The brake rivals can trust.
The Verifiable Compute Commons: neutral, open infrastructure that makes a coordinated slowdown credible. Not an enforcement mechanism. A common-knowledge machine, where a defector is seen, not merely asked to stop.
A pause nobody can verify is just a race with extra steps
Every serious plan for frontier AI eventually reaches the same clause: if the danger spikes, we slow down. And every rival reads that clause the same way: you first. Labs race because each fears the others will not stop. States race because each fears the others are lying. The clause is empty until someone can check it.
That is the gap the Commons fills. In the book's terms, it is a denominator move at civilization scale: it does not slow the numerator by decree, it grows our collective power to detect, decide, and correct. It turns the option to slow down from a promise into a switch, installed in peacetime, dormant until needed, and verifiable by the very rivals it binds.
When AI builds itself, the reviewer becomes the bottleneck
Once models write most of the code and human review can no longer keep pace, promises to "watch it closely" stop scaling. The only brake that scales is one that watches compute, not press releases.
Read the essay →Six layers, one purpose
Each layer answers one question. Together they produce the rarest commodity in a race: common knowledge that everyone is still keeping their word.
Policy
Commitments written for machines, not press offices: compute ceilings, architecture and dataset restrictions, deployment conditions, all machine-readable.
Attestation
Hardware that testifies about itself. Secure-enclave and firmware attestation on chips that exist today generate evidence of what actually ran.
Verification
The hard part: proving a negative. Not "here is what we trained," but "nothing above the ceiling was trained," checked against the policy automatically.
Adjudication
Anomalies happen. A neutral process sorts sensor noise from defection before anyone reaches for an accusation.
Transparency
Outsiders can confirm the system is honest without seeing anyone's secrets: public heartbeats, not public weights.
Reciprocal Reveal Escrow the new move
Encrypted compliance evidence sits in escrow that nobody can read in peacetime. Open it, and it opens for everyone symmetrically. Mutual visibility, held in reserve.
Five commitments that keep it honest
Open trust
Every line of verification logic is public and auditable. Trust the math, not the operator.
Privacy by design
Proofs about bounds, never contents. No lab shows its weights; no state shows its secrets.
Neutrality
If any one lab or state owns the referee, adoption dies. The Commons belongs to no player.
Peacetime first
Adopted for everyday, independently useful reasons. The slowdown is a latent feature, not a crisis invention.
The ratchet
Rules can tighten by normal vote. Loosening them takes a supermajority. Vigilance compounds by default.
Every century, restraint had to be reinvented as infrastructure
The Commons is not a utopian novelty. It is the next entry in a long series: promises that became checkable, and therefore real.
IAEA safeguards
Nuclear material stayed peaceful not because states promised, but because inspectors could count it. Seals, cameras, and material accounting turned "trust us" into "check us."
Test-ban monitoring
Banning nuclear tests only became negotiable once seismometers could hear a violation from across the planet. Today a global sensor network listens continuously; a secret test is a contradiction in terms.
On-site missile inspections
The INF treaty eliminated an entire weapons class with a then-radical clause: each side walks the other's factories. Verification was the treaty; the signatures were decoration.
Open Skies
Rivals granted each other scheduled reconnaissance flights over their own territory, buying stability with mutual visibility. Transparency as a standing service, not a concession.
Certificate Transparency
The web stopped trusting certificate authorities silently: every certificate now lands in a public, append-only log that anyone can audit. Misissuance did not become impossible; it became visible. The Commons borrows this exact grammar for compute.
The Verifiable Compute Commons
The same move, one level up: apply the inspector's logic to training runs. Attest the hardware, log the bounds, escrow the evidence, and let rivals verify each other without exposing a single secret.
The threat model is the design
A verification system that cannot name its own attackers is theater. The Commons starts from four.
Off-the-books compute
The dark-fab problem: capability thresholds fall while unregistered clusters rise. Answer: make participation independently valuable, so staying outside the Commons costs more than joining.
Spoofed proofs
Any attestation that can be forged will be. Answer: hardware roots of trust plus cross-checks between independent layers, so a lie has to be consistent everywhere at once.
Neutrality capture
The referee is the prize. Answer: open verification logic, distributed governance, and the ratchet, so no single actor can quietly loosen the rules it plays by.
The legitimacy trap
A slowdown that only handicaps the careful makes the world less safe. Answer: symmetric visibility. Nobody slows alone, because everybody sees everybody.
Built in phases, useful at every phase
Charter
A neutral home and public rules of the game.
Attestation
Open training-provenance attestation on hardware that exists today.
Common knowledge
Multi-party verification: the first moment everyone knows that everyone knows.
The dormant brake
Slowdown capability and the reveal escrow, installed but sleeping.
Into the silicon
Verification moves down the stack, into the hardware itself.