  Offline Licensing is a mechanism for compute governance that could be used to
prevent unregulated training of potentially dangerous frontier AI models. The
mechanism works by disabling AI chips unless they have an unused license from a
regulator. In this report, we present a design for a minimal version of Offline
Licensing that could be delivered via a firmware update. Existing AI chips
could potentially support Offline Licensing within a year if they have the
following (relatively common) hardware security features: firmware
verification, firmware rollback protection, and secure non-volatile memory.
Public documentation suggests that NVIDIA's H100 AI chip already has these
security features. Without additional hardware modifications, the system is
susceptible to physical hardware attacks. However, these attacks might require
expensive equipment and could be difficult to reliably apply to thousands of AI
chips. A firmware-based Offline Licensing design shares the same legal
requirements and license approval mechanism as a hardware-based solution.
Implementing a firmware-based solution now could accelerate the eventual
deployment of a more secure hardware-based solution in the future. For AI chip
manufacturers, implementing this security mechanism might allow chips to be
sold to customers that would otherwise be prohibited by export restrictions.
For governments, it may be important to be able to prevent unsafe or malicious
actors from training frontier AI models in the next few years. Based on this
initial analysis, firmware-based Offline Licensing could partially solve urgent
security and trade problems and is technically feasible for AI chips that have
common hardware security features.
