Towards the Asia-Pacific Safety Compute Initiative

On the origins of this idea

This April, I spent four weeks visiting AI laboratories in China. I went to understand the people training the models that Anthropic’s May 2026 policy paper identifies as having weaker safety practices than US labs, regulated by a government Anthropic identifies as the principal threat to a beneficial AI transition.

“While increasing numbers of researchers in China’s AI labs and policy community are concerned with AI safety risks, this trend has not translated into safety practices on par with labs in the US. As of last year, only 3 out of 13 top Chinese AI labs published any safety evaluation results, and none disclosed evaluations for Chemical, Biological, Radiological, and Nuclear (CBRN) risks.”

What I observed in China shaped the whole of this proposal. Empirical claims about Chinese lab compute conditions are from first-hand conversations.

This is a proposal for a multilateral institution worth building, the constituencies who would need to move for it to exist, the technical and security architecture that would make it credible, the funding path that would underwrite it, and the four tests by which its success or failure should be judged.

On where we spend a trillion dollars

We’re easily on track to spend a trillion dollars on AI infrastructure in the decade between 2023 and 2033, and smart folks I know think we’ll spend much more than that. The vast majority of that money will be spent in the continental United States.

The following is a proposal to divert some amount of that money, and working with partners on both sides of the Pacific, build a dedicated cluster of GPUs for safety research.

The Asia-Pacific Safety Compute Initiative (APSCI) would be a Singapore-based shared compute program. Beginning with a rented cluster and moving to a dedicated Johor-sited facility in Phase Two, this cluster would be dedicated to evaluations, red teaming, interpretability, scalable oversight, and dangerous capability testing for models being built on both sides of the Pacific.

Working to assess dangerous capabilities in chemical, biological, radiological, nuclear, cyber, autonomy, and persuasion, this initiative gives a dedicated institutional home for safety work by labs, independent evaluators, and AI safety research organizations.

Recent Developments

The Singapore Consensus on Global AI Safety Research Priorities, released April 26, 2025, at the inaugural Singapore Conference on AI, was authored by 88 named scientists, with Yoshua Bengio, Stuart Russell, Max Tegmark, Dawn Song, Ya-Qin Zhang, and Xue Lan at the lead. It builds on the International AI Safety Report chaired by Bengio and backed by 33 governments. Their research agenda is organized around a defence-in-depth taxonomy of Development, Assessment, and Control. They did not describe the method that would procure the compute to do this at scale, because they are missing compute.

The UK’s AI Safety Institute Alignment Project dedicated £27 million across 60 projects alongside a coalition that includes almost every important name in AI. This work is fantastic and important, but insufficient, as they are missing compute.

The International Network of AI Safety Institutes, founded in San Francisco in November 2024 with ten member states including Singapore, has produced shared evaluation protocols and joint exercises in eighteen months, but has lacked the power to advance further as it is missing compute.

LawZero, Yoshua Bengio’s Canadian nonprofit launched June 3, 2025 with thirty million dollars and a Gates Foundation grant the following August, has assembled the technical leadership for safe-by-design AI research and is one of the most interesting institutional bets in the field. It is missing compute.

Labs across Asia making open-weight models that are 6-8 months behind the frontier have been forced to choose between safety research and model capability, and they are choosing model capability. They do this because they are missing compute.

We love to make institutions for AI safety. We love doing summits and bilaterals and secret London meetings where we express our concerns. If we want to actually work the problem, we need a massive number of GPUs that are outside the control of the researchers who are advancing model capability. To quote Hinton: “the prospect of discovery is too sweet.”

Compute Asymmetry

The argument for building APSCI does not depend on any particular forecast of AI capability. It depends on the present-tense distribution of compute, which is one of the most lopsided in modern science.

In July 2023 OpenAI publicly committed twenty percent of its then-secured compute over the following four years to the Superalignment team. Six sources told Fortune in May 2024 that the team received an estimated one to two percent.

By May 2024 the team had been dissolved; twenty-five researchers were reassigned. At least six other AI safety researchers from adjacent teams left OpenAI in the same window. This is the best-documented public case of the pattern APSCI is designed around: voluntary internal safety-compute commitments are fragile when they compete with the capability roadmap.

