Working draft
Running…
The model runs on a calendar with four periods:
The page opens on the Defaults preset. Some box notes compare it with the engine's base settings: the values the model falls back on for any setting a saved parameter file leaves out, with an 18-month audit at the records-and-interviews access level, legal imports, the offshore channel, a 1.5-times smuggling surge, amnesty and every hiding route switched on. They are not a preset you can pick on this page.
Preset: Defaults.
Settings are grouped like the diagram. Click a box title to find it in the diagram, where the same settings sit in its details panel. A dot marks a setting changed from the loaded inputs; ↺ puts it back. Greyed settings have no effect with the current choices.
How this model differs from AI 2040's. AI 2040 is the AI Futures Project's scenario for a US–China AI deal. Its Covert AI Projects supplement estimates how much computing power China could gather for a hidden AI project before the deal without the US finding clear evidence: about 1.5M H100e, where one H100e is the computing power of one Nvidia H100 chip. The first diagram above redraws that estimate, which AI 2040 calls Method #1.
The page opens on the Defaults preset, which keeps AI 2040's settings apart from a short list of changes the author prefers. So the This model column says what the model can do, and the last column says, row by row, whether Defaults uses this model's version, AI 2040's, or a mix. Most changes can be switched off under All settings; the AI 2040 reproduction preset switches them off and returns AI 2040's result.
A route is one way China could hide chips, and its pool is the chips it can draw on. AI 2040 counts three routes. This model has seven, labelled R1 to R5 in the second diagram, with two variants each of R2 and R5. Dark compute, the model's main result, is the H100e China holds hidden and still unfound when the verifier's search ends.
| Topic | AI 2040 | This model | In the Defaults preset |
|---|---|---|---|
| Time and data | |||
| Timeline | China sees the deal coming a year ahead. It starts hiding chips on 1 January 2028, and on 1 January 2029 the deal takes effect and China declares its chips. Production and smuggling are counted over that one year, false decommissioning from the stock at its start, and the result is what China holds hidden on the declaration day. With three months of warning, AI 2040 notes, China would hide about a third as much. | Chips are tracked quarter by quarter from the end of 2025. The calendar has three periods and a date: a baseline period of business as usual from late 2026; a diversion period, once an agreement looks likely, when China moves chips into hidden stock; the agreement's entry into force, when China declares its chips; and an audit period, when the verifier (the body that checks the agreement; in AI 2040, the US) searches for undeclared chips. You set each period's length. Schemes to hide chips China already holds can be set to need preparation time, so a short diversion period shrinks them. | Mixed. AI 2040's dates: diversion through 2028, entry into force on 1 January 2029, no audit period and no preparation time. But China's 2028 stock is built up quarter by quarter from the end of 2025, not read from AI 2040's snapshots (see Data). |
| Data | Two snapshots of the world's AI chips from a data sheet published with the scenario: 135M H100e on 1 January 2028 and 289M a year later. Fixed shares of the world total place China in them: 6.7% of the world's chips sit in China and 3.7% are Chinese-designed, leaving about 3% as US-designed chips in China. Method #1 uses no other years and doesn't split China's chips by how they arrived. | Year-by-year forecasts of world and Chinese chip production from AI 2040's Compute supplement. China's chips at the end of 2025 are split by origin: made in China, imported legally, owned or rented abroad, and smuggled (about 0.66M H100e, Epoch AI's estimate). After 2025, legal imports and chips owned or rented abroad can keep growing, each as a share of production outside China. AI 2040's snapshots remain a data option. | Mixed. The Compute supplement's production forecasts and end-2025 stock, but no new legal imports or chips abroad after 2025, although the supplement forecasts both: about 2.75M and 5.45M H100e over 2026–2028. Method #1 counts neither. |
| Smuggling | 2% of the AI chips sold worldwide in 2028 reach China by smuggling (80% range, the middle 80% of outcomes: 0.66–6%). AI 2040 started from Epoch AI's 3.2% for sales through 2025 and lowered it for the better US enforcement it assumes. Only 2028 smuggling feeds its smuggling route. | Smuggling runs every quarter from 2026. Its normal level is a share of chip production outside China (or of world sales, as in AI 2040), cut by any enforcement policies that are on, though 30% of the blocked flow finds another way in. Once an agreement looks likely, China's government can buy extra smuggled chips, raising the flow by a multiple you set, up to what smuggling networks can carry: 2.5 times the normal flow in all. | Mixed. Smuggling every quarter from 2026, at AI 2040's 2028 rate of 2% of world sales in every year (the Compute supplement has about 3.5% in 2026). No extra government purchases. |
