Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance
cs.CY · cs.AI · cs.CR
Quick verdict
A 20-mechanism taxonomy of inference-time AI governance; 15/20 rated deployable, coverage collapses vs state-level deployers — rigorous, but thinly validated.
Summary
The paper argues that compute governance attaches to training runs while capability increasingly migrates to the deployment stage through inference-time scaling, agentic scaffolding, and compression onto consumer hardware. It builds a feasibility taxonomy of twenty inference-time governance mechanisms across monitoring (M1–M6), verification (V1–V7), and enforcement (E1–E7), each rated on a four-point readiness scale (currently deployable to speculative) against a documented four-vendor evidence base (Anthropic, OpenAI, AWS Bedrock, Google Vertex AI). Fifteen of twenty mechanisms have commercial substrates in production. A two-dimensional adversary model (three capability tiers crossed with four roles: developer, deployer, user, fine-tuner) shows this readiness holds only against cooperative deployers and low-to-medium-capability users: no mechanism rates adequate against a high-capability state-level deployer (17 of 20 inadequate; V1, V4, E4 partial), and fine-tuning defeats model-internal enforcement. Mechanisms are mapped to four governance scenarios; jurisdiction-bounded inference (E3) is the only lever in three scenarios. A conditional substitution principle links the taxonomy to a companion hardware-governance paper. Main limitations: ratings are essentially single-author judgments with a second-rater check on only 7 of 20 mechanisms (quadratic-weighted kappa 0.74, unweighted 0.53, no confidence interval), and the evidence base excludes open-weight and self-hosted deployment.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Fifteen of twenty inference-time governance mechanisms have commercial technical substrates in production today at major providers, though governance-grade assurance and adversarial robustness vary.
- No mechanism in the taxonomy rates adequate against a high-capability state-level deployer; seventeen of twenty are inadequate and only V1, V4, and E4 retain partial coverage.
- Fine-tuning defeats the model-internal components of the enforcement cluster (E2 inadequate at C2.R4 and C3.R4), while verification mechanisms attesting model identity (V1, V5) remain effective against the fine-tuner.
- Existing training-compute threshold regimes (EU AI Act >10^25 FLOPs; revoked US EO 14110 >10^26) attach no obligations to inference, and above-optimal inference-time compute scaling can substitute for training compute at frontier capability.
- A conditional substitution principle: parallel-substitution mechanisms give comparable regulatory coverage at either lifecycle stage only while training-inference substitution is bounded; when the channel opens, hardware-dependent layered mechanisms (M4, V3, E3) become structurally necessary.
Strengths
Operationally anchored taxonomy
Each of the 20 mechanisms gets an operational definition, a vendor-productisation account, an academic source, and a rating (Section 3). Ratings cite concrete API evidence: M1 rests on Anthropic's usage object (cache_creation_input_tokens, thinking_tokens), OpenAI's six rate-limit metrics, Vertex usageMetadata, and Bedrock billing telemetry; V4 rests on Anthropic's thinking-block signatures versus Vertex's thought_signature with HTTP 400 enforcement.
Adversary-scoped rating discipline
Readiness ratings are explicitly claims against named adversary surfaces, not unconditional properties (Sections 1.2, 3.4, 4.3.8). This reconciles E2 being 'currently deployable' yet inadequate against fine-tuners at C2+ and quantifies the headline gap precisely: at C3.R2, 17 of 20 mechanisms inadequate, only V1, V4, E4 partial, none adequate (Finding 2, Section 4.3.4).
Honest reliability reporting
Falsifiable synthesis
Internally consistent quantitative bookkeeping
Weaknesses
Thin reliability protocol behind the headline
Single-author rating subjectivity and granularity arbitrariness
Four-vendor evidence base bounds external validity
Substrate availability conflatable with governance efficacy
Analogy transfer asserted, not tested
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is the second instalment of a two-paper research programme: where the companion work (Ansari [12]) rated twenty hardware-level governance mechanisms, this paper applies the same apparatus to the inference stage. The regulatory motivation is the silence of training-compute thresholds on deployment: Table 2 shows the EU AI Act's >10^25 FLOP systemic-risk presumption (in force), the revoked US EO 14110's >10^26 reporting threshold, and the UK's emerging code all attach obligations to training and none to inference, while capability migrates via inference-time scaling, agentic scaffolding, and compression (Section 2.1, citing Hooker and Pistillo/Villalobos). Four contributions are claimed: (1) a taxonomy of twenty mechanisms — monitoring M1–M6, verification V1–V7 (V7, chain-of-thought monitorability, an explicit one-mechanism extension beyond the hardware paper's V1–V6), enforcement E1–E7; (2) a two-dimensional adversary model (three capability tiers × four roles: developer, deployer, user, fine-tuner); (3) mapping to four governance scenarios; (4) a convergence analysis culminating in a conditional substitution principle. Headline result: fifteen of twenty mechanisms rated 'currently deployable'.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What does the paper conclude about inference-time AI governance?
It argues a feasible technical substrate already exists at the inference layer: 15 of 20 governance mechanisms (per-query token accounting, rate limiting, output filtering, geofencing, licensing, and others) have production substrates at major commercial providers. However, this readiness holds only against cooperative deployers and low-to-medium-capability users — no mechanism is adequate against a high-capability state-level deployer, and fine-tuning defeats model-internal enforcement.
What are the paper's four readiness levels?
(1) Currently deployable — a commercial technical substrate is in production at a major provider; (2) Near-term — substrate exists, integration or scale-up needed (roughly 2–3 years); (3) Requires R&D — foundational research exists but key components are missing (roughly 5–10 years); (4) Speculative — academic concept only, no production implementation.
Why does the paper say training-compute thresholds are insufficient?
The EU AI Act (>10^25 FLOPs presumption) and the revoked US Executive Order 14110 (>10^26 reporting) attach obligations only to training runs and are silent on inference. Cited literature (Hooker; Pistillo and Villalobos) shows that fine-tuning, model reuse, and especially above-optimal inference-time compute scaling can produce frontier capability while staying below those training-compute thresholds.
How reliable are the paper's 20 mechanism ratings?
A second rater independently re-rated a random subset of 7 of the 20 mechanisms, agreeing exactly on 5; quadratic-weighted Cohen's kappa was 0.74 (substantial agreement), but the unweighted kappa was 0.53 (moderate) and no confidence interval is reported, so the reliability evidence is suggestive rather than strong. All primary ratings remain single-author judgments anchored to dated vendor documentation.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Sections 2.3 (tail), parts of 3.2.4–3.3.1, 4.1 (tail), 4.2, 4.4–4.5, 6.1 (tail), 6.4–6.5, and Section 7 fall within marked sampling gaps, and the provided text ends mid-Section 6.3; Appendices B–F were not in the provided text, so reliability methodology, the populated adversary/scenario matrices, and the paper's own limitations discussion are assessed via inline cross-references only.
- Figure 1 reaches the extraction only as its letter-code matrix and caption; the visual rendering cannot be assessed.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.