Google DeepMind published the Gemma Scope sparse autoencoder suite in 2024, with comprehensive interpretability coverage of every layer and sub-layer of the Gemma 2 9B model. The disclosed training cost was approximately fifteen percent of the underlying model’s training compute. Only a frontier-lab-scale compute holder could publish a comprehensive interpretability suite at this scale; independent interpretability research at Goodfire, Decode, EleutherAI, and the academic safety community runs at two to three orders of magnitude less compute.

METR’s RE-Bench autonomy evaluation environment, the methodology underlying the autonomy time-horizon paper that has become a primary reference in frontier evaluation work, allocates eight H100 GPUs per evaluation environment for an eight-hour run. METR has stated publicly, in its o3 evaluation write-up, that GPU-hours are the binding constraint on how often it can evaluate new frontier models.

What a safety workload actually costs

Concrete numbers help calibrate what “Phase 1 Tier A is one thousand GPUs” actually unlocks. A METR-grade autonomy evaluation against a single frontier-scale model, with comprehensive RE-Bench coverage and statistical robustness, consumes roughly five to fifteen thousand GPU-hours. A full pre-deployment safety bundle against a 70-billion-parameter open-weight frontier model, run jointly by METR, Apollo, the UK AISI, and CAISI across the CBRN, cyber, autonomy, and persuasion suites, consumes roughly twenty to fifty thousand GPU-hours depending on depth. Comprehensive Gemma-Scope-style interpretability work on a frontier-scale open-weight model is in the range of fifty to two hundred thousand GPU-hours per model.

A Phase 1 Tier A cluster of one thousand H200s at eighty percent utilization for one year delivers approximately seven million GPU-hours. That funds in the range of one hundred and fifty to three hundred comprehensive frontier-model safety campaigns per year, plus a dozen interpretability projects at frontier scale. The current global rate of comparable published safety work is in the range of twenty to forty campaigns per year, almost all of them done either inside one of the three richest US labs or under the UK AISI’s tightly-budgeted pre-deployment evaluations.

Phase 1 Tier A is therefore a roughly five-to-tenfold multiplier on the external safety-research output of the entire field. Tier B at five thousand GPUs is a twenty-five-to-fifty-fold multiplier. Phase 2 at twenty-five thousand GPUs operates the field at a scale where safety research begins to keep pace with the rate of capability releases rather than lag it.

Continuing

Anthropic’s May 2026 “2028: Two Scenarios for Global AI Leadership” paper notes that only three of thirteen leading Chinese AI labs published safety evaluations for their recent model releases, and that none disclosed CBRN evaluations. The paper frames this as evidence of Chinese AI recklessness.

What looks like recklessness from the outside is more often starvation. Other contributing factors include non-disclosure for regulatory or competitive reasons, and in some cases real inattention. APSCI is designed for the part of the problem that compute access can fix, the part that, based on the spring 2026 lab visits behind this paper, is larger than the disclosure debate has so far recognized.

Public evidence points to a low-single-digit percentage of frontier AI compute going to safety work, with public-sector and independent researchers one to two orders of magnitude below even that internal-lab pool. The institutions whose job it is to make AI safer, including METR, Apollo, the AI Safety Institutes, the safety teams inside Chinese labs, and the academic safety community worldwide, together command compute resources that are not in the same order of magnitude as the safety problem they are trying to address.

This problem is solvable, but not by asking frontier labs to reallocate more internal compute to safety. They have already promised to do that, and the promises have not survived contact with the capability roadmap. Export controls slow some capability work, but the chips not reaching Chinese labs are not being redirected to global safety research, and so cannot substitute for a positive safety-research institution. The solution runs through building the cluster.

A note on what this paper does not claim. APSCI does not make frontier-model-weight sharing risk-free, does not solve US-China AI competition (though it would not hurt), and does not replace export controls or the existing AI Safety Institutes. It complements both. Interpretability and evaluation work have always had capability implications; APSCI does not change that. What it changes is who can do the work, at what scale, and how observable the results are.

Some Pragmatism

Team

APSCI will be led by both hardware engineers and national AI Safety Institute team members, with a staff of independent evaluators both in person and remote.

Prospective participant list:

METR, Apollo Research, MATS, FAR.AI, the UK AISI, the Singapore AISI / Digital Trust Centre at NTU, Japan AISI, Korea AISI, Canada AISI, India AISI, the EU AI Office, France INESIA, the US Center for AI Standards and Innovation. Anthropic, Google DeepMind, OpenAI, Meta, Microsoft, DeepSeek, Stepfun, Ant Ling, Reflection, Arcee, Shanghai AI Lab, Zhipu, Moonshot, Qwen, Mistral, Cohere, and others.

