Toward a Global Regime for Compute Governance: Building the Pause Button

Ananthi Al Ramiah; Farhan Shafiq; Jim Zhou; Joep Meindertsma; Josh Thorsteinson; Raymond Koopmanschap; Sadruddin Khan; Shafira Noh

REVIEW 3 major objections 5 minor 2 cited by

Toward a Global Regime for Compute Governance: Building the Pause Button

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that a global 'Compute Pause Button' can be built now by restricting chips, tracing them, and regulating them, making dangerous training runs infeasible rather than merely illegal.

desk verdict A useful organizing framework for compute governance, but the central feasibility claim leans on hardware that doesn't exist yet—worth engaging, not taking at face value. read the letter →

arxiv 2506.20530 v1 pith:5P7RXDPP submitted 2025-06-25 cs.CY

Ananthi Al Ramiah , Raymond Koopmanschap , Josh Thorsteinson , Sadruddin Khan , Jim Zhou , Shafira Noh , Joep Meindertsma , Farhan Shafiq This is my paper · ORCID

classification cs.CY

keywords AIcomputegovernancepausebuttonFLOPthresholdshardware-enabledenforcementtraceabilityexportcontrolsGEVframeworkfrontiersafety

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the gap in AI governance is not the lack of a plan but the lack of an enforceable one, and it supplies a concrete architecture: a global Compute Pause Button that stops frontier training runs by restricting compute itself. It claims that credible intervention points already exist in hardware, traceability, and regulation, and that organizing them under a Governance–Enforcement–Verification (GEV) framework makes threshold-exceeding AI training not just illegal but logistically and technically infeasible. The paper reports that frontier labs could cross critical danger thresholds as soon as 2027–2028, so it frames the contribution as a roadmap to build now, while the window for effective intervention is still open. A sympathetic reader would take the central message to be that compute is a governable chokepoint, and that the tripod of technical controls, chip tracking, and legal authority can hold if all three legs are built together.

What carries the argument

The machinery is the Governance–Enforcement–Verification (GEV) framework applied to each of three intervention points. GEV is a cyclical operating system: governance defines rules and thresholds before deployment, enforcement prevents or punishes violations during sales and usage, and verification audits compliance after the fact, feeding back into updated rules. The intervention points are the physical and legal locations where policy levers attach: technical controls embedded in chips, traceability mechanisms along the supply chain, and regulatory instruments at borders and factories. The load-bearing piece is the claim that compute is a measurable, concentrated chokepoint: FLOP thresholds give an objective trigger, and the chip supply chain gives a finite set of actors and components that can be controlled.

What would settle it

A decisive test would be to run a distributed training job above the proposed threshold—say $≥ 10^{25}$ FLOPs accumulated on hardware with nominal cluster capacity $≥ 10^{20}$ FLOPS—using only commercially available chips and standard cloud access, and to show that neither hardware counters, license servers, registries, nor export rules halt or flag it. If such a run completes without any GEV mechanism firing, the central claim that threshold-exceeding training can be made infeasible is falsified.

Watch

Extended reading notes

Core claim

The central claim is that a globally enforceable pause on dangerous AI training is a credible and buildable governance architecture, not a metaphor. The paper proposes to trigger the pause on a compute threshold measured in FLOPs and FLOPS, and to enforce it at three intervention points: technical mechanisms embedded in hardware (tamper-proof FLOP caps, offline licensing, fixed-set cluster configurations, model locking), traceability infrastructure over the chip supply chain and compute users (registries, chain of custody, KYC), and regulatory authority (export controls, production quotas). Each mechanism is assessed against GEV: governance must set the rules, enforcement must make violations costly or impossible, and verification must make compliance independently checkable. The paper's own position is that no single mechanism is sufficient; the three legs function as a tripod, and the credible mechanisms already exist even though some hardware guarantees are not yet available at scale.

Load-bearing premise

The load-bearing premise is that hardware can be made to enforce compute limits in a tamper-resistant way: the paper itself says flexHEGs are not yet available and firmware licensing can be forged, so if affordable tamper-proof enforcement cannot be built, the technical leg fails and the remaining traceability and regulation are, by the paper's own account, insufficient alone.

