The Verification Gap: A Cryptographic Autopsy of the 'Trustless' US-China AI Cooperation Framework

On the morning of an otherwise unremarkable news cycle, a crypto-native outlet published a policy flash about US-China AI safety cooperation. That mismatch — a governance argument appearing on a channel built for token coverage — is the first thing worth auditing. The second thing is that the argument itself rests on a word the crypto industry has spent a decade monetizing: verification.

In late 2024, Shlomit Wagman — a former Israeli antitrust official and Harvard-affiliated researcher — advanced a claim that has since circulated quietly through AI governance circles: the United States and China can cooperate on AI safety without trusting each other, by anchoring cooperation in narrow, mutual-interest agreements rather than broad confidence-building. Crypto Briefing carried the flash. The substance was thin — four information points, three of them traceable to Wagman herself. But the placement is a signal, and I want to dissect why.

The framework is conceptually clean. It transplants the arms-control doctrine of "trust but verify" — the operational backbone of the 1987 INF Treaty and the New START regime — into AI governance. During the Cold War, the US and USSR signed verifiable treaties while maintaining total strategic distrust. Cooperation did not require friendship. It required only that both parties could observe the other's compliance well enough to make defection costly. Wagman's argument is that AI safety can work the same way: two rivals, no shared values, one narrow set of catastrophic-risk red lines, and a verification mechanism in the middle.

Here is the problem I cannot get past, and it is the same problem that should stop any ZK researcher from nodding along: the framework imports the word "verification" from a domain where it means something measurable, into a domain where the observable does not exist. A nuclear warhead has a radiation signature. A missile silo has coordinates. A centrifuge cascade has an enrichment footprint you can sample with a swab. An AI model has none of these. Its most dangerous properties — latent capability, alignment state, a hidden fine-tune that unlocks bioweapon synthesis — live inside weights that no external inspector can read, and no external party can reproduce.

So the phrase "trust but verify" sounds like engineering. It is actually an analogy. And analogies don't ship.

The mechanics of the verification gap

Let me be precise about what verification means in the domain where it actually functions.

Zero knowledge isn't magic; it's math you can verify. A ZK-SNARK proves a statement is true without revealing the witness. It works because the statement is formal, the circuit is fixed, and the proof is checkable in polynomial time by anyone. There is no trust in the verifier, no trust in the prover, and no trust in the channel. That is the entire point. The cryptographic object is self-authenticating.

An AI model is not a circuit with a fixed statement. It is a high-dimensional function approximator whose behavior is emergent, input-dependent, and stochastic. You cannot write a ZK circuit that proves "this model is not dangerous," because "dangerous" is not a property of the weights — it is a property of the interaction between the weights, the deployment context, and the adversary's creativity. Prove the model is safe on Tuesday, and a jailbreak discovered on Wednesday invalidates the proof. The circuit cannot even be specified, because the threat model is open-ended.

The nuclear analogy fails at exactly the point where the crypto analogy also fails. Let me lay the two side by side.

For a nuclear treaty, the compliance signal is a physical object with an immutable signature: isotope ratios, seismic events, satellite imagery of a known facility. Cheating is detectable because the thing being hidden has mass and location. For an AI treaty, the compliance signal would have to be a property of a computational process that can be copied, split, quantized, distilled, encrypted, and run in a jurisdiction with no reporting regime. You can verify that a 70-billion-parameter model exists. You cannot verify that it is the same model, that it has not been fine-tuned, or that its evaluation results were not selectively reported. The artifact is trivially forgeable and the property is fundamentally private.

This is where I expect the crypto-adjacent optimists to jump in with verifiable computation. ZK-ML, trusted execution environments, federated evaluation, on-chain attestations of model provenance. I have spent three months compiling and testing ZK-SNARK circuits on local hardware, and I will tell you what I learned: the overhead of proving even a small ML inference is brutal, and the security guarantees collapse the moment you move from "this computation was executed correctly" to "this computation produced a safe outcome." The first is a math problem. The second is a philosophy problem wearing a math costume.

TEEs are worse. Intel SGX and its descendants have a two-decade track record of side-channel disclosures — Foreshadow, Plundervolt, Aepic Leak, the list grows. An attestation signed by a hardware enclave tells you the enclave ran the code it claims. It does not tell you the code is honest, that the host is not observing side channels, or that the vendor — which may be subject to a third country's legal compulsion — has not been coerced. In a US-China cooperation framework, the TEE vendor becomes a single point of geopolitical failure. Whoever controls the silicon controls the attestation root. That is not a trustless mechanism. That is a trust mechanism with extra steps, wearing a hardware badge.

Where the crypto narrative enters

Now the channel mismatch starts to make sense, and this is where I want to slow down.