Model makers participate as provider partners under a separate users’ agreement, not as voting members. This is the most important governance choice in the design. Frontier labs are commercial competitors; independent evaluators and national institutes are not. Seating commercial competitors at the same voting table guarantees deadlock, so APSCI does not seat them. Philanthropic funders sit on the board as funding members without workload-allocation authority.

China-side institutional partner

The proposal needs an institutional partner inside China; not a frontier lab, but an academic and policy organization with credibility on both sides of the Pacific that can liaise with Chinese-lab safety teams, route Chinese-academic researchers into APSCI’s fellowship pipeline, and serve as a Beijing-side reference point for the project.

Concordia AI is the natural candidate. Brian Tse’s organization has been the most consistent China-side participant in international AI safety dialogue since 2020. It convenes the International Dialogues on AI Safety series alongside FAR.AI, has published the most-cited English-language analyses of Chinese AI safety institutional capacity, and has the trust of both Chinese-lab safety researchers and the Western AI safety community. APSCI’s China-side institutional partner role is theirs to take, and the paper assumes Concordia in that role unless the consortium-formation process produces a stronger alternative.

Operations

APSCI commits to three operational rules that, taken together, make it a verifiably safety-only facility rather than another general-purpose AI compute cluster. The rules are designed to be checked by independent auditors, not just promised by the operator.

First, APSCI never holds proprietary model weights.

The most urgent safety work in AI happens in two places: closed state-of-the-art models, and capable open models. APSCI commits to studying both groups without ever having to deal with closed model weights on a server outside of the lab’s control. The compute APSCI provides is for running safety workloads against those models, not for hosting the models themselves.

This dissolves the entire problem set that has prevented every previous attempt at multilateral AI safety infrastructure: weight-security risk, export-control exposure tied to proprietary weights, intellectual-property leakage, the IGAA-style sandboxed-operator legal architecture, and the political question of whether to seat US and Chinese labs at the same governance table.

If a model is already public, there is no proprietary weight to lose, no IP question to argue about, and no asymmetric trust required to host the research. If a closed-weight model is accessed through the lab’s own API, the weights never leave the lab’s infrastructure and APSCI’s legal exposure on those weights is no greater than any other safety evaluator’s.

The architectural choice is permissive on what work can be done. The vast majority of safety testing (evaluation, red-teaming, capability elicitation, dangerous-capability assessment across CBRN/cyber/autonomy/persuasion threat surfaces, scalable-oversight experiments, behavioral robustness work) is input-output research that needs an inference endpoint, not weight access.

METR’s RE-Bench, the UK AISI Inspect framework, Apollo’s scheming evals, the WMDP and Cybench and HarmBench benchmarks, and the CAISI evaluations Anthropic itself cites all fit inside this category. Mechanistic interpretability research is more compute-intensive and does need weight access for the model under study, but as practiced by the external research community it already happens almost exclusively on open-weight models: Gemma Scope on Gemma 2, EleutherAI’s work on Pythia and OLMo, Goodfire’s commercial interpretability on open models, and MATS scholars on the open-weight frontier. The interpretability work that does happen on closed weights (Anthropic’s Scaling Monosemanticity on Claude 3 Sonnet, OpenAI’s SAE work on GPT-4) is done by the labs themselves on their own infrastructure, and would stay there regardless of whether APSCI existed.

This approach gives APSCI political tractability and a very quick path to being the default place Chinese labs will go to do safety work.

Second, compute cannot be used to upgrade an AI model.

Researchers can run an uploaded model, observe how it behaves under different conditions, and study its internals where the weights are public. They cannot use APSCI to produce a stronger fine-tuned version of an open-weight model and walk out with it. Training the next generation of models, even from an open-weight starting point, is not what this cluster is for. The job scheduler refuses tasks that amount to training; rate limits and workload review prevent the same researcher from running, in sequence, the disguised equivalent of a training run. APSCI is built for analysis. A training job produces a new model artifact, and the absence of that artifact at every job’s completion is the verifiable proof that no training occurred.

Third, every job is on the public record within ninety days.

