The aim of verification is roughly this. Two or more parties, say frontier labs or nation states, agree not to run some AI workload. They will only agree if they can be sure the others are not secretly defecting. So the work is to build mechanisms that the parties think are strong, so they are willing to enter the agreement, and that we think are strong, so no one can gain an advantage by signing up and then secretly defecting.
This unit builds up to that. It starts with why powerful AI could be dangerous, moves to why compute is the thing you can get a handle on, and ends with the research agendas that have formed around AI assurance. There are a number of questions across the unit, but the load-bearing ones are what claim needs checking, what evidence could check it, and what institution would act on that evidence.
Eight readings are marked core and make up the unit. The rest are optional, there if you want to go further.
An agent given a goal, even one as simple as fetching tea, has reasons to stop you switching it off, and each obvious patch produces something suicidal, manipulative, or deceptive instead. The idea to hold onto is that a system can be deceptive enough to pass every test you set while still working against you, so watching its behaviour is not enough to trust it.
Watch on YouTube
If the model itself might be scheming against you, defending against it means treating it as an adversary inside your own infrastructure. You watch it with weaker models you do trust, working with a human review budget of around one per cent, against an attacker who spreads the harmful action across many innocent-looking steps and only has to succeed once. Catching an adversary who only has to defect once, using cheap checks on a small sample, is the same problem as verifying a compute agreement between states that do not trust each other.
Watch on YouTube
A concrete scenario of exactly the regime this course is about: two superpowers agree not to run certain AI workloads, then verify it. It walks through the compute declaration, the inference-only verification (network taps and random recomputation) that enforces a training pause, and the transparency and mutually assured compute destruction that hold the deal together. The clearest picture of what all these mechanisms are ultimately for.
Read the parts about the deal, not the whole scenario. That is the opening ‘What is Plan A’, the 2029 negotiation (compute declaration, training pause, worldwide buy-in) and 2030 ‘Plan A is Established’ with its four principles and verification architecture.
The foundational case for why advanced AI could be dangerous. It argues that we may build systems with their own long-term goals that have reason to seek power and resist human control, possibly to the point of disempowering humanity.
The full profile.
This covers the second major risk, which gets less attention than misalignment. Even AI that stays under human control could let a small group concentrate power to an unprecedented degree, and verification is one way to keep that power visible and accountable to the public.
The full profile.
Breaks a slowdown into three questions: what it is for, what actually gets slowed (the research, its compute inputs, or model releases), and how it is structured.
The whole post.
The US and China each fear that pausing hands the advantage to the other, so even a mutually beneficial deal collapses unless each side can check the other is keeping to it. The piece names this the ‘assurance dilemma’, explains why nuclear-style inspections do not transfer to compute, and previews the hardware mechanisms covered later in the course.
The full article.
The canonical argument that compute is more governable than data, talent, or algorithmic insight, and so the most practical lever for AI governance. The governance you can build rests on being able to verify claims about compute.
Section 1, Introduction and Summary, pages 2 to 6.
A short argument that verification gets built up incrementally, one rung at a time, drawn from how nuclear arms control verification developed.
The full post.
An account of how verification worked in nuclear arms control and what transfers to AI. Useful for seeing the institutional machinery, on-site inspection and seals that a working verification regime has historically needed.
The executive summary, around four pages.
The cleanest hardware-enabled verification taxonomy in the unit, built around four mechanism categories: verifiable workloads, cluster configuration, location verification and offline licensing.
The taxonomy and the four mechanism categories.
The assigned pages argue that frontier AI auditing needs technical foundations: adversarial testing of verification mechanisms, model and system fingerprinting, formal methods and realistic pilots.
Pages 53 to 54.
The closest thing the field has to a full survey. The assigned compute subsections show how assessment, access control, verification and security become different technical-governance problems once the target is compute.
Sections 3.2, 5.2 and 6.2.
This is the broad mechanism survey for international agreements. Do not try to absorb the whole report; extract the menu of ways agreements could be checked and the assumptions each mechanism needs.
Executive summary, then skim the mechanism survey for categories and tradeoffs.
A long report on how verifiability changes the politics of international AI agreements. The useful contrast is its pessimistic assumptions. It asks what remains workable even when privacy, sovereignty and security constraints are taken seriously.
Executive summary only, especially the agreement types and feasibility tradeoffs.
A compact RAND framing of verification as layered evidence. The summary is enough here. It explains why no single mechanism is likely to be sufficient and why on-chip, off-chip and personnel-based layers have different failure modes.
The summary, plus the goals of verification on page 3 and the on-chip versus off-chip taxonomy.
A short taxonomy that separates monitoring, verification and enforcement mechanisms, then asks which ones are feasible under adversarial and political constraints.
Sections 3.4 and 4. Feasibility summary, constraints and adversarial considerations.
Frames pausing as one form of ‘capability restraint’ and works through when slowing AI down is actually worth it. Compute is the practical lever for restraint, while algorithmic progress is the hard thing to monitor, which is much of what verification is trying to make possible. Long, but strategically clarifying.
Long. The introduction and sections 4 to 6 carry the argument.
Finished this unit? Please give us your feedback on how it went!