therefore is suggestive that the observed gains in a counterfactual “paused” world, where compute budgets had remained fixed at 2012 levels, would have been much slower.

More recently, Patel and Han (2026) found annual pretraining efficiency gains of 57% over the period 2019 to 2025, through computational experiments comparing new methods and data to old methods and data, at fixed scale $C = 10^{19}\,\mathrm{FLOPs}$. They cite scale-dependence as an explanation for the difference between their estimate and the estimate of Ho et al. (2024). Interestingly, by separately varying data improvements and algorithmic improvements, they find that data improvements alone accounted for three times as much efficiency gain as algorithmic improvements.

6.3.2 Training efficiency gains after a pause

Since training efficiency gains are a product of human effort and not an exogenous force of nature, their rate could be very different in a post-treaty world than it has been over the last decade. At present, gains are driven by overwhelming commercial incentives drawing thousands of the world’s most talented engineers to work full-time on training more capable models with costly and constrained computational resources. A ban on frontier model training could decelerate training efficiency gains by redirecting commercial research and development efforts away from training new models and toward diffusing current model capabilities.

A second reason why a hardwired pause might be expected to decelerate training efficiency gains is that it would sharply limit engineers’ ability to test ideas at scale. The internal workings of frontier AI models are famously inscrutable even to their creators, motivating the common analogy that they are not “built” like cars or bridges but “grown” by empirically fiddling with weights. As a result, research on how to train models more effectively is highly empirical. The empirical nature of training efficiency gains is well-known in the AI world; as one inventor of the transformer famously quipped with regard to another improvement, “We offer no explanation as to why these architectures seem to work; we attribute their success, as all else, to divine benevolence” (Shazeer 2020).

A third reason relates to the finding by Patel and Han (2026) that data improvements have driven most recent pretraining efficiency gains. If so, then a future covert evasion project might have difficulty realizing these gains, as the internet of ten years hence might be much more hardened against automated crawling than today’s internet, by necessity, due to greater abundance of bots, potentially leaving covert evaders with stale data sets. There are some indications that this is already happening: Cloudflare has begun blocking AI crawlers on some websites for which it proxies traffic, and has continued to tighten its block as recently as July 2026 when it announced stricter defaults (Cloudflare 2025; Lee and Becker 2026); see also Longpre et al. (2024) for empirical evidence that data restrictions on websites are rising in the AI era.

On the other hand, an ineffectively enforced hardwired pause could plausibly accelerate efficiency gains by tightening constraints on the computational resources available to any engineering teams that continued frontier model training efforts, especially if illicit efforts are widespread. Maintaining a wide margin between governance thresholds $C_{T}$ and $N_{T}$ and frontier capabilities could mitigate this acceleration by reducing the temptation to evade. Likewise, efficient inference on frozen frontier models could contribute to training efficiency gains in a variety of ways, such as generating data sets for distillation, grading RL rollouts, or suggesting algorithmic improvements to engineers.

Continued training efficiency gains would not necessarily be fatal to an adaptable governance regime. As governance matures, hardware and software innovations could give authorities more options for flexible, light-touch governance: more reliable geotracking of chips could cause the supply of dark compute to dwindle away; advances in hardware specialization could yield a variety of performant hardware systems that, like inference-only chips, are inefficient for frontier model training; or advances in privacy-preserving software-based verification and workload classification could allow for the wide deployment of hardware that offers users relatively unrestricted general-purpose functionality while detecting and deterring evasion.

6.4.1 Discount factors

For each of the two risk scenarios, two discount factors could be applied: a political discount factor $\pi$ representing the fraction of hardware in that category that could plausibly be marshalled toward building frontier models (fractionally including hardware engaging in part-time evasion), and a technical discount factor $\tau$ representing the average sustained utilization that could realistically be achieved, relative to present-day frontier training. That is, $\tau = 1$ means similar utilization to present-day data-center grade training, not 100% utilization.

For each compute source $c$ and state $s$, the parties could negotiate means of estimating a total (undiscounted) existing capacity $K_{0}(c,s)$ as well as four discount factors: $\pi _{E}(c,s)$ and $\pi _{B}(c,s)$, the political discount factors for the covert evasion and overt breakout, and $\tau _{E}(c,s)$ and $\tau _{B}(c,s)$, the technical discount factors for the same. Then, the evasion capacity for that compute source and state would be estimated as $K_{E}(c,s) = \pi _{E}(c,s) \cdot \tau _{E}(c,s) \cdot K_{0}(c,s)$, and the breakout capacity would be estimated as $K_{B}(c,s) = \pi _{B}(c,s) \cdot \tau _{B}(c,s) \cdot K_{0}(c,s)$. Summing over $c$ gives the evasion and breakout ledgers $L_{E}(s)$ and $L_{B}(s)$ for each state, which must respectively be kept below $\alpha _{E} \cdot F_{E}$ and $\alpha _{B} \cdot F_{B}$. The discount factors and the raw capacities could all change with time, but we suppress their dependence on time to avoid cluttering notation.

Considerations in determining the political discount factors would include how diffusely or centrally held the relevant chips are, whether they are directly controlled by the state, and what legal or political barriers the state would face in commandeering them in a covert or overt scenario. The covert discount factors in particular would depend on what kinds of verification measures the state allows in its facilities, how many different actors would need to be involved in a conspiracy to violate the treaty, and how successfully the state could force them to remain silent.

For example, a supercomputer facility in a sovereign fleet would be charged with a high overt political discount factor because it could be reassigned to breakout training in a short period of time $(\pi _{B} \approx 1)$. However, it might be charged a much lower covert political discount factor if the host state is willing to allow power monitoring, telemetry mechanisms, periodic inspections of facilities, or legal and political safeguards such as criminalization of treaty violation and protection for whistleblowers. If a state can persuade other parties to accept that no more than 20% of a facility could plausibly be marshalled toward covert training without a significant likelihood of detection, its $\pi _{E}$ might be 0.2.

Considerations in determining technical discount factors would include limitations on memory and interconnect bandwidth, or parallelism overhead for chips with low memory. The technical discount factor for covert training could be less than that for overt training due to the technical overhead of distributed training, disguising workloads, or locating chips in secret data centers with substandard operating conditions. We undertake a simple illustrative analysis here, but a more complete analysis would disaggregate each source by the type of hardware and details about its deployment; the utilization achieved by current AI companies in frontier pretraining under idealized conditions might be realistic for some overtly-deployed accelerator hardware $(\tau _{B} \approx 1)$, but technical discount factors for present-day inference-optimized chips would likely be below 1, and those for consumer GPUs would be considerably lower still.

To establish plausibility that these bounds could be realistically verified, we consider several sources in turn, discussing realistic upper bounds for capacity and discount factors for the U.S. and China. In each case, we compare them to the covert evasion fleet threshold $F_{E} = 6.4\mathrm{M}$ and the overt breakout fleet threshold $F_{B} = 180\mathrm{M}$ for our near-term pause scenario. As these estimates apply to a hypothetical future, they necessarily reflect speculations about, e.g., how cooperative pause-willing states parties would be in implementing treaty rules or furnishing sales records to locate existing lithography machines and accelerator chips.

As we will see, under plausible assumptions, it is unlikely that any of the sources discussed below could represent a significant strategic threat for overt or covert evasion in the short term after a pause. For each source, we evaluate its headroom for a treaty that gives an allowance of 25% for both ledgers $(\alpha _{E} = \alpha _{B} = 0.25)$, defined as the number of orders of magnitude of erosion, due to training efficiency gains, that the treaty would have to sustain before that source became a binding constraint on balancing the ledger.

6.4.2 Transitional training-capable inference service

The most obvious treaty exposure would be that from transitional inference service on pre-pause training-capable hardware. Leaving these training-capable accelerators in industry-grade commercial data centers, where they could in principle be seized by a state government in an overt breakout scenario, plausibly gives $\tau _{B}$ and $\pi _{B}$ close to 1.

In practice, both discounting factors might be somewhat lower. The value of $\pi _{B}$ could vary widely, depending on the political plausibility of the state’s government seizing an enormous quantity of privately-held capital for a national breakout program. Political or institutional safeguards that would make it more difficult for the state to do so, or that create hurdles that would delay deployment in such a scenario, could reduce the average amount that would be available over a window of length $T_{B}$. The value of $\tau _{B}$ also might be lower than 1 since the total installed stock is heterogeneous, with a significant fraction of older hardware.

In any case, we can bound $\tau _{B}, \pi _{B} \le 1$, thereby bounding each state’s breakout capacity by the total stock located in each country at the pause date.

$$K_{B}(\text{Transitional}, \text{U.S.}) \le Q_{\mathrm{US}}, K_{B}(\text{Transitional}, \text{China}) \le Q_{\mathrm{CN}},$$

We project the U.S.-located stock at $Q_{\mathrm{US}} = 35\mathrm{M}\,\mathrm{H100e}$ total at year-end 2026, giving:

$$K_{B}(\text{Transitional}, \text{U.S.}) \le 35\mathrm{M}\,\mathrm{H100e},$$

or 20% of $F_{B}(0)$, and

$$K_{B}(\text{Transitional}, \text{China}) \le 3.1\mathrm{M}\,\mathrm{H100e},$$

or 1.8% of $F_{B}(0)$. Thus, at the pause date, both breakout capacities would likely be below the allowance before discounting. However, the breakout number leaves almost no headroom for a treaty with 25% allowance, and two doublings of training efficiency gains could bring $F_{B}(t)$ itself close to the U.S. breakout capacity. This would be a problem in the early years of the treaty, but not an insoluble one; we discuss ways to ameliorate it in § 6.5.2.