APSCI publishes a continuously updated ledger of every research task it runs: which lab submitted it, which model it studied, how much compute it consumed, and what category of work it was. The default disposition for findings is open publication on the ninety-day clock, modeled on CERN’s open-data policy for high-energy physics.

Findings that meet biosecurity-style “dangerous to disclose” criteria adapted from the National Institutes of Health’s existing framework for Dual-Use Research of Concern, which has handled the same problem in life sciences for two decades, can be embargoed by an independent review committee; the existence of the embargo and its target resolution date are themselves published.

No work happens at APSCI in secret. That transparency commitment is the structural feature distinguishing APSCI from any commercial AI compute facility, and is what makes the safety-only mission verifiable to outside auditors, foreign partners, and the international community that would rely on the facility’s findings.

The potential for abuse will always exist. The goal is to make the effort of obfuscating capability work both expensive and time-consuming compared to renting GPUs from another provider.

Legal architecture and the questions counsel will ask

A serious proposal does not pretend the legal questions have been answered. APSCI’s launch documents include three legal opinions that any participating lab’s general counsel will demand to see before authorizing engagement.

The first is a US Bureau of Industry and Security opinion on whether the compute hardware exported to the Singapore operator falls inside or outside any future replacement to the rescinded AI Diffusion Rule, and on what comfort the operator’s single-entity Validated End User authorization provides against the diversion-risk framing that has attached to Singapore since the 2025 DeepSeek prosecution.

The second is a Singapore Companies Act and Charities Act opinion on the operating entity’s governance, charitable status, and tax treatment under the AI Verify Foundation legal model with independent ownership rather than a wholly-owned-subsidiary structure.

The third, the load-bearing one for Chinese-lab participation, is a US Entity List opinion on whether a Chinese frontier lab’s participation in APSCI, in any of the protocol’s defined roles, creates Entity List exposure for the lab itself, for its individual researchers, or for APSCI. The current Entity List treatment of academic and safety-research engagement is narrower than the political conversation suggests, but no Chinese-lab general counsel will accept a verbal assurance on this point. APSCI commits to publishing the formal legal opinion in its launch documents.

Location, Location, Location

Singapore is the best position to host because of intellectual, institutional, financial, and political preconditions.

Singapore has robust AI safety institutions already, and has been host to much of the most important work done in the field. It began one of the earliest sector-specific AI governance regimes in 2018 and has developed deep expertise over this eight-year period. Many of these institutions share staff, leadership, and talent, which makes the addition of another venture here, providing compute, indisputably good for the rest of the ecosystem.

The Singapore Consensus in particular is an example of work already done to make this compute cluster relevant. With 88 authors and an explicit thesis on how AI safety should be managed, it describes a brilliant research agenda without describing the compute facility that would allow that research to proceed. APSCI is the facility and compute that can execute that vision.

Geopolitically, Singapore has been remarkably resistant to the U.S.-China tensions that have narrowed the host-country list. Its national AI strategy and the accompanying $740 million envelope list sovereign compute as a priority, meaning ideas like this are already notably important to the development of the Singaporean state’s AI policy.

We’ve Been Here Before

In the sixties, Abdus Salam founded the International Centre for Theoretical Physics in Trieste, Italy. His diagnosis was that the world’s frontier physics was being done in three or four laboratories, all in countries that could afford to host them, and that the talented theoretical physicists not in those labs were not able to access the resources they needed to succeed.

A similar diagnosis applies to AI today. The top 10 labs in both the US and China control a vast amount of both talent and compute, and the “home” for researchers who want to do good work in safety is terribly difficult to find. Countries like the UK who want to support AI Safety work have no problem outlaying for salaries (a line item states are not unfamiliar with) but balk at the costs incurred in purchasing millions or billions of dollars of compute.

ICTP did not require GPU procurement, and the scale also does not transfer directly: ICTP started at roughly $300,000 in 1964, perhaps $3 million in 2026 dollars, against APSCI’s Phase 1 pilot at $20–50 million. Frontier-model interpretability is dramatically more compute-intensive than 1960s theoretical physics.

Trade-offs

APSCI works only if each participant sees a concrete trade worth the risk. The trades are described below. Every gain is paired with the concession that pays for it.