Editorial extensions

If this is right

If the architecture works, a training run above the agreed FLOP ceiling becomes physically or cryptographically hard to complete, so the pause is enforced by hardware and logistics rather than by inspection alone.
Traceability plus licensing gives regulators a dynamic lever: chips can be denied license renewal, their usage can be logged and audited, and a pause can be pressed, released, or extended without seizing hardware.
Production and export controls would pace the global stock of frontier chips, buying time for safety evaluations and threshold recalibration as algorithmic efficiency improves.
The framework converts existing proposals—from chip export rules to cloud KYC—into a single standard of governance, enforcement, and verification, so partial measures can be evaluated by which leg of the tripod they strengthen.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Extension the paper leaves implicit: because algorithmic progress lowers the compute needed for a given capability, the proposed expert-panel threshold revision could be made self-calibrating, for instance by tying FLOP ceilings to the compute required by the best available capability benchmark.
The paper's own evidence that low-bandwidth distributed training is improving suggests the fixed-set leg will erode first; a testable extension is to track total compute across time and across clusters rather than relying on interconnect topology.
A natural pilot, not specified in the paper, is to deploy the registry and KYC legs first in a coalition of chip exporters, measuring the detection rate of grossly under-declared compute before hardware controls mature.
If tamper-resistant hardware never becomes cheap enough for broad deployment, the framework implies a fallback regime where traceability and regulation bear the full load; the paper says that load is insufficient, so the architecture would then need a different enforcement leg.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Read the compute governance white paper. The genuinely new thing is the GEV framework—governance, enforcement, verification—wrapped around three intervention points: technical, traceability, regulatory. That's a real contribution: it gives policymakers a way to see which mechanisms are just rules on paper and which have enforcement and verification teeth. The paper does a solid job cataloging the mechanism landscape, and it's honest about limitations: flexHEGs are years away, fixed-set mechanisms are undermined by distributed training, and the tripod needs all three legs. Credit where due: it doesn't oversell the maturity of any single tool.

The soft spot is the central claim. 'Credible mechanisms already exist' is asserted rather than shown. The technical leg—the one that makes threshold-exceeding runs logistically infeasible—depends on tamper-resistant hardware that the paper admits isn't deployable. Fixed-set is losing effectiveness now. Offline licensing via firmware is vulnerable to forgery. The traceability and regulatory legs are more credible in the near term, but the paper's own tripod logic says they're insufficient alone. So the architecture is plausible as a direction, not as a credible mechanism that exists today. That's a meaningful gap between the abstract and the body's own caveats.

Also minor: reliance on MIRI sources is heavy, but they're the right sources and the paper cites them properly.

Who it's for: policymakers and AI governance researchers who want a structured map of compute levers. It's a white paper, not an empirical study. The math is absent but not needed. The citation pattern looks sound.

My take: this deserves a serious referee. The framework is useful, the limitations are largely self-acknowledged, and the field needs organizing work like this even if the headline claim is ahead of the evidence. I'd engage with it and cite it in compute governance work, but I wouldn't yet bet any policy on the technical leg. Send it to review with the expectation that the abstract needs softening.

Referee Report

3 major / 5 minor

Summary. This paper proposes a global 'Compute Pause Button': an architecture intended to prevent AI training runs above agreed compute thresholds, organized around three intervention points (technical, traceability, and regulatory) within a Governance–Enforcement–Verification (GEV) framework. It catalogs eleven mechanisms (FLOP caps, offline licensing, fixed-set mechanisms, model locking, key-material monitoring, a global compute registry, KYC, chain-of-custody, production controls, and export controls), maps each onto GEV, and draws lessons from the NPT/IAEA, CWC/OPCW, Operation Warp Speed, and the Wassenaar Arrangement. The central claim is that credible mechanisms already exist and that the proposed architecture can make threshold-exceeding training 'logistically and technically infeasible,' despite acknowledged technical and political challenges.