Even while inference service continued, verification measures such as those described in § 3.3.3 could significantly reduce its covert evasion risk. If we assume pessimistically that 10% of hardware operators in the U.S. engage in treaty evasion, somehow avoiding detection by treaty recomputation servers even while diverting 1% of their computing power to evasion, we arrive at $\pi _{E} = 0.001$. Even if they achieved frontier-grade utilization for their covert evasion, the total covert evasion capacity would be

$$K_{E}(\text{Transitional}, \text{U.S.}) \le 35\mathrm{k}\,\mathrm{H100e},$$

or 0.55% of $F_{E}(0)$. Assuming, again pessimistically, that the Chinese government were able to covertly suborn all of its hardware operators into diverting 1% of their computing power, their covert evasion capacity would be similar, with

$$K_{E}(\text{Transitional}, \text{China}) \le 31\mathrm{k}\,\mathrm{H100e}.$$

These evasion capacity numbers apply to the transitional inference service after verification protocols have been implemented. Both political discount factors would likely be higher during the stages when these methods were being set up. However, provided this could be done in a timely fashion, it would leave little time for a strategically relevant model to be covertly trained. Whole-lab inspections as proposed by Choussat and Khoja (2026) could be a stopgap interim measure, if it were difficult to stand up the inference-only cluster protocols of § 3.3.3 at the timescale on which leaders wished to implement a pause.

For a longer-term pause, we expect that verification measures could be considerably tightened based on methods currently under development as described in § 3.3.3, leading to $K_{E}$ values that were considerably reduced for both states.

However, doing so would not on its own be sufficient for implementing the treaty, because verification measures generally do not reduce breakout exposure. This is what makes stopping the production of training-capable hardware an essential element of a hardwired pause: the more training-capable hardware states accumulate, the less credibly they can assure other states that they would not break out and race faster than before.

A more complete covert evasion analysis would consider the possibility of the U.S. or China subverting transitional inference service outside their jurisdiction. We assume such use would likely incur considerably steeper political discounting.

6.4.3 Dark compute

Significant quantities of ungoverned accelerators would be highly problematic for treaty governance. Chips lost or stolen in a host state might be charged under political and technical discount rates close to one, reflecting the high risk of their being used for covert evasion or overt breakout. While a few thousand missing chips would not approach relevant treaty allowances, a million missing H100e units would approach 16% of $F_{E}$, leaving little margin for training efficiency gains to erode the evasion fleet threshold $F_{E}(t)$.

Our estimates from § 5.5 reflect what a thorough census might miss, but our analysis does not assume that a thorough census could happen overnight. Compliance would depend on political conditions we cannot foretell. In some pause-willing futures, leaders could be ambivalent about the pause and unwilling to provide any transparency to rivals; while in others, leaders’ most urgent concern could be to prevent further training or fine-tuning of frontier models by private evaders. It could also be that leaders gain greater confidence in each other over time, beginning with small measures and slowly finding ways to work together more closely. It is possible that the census would take time to implement.

We divide our analysis into several scenarios, according to states’ degree of cooperation in the census.

In a high-cooperation scenario, we consider a world where American, Chinese, and other world leaders conclude they have a mutual interest in cooperation to address common threats, and prefer to pursue national strategic objectives through alternative treaty-provided channels. Both nations make convincing public efforts to recover pre-pause chips, but might stash a small, plausibly deniable number as insurance.

For such a scenario, we assume that both states would not significantly sabotage their own internal census methods, and would stash no more than 20% of the total missing amount, giving

$$K_{0}^{\mathrm{HC}}(\text{Dark}, s) \le 1.2 \cdot K_{M}(s).$$

We assume this cooperation would be evident to other states, who might conservatively estimate that at most half of the missing compute was in the state’s possession, giving a covert evasion political discount factor of $\pi _{E} = 0.5$, leading to

$$K_{E}^{\mathrm{HC}}(\text{Dark}, s) \le 0.5 \cdot 1.2 \cdot K_{M}(s) = 0.6 \cdot K_{M}(s).$$

Applying these bounds to the U.S. and China gives

$$K_{E}^{\mathrm{HC}}(\text{Dark}, \text{U.S.}) \le 6.7\mathrm{k}\,\mathrm{H100e},$$

or 0.11% of $F_{E}(0)$ for our near-term scenario, and

$$K_{E}^{\mathrm{HC}}(\text{Dark}, \text{China}) \le 6.7\mathrm{k}\,\mathrm{H100e},$$

or 0.10% of $F_{E}(0)$ (the two 6.7k figures above are different values).

In this scenario, the treaty would appear to be quite durable after the sunset of transitional inference service, since all other terms in the covert evasion and overt breakout ledgers would initially remain below half of one percent. It could comfortably survive two orders of magnitude of erosion due to training efficiency gains, and plausibly more if innovation in verification methods or national technical means drove down political discount factors, or if other modes of hardware specialization similar to inference-only chips drove down technical discount factors for non-dark compute on new, governed hardware.

The main threat to durability would be the threat that new sources of undeclared accelerator production would be developed; measures like those in § 5.3 would therefore be essential.

Second, we consider a low-cooperation scenario, in which China and the U.S. arrive at a tense agreement with relatively little trust or goodwill. Both accede reluctantly to most records requests, but records requests that are at all politically sensitive are refused, making it more difficult to account for chips. Despite their pause-willingness, both states suspect the other of planning to cheat, and both find ways to hold back as much untracked hardware as they can, especially powerful newer hardware, possibly sabotaging their own investigation efforts in order to increase the plausible deniability of their own concealed stockpile.

In this case, we would expect a larger fraction to go missing, and no political discounting to be applied. In the U.S., it would likely be more difficult to conceal a large stock owing to the relatively greater difficulty of keeping secrets. For this scenario, we assume five times the missed quantity estimated in § 5.5.2 for the U.S., and ten times the missed quantity for China:

$$K_{E}^{\mathrm{LC}}(\text{Dark}, \text{U.S.}) = 5 \cdot K_{M}(\text{U.S.}), K_{E}^{\mathrm{LC}}(\text{Dark}, \text{China}) = 10 \cdot K_{M}(\text{China}).$$

which would respectively be 0.88% and 1.7% of $F_{E}(0)$ for the U.S. and China, and 0.032% and 0.063% of $F_{B}(0)$.

In this scenario, the regime could survive one order of magnitude of training efficiency gains relatively comfortably. It could survive two if the U.S. and China could eventually achieve something closer to the high-cooperation scenario after a thaw in relations, an increase in the degree of pause-willingness, or an increased sense of urgency after training efficiency gains eroded treaty bounds. If greater cooperation could not eventually be achieved, longer-term durability would hinge on the success of detection-based fallback measures.

Finally, we consider a non-deniable concealment scenario in which negotiations over recovery break down. Both states openly accuse each other of pursuing covert evasion plans, and each sees limited political value in persuading the other that they are not pursuing it themselves, but a deal nevertheless barely gets through as a stopgap measure against some acute emergency. In this case, China might conceal an amount roughly equal to its pre-pause diverted stock; in the U.S., it would likely be more difficult to conceal a large stock owing to the relatively greater difficulty of keeping secrets. Then we might have

$$K_{0}^{\mathrm{NC}}(\text{Dark}, \text{U.S.}) = 300\mathrm{k}\,\mathrm{H100e}, K_{0}^{\mathrm{NC}}(\text{Dark}, \text{China}) = 1\mathrm{M}\,\mathrm{H100e},$$

which would respectively be 4.7% and 16% of $F_{E}(0)$, and 0.17% and 0.57% of $F_{B}(0)$, if undiscounted.

This scenario would leave little margin for erosion of $F_{E}(t)$; in particular, China’s covert evasion capacity from dark compute would pose a similar issue as the U.S.’s overt breakout capacity from transitional inference service. Both problems would need to be resolved in the early years of the treaty, but the two states would likely have a few years.

6.4.4 Inference-only accelerators

While inference-only accelerators would be deployed at scale, their residual training factors would be audited with certified bounds, and their total training capacities bounded per hardware operator and state.

The covert evasion risk from licensed inference-only accelerators would be a choice parameter for treaty governance: the number of licenses for a given state could be reduced if the state had insufficient headroom on its covert evasion or overt breakout ledger.

Under overt breakout scenarios, seized inference-only hardware in commercial data centers could be used at its peak arithmetic throughput for training $(\pi _{B} = \tau _{B} = 1)$, so the treaty-certified residual training factor would be the primary protection against breakout. A host state’s inference-only fleet with an average residual training factor of $\phi$ could remain below $x \cdot \alpha _{B} \cdot F_{B}$ while serving $x \cdot \alpha _{B} \cdot F_{B} / \phi$ units of inference demand. For example, if a state wished to spend 1M H100e of its overt breakout allowance on an inference-only fleet, then it could serve 100M H100e worth of token demand on a fleet with average residual training factor below 0.01, or 1B H100e on a fleet with average residual training factor below 0.001. By comparison, Deloitte projected that two thirds of AI compute would be used for inference in 2026 (Crossan et al. 2025), or roughly 31M H100e if applied to our earlier estimate of 47M H100e of global capacity.

An average residual training factor of $10^{-4}$, amounting to 100 GFLOP/s of GEMM-laundering ability per H100e, would allow each of the U.S. and China to replicate the estimated 31M H100e of global inference service one hundred times over with inference-only accelerators, with each state keeping its breakout exposure below

$$K_{B}(\text{Inference-only}, s) \le 310\mathrm{k}\,\mathrm{H100e},$$

or 0.18% of the initial breakout fleet threshold $F_{B}(0)$, leaving two orders of magnitude of headroom.

Here, $10^{-4}$ is not an estimate or prediction but an illustrative value, and the ledger estimates do not ride on its value. If available residual training factors were higher or lower, or technical discounting factors below one could be justified, the total inference service could be adjusted based on available headroom. Significantly lower values can be achieved if all major channels for GEMM laundering can be foreclosed, but doing so would require a physical audit of a realized system.

