I’m not a compute verification expert, at least not yet. I’m the person who watched the clock, moved people between breakout rooms, and listened to what came out when a group of incredibly smart strangers got stuck on the same problem. It turned out to be a good seat from which to learn.
Here is the question the course circles. Suppose the major powers agreed to pause the largest AI training runs. How would anyone know they were keeping the deal? A promise nobody can check is just a hope with a signature on it. Verification is the part that makes an agreement more than words. It means watching chips, data centres, cloud accounts, power draw and supply chains, and working out what each of those can and cannot tell you.
We ran five sessions of ninety minutes. Each session used the same format. A short icebreaker in a small room, back to the main room for a few minutes, then a harder prompt in a new group, then another shuffle. By the end of a session everyone had argued with about ten different people.
Letting people say it’s hard
The first thing I noticed is that the course content was heavy and the participants said it. In the first session, a group told me nobody had finished the reading. Someone said the writing was too technical and a bit wordy. Others kept saying it at the end of the later units too. I used to think a facilitator’s job was to make the material feel manageable. I now think it is to let people say it is hard without feeling behind. The “I didn’t finish” answer was explicitly allowed in the prompts, and I think that single line did more for honesty in the breakout rooms than any amount of encouragement from me.
Forcing a side
The second thing is that prompts that force a side beat prompts that ask for understanding. The best room of the whole course was a roleplay. One person played a skeptical senior official who wanted no verification regime at all, and everyone else had to change their mind in plain words. The objections were the kind you would really hear. We don’t regulate electricity, so why this. The labs are run by good people who won’t risk our safety. Why should I take the political hit for looking anti-tech. The answers that landed were never clever. One person said it is irrelevant whether the people running the labs are good, because nobody understands the technology well enough yet to control it. Another pointed out that a country that is not leading in AI may be the one that benefits most from a slower, safer global pace. You could watch people discover which of their arguments held weight and which only sounded good in their head.
A similar thing happened in the red team room. Learners were asked to attack a draft treaty. Within minutes one group found that a clause allowing a party to report an accidental over-the-limit training run could be used to “discover” the run many months after it began. Another group noticed that the draft watched AI hardware closely but left ordinary hardware mostly alone, which means someone could quietly stack up compute that is not covered. I can't recall if anyone in this cohort was a lawyer or a treaty negotiator... I doubt that. They found real holes anyway, because they were told their job was to break it.
Who produces the evidence?
The third thing is that every group kept arriving at the same question without being told to. Who produces the evidence? Early in the course, a pair argued about which mechanism to cut, and one of their reasons was that network restrictions control more than they verify. Later, someone compared the whole thing to exam proctoring. A camera sees one angle, so it cannot see the second camera you never mentioned. Someone else compared it to drug safety monitoring, where you only see the side effects people bother to report. These are small, ordinary examples, and they taught the core idea better than the formal version did. A regime can only conclude what it can see, and what it can see depends on who handed it the evidence.
The unit where learners distilled a report for a reader was the one people said stuck with them. One learner told me that sorting snippets by how much weight each deserved forced them to read carefully, and that they would have skimmed otherwise. Another admitted they had not yet learned to keep only the statements that carry weight. I recognised that. I do the same thing when I read a long report.
The morning after
The icebreakers I thought were throwaways ended up mattering loads. One asked what would change on Wednesday morning if two superpowers signed a three-month pause the day before. A lot of people who build software said nothing would change for them, apart from not waiting on new model releases. Then someone from the safety world pointed out that the work of most organisations would flip overnight. They had spent years arguing that a pause should happen. Now they would have to figure out how to check it.
I also saw hope go down. At the end of the course I asked whether people felt more or less hopeful that a pause could be verified. At least one person said less, mainly because of the rivalry between the two biggest powers. Another wondered how any verification would work between them at all. I did not try to talk anyone out of that. A course that only leaves people hopeful has probably not taught them much about what is hard. The later prompt on who holds the key to a chip licence server, and what happens if it goes down for a day, did not have a clean answer either. Fail open and you can run unchecked. Fail closed and you can shut down a hospital. Groups had to pick one and defend who pays when it goes wrong.
A patience problem
If I ran it again, a few things would change, and none of them are big. I would ask on day one how many hours people really have each week, because time was what stopped people every time. I would make the five minutes back in the main room more deliberate, since that is the only moment one group’s sharpest idea can reach the others. And I would say out loud that the reading is dense, so nobody spends the first unit wondering if the problem is them.
The last room of the last session was the one I liked most. Everyone had to pick one thing to keep doing after the course, give it a first step with a date, and tell the person they had been checking in with. It was a small ask and it felt like the right size. Nobody on that call is going to verify a pause on their own. But a few more people now know what to ask when someone tells them a pause is being kept.