Crypto Briefing is not a foreign-policy desk. It covers tokens, protocols, exchanges, and DeFi. When an outlet built around on-chain assets publishes a US-China AI governance flash, the editorial decision is not neutral. It is a positioning move. The AI×Crypto narrative is the growth story of the current cycle — decentralized compute marketplaces, tokenized GPU credits, verifiable inference, "AI agent" tokens, data-provenance protocols. Every one of those narratives needs a policy tailwind to keep its valuation story intact. A credible researcher saying "AI safety cooperation is possible" becomes, with two hops of editorial drift, "the world needs verifiable AI — and crypto is how you verify it."

I have seen this exact pattern before. In 2020, during DeFi Summer, I manually traced the execution flow of Uniswap V2's swap function, focusing on the integer overflow protections and the fee distribution logic. I wrote a Python simulation to model slippage under varying liquidity depths. What the simulation showed me was not a market truth — it was a mechanism truth. The constant product formula has a precise, deterministic behavior, and the fee logic has a precise, deterministic distortion of it. The AMM model hides its truth in the invariant. Every narrative built on top of that mechanism — "liquidity fragmentation," "better capital efficiency," all of it — had to survive contact with x·y=k or it was fiction.

The same discipline applies here. The AI×Crypto narrative wants you to believe that cryptographic verification is the missing piece of AI governance. Test it against the invariant. The invariant of AI governance is: can a third party, without cooperation from the model owner, determine whether the model crossed a catastrophic-risk threshold? If the answer is no — and today it is unambiguously no — then no amount of ZK, TEE, or tokenized attestation closes the gap. The crypto layer verifies the wrong object.

What the crypto layer can do is verify that a specific computation was performed on specific inputs and produce a proof of that fact. That is useful for provenance, for audit trails, for supply-chain integrity of model weights. It is useless for capability assessment. Proving that you ran a benchmark is not proving that the benchmark result is meaningful, or that the model you ran is the model you deployed.

The manufactured-narrative dynamic here is structurally identical to the DeFi one I dissected years ago. A real technical primitive — verifiable computation — gets attached to a governance problem it cannot solve, because the governance problem is urgent and the primitive is legible. VCs who need a new rotation find the attachment convenient. Media that need an AI hook to keep their crypto audience find it convenient. Researchers who need funding find it convenient. The primitive is real. The framing is manufactured.

The arms-control analogy, audited

Let me do the forensics on the historical claim, because it is the load-bearing element of the whole framework and it is weaker than it looks.

The INF Treaty worked because the USSR agreed to destroy an entire class of missiles and submit to on-site inspection. The verification was intrusive, physical, and — critically — mutual in a way that imposed symmetric costs. Both sides had to open facilities. Both sides had to accept inspectors. The compliance signal was observable because the things being verified were large, fixed, and expensive to hide.

New START works because warheads sit on delivery vehicles at declared bases, and the treaty caps those vehicles. Satellite imagery and notifications do most of the verification work. Again: physical objects, fixed locations, observable signatures.

Now ask the AI equivalent. What would a "narrow agreement" actually cover? The plausible candidates are: bioweapon-relevant model capabilities, cyber-offensive capabilities, autonomous-weapons integration. Each of these is a capability claim, not an object claim. To verify a capability claim, you need to evaluate the model — which means you need access to the model, its weights, its training data lineage, and its eval harness. In a US-China cooperation framework, that access is exactly what neither side will grant, because granting it transfers the most valuable asset in the strategic competition.

The framework therefore has a circular dependency. Verification requires access. Access requires trust. Trust is what the framework was designed to avoid. You have not removed the trust requirement — you have relocated it to the definition of the narrow scope.

Who defines "narrow"? If the US defines it, China sees a containment mechanism. If China defines it, the US sees a loophole. If a third party defines it — say, a UK or EU technical body — that body acquires de facto authority over the red lines of two superpowers, which neither will accept. The scope-setting problem is not a detail. It is the framework. And it does not dissolve under any cryptographic trick I am aware of.

I am not saying the framework is worthless. I am saying it is a policy argument dressed as an engineering argument, and the engineering part does not hold up. That distinction matters, because the crypto industry is about to sell the engineering part to investors who cannot tell the difference.

What the framework actually gets right

The skeptical reading is not the whole reading, and I want to be fair to the argument before I forecast.

The narrow-agreement approach is genuinely the only realistic path. Comprehensive AI governance — one treaty, one set of global rules, one enforcement body — is dead on arrival. Values diverge, data sovereignty is non-negotiable, and the domestic politics of both superpowers punish visible cooperation. Incrementalism is the only mechanism that has ever moved international security law forward, and narrow agreements are incrementalism by construction.