The covert exposure could be driven further down by certifying a separate residual training factor $\phi _{E}$, which might be lower than $\phi$ if the most favorable GEMM-laundering channels required physically tampering with inference-only chips in a way that would be evident to inspectors. Additional verification steps, such as those suggested above for the transitional inference service fleet, could reduce the covert evasion capacity further. If $\pi _{E} \le 0.001$, as assumed above owing to the difficulty of evading discovery by the recomputation server, then the covert evasion capacity is still lower:

$$K_{E}(\text{Inference-only}, s) \le 310\,\mathrm{H100e},$$

or only 0.0049% of $F_{E}(0)$.

6.4.5 Consumer GPUs

Next, we consider consumer GPUs. Jon Peddie Research (2024) forecasts a global installed base of 119M discrete desktop add-in boards by the end of 2028. If there are half as many laptop units as desktop units,⁠⁷² we might use a rough conservative bound of 100M total cards in either the U.S. or China, with the average such chip having peak dense arithmetic throughput of 30 TFLOP/s,⁠⁷³ giving $K_{0}(\text{Consumer}, s) = 3\mathrm{M}\,\mathrm{H100e}, a$ potential covert training risk before discounting.

Political discounting would deflate this risk considerably, especially under the covert scenario. Since gaming cards are diffusely held, deploying them at scale would require either a vast conspiracy of regular citizens knowingly permitting their cards to be used toward treaty violation, or hacking into and diverting a small portion of a much larger group of citizens’ cards without their noticing. If parties deem it implausible that a state could commandeer more than 1% of consumer card capacity for a covert run without running a major risk of discovery, we might take $\pi _{E} \le 0.01$.

Political discounting of consumer GPUs under an overt breakout scenario is more uncertain and depends on parties’ estimation of the likelihood that governments could commandeer a large fraction of consumer hardware even in a wartime footing scenario. In constitutional democracies, at least, any such effort would require sufficient constitutional or statutory basis⁠⁷⁴ and might face significant legal as well as political hurdles. States might accept the premise that it would be difficult to commandeer more than 25% of total consumer capacity toward a breakout program, giving $\pi _{B} \le 0.25$.

Even generous technical discount values would likely be low for consumer GPUs since they are heterogeneous, are thermally limited when operated at high utilization, and have low memory and interconnect bandwidth, all rendering them unsuitable for efficient training at frontier scale; the covert technical discount factor would be lower still due to evasion overhead. Dean (2026a) estimates the “usefulness” (essentially a technical discount factor) of each chip, finding consumer gaming cards to be worth roughly 0.05 of an H100e. If we are twice as generous and take $\tau _{E}, \tau _{B} \le 0.1$, the total covert evasion risk is reduced to

$$K_{E}(\text{Consumer}, s) \le 3.0\mathrm{k}\,\mathrm{H100e},$$

and the overt breakout risk to

$$K_{B}(\text{Consumer}, s) \le 76\mathrm{k}\,\mathrm{H100e},$$

representing 0.047% and 0.043% of $F_{E}(0)$ and $F_{B}(0)$, respectively.

Thus, under covert or overt scenarios, the consumer GPU base does not appear to represent a significant hurdle to the treaty’s durability, up to at least two orders of magnitude, due to its diffuse ownership.

One possible future failure mode of this calculation is that, under a treaty, a few individuals or firms might buy up a very large number of consumer GPUs, negating the above argument based on diffuse ownership. In order to defuse this longer-term threat, states parties might consider passing laws limiting the number of consumer GPUs held by any one actor, and taking steps to prevent skimming from the production line.

6.4.6 Licensed sovereign fleets

In § 3.3.1 we discussed the possibility of permitting licensed sovereign training-capable accelerator fleets to be used for specific sensitive national security workloads. We assess the exposure from these fleets by considering El Capitan, the largest supercomputer in the U.S. and an important strategic asset with the primary mission of nuclear stockpile maintenance. El Capitan serves 46k AMD Instinct APUs with 980.6 TFLOP/s each, amounting to $K_{0}(\text{El Capitan}, \text{U.S.}) = 46\mathrm{k}\,\mathrm{H100e}$ in total (Lawrence Livermore National Laboratory 2025; AMD n.d.).

The technical discount factor for overt breakout can be conservatively estimated close to 1,⁠⁷⁵ though it might be lower for covert evasion since the network topology is presently optimized for scientific workloads like fluid dynamics simulation rather than frontier AI training, and any evasion scheme would likely come with technical overhead.

We assume an overt breakout political discount factor of $\pi _{B} = 1$, since the supercomputer is fully controlled by the U.S. Federal Government, giving total breakout exposure of

$$K_{B}(\text{El Capitan}, \text{U.S.}) \le 46\mathrm{k}\,\mathrm{H100e},$$

or about 0.026% of $F_{B}(0)$.

The political discount factor for covert evasion, however, might be much lower, owing to the difficulty of keeping secret from staff the diversion of a large fraction of such a supercomputer. We might conservatively take $\pi _{E} = 0.2$, yielding covert exposure

$$K_{E}(\text{El Capitan}, \text{U.S.}) \le 9.1\mathrm{k}\,\mathrm{H100e},$$

or about 0.14% of $F_{E}(0)$.

As a result, we estimate that the treaty could sustain a practice of allowing a number of supercomputers on the scale of El Capitan per state without threatening treaty thresholds, at least early on.

The number could grow further with improved institutional governance or verification measures allowing for steeper political discounting, or improved technical governance measures such as hardware specialization allowing for steeper technical discounting. If the political discount factor and the technical discount factor each fell by an additional factor of five, for example, then the covert evasion capacity would fall to 0.0057% of $F_{E}(0)$, which would leave room for each state to operate a multiple of the capacity of El Capitan, even after two orders of magnitude of erosion.

We assess this as an encouraging sign for political feasibility: it does not appear that, in the immediately foreseeable future, a treaty would need to impose on strategically important assets like El Capitan.

6.4.7 Other categories

Another palatability feature we discussed in § 3.3.1 was the option to create internationally governed scientific preserves. Such preserves’ near-term size would likely be small compared to current commercial fleets, and it would appear highly difficult for covert evasion to occur there in transparent and replayable workloads, under the noses of the treaty authorities running the preserve. It would be important to guard against overt breakout scenarios, however, either by locating them in neutral states unlikely to participate in a breakout, or giving treaty monitors the ability to quickly and permanently incapacitate the chips located in a scientific preserve when the host state attempted to seize them, or both. Thus, it appears possible to ensure that scientific preserves contribute negligibly to the U.S. or China’s covert evasion or overt breakout ledgers.

Finally, we discussed in § 3.3.1 the possibility of states leaving strategic reserves under seal, monitored by other states or treaty authorities. Such reserves would, by design, be fully available to states in overt scenarios, so $\pi _{B} = \tau _{B} = 1$; thus, their undiscounted compute capacity would be added to the state’s breakout ledger. However, it should be possible to implement such a plan so that the strategic reserves are verifiably powered off at all times while they remain under seal, so $\pi _{E} = 0$, thereby contributing nothing to a state’s covert evasion ledger. This is what makes the strategic reserves an attractive, politically cheaper alternative to covertly hoarding a large reserve of chips.

The above analysis is intended to be illustrative, not exhaustive. A more complete analysis would include integrated consumer graphics cards, phones, CPUs, and edge devices such as hardware installed in vehicles. Based on our initial analysis above, however, we believe there is good reason for optimism that treaty constraints could be satisfied in the near future.

6.5.1 Durably guarding against covert evasion

Dark compute is the term in the breakout and the covert evasion ledgers over which the treaty would have the least control, and it would also be the term most difficult to discount for covert evasion purposes. Based on our estimates from § 6.4.3, it appears implausible that dark compute would pose an immediate covert evasion risk but, if undiscounted, it could plausibly pose a risk over time due to training efficiency gains. Under our high-cooperation scenario, the treaty ledger would initially have two orders of magnitude of headroom, while under our low-cooperation scenario it would only have one order of magnitude.

If the U.S. and China found it difficult to cooperate in the early years of a pause, they would have further chances to reduce dark compute stockpiles before the initial headroom ran out. If they could not do better than our non-deniable concealment scenario, for example, the covert evasion ledger could survive roughly six-fold training efficiency gains before China’s covert capacity exceeded the fleet threshold. Achieving the low-cooperation scenario would be sufficient to get both states through the first order of magnitude of training efficiency gains, and achieving the high-cooperation scenario would be sufficient to achieve two orders of magnitude at a 25% allowance. Thus, a thorough global accelerator census would not be absolutely required on day one, but would need to be completed shortly after the first order of magnitude of training efficiency gains. However, we do not suggest this to encourage complacency, as an initial failed accelerator census could make it more difficult for a second census to succeed.

The most plausible fallback plan, if states could not manage to conduct a thorough census, would be efforts to detect covert training at the time it occurred. Such detection would be made more difficult owing to advances in distributed training, using methods like DiLoCo (Douillard et al. 2023), DiLoCoX (Qi et al. 2025), and more recent variants further extending distributed parallel training, but at present known methods would still require large compute clusters in order to train a model on the scale of $C_{E} = 2\times 10^{28}\,\mathrm{FLOPs}$; see Sevilla (2025) for further discussion.

6.5.2 Durably guarding against overt breakout

The transitional inference service in the U.S. could plausibly pose a breakout risk much sooner, if its replacement by inference-only compute were delayed for a long enough period of time. If 57% annual training efficiency gains accrued in the 26 months that we project it might take for inference-only chips to begin production at scale, the U.S.’s 20% overt breakout capacity would rise to 53% unless most of the pre-pause training-capable stock had been replaced.

There are several potential ways to mitigate this exposure. The simplest would be to make a one-time exception for transitional inference service and wait for pre-pause training-capable hardware to be replaced by inference-only hardware, which we estimate would happen shortly thereafter. This could be accomplished by using a shrinking schedule $\alpha _{B}(t)$ for the allowance, which could shrink to 0.25 or another terminal value over a period of years as discussed above.