Governments. Singapore would gain a credible claim to the Geneva-of-AI position it has spent half a decade building toward and a multilateral institution sited under Singapore law. Singapore’s concession is sharing institutional control with a multinational consortium rather than running the facility through an IMDA-subsidiary structure. The United Kingdom would gain a scaling of the Alignment Project model that its AI Security Institute already proved at twenty-seven million pounds; its concession is sharing the multilateral safety-institute mantle it presently holds essentially alone. Japan, Korea, and India would gain Asia-Pacific safety-research presence their bilateral relationships have not produced; their concession is alignment on governance choices that may at the margins constrain their own AI policy autonomy. Australia, Canada, France, Germany, the EU, and Switzerland would gain participation in the first serious Asia-Pacific multilateral AI venue without having to host it. The United States, if it joins as a consortium member when its political position permits, would gain transparent safety research on the open-weight Chinese frontier models that the Anthropic 2028 paper itself identifies as a concern, produced under a public ledger that no bilateral channel currently delivers. The US’s Phase 1 ask is narrower: BIS comfort that compute hardware exported to the Singapore operator is not subject to diversion. Phase 1 launches whether or not US-state consortium membership materializes; CAISI participates bilaterally as a workload partner.

The Chinese-side participation problem is dramatically smaller under the open-weight architecture than it was under the closed-weight one. The Chinese open-weight frontier is publicly downloadable today. APSCI hosting these models on its cluster is legally and politically identical to hosting Llama or Gemma. No Cyberspace Administration of China approval is required, and no Entity List exposure attaches to APSCI for studying publicly-released models. The structural barriers are dramatically lower than under any closed-weight architecture: compute in China is at a premium, and this type of coalition is exactly what Chinese open-weight labs need to ensure safety research scales with their models.

Frontier laboratories participate as workload providers in two modes. Open-weight model developers gain external safety research on their models at a scale they cannot fund internally. As API providers for closed-weight models (Anthropic on Claude, OpenAI on GPT, Google DeepMind on Gemini) they gain external evaluation against a published-by-default ledger that lets them ship safety claims their customers can verify, without ceding control of the model itself.

Anthropic’s case under the open-weight architecture is much easier than it was. Anthropic does not have to upload Claude to a multilateral facility, the “Chinese lab at the same governance table” concern disappears because the Chinese participation is in open-weight model studies that Anthropic researchers can themselves run, and the recent Pentagon supply-chain-risk designation gives Anthropic a strategic reason to invest in international institutional legitimacy. The concession for every frontier lab is the transparency burden: external evaluation results on their models are published on the ninety-day ledger by default.

Independent evaluators and the AISI Network. METR, Apollo Research, MATS, FAR.AI, and the dozen-plus AI Safety Institutes gain a meaningful multiple on the operational compute available against the binding constraints they have all stated publicly. METR-grade evaluation campaigns can run more often and against more frontier models. Apollo can run scheming and deception evaluations against new model releases on a faster cycle. MATS fellows can do interpretability work at scales beyond the current $8K-per-month ceiling. The AISI Network gains the compute it has lacked since founding. Their concession is shared governance and the loss of single-institution control over research direction, and competition for compute between model labs and safety orgs.

The Funding Path

Days ago Anthropic raised at a trillion-dollar valuation, and as they move to IPO there will be a very large number of philanthropic dollars seeking a place to have impact in the safety ecosystem.

Acquiring compute is a difficult use of philanthropic funds for many donors who are used to allocating against salaries or infrastructure. Understanding the value of compute is tremendously difficult for anybody who’s not coming from an AI background.

The wave of coming IPOs will change this math. For the first time in history, it will be viable to raise philanthropic dollars to buy compute, and this opportunity will unlock significant funds for initiatives such as APSCI.

Certain organizations inside the space, like Renaissance Philanthropy, will be positioned well to organize these dollars and deploy them into trusted sources. Their main point of contact will be Singapore, and I believe that similar organizations will play the parallel role in the United States.

Fundraising should happen in two phases: an initial 1,000 GPUs rented, scaling to 5,000 in a dedicated facility within one year. As difficult as it is to allocate philanthropic dollars to GPUs, it has one massive advantage: if the underlying premise is proven to be false, the GPUs still have value.

Avoiding a multi-year treaty process is important; government affiliations represent an opportunity for researchers to drive the conversation about access to compute. Singapore covering in-kind space, ops support, and other necessities will be key. This is plausible within a 12- to 18-month launch window if the political alignment remains as it is today.

