# What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring

**Authors:** Yonadav Shavit  
**arXiv:** [2303.11341](https://arxiv.org/abs/2303.11341)  
**Date:** 2023-03-20  
**Summary page:** https://www.summarizepaper.com/en/paper/2303.11341v2/

## Key points

- Governments need to enforce rules on the development of machine learning systems within their borders
- A mechanism is proposed to monitor computing hardware used for large-scale neural network training
- The proposed solution involves chip inspections at three stages: on the chip, at the prover's data-center, and in the supply chain
- On-chip firmware saves snapshots of NN weights stored in device memory as fingerprints of training runs
- Sufficient information about each training run is saved to prove details of snapshotted weights to inspectors
- Monitoring the chip supply chain ensures no actor can avoid discovery by amassing untracked chips
- This approach does not curtail consumer computing devices' use and maintains privacy and confidentiality for ML practitioners' models, data, and hyperparameters.
- Limitations include assuming all actors involved will act honestly and not attempt to circumvent monitoring mechanisms.

## Summary

As machine learning systems become increasingly advanced and play a significant role in geopolitics and societal order, it is becoming imperative for governments to enforce rules on the development of these systems within their borders. To ensure compliance with potential future international agreements on advanced ML development, this paper proposes a mechanism to monitor the computing hardware used for large-scale neural network (NN) training. The framework's primary goal is to provide governments with high confidence that no actor uses large quantities of specialized ML chips to execute a training run in violation of agreed rules. The proposed solution revolves around chip inspections, where the verifier inspects a sufficient random sample of the prover's chips and confirms that none of these chips contributed to a rule-violating training run. To ascertain compliance from simply inspecting a chip, interventions are needed at three stages: on the chip, at the prover's data-center, and in the supply chain. On-chip firmware occasionally saves snapshots of the NN weights stored in device memory so that an inspector could later retrieve them. These weight-snapshots serve as fingerprints of the NN training that took place on each chip. The system also saves sufficient information about each training run to prove to inspectors the details of the training run that had resulted in the snapshotted weights. Lastly, monitoring the chip supply chain ensures that no actor can avoid discovery by amassing a large quantity of untracked chips. The proposed design decomposes the ML training rule verification problem into narrow technical challenges, including a new variant of Proof-of-Learning problem. This approach does not curtail consumer computing devices' use and maintains privacy and confidentiality for ML practitioners' models, data, and hyperparameters. While this solution provides an effective mechanism for verifying compliance with agreed-upon rules during large-scale NN training runs, it has limitations such as assuming all actors involved will act honestly and not attempt to circumvent its monitoring mechanisms. Nonetheless, this paper presents a significant step towards ensuring responsible and ethical development of advanced machine learning systems which should be further explored through implementation and research into potential next steps.