Alternatively, if parties to the treaty were not satisfied with the transition timeline as a mitigation, some of the hardware could be transferred to data centers outside U.S. territory at an earlier date. These could be located offshore or in space, in the custody of a neutral state, or in international custody, for example in scientific preserves. These options would only mitigate breakout risk if it were understood that the owner state would not be able to recover these chips’ training capacity after a breakout (cf. Dean 2026b). Under our near-term pause scenario, if the U.S. were willing to do this for half of its transitional inference service (which would not require a major commercial disruption if the chips kept operating in new data centers) then it could ensure that its breakout ledger did not exceed 100% of $F_{B}(t)$, and it could eliminate this term entirely once transitional inference service were phased out by inference-only service. Since all other terms have at least two orders of magnitude of headroom at a 25% allowance, phasing out transitional inference service by this time would be sufficient for the treaty to last for two orders of magnitude of training efficiency gains.

If most or all of the pre-pause training-capable compute used for transitional inference service were transferred to data centers in locations where they were judged to pose low breakout risk for any state, such as offshore or in space, they would still need to be weighed into states’ covert evasion risk ledgers. If states parties were confident enough in verification methods, and in the plan to prevent recovery upon breakout, it is possible that pre-pause training-capable compute could continue to perform inference service for the remainder of its useful lifetime.

6.5.3 Extension options

In each of the above scenarios it is possible that the combination of training efficiency gains and dark compute would eventually make it impossible to balance the covert evasion ledger, with detection-based methods failing to make up the difference. In that case, the simplest way for pause-willing states to extend the lifetime of the agreement would be to declare their dark compute and place it in strategic reserves, but this might be politically difficult. An alternative option would be for an international consortium to jointly train a larger model to advance the frozen frontier $C_{F}$ just enough to make policing $C_{E}$ feasible once again.

6.5.4 Lithography proliferation

Missing lithography machines, supported by a complete indigenous covert supply chain, could significantly undermine the regime over a period of years by creating a continuous inflow of dark compute into one state. For example, Brown and Khan (2026) estimate that a single ArF-immersion DUV machine could contribute roughly 30k–47k Ascend 910C-equivalents—or 24k–38k H100e in our units—per month at state-of-the-art yields for 7nm precision using multipatterning, significantly eroding durability. The regime would need to prevent undeclared accelerator production by verifying the location of each advanced pre-pause lithography machine in each state from vendor service records and by dedicating sufficient ongoing intelligence efforts to detect any new undeclared manufacturing facility or covert supply chain. Such an effort would be highly plausible given the many subcomponents and materials required to service a fully functional lithography machine.

7.3.1 MSIC adoption in a mixed MSIC-flexible world

Assume there is a whitelist of finitely many models. We will consider a simple rule for deciding whether to build an MSIC for a given model on the whitelist, based on the following data:

• $D_{M}$ is the expected share of total inference demand (as a percentage) that will go to model $M$ on the whitelist. We abstract away from the fact that building an MSIC for $M$ could lower its inference price and thereby increase demand for that model.

• $\mathrm{NRE}$ is the fixed cost of development (in dollars) of an MSIC for a model (assuming for simplicity this is the same for each model on the whitelist), called the non-recurring engineering cost for the MSIC.

• $S$ is the savings of moving model inference from flexible accelerators to MSICs, as a percentage of the cost of inference on flexible accelerators (again assuming for simplicity this is the same for each model).

• $B$ is the expected (discounted) lifetime cost of serving all inference demand that it is profitable to serve using only flexible accelerators, which we call the baseline cost of serving inference.

Suppose that an MSIC will be developed for model $M$ if and only if the expected (discounted) lifetime cost-savings exceeds the fixed cost $\mathrm{NRE}$:

$$S \cdot D_{M} \cdot B > \mathrm{NRE}.$$

Estimates for the savings term $S$ range from 60% to 95%.⁠⁷⁹ Estimates for the fixed cost $\mathrm{NRE}$ of developing an MSIC range from $10M to $500M.⁠⁸⁰ If we imagine that all models currently available on OpenRouter pass safety scrutiny and are whitelisted,⁠⁸¹ then we can use OpenRouter data⁠⁸² to give us a scenario for the distribution of demand shares $D_{M}$: for each model $M$ served by OpenRouter, we simply take $D_{M}$ to be the share of total tokens of inference served on model $M$ from August 5-11, 2026 (below we extend our analysis to allow for changing demand over time).⁠⁸³ Finally, for the expected (discounted) lifetime cost of serving all inference demand that it is profitable to serve using only flexible accelerators, we consider a range of scenarios for $B$ from $500B to $2T.⁠⁸⁴

Figure 7.1 shows the results based on the OpenRouter data, assuming $S = 85\%$ (the share of tokens served on MSICs is largely insensitive to the choice of $S$ within the range from 60% to 95%⁠⁸⁵). The upshot is that assuming the long-run economic model above, the vast majority of inference tokens on whitelisted models would be served on MSICs. Moreover, there would be major cost savings over serving all inference on only flexible accelerators.⁠⁸⁶ Models with insufficient demand would not justify dedicated MSICs, but collectively such models serve a small share of total inference. Again note that our analysis holds the demand shares $D_{M}$ fixed, but since serving a model on an MSIC lowers its cost and therefore its price (assuming competition), demand would shift toward MSIC-served models. In this respect, the estimates in Figure 7.1 for the share of tokens served on MSICs are lower bounds.

The decision rule above determines whether to build an MSIC based on minimizing total cost for the assumed volume and distribution of inference demand. The question of when a market left to its own devices would build an MSIC is more complicated, since firms might not fully capture the savings of using an MSIC, whether because of competition among MSIC developers or for other reasons. But even under the worst-case parameters of Figure 7.1, the expected savings of using the MSIC exceed the fixed cost of developing it by roughly 120x for the most popular model and by at least 10x for every model in the group of most popular models that collectively serves three-quarters of all tokens. Thus, the incentives to create MSICs for the models serving most of the inference would likely exist even if only a small fraction of the savings could be captured by any single investor.

It is instructive to compare this analysis with the historical record concerning hardware for Bitcoin mining. In a span of four years, Bitcoin mining went from CPUs to GPUs (by 2010) to FPGAs (by 2011) and finally to ASICs (by 2013) (Taylor 2017); an early Bitcoin mining ASIC had 4.4 times the hashing throughput per dollar of hardware cost and was 40 times more energy efficient than a contemporaneous GPU (Taylor 2017, 64). In the case of Bitcoin, the economic incentives toward ASICs may be greater than in the case of AI models, since there is essentially just one algorithm for Bitcoin mining, which one would naturally want to hardwire into an ASIC for maximum efficiency. However, the example of AMD’s pending acquisition of Taalas (AMD 2026) suggests that even without a frozen whitelist of AI models, there are economic incentives in favor of some development of MSICs. The analysis of this section suggests that in the presence of a frozen whitelist, the economic incentives in favor of MSICs could be much greater.

7.3.2 The cost of a pure MSIC world

What would happen if inference were allowed only on MSICs? What would be the resulting economic inefficiency relative to allowing both MSICs and flexible accelerators, in the sense of increased cost of serving inference and loss of consumer utility due to some models not being served?

All of the models that justified dedicated MSICs in the “mixed MSIC-flexible world” of the previous subsection would still justify MSICs in the “pure MSIC world”, but in the pure MSIC world some additional models might justify dedicated MSICs. The reason is that in the pure MSIC world, it is not necessary to clear the hurdle of the cost-savings condition relative to flexible accelerators from the previous subsection. It is sufficient that it would be profitable to create an MSIC in order to serve a model, even if that would be less profitable than using flexible accelerators to serve the model, if that were permitted (which it is not in the pure MSIC world); and profitability was already implicitly a necessary condition of creating an MSIC in the mixed MSIC-flexible world.⁠⁸⁷ Thus, in the pure MSIC world, at least as many and plausibly strictly more models would justify dedicated MSICs.

The key difference is that in the pure MSIC world, if an MSIC is not created for a model, then demand for inference on that model is unserved. By the reasoning in the previous paragraph, Figure 7.1 gives an upper bound on the number of models that would go unserved and the share of demanded tokens that would go unserved. While the number of models that go unserved could be substantial, the share of demanded tokens that would go unserved would be at most a few percent under the worst-case assumptions of Figure 7.1 (and the unserved share of inference spending would be about 2%, as discussed in Footnote 83).

Of course, some consumers whose favorite model has insufficient demand to justify an MSIC would switch to demanding tokens from their next favorite model, which might already have an MSIC based on aggregate pre-switch demand or could justify a new MSIC based on aggregate post-switch demand. The inefficiency of the pure MSIC world relative to the mixed MSIC-flexible world depends on what fraction of consumer utility is preserved after switching to their next favorite model among those that justify an MSIC (cf. Hausman 1996; Conlon and Mortimer 2013). Given the similar capabilities of frontier models and the fact that even in the worst-case scenario of Figure 7.1, 60 models are served by MSICs, consumers may preserve a substantial fraction of their utility by such a switch, though the loss may be greater for users for whom no model with an MSIC performs well in their native language. Without studies of consumer utility functions for tokens from different models, we are not able to quantitatively estimate the utility loss implied by 3.7% of tokens (to take the worst-case scenario from Figure 7.1) switching from the consumers’ favorite models to their next favorite models that are popular enough to justify an MSIC. We encourage economists to study consumer utilities for tokens in future work.