The "common self-interest" logic is also sound, as far as it goes. Catastrophic AI risk is symmetric. If a frontier model is misused for autonomous cyberattack or bioweapon design, the damage does not respect borders. There is a genuine game-theoretic mutual-interest zone. That zone is real, and the 2024 Geneva channel — the first formal US-China AI government-to-government dialogue — is evidence that both sides recognize it.

Where the framework overreaches is in claiming that recognition of mutual interest is sufficient to produce a verifiable mechanism. It is not. Mutual interest produces agreement on paper. Verification produces compliance. Between the two sits the entire engineering problem, and the engineering problem is unsolved.

There is also a real, underdiscussed tension the framework does not address: export controls. The US controls H100, H800, and B200 flows to China. China accelerates domestic substitution — Ascend, Cambricon. If compute is treated as a national-security asset, and it is, then the most sensitive cooperation topic is compute-flow monitoring. That is where the narrow agreements would have to bite, because compute is the binding constraint on frontier capability. But monitoring compute flows is precisely what both sides treat as intelligence gathering. The framework's most natural technical subject is also its most politically radioactive.

And notice the packaging move. Export controls can be reframed as "responsible behavior to prevent AI-safety risk." That framing lowers international friction while maintaining the strategic effect. Cooperation language becomes a rhetorical cover for competition policy. This is not cynicism — it is what governments do. But anyone reading the framework as a step toward genuine AI safety cooperation should understand that the same text can serve containment.

The audit checklist

If you are reading a claim about AI safety cooperation, run this list. I keep it short because verification should be mechanical.

First: does the claim specify a verifiable observable? If it says "both sides agree to" without saying "both sides can observe," it is a paper agreement. Paper agreements have value, but they are not verification frameworks, and calling them one is a category error.

Second: who is the verification authority? If the answer is "a vendor," check the vendor's jurisdiction and legal exposure. If the answer is "a third country," check whether both superpowers accept third-country authority. If the answer is "self-reporting," you have a trust mechanism, not a verification mechanism, regardless of the vocabulary.

Third: what is the defection cost? In a no-trust environment, cooperation holds only when defection is detectably punished. If the agreement has no detection mechanism and no penalty, it is a press release. Ask what happens on violation. If the answer is "diplomatic consequences," the agreement is advisory.

Fourth: does the cryptographic layer verify the object that matters? Provenance proofs verify provenance. Execution proofs verify execution. Neither verifies capability or alignment. If a pitch blurs the three, the pitch is selling you the wrong circuit.

Fifth: what is the channel? If an AI governance argument arrives through a crypto outlet, ask what narrative the placement serves. This is not about the outlet's integrity. It is about the incentive gradient. Media outlets position for audience growth. Audience growth in this cycle is AI-adjacent. The governance content is real; the packaging is directional.

I do not run this checklist because I distrust the researchers. I run it because I have watched good primitives get attached to bad claims for a decade, and the taxonomy is stable.

The bear case on verification, stated plainly

The honest summary is this: the AI safety verification problem is not a cryptography problem, and the crypto industry does not have the missing piece.

Cryptography verifies formal statements about fixed objects. AI safety is about open-ended properties of adaptive systems in adversarial deployment. The gap between those two is not a gap that a better proof system closes. It is a gap in the structure of the problem. You cannot prove a negative about an adversarial system in an unbounded interaction space. That is not a limitation of current technology. It is a limitation on what "proof" can mean here.

What cryptography can do — and this is genuinely valuable — is make certain classes of process verifiable. That a given training run used a declared dataset. That a given inference used declared weights. That a given evaluation was run on declared hardware without tampering. These are audit primitives. They support compliance regimes. They do not support capability restriction.

So the correct read of the Wagman framework is narrower than the flash suggests and much narrower than the crypto narrative wants. It is a useful policy articulation of the only viable path, paired with an unexamined technical claim about verification that does not survive contact with how AI risks actually manifest.

The market, meanwhile, is in a bull phase, and bull phases reward optimism with capital. Every framework that sounds like cooperation sounds like a reason to buy the associated token. Every verification primitive sounds like a reason to price in a new category. The FOMO does the rest. My job is not to talk anyone out of their thesis. My job is to point at the invariant and let the reader check it. Zero knowledge isn't magic; it's math you can verify. So is every claim in this space, and most of them do not verify.

The forward question is not whether the framework gets adopted. It is whether, when the first "narrow AI safety agreement" is announced, anyone reads the verification annex — and whether the annex contains an observable, an authority, and a penalty, or three paragraphs of aspiration. The first case is a mechanism. The second is a narrative, and narratives get priced. Watch which one ships.