| Enforcement before the agreement | Not a setting. AI 2040 assumes the US carries out all of AI 2040's recommendations well. The one effect it puts a number on is the lower smuggling share; without that cut, it says, China would hide about 1.5 times as much. | Six policies, each with a start date and a ramp-up: active US enforcement of export controls, import permits in transit countries, location checks in new chips, a chip registry built from vendor sales records, know-your-customer rules for cloud providers, and stronger intelligence tracking of China's chips. Between them they can cut how many chips arrive, raise the share with a record, make the verifier's estimate of China's total more precise, and make hiding schemes likelier to be exposed. | AI 2040's. No policies; better enforcement is built into fixed numbers such as the 2% smuggling share. |
| Recorded and unrecorded chips | For chips smuggled in 2028, the share whose final buyer can't be identified: median 25%, 80% range 2.5–70%. A chip counts as traceable if any usable record exists, even one that only US intelligence holds. China gets every untraceable smuggled chip. | Each quarter's smuggled chips are split into recorded ones, whose chain of custody (who sold them to whom) the verifier could follow, and unrecorded ones. The starting split is AI 2040's, so about 75% are recorded; legal imports always are. Enforcement policies raise the recorded share for chips arriving after they start; the chip registry raises it for earlier sales too. The split decides how a chip in China can be hidden: a recorded one only by false decommissioning (R1), an unrecorded one by the government keeping it off the declaration (R3, R4). | This model's, with AI 2040's share for every quarter, since no policy changes it. |
| Routes: the ways China could hide chips | |||
| False decommissioning (R1) | AI 2040's Route 1. Chinese firms report working US-designed chips as scrapped while fake recyclers keep them. The pool is every US-designed chip in China on 1 January 2028, about 4.0M H100e, and China hides about 22% of it (80% range 15–30%). AI 2040 treats this as the only way to hide chips already in China, since tracked chips can't vanish without explanation. | The same scheme and share. The pool is the recorded US-designed chips in China, counted on the declaration day, so chips arriving up to then count too. Unrecorded chips belong to R3 and R4 instead. Two options under All settings restore AI 2040's pool; switch R4 off with them, or unrecorded chips count twice. | This model's pool. |
| Concealed production during diversion (R2a) | AI 2040's Route 2. China keeps about 7% of its 2028 chip output off the records, with one chance in ten of more than 15%. The output is a 3.7% share of the world's 2028 production, about 5.7M H100e. | The same share, applied to China's output during the diversion period from the Compute supplement forecast (5.0M H100e in 2028). | This model's: AI 2040's share of the Compute supplement's output. |
| Concealed earlier production (R2b) | Left out. An appendix judges it ineffective: hiding about 5% of the output made before 2028, with a 7% chance of working. | A route of its own with AI 2040's numbers: about 5% of all of China's output from before the diversion period, including its end-2025 stock. With the verifier's fullest access (physical inspections; see Search after the declaration), it exposes the scheme 93% of the time, one minus AI 2040's 7%. | AI 2040's: left out. |
| Smuggled during diversion (R3) | AI 2040's Route 3. China ends up with every chip smuggled in 2028 whose final buyer can't be identified, and the route always works. | Only unrecorded chips can be hidden. The government keeps every such chip it buys itself (the extra purchases under Smuggling). Most smuggled chips go to ordinary companies, and of those it collects only part for its hidden stock: the gathering share. | This model's. No extra purchases, and a gathering share that is uncertain and a guess: median 42%, 80% range 10–80%. AI 2040 in effect uses 100%. |
| Earlier smuggled chips, not declared (R4) | No route. Chips smuggled before 2028 sit in the false-decommissioning pool and are hidden at the same rate as legal imports. | Unrecorded chips smuggled before the diversion period, including the end-2025 stock. China's customs or police may have seized some of them (about 2%, a placeholder with no public data). The government keeps those, collects the gathering share of the rest, and declares none of them. | This model's. With R1, every chip smuggled before diversion has a route: recorded ones R1, unrecorded ones R4. |