7.3.3 Shifting demand among whitelisted models

However, what happens if changing consumer tastes lead to shifts in the distribution of demand among whitelisted models? If many copies of an MSIC are created for a once popular model, but this model becomes less popular in the future (even though the whitelist remains frozen, so no new models appear as competitors), then those chips cannot be turned into MSICs for a more popular model (cf. the literature on investment in flexible versus dedicated production capacity, as in Fine and Freund 1990; Van Mieghem 1998). A fleet of MSICs could adjust its distribution over time by increasing production and delaying retirement of chips for models with rising demand and doing the opposite for models with falling demand, but it could not do so instantly as a fleet of general-purpose accelerators could. This higher latency in responding to shifting demand would likely be a source of some inefficiency, though it is hard to estimate how much from current market data because, unlike today’s world, a paused world would see very little churn in what model options were available to customers from one month (or year) to the next. On the other hand, general-purpose accelerators pay a steep cost for their flexibility, as reflected in the 60-95% cost savings for MSICs.⁠⁸⁸

If we continue to assume $S = 85\%$, then serving virtually all whitelisted inference on MSICs costs roughly 15% of $B$, plus design fees ranging from a fraction of a percent to a few percent of $B$. Thus, even if demand shifted so much that all chips in the initial fleet of MSICs were turned into obsolete write-offs (say because 20% of initial demand migrated every year for five years to models not originally covered by MSICs, with price cuts unable to win back any consumers) and had to be fully replaced with new MSICs (requiring roughly the same number of designs as the original MSIC fleet), the cumulative resource cost would be roughly 30–40% of $B$ (including a second round of design fees),⁠⁸⁹ representing a 60-70% cost savings relative to a pure flexible world.

Another concern is daily fluctuations in demand. As an extreme example, suppose there is a model $M$ popular in the U.S. that receives no demand during the U.S. nighttime. Thus, the MSICs for model $M$ may achieve 100% utilization during the U.S. daytime but 0% utilization during the U.S. nighttime, for an average utilization of 50%. By contrast, a flexible accelerator could achieve 100% utilization during the U.S. daytime by serving model $M$ and 100% utilization during the U.S. nighttime by serving a model $M'$ popular in China, for example. Then if the cost per token of an MSIC is 15% of that of a flexible accelerator assuming 100% utilization of both, the cost per token of an MSIC rises to 30% if the MSIC can only achieve 50% utilization, assuming conservatively that halving MSIC utilization doubles its average cost per token (excluding $\mathrm{NRE}$). This would still represent a 70% saving for MSICs over flexible accelerators. Moreover, the utilization gap between MSICs and flexible accelerators could be smaller if $M$ retains some demand across time zones or if scheduled inference jobs with $M$ could be run overnight.

Finally, the loss of efficiency in moving from the mixed MSIC-flexible world to the pure MSIC world would have to be weighed against the benefits of the pure MSIC world in facilitating a pause. If the probability of catastrophic outcomes for humanity were much lower in a pure MSIC world (due to more reliable prevention of frontier AI training) than in an alternative world with flexible accelerators, this might swamp considerations of the economic frictions in dealing with shifting demand between models.

7.3.4 Temporary or permanent de-whitelisting of models

One possible concern about a pure-MSIC world is that if a model gets de-whitelisted (a kind of extreme case of a demand shift, where demand goes to zero by decree rather than due to changing tastes), then its MSICs are stranded capital. In this subsection, we consider the extent of this concern. The takeaway is that the possibility of de-whitelisting does not rule out the use of MSICs as inference-only chips for a hardwired pause; the cost savings from MSICs may outweigh losses from de-whitelisting, and insurance could help manage the financial risk of de-whitelisting for firms that own and operate MSICs.

First, we must distinguish between temporary and permanent de-whitelisting. When a model is de-whitelisted due to a discovered jailbreak, it might be re-whitelisted after the development of appropriate external guardrails such as an input classifier or safety harness, which inference providers would be required to run when serving the model. In this case, de-whitelisting is temporary, like most automobile recalls; the MSICs are temporarily idle but not permanently stranded.

Permanent de-whitelisting would be more costly. Suppose it is discovered that a whitelisted model poses a safety risk for which no external guardrails are adequate, so the only choice is to retire the MSICs for the model. In the worst case, suppose this happened to the most popular model. In the OpenRouter data used above, the most popular model serves 14% of all tokens, but let us suppose the most popular model overall (not just on OpenRouter) serves 30% of all tokens, i.e., $D_{M} = 0.3$. The (discounted) lifetime cost of serving the model using flexible hardware is therefore $0.3 \cdot B$, whereas the (discounted) lifetime cost of serving the model using its MSICs is $(1 - S) \cdot 0.3 \cdot B$. To estimate the stranded capital cost, we introduce three more parameters, two of which are a function of the time $t$ of de-whitelisting:

• $K$ is the chip-capital share. This is the share of the (discounted) lifetime cost of serving the model (not including $\mathrm{NRE}$) using MSICs that is spent on the chips themselves.

• $W_{M}(t)$ is the stranded-chip fraction. This is the book value of model $M$'s installed MSIC chips at time $t$, divided by the total (discounted) amount that would have been spent buying MSIC chips for $M$ over its lifetime if it had remained whitelisted.

• $V_{M}(t)$ is the unamortized design-cost fraction. This is the unamortized share of model $M$'s design cost $(\mathrm{NRE})$ at time $t$, where the design cost is amortized in proportion to tokens served with $M$.

Then the stranded capital cost is

$$(W_{M}(t) \cdot K \cdot (1- S) \cdot D_{M} \cdot B) + (V_{M}(t) \cdot \mathrm{NRE}),$$

where the first summand is due to wasted chips and the second is due to wasted engineering. Let us consider some cases for when de-whitelisting occurs.

Early de-whitelisting. If de-whitelisting happens shortly after production of $M$’s MSICs begins, then $W_{M}$ is close to 0, since not many chips have been built. On the other hand, in the worst case where the $\mathrm{NRE}$ was spent on a chip platform that is not at all reusable—it is useful for only model $M$—then $V_{M}$ is close to 1 in this scenario, since no amortization has occurred right after production begins, before tokens have been served.

De-whitelisting after initial large-scale production. If de-whitelisting happens right after the first major wave of MSIC production for $M$, then $W_{M}$ is roughly the cost of the chips in the first wave divided by the (discounted) cost of the chips in all the waves that would have been produced had de-whitelisting not occurred. Again, in the worst case where the chip platform is not reusable for other models, $V_{M}$ would be close to 1 since few tokens have been served and hence little amortization has occurred.

Later de-whitelisting. If de-whitelisting happens a while later, then both $W_{M}$ and $V_{M}$ might be significantly less than 1. And if the $\mathrm{NRE}$ went to a reusable chip platform, like that of Taalas, this would further reduce $V_{M}$.

For a scenario in which the most popular model with $D_{M} = 0.3$ gets de-whitelisted some way into the pause, suppose $W_{M}(t) = V_{M}(t) = 0.5$. Suppose our earlier variables are $S=0.85, B = \$2\mathrm{T}$, and $\mathrm{NRE} = \$500\mathrm{M}$ (the top of our range). Let us suppose, adversarially, that $K=1$ (whereas in reality energy costs imply $K<1$). Then the stranded capital cost is approximately $45B, where the part coming from wasted $\mathrm{NRE}$ is negligible. We can put this into perspective in several ways. First, for comparison, the FAA’s temporary grounding of Boeing’s 737 MAX cost Boeing more than $20B in direct costs (Robison 2021). Second, let us compare the de-whitelisting scenario in a world in which $M$ is served using MSICs versus a world in which $M$ is served using flexible accelerators, which can simply switch to serving other models when $M$ is de-whitelisted. Let $f$ be the fraction of the model's lifetime demand served before the de-whitelisting at time $t$. If we live in a world in which $M$ is served only by flexible accelerators, we would spend $f \cdot D_{M} \cdot B = f \cdot 0.3 \cdot \$2\mathrm{T} = f \cdot \$600\mathrm{B}$ on serving $M$ before de-whitelisting. If we live in a world in which $M$ is served only by MSICs, we would spend $f \cdot (1-S) \cdot D_{M} \cdot B = f \cdot 0.15 \cdot 0.3 \cdot \$2\mathrm{T} = f \cdot \$90\mathrm{B}$ plus the stranded capital cost of $45B for a total of $(f \cdot \$90\mathrm{B}) + \$45\mathrm{B}$ before de-whitelisting.⁠⁹⁰ It follows that if $f > 9\%$,⁠⁹¹ then even with the stranded capital, serving model $M$ with MSICs before de-whitelisting is cheaper than serving model $M$ with flexible accelerators before de-whitelisting.

The firms that own and operate MSICs incur the losses when a model is de-whitelisted, which raises the worry that they will lobby heavily against any de-whitelisting. To reduce this pressure, one possibility would be to require firms to buy insurance covering losses from de-whitelisting as a condition of their license to serve inference with MSICs.⁠⁹² The insurance premiums would depend on the book value of the MSICs covered and the assessed risk of de-whitelisting, helping to limit the incentives of firms to overinvest in MSICs for models at risk of de-whitelisting. The insurance fund would compensate a firm for the book value of its MSICs in the event of de-whitelisting, but only upon return of the MSICs to authorities. The treaty authority could serve as the insurer of last resort. Coverage would carry a deductible, so operators would maintain an interest in the likelihood that the models they serve will remain safe. Note that the purpose of the insurance requirement would not be to make operators whole but rather to make the treaty authority's whitelisting decisions more independent of firms' financial interests.

8.2.1 Fundamental changes in the technology

One primary factor shaping pause-willingness is the state of AI technology itself. Changes in the technology or its use could reshape (1) the marginal value of racing, (2) the dangers created by racing, and (3) the feasibility of reciprocal restraint. This section considers these three dynamics across five illustrative technological trajectories. Given that the contextual application of technologies is a major determinant of their risk profile, this analysis will consider AI as a broader sociotechnical system (Bijker et al. 1987). This means that relevant technological shifts could be concrete changes in the capabilities of models but could also be changes in their use or application.

First, frontier progress could encounter a substantial plateau or a “wall,” reducing the marginal value of accelerated frontier model training. This could happen, e.g., if additional compute, data, algorithmic advancement, or capital start to generate sharply diminishing improvements in strategically relevant capabilities.