Significance. If its central claim held, the paper would offer a valuable synthesis and an actionable agenda for compute governance. Its strengths are the clear GEV taxonomy, the systematic mechanism tables, and the candid acknowledgement of several limitations, including the immaturity of flexHEGs and the weakening of fixed-set mechanisms. However, the paper provides no new empirical evidence or formal model, and its load-bearing feasibility claim rests on hardware capabilities that it concedes are not yet available or are vulnerable to circumvention. The paper is best assessed as a policy blueprint and research agenda rather than as a demonstration that a credible Compute Pause Button can be built now.

major comments (3)

[Abstract; §4; Table 2; §6.1.1–§6.1.4] The paper's central claim is not supported by its own evidence. The Abstract asserts that 'credible mechanisms already exist' and that the architecture can make threshold-exceeding training 'logistically and technically infeasible,' while §4 states that the three intervention points are legs of a tripod and that removing one makes the system liable to collapse. Yet Table 2 reports that flexHEGs and tamper-proof FLOP caps are 'not yet deployable' and require years of R&D; §6.1.1 says flexHEGs are 'not yet available'; §6.1.3 concedes that firmware-based offline licensing is 'vulnerable to circumvention or license forgery'; and §6.1.4 says the DeepMind distributed-training result 'undermines the core premise' of fixed-set mechanisms. On the paper's own tripod logic, the technical leg is currently missing or unreliable, so the credibility of the whole regime is not established. The authors should either present concrete evidence that tamper-resistant hardware can be produced securely, affordably, and at global scale, or revise the central claim to a conditional proposal whose feasibility depends on an explicit research program.
[§7.2; §7.6] The policy analogues do not supply the demonstration claimed in the Abstract and §1. The paper itself records that NPT/IAEA enforcement has not prevented North Korean proliferation (§7.2) and that the Wassenaar Arrangement's effect on weapons sales has been questioned (§7.6, citing Lewis & Goldstein, 2015). The proposed compute regime faces even stronger economic incentives to defect, since chip exports are highly profitable and a major producer is outside the Wassenaar-style arrangement. The analogues are informative models of institutional design, but they do not by themselves demonstrate that a near-universal, enforced compute-pause regime is credible. The paper should add an explicit analysis of how non-participants and determined defectors are contained, or weaken the inference from precedent to feasibility.
[§3; §6.1.2; §6.1.4] The threshold mechanism is under-specified and susceptible to evasion. Section 3 acknowledges that algorithmic progress will render any fixed FLOP threshold obsolete and proposes an 'expert panel' to revise limits, but it does not describe how the panel would set or validate thresholds beyond an unspecified suite of capability evaluations. Sections 6.1.2 and 6.1.4 acknowledge that task splitting can evade per-run FLOP caps and cluster limits, yet no concrete cross-run accounting or detection architecture is provided. Because the entire pause is triggered by thresholds and the GEV framework claims violations are 'detectable,' this gap is load-bearing for the paper's central feasibility argument.

minor comments (5)

[§1; throughout] The text contains several run-together words and typos, e.g., 'analoguessuchas' in §1 and 'ensurethathigh-riskactors' in §6.2.3; please proofread carefully.
[Figures 1 and 2] Figures 1 and 2 are not referenced in the body text; add in-text references and explain how each figure relates to the GEV framework.
[§6.2.3] The citation to Executive Order 13984 is incomplete: the text says 'in light of cyber risks 2021,' which reads as a citation error; provide the full order title and year in parentheses.
[§7.2] The sentence 'The IAEA runs one of the most advanced international monitoring systems in existence, signed by member states' is grammatically ambiguous; clarify that it is the safeguards agreements, not the monitoring system, that are signed by member states.
[Table 4] Table 4 uses the column header 'Primary object of traceability' for regulatory mechanisms, which §6.3 explicitly says 'do not monitor or track activity directly'; change the header or add a note explaining the intended meaning.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper transparently reviews and organizes existing external mechanisms; no load-bearing claim reduces to its own inputs.

full rationale

The paper is a policy white paper rather than a derived model, and there is no circular step that reduces an output to an input by construction. The GEV framework is explicitly presented as an organizing lens: the paper says it “reviews existing proposals for limiting large-scale AI training runs and organizes them within a unified governance framework,” rather than deriving the mechanisms from GEV. The technical mechanisms are sourced from external work (Petrie et al. 2024 for flexHEGs and offline licensing; Scher & Thiergart 2024 for MIRI mechanisms), and those sources are not the present authors’ own prior work, so this is independent support rather than a self-citation chain. The paper also states its own limitations, including that flexHEGs are “not yet available” and that DeepMind’s distributed training result “undermines the core premise” of fixed-set mechanisms, which separates the feasibility assessment from the organizing framework. There are no fitted parameters, no predictions that reduce by construction, and no uniqueness theorem imported from the authors. The central claim that “credible mechanisms already exist” rests on external precedents (IAEA, OPCW, Wassenaar) and external technical proposals; even if one disputes the sufficiency of those mechanisms, that is a correctness or feasibility concern, not circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The framework rests on several unproven domain assumptions: the validity of compute thresholds as a risk proxy, the feasibility of tamper-proof hardware at scale, and the achievability of international cooperation. None of these are derived or empirically demonstrated; they are the load-bearing assumptions of the proposal.