| Chips abroad held through fronts (R5a) | No route. AI 2040 counts China's chips by where they sit, so chips that Chinese firms own or rent abroad are left out, although its Compute supplement puts its "loopholes" channel (data centers abroad that Chinese firms own or rent, plus chip dies smuggled in for packaging) at about 6.15M H100e by the end of 2028. | The model assumes the agreement makes China declare every chip Chinese entities own or control, wherever it sits. China can hide 20% of the chips it owns abroad through front companies or undeclared subsidiaries. A setting from 0 (no help) to 1 (full help) for how far host countries help the verifier scales the search on R5a and R5b. | AI 2040's: no route. |
| Leased chips bought out and moved (R5b) | No route. | Capacity that Chinese firms rent from foreign-owned clouds is not China's to declare. The model assumes the verifier knows about it, and the results show it on a line of its own, outside dark compute. During the diversion period China can buy out 10% of it and move the chips into China; the sale shows in the owner's records, so the verifier knows these chips are missing. | AI 2040's: no route. Capacity rented by the end of 2025 (Defaults adds none later) still shows on its own line in the results. |
| Declaration and search | |||
| Declaration threshold | None: China declares every AI chip. AI 2040's example audit threshold of 30,000 H100e only decides which owners its plan would audit in full and which it would sample. | Optional: only facilities above a size you set must declare. Chips in smaller facilities may then legally be left off. The verifier never looks for them and they don't count as hidden, but they add to the share of China's compute outside verification. Their amount applies the Compute supplement's share of world compute in sites below that size (6.3% below 100,000 H100e) to China's chips that are not hidden. | AI 2040's: every chip declared. |
| Search after the declaration | None in the estimate. It counts what China could gather without the US getting clear evidence of a violation, on the declaration day. Steps AI 2040 recommends for later, such as amnesty and buybacks, are not subtracted. | An audit period of a length you set. The verifier's access is one of four levels, each adding to the last: open sources, national intelligence, company records and interviews, and physical inspections. The level sets most detection values: the chances and speeds with which the verifier exposes schemes and finds chips. Amnesty (no penalty for handing in hidden chips) and buybacks can recover a small share each year. | AI 2040's: no audit period, the top access level and no amnesty, so the count is taken on the declaration day. |
| Chance that a scheme works | A yes-or-no draw in each simulation run for whether a scheme can run at all without clear evidence: 60% for false decommissioning, 25% for concealed 2028 production. Buying smuggled chips always works. A no means the route yields nothing. | The same draw seen from the verifier's side: the chance it exposes a coordinated hiding scheme (R1, R2a, R2b, R5a); an exposed scheme yields nothing. With the fullest access and no audit, the chance is 40% for R1 and 75% for R2a (93% for R2b): one minus AI 2040's odds, replacing AI 2040's draw rather than adding a second one. Lower access, a longer audit and some enforcement policies change the chances. Smuggled and moved chips (R3, R4, R5b) get no such draw: a gradual search finds them during the audit, and bought-out chips (R5b) also lose a share at once to a check of the foreign owner's records. | This model's, matching AI 2040's odds: 40% and 75%, varied across simulation runs by the uncertainty below. |
| Unknown and known-missing chips | Not separated in the estimate. AI 2040's audit plan keeps an "untraced pool" of chips that records show but can't follow, such as scrapping claims that fail checks and sales to buyers who can't be found, but its 1.5M total mixes these with chips nobody has reason to suspect. | At the declaration each route's hidden chips are split into unknown chips, which no record points to, and known-missing chips, where a record shows a gap but the chips can't be located. How many fall on each side depends on the route and the access level. Known-missing chips face a targeted search during the audit. | This model's. With no audit period, the split divides the result without changing its size. |
| Verifier's estimate of China's total | Not in the estimate. AI 2040's Verification Plan has US intelligence knowing China's total to within about 10% in 2026 and about 4% by the end of 2028. | The verifier compares China's declaration with its own estimate of China's total, separately for US-designed and Chinese-made chips. The estimate's error starts at 10% either way (80% confidence), 15% for Chinese-made chips, and only 1% for recorded US-designed chips arriving after late 2026; the access level changes all three, and some enforcement policies the first two. Hidden chips that leave no record open a gap between declaration and estimate. A gap that is large next to the error is likely to be flagged, and the chips behind it become known-missing. Optionally, China hides such chips only up to about four-fifths of the error and declares the rest. | This model's, at the top access level: an error of about 6% for most US-designed chips, 0.6% for recorded ones arriving after late 2026 and 9% for Chinese-made chips, varied across runs. AI 2040's path to 4% would need the intelligence-tracking policy, which is off. With no audit period, a flag moves chips from unknown to known-missing without changing the total. |
