Open Source AI and Verified Hardware

That Refuses to Run or Train Unless It Is Done in the Open

If not verified open weights then the machine stops

Problem

Advanced artificial intelligence is being developed through increasingly concentrated and opaque systems. A small number of corporations and states control the largest models, the hardware needed to train them, and the information needed to understand what those systems can do.

This creates two connected dangers.

The first is loss of control. Systems may become too complex, autonomous or strategically capable for their developers—or society—to understand and govern reliably. Secret development makes this danger worse because failures, unexpected capabilities and unsafe design choices can remain hidden until deployment.

The second is control by bad actors. Corporations, governments, criminal organisations or unaccountable individuals may develop powerful capabilities without public scrutiny. Regulation alone is insufficient when the regulated activity can occur inside private data centres, classified facilities or proprietary cloud systems.

AI safety cannot depend entirely on promises made by those racing to build the most powerful systems. Nor should it depend on a central authority deciding which organisations, models or ideas are permitted.

The central problem is not simply that AI may become powerful. It is that powerful intelligence can be developed secretly, irreversibly and without collective oversight.

Proposed Solution

Advanced AI should be based on two linked requirements:

Open-source models and verifiable hardware.

Before running a sufficiently powerful model, the hardware would calculate a cryptographic checksum of its weights. It would compare that checksum with a signed manifest published at a public URL containing—or permanently linking to—the corresponding model weights.

The signed manifest would identify the model, version, architecture, publisher and checksum. Execution would proceed only when the signature was valid and the local weights exactly matched the publicly available weights.

The hardware would verify one narrow claim:

The model being run is the same model that has been made publicly available.

A signed denylist—or, more restrictively, an allowlist—of model checksums could also be published. Verified hardware would refuse to run a listed model, providing a collective kill switch for models judged unsafe. But the safe default is don’t use it.

Training requires an additional mechanism because the weights continually change.

After an agreed amount of training—defined by a maximum number of optimisation steps, computational work or accumulated weight change or elapsed time —the hardware would require the resulting weight delta to be published.

The delta would contain the changes needed to reconstruct the new model from the previous verified checkpoint:

New weights = previous verified weights + published delta

Both the delta and the reconstructed model would receive cryptographic checksums. Before training could continue, the delta would have to be uploaded either to the open distributed web or to at least three operationally independent parties.

Each party would sign a receipt confirming possession of the delta and its checksum. Model sizes and parameters should be included in the checksum. Three servers controlled by the same organisation would count as one party, not three.

The verification chain would therefore be:

Initial public weights → signed delta → verified checkpoint → signed delta → verified checkpoint

The hardware would enforce a maximum amount of unreported training. A developer could not secretly complete a major training run and later publish only a weakened, edited or sanitised model.

The hardware would not decide whether a model was politically acceptable, commercially approved or officially correct. It would enforce a simpler constitutional rule:

No advanced model may move too far from its last public state without publishing the difference.

Hardware should verify openness, not obedience. If not then the machine stops.*

Evaluation

Openness does not guarantee safety. Public models can be misused. Hardware protections may be bypassed even if inspected regularly. Determined states may manufacture non-compliant accelerators. Public weight deltas may also require substantial storage and network capacity.

The proposal should therefore not be judged by whether it makes wrongdoing impossible or accounting and charging possible or not. It should be judged against the alternatives.

Closed corporate development places control in private hands. Central licensing places control in political and bureaucratic hands. Voluntary safety agreements weaken under competitive pressure. Conventional software regulation is difficult to enforce because code and weights can be copied, modified and executed secretly.

Large-scale AI, however, depends on specialised physical infrastructure. Hardware is more difficult to copy, conceal and modify than software alone. It is therefore the most credible point at which to enforce a shared requirement for openness.

A three-party quorum prevents one company from merely claiming that its work is public while retaining exclusive control of the only usable copy. Independent custodians could include universities, public archives, civil-society organisations, competing infrastructure providers or distributed storage networks.

The system need not publish private training data. It would publish the model changes produced by training. Privacy, copyright and personal-data protections could therefore remain somewhat separate from public accountability for the intelligence created from that data.

There are genuine risks. Mandatory disclosure may expose dangerous capabilities, proprietary information or information recoverable from the weights. Thresholds, privacy protections and narrowly defined exceptions would therefore be necessary. The signing system, verification hardware and public protocols must themselves be open and independently auditable.

The first practical step could be a Verified Open certification for AI models. A certified model would have publicly downloadable weights, a signed manifest and a cryptographic checksum independently confirmed to match the model being distributed or operated. Fine-tuned versions would publish their updated weights or weight deltas under new checksums.

Certification could initially be voluntary but supported through public procurement, cloud-provider policies and research standards. A model would lose its certification if its weights disappeared, its checksum no longer matched or an undisclosed version was deployed under the certified name. This would establish the standards and infrastructure needed for verified hardware later to enforce the same principle directly.

This is not a complete solution to AI safety. It is a constitutional foundation for one.

We may not be able to guarantee that advanced intelligence will always remain controllable. We can insist that no corporation, state or individual should be able to develop it entirely behind closed doors.

Open the models. Publish the differences. Verify the hardware. Make secret intelligence computationally difficult.

“Only open-source AI, on verified hardware that refuses to run or train it unless it’s done in the open. Or the machine stops.”

---

Andre with ChatGPT-5.6 and Deepseek-v4-Flash,

August 2026

* The Machine Stops, a short story by E.M. Forster