The Chip, Not the Code

I — Why States Restrict Frontier AI

Three properties have to coincide before a technology becomes a serious object of state restriction, and frontier AI has all three. The first is that it is dual-use: the same model that drafts contracts can assist in designing weapons, running influence operations, or automating cyber-intrusion. The second is that it is strategically decisive: a sufficient capability advantage is not a marginal economic edge but a potential transformation of military and economic power. The third — and this is the one that makes restriction enforceable rather than merely desirable — is that the capability is physically concentrated. It is not diffused across millions of actors. It is produced by a small number of organisations using inputs that come from an even smaller number of sources.

Most technologies fail the third test, which is why most technology restriction fails. Encryption was supposed to be controllable and is now everywhere, because the capability is mathematical and the marginal cost of reproduction is zero. Frontier AI is different in a way that matters enormously: the capability is not the algorithm. The transformer architecture is public. The training techniques are published. What is scarce — what cannot be reproduced from a paper — is the compute required to turn those public techniques into a frontier model. And compute is not mathematics. It is metal: physical chips, manufactured in physical fabs, installed in physical data centres drawing physical power.

The chokepoint, therefore, is not the code. It is the chip — and behind the chip, the fab; and behind the fab, the handful of firms that make the lithography equipment without which advanced chips cannot be produced at all. This is the most concentrated industrial supply chain in the modern economy. A small number of designers, a smaller number of fabs capable of producing at the leading node, and effectively one supplier of the most advanced lithography. (Khan, CSET, 2021; Miller, 2022) Restriction works because there are physical points in that chain where a small number of actors can say no, and the no cannot be routed around on any near-term horizon.

Encryption escaped control because the capability was mathematical. Frontier AI has not, because the capability is metallurgical — and metal can be counted, located, and denied.

II — What Restriction Actually Targets

The policy debate routinely blurs three things that behave completely differently, and the blurring produces most of the confusion about what restriction can and cannot achieve. The three are the model weights, the compute used to train them, and the compute used to run them. They are not interchangeable, and the restrictions that bind on one do not bind on the others.

The weights — the trained parameters that constitute the model — are a file. A large file, but a file. Once trained, they can be copied at near-zero cost and moved anywhere a file can go. The open-weights models that already exist demonstrate this completely: their weights have been downloaded millions of times, run on hardware their creators do not control, in jurisdictions their creators cannot reach. There is no effective restriction on the movement of weights that already exist, and there will not be, for the same reason there is no effective restriction on the movement of any other file. The artefact, once made, travels freely.

Training compute is the opposite. Producing a frontier model from scratch requires tens of thousands of the most advanced accelerators, co-located, running for months, wired together with specialised high-bandwidth interconnect. This is not a file. It is an industrial facility — capital-intensive, power-hungry, physically fixed, and dependent on exactly the chips that sit at the chokepoint. Restriction targets this, and against this it is effective. You cannot smuggle a training run.

Inference compute — the compute used to run a finished model — sits in between. It is far less demanding than training; a capable model can be run on modest hardware, and quantised versions of large open-weights models run on consumer machines. Inference is therefore much harder to restrict than training and much easier to decentralize. This distinction is the hinge of the entire decentralization argument, and the next two sections turn on it.

Three layers, three different restrictabilities

1. Model weights — A file. Copyable at zero cost, movable anywhere. Existing open weights are already beyond restriction. The artefact travels freely.
2. Training compute — An industrial facility. Tens of thousands of co-located, interconnected accelerators running for months. Capital-intensive, fixed, chip-dependent. This is what restriction targets, and against this it works.
3. Inference compute — Modest by comparison. Runs on commodity and sometimes consumer hardware. Hard to restrict, easy to decentralize. The hinge of the decentralization argument.

III — The Decentralization Proposal — and What It Solves

The proposal in its strongest form is appealing and deserves to be stated at full strength rather than knocked down in a weak version. Take a capable model. Distribute its weights across thousands of participants spread across every jurisdiction. Let inference be served collectively, by a network rather than a company, so there is no single server to seize, no single operator to coerce, no single switch to flip. Give the participants fractional ownership and a vote in how the model is governed. The result is a model that no state can unilaterally switch off, because there is no central point at which "off" can be applied. For a whole class of concerns — censorship, deplatforming, unilateral withdrawal of access — this genuinely works.

It works because it operates at the layer where restriction is weakest. Distributing existing weights is, technically, file-sharing, and file-sharing has comprehensively defeated every attempt to suppress it. Serving inference collectively is harder but tractable, because inference is not compute-intensive enough to require concentration. A network of geographically dispersed participants, each running a portion of the model or a quantised copy of the whole, can serve a model that remains available even as individual nodes are removed. For the use case of "a model that cannot be taken away from the people using it," decentralization is not a fantasy. It is achievable with technology that exists today.

This much should be granted without reservation, because it is the part of the argument that is true, and the temptation in a sceptical piece is to skip past the part that is true in order to reach the part that is not. Decentralization defeats the switch-off chokepoint. If the concern is that a model people depend on could be withdrawn by a company or a government, distribution answers that concern. The mistake is to assume that because decentralization solves this problem, it solves the problem that restriction is actually built around.