An agreement to stop advancing the AI frontier could be more politically costly for leaders if they believe that continued research could give them near-term decisive military, intelligence, scientific, or economic advantages. It is substantially less costly if additional investment is expected to yield only incremental improvements, perhaps opening the door to pause willingness even in otherwise challenging national or international incentive contexts. Slower discovery of significant capabilities could also facilitate better safeguards and more time to plan robust enforcement mechanisms, with the latter perhaps further incentivizing an international agreement pausing AI research in areas where higher risks remain. In short, a plateau would decrease the benefits of racing.

Second, the opposite trajectory, which appears more likely at the time of writing, could also shape and enhance pause willingness. Capabilities could increase so rapidly that the expected cost of continued development raises questions about the advisability of continued research even in political contexts that would otherwise incentivize it.

The political effects of this change would not depend on the absolute dangers of advanced AI but on whether these additional capabilities create forms of mutual vulnerability that neither side could reliably escape through unilateral action. Whether rapid advances result in intensified racing dynamics (perhaps on defensive research or action motivated by a “closing window” effect) despite these risks would likely depend on the broader international system context. In contrast to a plateau, which would decrease the benefits of racing, an acceleration could increase the costs of racing. Because the development of technologies is not teleological, it is possible that some capabilities may plateau while others improve rapidly, perhaps exercising independent effects on risk and benefit in various sectors.

Third, AI development could produce consequential shifts in the offense-defense balance of AI tools across domains. If AI capabilities confer significant defensive advantages in, for example, bio and cyber risk, this may reduce incentives for pausing while increasing pause willingness. If AI capabilities are on balance defense dominant, potential aggressors may anticipate fewer strategic benefits to be derived from further advances. Leaders in turn may simultaneously worry less about the likelihood of offensive uses of AI and become more confident in their ability to defend against them, thereby decreasing their incentives to pursue a pause while concomitantly increasing their willingness to agree to one. At the same time, significant increases in offensive capabilities may increase desire for a pause while increasing the costs of adversary defection from a pause regime. If AI capabilities significantly increase with respect to cyber attacks, intelligence collection, military targeting, operation of autonomous weapons, or the discovery of security vulnerabilities, leaders may fear that falling behind even briefly could create acute strategic risks. Such a development could intensify the race rather than facilitate restraint. But if offense dominance becomes sufficiently severe on both sides, particularly if neither side can plausibly secure a lasting lead in AI capabilities (see below), offense-related harms could facilitate national demand for a pause in a vacuum and the resulting mutual vulnerability could cultivate the pause willingness needed to bring this about through international agreement.

Fourth, it is possible that the “brittleness” of an advantage in AI capabilities may shape pause willingness. If advantages in AI capabilities are tenuous, possessing a temporary lead may become less strategically valuable, perhaps clearing a path to pause willingness even as national and international dynamics remain otherwise consistent. Conversely, technological developments that make capabilities highly excludable or self-reinforcing could increase fears that a temporary lag will become permanent, sharply reducing willingness to pause.

Finally, changes in the technology or its integration could shape the enforceability of an agreement, thereby affecting pause willingness. To offer just one example: a capability frontier that is dependent on large, centralized training runs, which require scarce and observable hardware, would be far easier to monitor than a corresponding frontier whose capabilities can be generated through the use of small, distributed or highly-compute efficient hardware systems. While this latter paradigm is not in view at the time of writing, unforeseen technological developments are not without precedent. Taken together, technological change, to include changes in broader socioeconomic context, can make a pause more plausible through at least the three mechanisms mentioned above: reducing the expected payoff from continued racing, increasing the shared dangers produced by continued racing, or making reciprocal restraint easier to verify and enforce. Importantly, the same technological development can push these mechanisms in opposite directions. The determinant for pause willingness is the balance of incentives for key actors in the broader international system shaped by these technological changes.

8.2.2 Changes in the international system: cooperation in the shadow of great power rivalry

The structure and distribution of power within the international system provides the underlying strategic environment within which decisions about frontier AI development are made. Changes in the system may not be determinative vis-à-vis pause-willingness, but shifts in the distribution of power and the importance of such shifts materially influence the incentive structures that states face when weighing the costs and benefits of an AI pause. This is because one, or maybe even the, fundamental challenge to reaching and sustaining pause willingness is that willingness is inversely correlated with perceived strategic advantage. However, shifts in the balance of power that instigate a rethinking of the strategic advantage bestowed by AI racing and reduce the expected gains relative to potential costs can enhance the viability and durability of pause willingness. This section discusses some of the key systemic variables that bear on AI pause willingness, by drawing upon the work of international relations (IR) theorists who have advanced a variety of frameworks that help explain why great powers might agree to hit pause on a technology they each regard as strategically consequential. Four are of particular relevance for an AI pause: power transition theory and its relationship to the security dilemma; hegemonic stability theory; polarity; and alliance dynamics.

8.2.3 Changes in national political environments

International agreements on frontier AI will not be negotiated by monolithic states, behaving as rational, utility-maximizing actors. Instead, any pause agreement$(s)$ will be agreed (or not) by governments, whose choices are informed, shaped, restrained, or undermined by the domestic political environments in which they operate. The previous two sections focused on the technological and international systemic factors that inform perceptions of the strategic costs and benefits of a pause. Those variables notwithstanding, whether shifts in incentives and cost-benefit calculations can engender buy-in and sustained commitment to a pause will depend fundamentally on whether the governments involved—be they democratic, autocratic or somewhere in between—can engineer and maintain the domestic political conditions necessary to negotiate, ratify, implement, monitor and sustain a pause. This section explores key domestic-level conditions that can enable or impede an AI pause.

Putnam’s (1988) now-classic “two-level game” framework offers analytical leverage for making sense of how, why and under what conditions domestic political contexts shape international agreements (and, conversely, how international agreements can affect domestic political outcomes). Putnam posits that negotiators function on two levels simultaneously, the international and the domestic, and the practicability and viability of any agreement forged on the international level is ultimately dictated by what is functionally possible on the domestic level. In Putnamesque terms, the “win-set” of any international negotiator—i.e., the range of agreements to which they can credibly commit—is thus constrained by what the relevant domestic constellation of actors will accept. Any changes that serve to expand a domestic win-set will make sustainable international agreement more achievable, while changes that reduce a domestic win-set will make international agreement harder.

Thus, in addition to the technological and international factors discussed above, for a pause to be actionable and sustainable there must be sufficient support from relevant domestic actors and agencies. Win-set relevant domestic actors include governments, national security agencies, military establishments, legislatures, and the general public as well as, quite critically, AI-focused firms—the primary developers, owners, and deployers of the technology being governed.

Pause-willingness at the national level could arise in a number of ways, and the route by which major states arrive at pause-willingness is likely to shape the design and durability of an eventual pause agreement. These paths to pause willingness themselves will be shaped by the public and private actors described above in addition to relations between major powers.

The paths to and durability of pause willingness will be shaped by the complex interplay between strategic interests of state actors, particularly the United States and China, and the capacity and willingness of governments to regulate, monitor and enforce frontier AI development. Durability may also depend on the inclusion in negotiations from the start of a broader array of states, jurisdictions and private actors within those territories due to their role in international norm setting, supply chain production, cloud infrastructure, and capital investments. Domestic dynamics differ and depend on the influence that private actors wield on public opinion (especially in democratically-elected governments), consumer behavior and importance to national economy and national security. As a result, a pause-willing future depends not only on international politics, but also aligning incentives and security buy-in from private actors and publics.

8.4.1 The expected costs of continued development have increased

Perhaps the most straightforward path to pause willingness is that the expected costs of continued frontier AI development could rise sufficiently such that both the United States and China begin to view unconstrained competition as less desirable than reciprocal restraint. Even in a future in which AI research or the tools provided by it remain valuable in absolute terms, this value may not merit increasing risks. The relative costs measured in economic stability, national security, or political cohesion might produce pause willingness even as large states continue to believe that advanced AI capabilities confer strategic advantages.

Of course, this does not mean that a heightened risk profile would be sufficient to produce pause willingness. If policymakers believe that advanced AI capabilities remain more dangerous in the hands of an adversary than in general, they may pursue unilateral countermeasures or deepen their commitment to racing. Given this possibility, pause willingness depends not only on the balance of risks and benefits of continued frontier AI development, but on the source and nature of the foreseen AI risks.

Reassessment of risk, perhaps leading to pause willingness, could result from a single, focusing event or from a gradual shift in belief. A shared focusing event that sharply changes beliefs about frontier risk makes the easiest example: a serious consequence, perhaps in the cyber or biological domain, could provide concrete evidence of high-impact AI harms and inject this evidence into important policy communities by virtue of its prominence. If mitigations for the resultant harms appear limited and the potential costs of recurrence are sufficiently severe so as to eclipse the broader benefits further frontier AI development may confer, the event could produce pause willingness in important policy communities. At the same time, a focusing event like this could raise awareness of risks in the general public and create political space for policy intervention. If important communities in both the U.S. and Chinese polity interpret the event as evidence of shared risk, the event could provide a practical and rhetorical basis for previously difficult negotiations.

While this “fulcrum” of negotiating context may ease paths to pause willingness, it is not strictly necessary. It is also possible that a series of smaller developments and their communication within relevant policy communities could convince important constituencies that systemic risk is rising faster than it can be managed, and critically, is outstripping the benefits of frontier AI development. It is easy to imagine that continued improvement in offensive cyber capabilities might generate increasing concern about frontier cyber risks. These increasing concerns might inspire a shift from asking whether AI could create severe vulnerabilities to asking whether existing institutions can manage realized risk. If mitigation does not appear sufficient, both expert communities and the broader public may shift attitudes towards pause willingness.