assumptions (4)

domain assumption Computing power (FLOPs) is a key determinant of AI model capabilities and a pragmatic proxy for catastrophic risk.
Section 3 argues for compute thresholds despite acknowledging that evaluations are insufficient and that algorithmic progress erodes threshold validity.
domain assumption Tamper-proof hardware mechanisms can be made secure and deployed at scale.
The technical intervention point depends on flexHEGs and hardened chips, which the paper concedes are not yet available (Section 6.1.1).
domain assumption International cooperation comparable to the NPT/IAEA and CWC/OPCW regimes can be achieved for AI compute.
Section 7 explicitly builds on these analogues and acknowledges enforcement limits against powerful actors.
domain assumption Governments, chipmakers, and labs can be compelled or incentivized to participate in the regime.
The regulatory mechanisms assume mandates and incentives can shape private industry behavior (Sections 6.3.1 and 6.3.2).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Toward a Global Regime for Compute Governance: Building the Pause Button." pith.science (2026). https://pith.science/paper/5P7RXDPP

@misc{pith2026250620530,
  author       = {Pith},
  title        = {Pith review of: Toward a Global Regime for Compute Governance: Building the Pause Button},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5P7RXDPP}},
  note         = {Machine review of arXiv:2506.20530}
}

read the original abstract

As AI capabilities rapidly advance, the risk of catastrophic harm from large-scale training runs is growing. Yet the compute infrastructure that enables such development remains largely unregulated. This paper proposes a concrete framework for a global "Compute Pause Button": a governance system designed to prevent dangerously powerful AI systems from being trained by restricting access to computational resources. We identify three key intervention points -- technical, traceability, and regulatory -- and organize them within a Governance--Enforcement--Verification (GEV) framework to ensure rules are clear, violations are detectable, and compliance is independently verifiable. Technical mechanisms include tamper-proof FLOP caps, model locking, and offline licensing. Traceability tools track chips, components, and users across the compute supply chain. Regulatory mechanisms establish constraints through export controls, production caps, and licensing schemes. Unlike post-deployment oversight, this approach targets the material foundations of advanced AI development. Drawing from analogues ranging from nuclear non-proliferation to pandemic-era vaccine coordination, we demonstrate how compute can serve as a practical lever for global cooperation. While technical and political challenges remain, we argue that credible mechanisms already exist, and that the time to build this architecture is now, before the window for effective intervention closes.

Figures

Figures reproduced from arXiv: 2506.20530 by the authors.

**Figure 2.** Cyclical nature of GEV work activates the intervention points. For example, governance defines the legal and institutional authority behind chip licensing or export controls. Enforcement gives teeth to FLOP caps, KYC protocols, or production quotas. Finally, verification ensures that traceability infrastructure and auditing mechanisms actually function as intended. In this way, GEV threads through and powers each i… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI Agreements
cs.CY 2026-06 conditional novelty 6.0 of 10

Verification of international AI agreements will fail first at detecting hidden compute facilities, around the 10,000-H100-equivalent scale, before other enforcement mechanisms break.
LLM Harms: A Taxonomy and Discussion
cs.CY 2025-12 unverdicted novelty 3.0 of 10

This paper proposes a taxonomy of LLM harms in five categories and suggests mitigation strategies plus a dynamic auditing system for responsible development.