IV — The Chokepoint It Doesn't Solve

Everything in the previous section concerns models that already exist. The binding question is not whether existing open-weights models can be kept available — they can — but whether the next frontier model can be produced outside the reach of restriction. Here the argument runs directly into physics, and the physics does not yield to governance.

Training a frontier model is not a large number of independent calculations that can be parcelled out to volunteers, in the way that distributed computing projects once parcelled out protein-folding or signal-analysis tasks. It is a single, tightly coupled computation in which every step depends on the results of the previous step, across the entire array of accelerators simultaneously. The accelerators must exchange enormous volumes of data with one another constantly, at bandwidths achievable only when they are physically co-located and wired together with specialised interconnect. Spread those same accelerators across the public internet, connected by ordinary network links, and the computation does not run slowly — it effectively does not run at all, because the time spent moving data between distant nodes swamps the time spent computing by orders of magnitude. (NVIDIA, 2023; Narayanan et al., 2021) The constraint is interconnect bandwidth, and it is not a software problem that better protocols will dissolve. It is a property of the distance between the machines.

The lesson is that a frontier training run is an industrial process that happens in one place. You can decentralize the ownership of the resulting weights. You cannot decentralize the production of them, because production requires the concentration that restriction targets. The decentralized model is not an alternative to the centralized compute — it is a downstream product of it. Someone, somewhere, on concentrated hardware in a specific jurisdiction, trained the model that the decentralized network then distributes. The chokepoint did not disappear. It moved upstream, to the metal, which is where it was the entire time.

You can distribute a file across ten thousand machines. You cannot distribute a computation that requires ten thousand machines wired into one. The weights can go anywhere; the training run happens in a room.

V — Co-Ownership Is a Governance Structure, Not an Escape

Suppose the compute problem were somehow solved — through a future architecture that makes distributed training viable, or through a participant network wealthy enough to assemble concentrated compute of its own. Grant the most favourable case: a genuinely decentralized frontier model, owned in fractions by participants across the world. The deepest difficulty is not yet addressed, because it is not a technical difficulty at all. It is the question of governance.

A model that can do consequential things in the world must decide which things it will and will not do. It must decide who may use it and on what terms. It must decide what happens when a participant wants it to do something the others find intolerable. And when it causes harm — when it is used to defraud, to manipulate, to damage — there must be some answer to the question of who is accountable. None of these questions is dissolved by distributing ownership. They are, if anything, made harder, because distribution removes the single locus at which they could otherwise be answered. A company can decide its model's policies. A network of ten thousand co-owners must somehow arrive at them collectively.

This is a constitutional question, and the experience of decentralized ownership to date is not encouraging about its easy resolution. Decentralized autonomous organisations — the closest existing analogue to a co-owned, self-governed digital entity — have repeatedly discovered that distributing ownership does not distribute the capacity to decide. (DuPont, 2017; Reijers et al., 2021) They tend toward one of two outcomes. Either no decision can be reached, because there is no mechanism to resolve disagreement among dispersed owners with divergent interests, and the entity is paralysed. Or a small, motivated minority captures the governance process, and the decentralization is nominal — ownership is dispersed but control is not. Paralysis or capture: the same pair that appears wherever a system attempts to disperse authority without first establishing a constitution for how authority is exercised.

A self-governed decentralized model does not avoid this. It is a polity. It needs a constitution — rules for who decides, how disagreement is resolved, what the entity will not do regardless of who wants it, and who bears responsibility when the rules fail. Co-ownership is not the answer to the governance question. It is the form in which the governance question arrives.

— What Would Actually Have to Be True

The honest scope of the decentralization argument can now be stated precisely. At the inference layer, decentralization is real, available, and effective: existing open-weights models can be distributed and served in ways that defeat any single point of control. For the concern that a depended-upon model might be switched off, this is a genuine answer. Anyone who tells you that decentralized AI is pure fantasy is wrong, and is wrong specifically about this layer.

At the frontier-training layer, decentralization largely dissolves, because training requires the concentrated compute that restriction targets, and that concentration is a physical necessity rather than a design choice. Anyone who tells you that decentralization frees frontier AI from geopolitical control is also wrong, and is wrong specifically about this layer. The decentralized model is a downstream artefact of an upstream industrial process that remains exactly as concentrated, and exactly as governable, as the compute it runs on.

And at every layer, co-ownership is a governance structure rather than an escape from governance. The question a decentralized model cannot avoid is the question at the root of every infrastructure failure: not who owns it, but who governs it, under what constitution, with what answer to the problem of accountability. Distribution changes where the question is asked. It does not answer it.

Which leaves the real question, the one the next piece takes up. If restriction binds at the compute layer, and the compute layer is concentrated, manufactured, and controllable, then compute is not merely an input to power. It is becoming a strategic reserve in its own right — and the world is beginning to sort itself according to who holds it. That trajectory, and the choice it forces on nations, is where this leads.