8.4.2 The perceived value of “winning the AI race” has fallen

What if, regardless of costs produced by risk, the expected benefits of AI vary? A second path to pause-willingness emerges if the expected benefits of continued frontier AI development decline sufficiently such that the U.S. and China become more willing to accept reciprocal restraint. In contrast to the previous scenario, this pathway does not require policymakers to become substantially more concerned about the risks generated by advanced AI. Instead, the strategic value associated with continued frontier AI development falls. AI could remain an important general-purpose technology with substantial strategic implications while policymakers become increasingly skeptical that pushing the frontier will create benefits commensurate with the resources required to do so and the risks produced by frontier capabilities. In this class of pause-willing futures, the opportunity cost of a pause falls, and given the material and risk costs of frontier AI development, restraint becomes easier to contemplate because key actors believe they are giving up less by forgoing frontier capabilities.

As with increasing costs, declining benefits do not necessarily produce pause willingness. Because the relevant comparison is between the strategic consequences of continuing and stopping relative to a potential adversary and not simply between the expected benefits of additional AI research and the risks associated with it, even modest improvements in frontier capabilities could sustain intense competition if policymakers believe that small capability advantages confer important military or economic advantages. Again as above, a pause-willing future of this type requires a convergence of U.S. and Chinese assessments, with both concluding in the broad strokes that mutual reciprocal restraint would sacrifice less than continued competition.

One pathway to a mutual reassessment of this kind is that progress on the AI frontier becomes increasingly difficult or that frontier returns become decreasingly attractive in strategically consequential terms. Additional investments in compute, data, energy, talent, or algorithm research could continue to produce model performance without producing commensurate improvements in business value, military capacity, or traction on scientific problems. It is also possible that scaling laws or unforeseen development challenges may cause direct declines in performance gains relative to investment. In either case, policymakers would gradually revise downward the expected marginal value of pushing the frontier. This would not mean AI has “failed” in any sense, of course. Existing models could remain extraordinarily useful and continued investment in diffusion could remain attractive. The specific activity targeted by a pause would become less valuable relative to other uses of resources or, consequentially, the risk profile of frontier AI development at the time of assessment.

It is also possible that frontier advances could remain fruitful but prove incapable of producing durable strategic advantage. There are several possible causes of this “brittle frontier” dynamic, some of which are discussed more thoroughly in the next section. Rapid cross-border diffusion, for example, can weaken incentives to race through two related but distinct mechanisms. For the state in the leading position in a competition, rapid diffusion could reduce the expected return from investing in further AI advances. This is because the advantages of doing so may be short-lived and because those same advances could end up helping the trailing state achieve the same results more efficiently. At the same time, rapid diffusion might cause the trailing state to ask why they should incur the costs of investing in discovery when they may be able to wait for innovations to rapidly diffuse, so they can reproduce them cheaply. In other words, rapid diffusion could end up reducing both the expected benefits of extending a lead and the expected benefits of racing to close the lead. In both cases, frontier progress may remain rapid and valuable while the value of being ahead in the race falls because neither side can remain ahead for long, and in fact breaking new ground may impose costs conferring a second-mover advantage.

This could result in a costly strategic treadmill. U.S. policymakers, leading by most frontier capability metrics at the time of writing, might conclude that enormous investments can purchase only temporary leads. At the same time, Chinese policymakers could reach the same conclusion from a different starting point: even massive investments and a great tolerance for risk along the way may not produce durable superiority, or in extreme cases, result in faster progress than counting on diffusion as part of a dedicated national strategy.

Across these narratives, pause willingness occurs when policymakers see declining value in each movement of the AI frontier, either in absolute terms or relative to a second mover strategy. The specific cause of the shift is unimportant. It could result from a technological plateau, challenges with traction on real world problems, rapid diffusion of breakthroughs (discussed in detail below), or a growing belief that frontier model leadership is but one facet of broader AI leadership from a prestige or strategic assessment standpoint. One potential challenge to this path to pause willingness is that while key actors within governments may be open to a pause on this logic, private firms, with their vast resources and influence over political decisions, may not be. Governments may conclude that another generation of models offers little additional national security or even economic advantage while firms continue to anticipate commercial returns, prestige, or market share. Pause willingness, then, would require the domestic political benefits for individual politicians or coalitions of politicians to outweigh the benefits of cooperating with large AI firms.

8.4.3 The distribution of capabilities creates support for a pause

As § 8.2.2 made clear, the question of who is ahead in the AI race dominates much of the political discourse surrounding AI governance, often implying that the leading power has strong incentives to race while the trailing power has incentives to catch up, making restraint structurally unlikely. The scenario presented in this section is predicated on an assumption that the traditional model, while not wrong per se, is incomplete. Rather the relationship between the distribution of AI capabilities and pause-willingness is considerably more nuanced, and under certain conditions—specifically, when the difficulty of further advancing the frontier is high and pricey while the cost and ease of catching up is low (see § 8.4.2)—the distribution of capabilities can itself become a facilitator of a sustainable pause, wherein both leading actors prefer coordinated restraint over continued racing.

8.4.4 Domestic coalitions could make reciprocal restraint politically viable

As discussed above, various political constituencies may become dissatisfied with unrestricted AI development as AI becomes more politically and economically consequential. Several polities in the United States could combine to produce pause willingness, perhaps as a side-effect of broader resistance to AI and related infrastructure. For example, national security officials cognizant of cyber risks and CBRN uplift, workers experiencing job insecurity, and environmental activists concerned about AI infrastructure may find common cause in pause willingness despite differing logics for their opposition to AI.

AI firms, their financial backers, and their major suppliers are one of the most important political constituencies. Depending on their preferences, they may attempt to shape, forestall, or encourage a pause agreement through donations, public statements, and engagement with important policymakers. While not determinative in the presence of strong pause willingness or political resistance to a pause, the perspective of firms is worth considering as it may shape the nature of a pause and impact willingness at the margins. The firms pushing the frontier of AI capabilities may experience strong incentives to continue frontier research even when their employees and even private leadership would prefer to moderate frontier AI development. This could include incentives to race from international—as well as domestic—competitors, in which case government officials may become more interested in mutual international restraint because further development would be mutually risky and counter-productive, and they cannot solve the firm-level race within a single country.

Under certain circumstances, firms may develop a preference for predictable, universal rules, perhaps in the form of a pause, to open-ended racing. A diversity in the number and market interests of AI firms might facilitate this, as some may prefer predictability and an opportunity to exploit a market niche through integration or product development rather than pursue (less likely in a diversified landscape) leadership in frontier model benchmarks. This would reflect a history of business coalitions splitting on regulatory issues as industries and markets mature and diversify from intense competition among a small number of early-moving actors.

This pathway creates a shift in patterns by: altering government perceptions such that they perceive marginal domestic frontier gains as less valuable because they intensify an unstable international and corporate race; shifting the domestic coalition structure towards convergence around restraint; increasing government willingness to build domestic and international governance capacity and infrastructure to bind firms; shifting the support of firms to support common standards because they remove the competitive disadvantage of restraint. In this scenario, domestic coalition realignment does not directly cause a state to abandon the AI race, but it does shift the domestic political calculus enough to enable credible offers of international restraint.

In line with the trust dilemma/coordination game dynamics outlined above, if policymakers in one state become confident that their counterparts are also willing to pause and that reciprocal compliance could be verified, the political meaning of restraint could change. A global pause could be presented as a way to reduce increasingly salient domestic and security risks without conceding the frontier to a geopolitical competitor. Consistent with Putnam’s logic, growing concerns about the risks of frontier AI development could reshape domestic political coalitions in ways that make mutual international restraint more feasible. Evidence of substantial harms could favor coalitions or individuals favoring restraint, while diverging interests among AI firms could weaken firms’ ability to organize effective opposition to regulation or international agreements. These shifts could alter governments’ disposition towards restraint, particularly if they come to believe other states are similarly open to restraint.

8.4.5 Shifting power distribution and heightened risks drive multilateral restraint

Leading AI states’ attempts to preserve advantage through export controls, domestic regulation, investment restrictions, or supply-chain pressure may produce adaptation rather than control. Firms restructure supply chains, third countries resist choosing sides, new compute hubs emerge, and restrictions create incentives to circumvent and substitute with indigenous development. At the same time, both countries may become more concerned that diffusion through third countries, private firms, and new datacenters is making the frontier harder for either government to control. This combination of factors leads policymakers around the globe—in leading as well as third-party states—to become less confident that competitive containment can prevent rivals from reaching the frontier at an acceptable economic and diplomatic cost.

At the same time, actors with important roles in the global semiconductor industry or which host significant clusters of compute infrastructure may adapt rather than comply with export controls. These entities, many of them influential middle and non-aligned powers, may resist being labeled or treated simply as instruments of great power competition among the AI-leaders. As noted above, some of these actors possess noteworthy leverage because key equipment, chips, capital, markets, or infrastructure pass through their jurisdictions, while, less potently, others can confer or withhold political legitimacy from a global order designed by just two states.

8.5.1 The view from the United States

Pause-willingness within the United States is influenced by a combination of technological, geopolitical, and domestic political factors, as is true elsewhere. U.S. pause-willingness may additionally be stymied or bolstered by some country- and context-specific factors.

The U.S. position as the incumbent leader in frontier AI development imposes asymmetric opportunity costs which have raised barriers to pause-willingness with some stakeholders. While the U.S. maintains an advantageous position in global AI competition amid a backdrop of broader geopolitical competition, some U.S. policymakers believe that continued development is risky, and that constraining development would be preferable to pressing its existing advantages. This is a demanding condition, particularly when others in the U.S. government believe AI will enable other strategically important capabilities. A pause may be more attractive to some U.S. policymakers who believe that the U.S. lead is difficult to extend or maintain, or that the maintenance or extension of this lead is unlikely to produce tangible strategic advantages.

U.S. politics and political structures will shape the translation of AI’s potential strategic incentives into pause-willingness. Presidents differ in their willingness to prioritize long-term risks, accept constraints on their freedom of action, defer to technical expertise, and pursue and adhere to international agreements. Further, presidential preferences are filtered through a fragmented, federal governmental structure in which Congress and courts provide checks and balances on one another, and in which state governments retain powers not granted to the federal government, all of which factors into overall U.S. pause-willingness.