Reference graph

Works this paper leans on

5 extracted references · 5 linked inside Pith · cited by 2 Pith papers

[1]

(2025, February)

Aguirre, A. (2025, February). Chapter 8: How to not build AGI. Retrieved June 19, 2025, from https://keepthefuturehuman.ai/chapter-8-how-to-not-build-agi/ Apollo Research. (2024, January). We need a Science of Evals. Retrieved June 19, 2025, from http s://www.apolloresearch.ai/blog/we-need-a-science-of-evals Arms Control Association. (2022, February). The...

arXiv 2010
[16]

(2020, May)

Russell, S. (2020, May). Human Compatible: Artificial Intelligence and the Problem of Control. Retrieved June 19, 2025, from https://www.cato.org/cato-journal/spring/summer-2020/h uman-compatible-artificial-intelligence-problem-control-stuart Scher, A., & Thiergart, L. (2024).Mechanisms to verify international agreements about AI develop- ment. MIRI Techn...

arXiv 2024
[1703]

https://doi.org/10.1056/NEJMp2027405 Swift. (n.d.). Know Your Customer (KYC). Retrieved June 20, 2025, from https://www.swift.com /risk-and-compliance/know-your-customer-kyc Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber- Enabled Activities(Executive Order 13984). (2021, January). U.S. Department of S...

arXiv doi:10.48550/arxiv.2408.16074 1995
[2025]

Epoch AI

Federal Regis- ter. Epoch AI. (2024). Data on notable AI models. https://epoch.ai/data/notable-ai-models Financial Crimes Enforcement Network. (2024, October). FinCEN Assesses Record $1.3 Billion Penalty against TD Bank. Retrieved June 20, 2025, from https://www.fincen.gov/news/ne ws-releases/fincen-assesses-record-13-billion-penalty-against-td-bank Futur...

arXiv doi:10.48550/arxiv.2403.14123 2024
[2027]

Retrieved June 19, 2025, from https://ai-2027.com/ Kulp, G., Gonzales, D., Smith, E., Heim, L., Puri, P., Vermeer, M., & Winkelman, Z. (2024). Hardware-enabled governance mechanisms. RAND. Lewis, A., & Goldstein, J. (2015). The effectiveness of the wassenaar arrangement as the non- proliferation regime for conventional weapons. Library of Congress. (n.d.)...

arXiv doi:10.48550/arxiv.2404.18308 2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

(2025, February)

Aguirre, A. (2025, February). Chapter 8: How to not build AGI. Retrieved June 19, 2025, from https://keepthefuturehuman.ai/chapter-8-how-to-not-build-agi/ Apollo Research. (2024, January). We need a Science of Evals. Retrieved June 19, 2025, from http s://www.apolloresearch.ai/blog/we-need-a-science-of-evals Arms Control Association. (2022, February). The...

arXiv 2010

[2] [16]

(2020, May)

Russell, S. (2020, May). Human Compatible: Artificial Intelligence and the Problem of Control. Retrieved June 19, 2025, from https://www.cato.org/cato-journal/spring/summer-2020/h uman-compatible-artificial-intelligence-problem-control-stuart Scher, A., & Thiergart, L. (2024).Mechanisms to verify international agreements about AI develop- ment. MIRI Techn...

arXiv 2024

[3] [1703]

https://doi.org/10.1056/NEJMp2027405 Swift. (n.d.). Know Your Customer (KYC). Retrieved June 20, 2025, from https://www.swift.com /risk-and-compliance/know-your-customer-kyc Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber- Enabled Activities(Executive Order 13984). (2021, January). U.S. Department of S...

arXiv doi:10.48550/arxiv.2408.16074 1995

[4] [2025]

Epoch AI

Federal Regis- ter. Epoch AI. (2024). Data on notable AI models. https://epoch.ai/data/notable-ai-models Financial Crimes Enforcement Network. (2024, October). FinCEN Assesses Record $1.3 Billion Penalty against TD Bank. Retrieved June 20, 2025, from https://www.fincen.gov/news/ne ws-releases/fincen-assesses-record-13-billion-penalty-against-td-bank Futur...

arXiv doi:10.48550/arxiv.2403.14123 2024

[5] [2027]

Retrieved June 19, 2025, from https://ai-2027.com/ Kulp, G., Gonzales, D., Smith, E., Heim, L., Puri, P., Vermeer, M., & Winkelman, Z. (2024). Hardware-enabled governance mechanisms. RAND. Lewis, A., & Goldstein, J. (2015). The effectiveness of the wassenaar arrangement as the non- proliferation regime for conventional weapons. Library of Congress. (n.d.)...

arXiv doi:10.48550/arxiv.2404.18308 2024