| Uncertainty in detection values | The chances that a scheme works are single values. | Most detection values are placeholder judgments. Four multipliers scale them up or down in each simulation run, each applied to a whole group so its values move together: how often schemes are exposed, how many hidden chips records point to, how fast searches find chips, and how precisely the verifier knows China's total. Their ranges are guesses. | This model's. With no audit period, only the exposure multiplier changes the total; the others move chips between unknown and known-missing or have no effect. |
| Result | |||
| What is reported | A median of 0.51% of the world's AI computing power on 1 January 2029 (80% range 0.11–1.4%), which is 1.5M H100e (0.31M to 4.13M). AI 2040 also calls it about 7% of the chips China would otherwise hold. Medians and ranges only. | Dark compute, split into unknown and known-missing chips, by route and by where the chips were designed. Also the share of China's compute outside verification: dark compute plus any chips legally left undeclared, divided by every chip China owns or controls at entry into force, hidden or declared, at home or abroad (rented capacity is left out). This share compares with AI 2040's 7% of China's chips, not with its 0.51% of world compute. Means, medians and 80% ranges. | This model's measures, taken on 1 January 2029 as in AI 2040. The results above show the current run. |
Sensitivity
How much each input moves the share of China's compute outside verification, starting from the inputs currently set in the simulator. Two views: each input changed on its own between a low and a high setting, and sweeps across the main continuous inputs. Every run uses the same random numbers, so differences come from the inputs, not sampling noise.
Each row sets a single input to a low and a high value, while every other input stays at its current simulator setting. Rows are sorted by how far the mean share of China's compute outside verification moves, largest first; the first row is the result with the current inputs. Hover an input's name for what it means.
Each chart moves one input across a range, with the others at their current settings, and shows the share of China's compute outside verification.
| Source | Date | Short description | What it estimates | Notes |
|---|---|---|---|---|
| Hardwired Pause (Fithian, Holliday et al., Berkeley) | 10 Oct 2026 | Litho based pause feasibility study. Includes a census of the world's AI chips by the type of operator. | China's undeclared AI chips when a treaty starts (end-2026). About 13k H100e if China cooperates fully, 110k if it cooperates poorly, and 1M if it conceals everything it can (Table 5.1; Sec 6.4.3). | Leans heavily on paper trails. Assumes smuggling stays constant at 330k H100e per year. Rates come from pretty loose analogies (US firearm hiding, US tax reporting). |
| Clymer, Halstead, Wallich, "An international AI slowdown deal is enforceable" | Draft, last edited Jul 2026 | Unfinished paper arguing that an international deal to slow AI can be enforced. | Compute a verifier wouldn't find in a 2027 deal, broken down by pathway. Top level result: 100k-400k chips. | Looks at how far off US intelligence estimates of adversaries' stocks have been (15 historical cases, median error 15%); how quickly covert programs leak, using nuclear programs as comps. The concealed domestic production estimate is ~5x AI 2040's. Most of the numbers are from Claude, not sure which version. |
| Epoch, "Diversion and resale" (Juniewicz) | 29 Apr 2026 | Estimate of AI chip smuggling to China. | Compute smuggled to China: 159k H100e in 2024, 480k in 2025, and 660k in total through 2025 (90% CI 290k-1.6M). | Uses a) public (alleged) cases combined with a detection rate, assumed to be ~25% and b) # of resellers times volume per reseller. |
| ChinaTalk, "How Much Compute Does China Have?" (Zakaria) | 7 Apr 2026 | Estimate of China's compute at the end of 2025. | China's total compute stock at end-2025: ~2.8M H100e (90% CI 1.8-4.8M) | Uses a legal imports, smuggled chips, domestic production and capacity rented abroad split. Claim that this is right within an OOM but not much more. |
| Grunewald, "Where will China get its compute in 2026?", The Substrate | 13 Feb 2026 | Forecast of China's 2026 compute acquisition by pathway (legal imports, domestic production, chips fabricated abroad through front companies, smuggling). | China's 2026 acquisition: ~320k B300e (~1.2M H100e). Smuggling is ~22k B300e (~84k H100e; range ~10k-365k), assumed to be about 10% of total intake. | Assumes large quantities of H200 imports, which didn't actually happen. |