These institutional considerations are not the only factors shaping national preferences. National and state polities are an important factor as well. As the country is profoundly polarized along party lines and appears likely to remain so for the foreseeable future, electoral politics may play a role in pause willingness. As the Washington Post recently pointed out, AI “is now fused with long-standing electoral issues such as the economy and the costs of living, corporate power and the future prospects of working Americans” (Ovide et al. 2026).

Nonetheless, a critical political question is whether competing groups are likely to form a coherent coalition that results in a mutually-agreeable domestic pause win-set. In addition, securing public buy-in may require linking previously separate voter concerns, framing a pause not merely as a safety measure, not merely as a labor protection, and not merely as a national security precaution (see e.g. Greenhill and Kroth n.d.), but rather as the best response to a broad set of domestic and international risks.

As is often the case in races, perceptions drive policy (see e.g. Greenhill n.d.). From Washington, perceptions of China are likely to be particularly important in determining how the political and technological context for a pause is interpreted. How U.S. political leaders perceive Chinese intentions and capabilities at any given time could produce different policy responses. For example, perceptions of the trajectory of cyber capabilities could lead policymakers to prefer restraint if they expect mutual vulnerability or to prefer racing if they believe that China is approaching a key capability threshold, especially one that confers offensive advantages. Finally, a shared focusing event could inspire massive investment in countermeasures, in addition to or instead of investment in agreeing to pause, in a scenario in which there is sufficient skepticism regarding the possibility, durability, or enforceability of a pause agreement with China. Further, the structure of the U.S. AI ecosystem creates unique dynamics which might facilitate or challenge pause willingness. Unlike the state-directed technological programs that make up much of the historical record on strategically consequential technological races, much of the relevant U.S. capability is concentrated in private hands. As discussed earlier in this section, frontier AI developers may be incentivized to resist compliance or tempted to cheat if they believe that agreement provisions impact their potential for revenue, market share and even prestige. In addition, leaders of frontier AI firms differ in their positions on pause willingness (see, e.g. Mui and Bordelon 2026), with some posing direct challenges to regulatory frameworks (Bond and McDaniel 2026). The firms have also increased and diversified their commitments to spending in political elections, pledging some $265 million to super PACs and political organizations in the 2026 cycle alone (Severns and Ramkumar 2026). While campaign contributions from Silicon Valley are not new, in the past they generally took the form of individual donations and corporate PACs (Bond and McDaniel 2026). In the U.S. political system and in today’s political climate, partially characterized by increasingly private access to federal policy, understanding the position of large private firms is key to understanding the position of the U.S. government.

As noted in § 7.1, an additional wrinkle arises from the fact that, at least as of this writing, a disproportionate share of US stock market value, capital investment and economic activity more generally is tied to AI and its further development (see e.g. Putzier 2025). Not only do the so-called Magnificent 7 technology firm stocks comprise more than a third of the S&P 500’s market value (Daly 2026), but also AI may have accounted for an outsized share of real GDP growth in recent years (see e.g. Rubinton and Patro 2026). It has been argued that such significant reliance on a single industry not only affords AI frontier firms outsized political influence, but also further deters the incumbent US leadership from embracing a pause for fear of catalyzing a market crash and triggering a recession (Sanger et al. 2026). While it is not self-evident what might be done in the near-term to guard against the realization of such concerns, to the extent that steps can be taken to allay fears of a market crash or economic slowdown, pause willingness may become more palatable to skeptical and chary US leaders. On the other hand, failing to proactively address the risks associated with a loss of control over AI could also bring on these selfsame economic calamities, which might provide an opening for enhancing US pause-willingness if economic resilience-focused efforts and activities were coupled with pause adoption.

Finally, the U.S. possesses forms of structural leverage that could either discourage or enable a pause. As noted above, U.S. firms occupy leading positions in frontier AI development, cloud computing, semiconductor design, and other parts of the AI ecosystem. Alliances connect Washington to additional critical nodes in the broader AI supply chain. So long as policymakers are confident that these advantages can be used to preserve a durable U.S. lead, they increase the opportunity costs of pausing. If this confidence erodes, however, the same advantages could make the United States singularly capable of constructing and enforcing a pause agreement. U.S. positions on pause willingness are therefore likely to come down to whether U.S. policymakers and the publics they represent believe U.S. interests are better served by using this existing leverage to extend its lead and unilaterally develop countermeasures or to institutionalize reciprocal restraint in the form of a pause.

8.5.2 The view from the People’s Republic of China

Turning to China, Chinese policymakers would be more likely to favor a pause if it is seen as more beneficial to national security, innovation, and economic futures than continued frontier AI development. Interest on the part of the Chinese government in pursuing a pause could come from a belief that continued frontier AI development posed a threat to China's political security and social stability, which official doctrine treats as the foundation of national security. Further, this would need to arrive from domestic calculations and be trusted by authorities in order to overcome suspicions that such an agreement is a mere continuation of the US semiconductor export control regime, which has been framed by Chinese officials as unilateral bullying measures by the US (Xinhua 2024). Two critical components of this include (A) a belief that continued training of new frontier models would substantially harm the PRC’s national security and (B) a belief that the incentives for the US government and industry actors are aligned towards the upholding of the agreement as well.

As in other states, domestic concerns in connection with advanced AI capabilities and their impacts may include: severe economic and labor market disruptions; misuse of (perhaps open-weight) models in cyber and other attacks by non-state actors; and broader shifts in military capabilities and balances of power that disallow the state from defending its national interests. If the frontier AI race generates substantial economic costs, such as inflation pressures and rising costs of basic utilities, Chinese leaders might view a pause as a means of mitigating the economic repercussions on citizens’ economic wellbeing. If malicious nonstate actors are repeatedly found using jailbroken versions of advanced models to stage biological or cyber attacks, this may tip the government’s political calculations about the benefits versus harms of developing increasingly advanced models and/or “open weights” releases.

Besides domestic concerns, China, like other states, faces the possibility that AI tools threaten its national security more directly. If AI systems become increasingly integrated into military activities, such as strategic planning, cyber operations, intelligence analysis, and even weapons deployment, an unconstrained frontier AI race could alter the regional balance of power in ways that threaten China’s national security interests. For example, frontier AI could enable rival states to develop military capabilities that significantly undermine China’s military capacity in the South China Sea or elsewhere in the Indo-Pacific.

There is also a documented and growing official discourse on frontier AI risk in China. In his remarks at the September summit, Xi Jinping noted that both China and the United States “have both the capability and responsibility to develop and manage AI for good, and ensure the development of AI is always under human control, and serves the well-being of the people.” The September 2025 AI Safety Governance Framework 2.0 explicitly listed loss of human control of AI as a distinct risk category, including scenarios of autonomous resource acquisition and self-replication, with the September 2026 iteration of the framework maintaining a line of analysis on loss of control. Further, China’s National Information Security Standardization Technical Committee (TC260), a major standard-setting body, has flagged the need for "circuit breakers" and "safety stop switches" (Wagner et al. 2026). Finally, state coverage of one of Xi Jinping’s speeches referenced "risks of technological loss of control" (Wagner et al. 2026); and at the September 1, 2026 Cybersecurity Awareness Week press conference, CAC's Cybersecurity Coordination Bureau named extreme loss-of-control risk as one of five headline AI security challenges (CCTV 2026). Importantly, however, although references to “loss of control” have steadily increased in Chinese AI discourse in recent years, the term is often used differently than it is by some in the West, either to describe smaller scale incidents centering around AI agents or to describe the loss of control or power over AI from a specific type of actor (Qian 2026).

One possible set of incentives in favor of China becoming a signatory on a major pause-oriented agreement is the institutional, soft power, and rule-setting benefits of doing so. Major powers tend to prefer to write international rules rather than have rules written for them. Moreover, if a broad coalition of major powers were to participate in a pause agreement that contains meaningful trade, technology, or market-access restrictions for nonparticipants, other key leaders might conclude that the economic and diplomatic costs of non-participation outweigh the potential benefits. At this point, some signs point to the Chinese side being more interested in global collaboration than the American side, although to date, these efforts have centered around capacity building and broader principles for AI governance, rather than capability-limiting considerations. China’s U.N. representative Fu Cong explicitly called for “a consensus-based global governance framework” around AI safety (Mak and Miller 2026), and China has positioned itself diplomatically as a stronger proponent of UN-centred, multilateral AI governance than the United States, though support for a consensus-based framework is distinct from acceptance of intrusive verification.

Further, Beijing has thus far worked to cultivate a reputation and institutional foundation for AI governance leadership globally (Chen et al. 2026; Blomquist 2026). China’s establishment of the World AI Cooperation Organization (WAICO) in July 2026 (PRC MOFA 2026), which builds on previous and related institutional announcements such as the Global AI Governance Action Plan (Permanent Mission of the People’s Republic of China to the United Nations 2025) and the World Data Organization (Nicole 2026), shows how the PRC is already seeking to shape the future of international AI governance. WAICO is largely an AI capacity building and benefits sharing regime, and it demonstrates that China has prioritized cultivating a reputation as a responsible leader in AI via diplomatic efforts and more formal agreements on international AI governance. From this perspective, China’s participation in a hardwired pause could be attractive not simply because it avoids international isolation, but because it could allow China to further define the rules of the game and cultivate its soft power globally, thereby shaping China’s relationships with other countries and advancing its sought after reputation as a responsible AI power.

Finally, a pause would likely be more palatable to states like the U.S. and China if it included inducements related to the global inference market. In general, a more intertwined U.S.-Chinese AI market and ecosystem could reduce the risk of unilateral defection and present mutually enforceable incentives. U.S.-China decoupling/supply chain derisking could actually exacerbate the risk of confrontation and conflict. Two separate ecosystems will make it difficult to monitor each other's progress, which is particularly disadvantageous to the West which lacks access and information about developments within China.