Power measurements weakly limit hidden ai computation in verification
Can Power Draw Constrain Covert Compute? Limits of Analogue Verification for AI Governance
Computers and SocietyArtificial IntelligenceCryptography and Security
Summary
When countries or groups want to agree on limiting how much computing power is used for AI, someone has to check if everyone follows the rules. The authors look at using electric power readings from AI chips as a way to check how much computing is done. They find that just measuring power use alone isn't very good at stopping cheating, because hidden computing can still happen without showing up clearly. However, if the checker can also rerun the same tasks and compare, they can make a much stronger check to catch hidden computation.
What this means in practice
- •For hardware security teams: Assess how much covert computing can hide behind power consumption during compliance audits of AI hardware.
- •For regulatory compliance officers: Use power monitoring combined with task replay to improve audits enforcing AI compute limits in agreements.
Authors
Tom Kimpson, Mauricio Baker, Emlyn Graham
Abstract
Frontier AI treaties or agreements on limiting computation require external verification; an external auditor must be able to confirm how much computation actually ran and that parties are adhering to the agreement. Analogue, off-chip measurements such as power draw provide an information channel for verification. It is unknown how well these analogue channels can constrain computation against an adversary who actively tries to subvert the audit. We derive a closed form for $β$, the largest hidden computation a power trace cannot exclude, as a fraction of the declared machine capacity. Measurements on NVIDIA A100 GPUs constrain $β= 1.16$ in the worst case, while adversarial matched-energy strategies are shown to hide at least $β= 0.41$ of compute. Analogue power measurements alone therefore constrain compute weakly. Additional restrictions granted by the threat model, such as the ability of the verifier to re-execute the declared work at an observed operating point, let the verifier push $β$ down to $0.059$ in the maximally restricted case. This gives a quantitative estimate of what analogue measurements can contribute to compute verification.