Moving from 5,000 to 25,000 H200-equivalent GPUs will be a difficult task, however the project will be successful at the 5,000 level. Should funding prove difficult, sovereign bridge debt and philanthropic continuation with compute providers doing an in-kind structure could be possible.

With Microsoft spending eighty billion, xAI having spent three or four on Colossus alone, and OpenAI and Anthropic spending hundreds of billions in the coming years, this eye-popping amount of money is relatively modest in the larger compute conversation. Pegging the total number of GPUs at three to five percent of total compute allocation planet-wide, these numbers are modest and achievable.

The institution that does safety research at planetary scale costs approximately two to three percent of the institutions that do capability research at planetary scale. The argument for this specific 2–3 percent ratio is that a credible eval program needs to keep pace with the capability frontier without requiring labs to self-allocate safety compute against their capability roadmap. At substantially less, safety falls behind. At substantially more, the marginal safety compute exceeds the binding methodological capacity of the field. The exact ratio is defensible within a factor of two; the order of magnitude is what matters. The scale mismatch is what this paper is asking funders to correct.

The Four Tests

The case for APSCI does not rest on any single forecast. It rests on the institution being net-positive in expectation across the following four tests. No one test individually is necessary, but together they describe a portfolio of outcomes that condition the value of the cluster.

The compute-diffusion test. Phase 1 lands as designed and produces a measurable expansion of global safety research output by Year 3. Year 1 indicators: thirty or more researchers from six or more countries with active access; eight or more published frontier-model evaluations; five or more interpretability projects on the open-weight frontier. Year 3 indicators: one hundred and fifty or more researchers; published dangerous-capability evaluations cited in three or more frontier-lab Responsible Scaling Policy disclosures. Counterpart failure: workloads run, publications appear, and nothing in the field changes. Mitigation: pre-committed lighthouse work from METR, Apollo, and the UK AISI in the first six months, funded explicitly to produce field-shifting results in Year 1.

The methodological-convergence test. Co-presence on shared infrastructure forces methodological standardization. By Year 3, the METR autonomy harness, the UK AISI Inspect framework, and the Apollo scheming evaluation suite are a reproducible reference bundle for models evaluated on APSCI, used by participating labs in their own pre-deployment safety claims. The Frontier AI Safety Commitments framework that labs already signed becomes operational because compliance is now an artifact anyone can rerun. Counterpart failure: labs treat APSCI as a publication venue rather than as their primary safety-research environment. Mitigation: the evaluator-led governance choice that put labs outside the voting consortium.

The diplomatic-relief-valve test. A working multilateral safety venue de-escalates the compute-denial-versus-cooperation framing. Observable Year 3 indicators: number of Chinese-affiliated principal investigators with active access; number of Chinese open-weight model safety evaluations published on APSCI; presence of Shanghai AI Lab, Zhipu, Moonshot, DeepSeek, MiniMax and others as workload partners; APSCI cited in Chinese-government AI safety statements. Counterpart failure: Chinese labs do not engage even with the open-weight architecture. Mitigation: APSCI is designed to be valuable independent of Chinese-lab engagement; the Western, Asia-Pacific allied, and academic safety communities are themselves compute-constrained.

The hub-formation test. Phase 2 succeeds in seeding Singapore as the AI safety hub it has been positioning itself to become. By Year 3 Singapore hosts a meaningful operational role within the AISI Network. Counterpart failure: APSCI never moves beyond Phase 1, Phase 2 deferred indefinitely. Mitigation: Phase 2 is an option held until Year 2 utilization data is in, not a Year 0 commitment.

Across the four tests, the probability-weighted Year 5 outcome, calibrated across the eight scenarios analyzed in the supporting research dossier, is net-positive. The Phase 1 pilot is justified by expected value at its $20–50 million scale. The Phase 2 commitment is an option that should be exercised only when Year 2 utilization data confirms the field’s response.

If Only This Much Is Possible

The political envelope may narrow before the full Phase 1 Tier A is funded. If it does, the smallest viable version of the proposal is a $10–15 million six-month proof-of-concept hosted as an AI Verify Foundation workstream rather than as a new entity. Two hundred and fifty to five hundred H200-equivalent GPUs. The single guardrail is the public ledger. A three-party consortium: Singapore (host through AI Verify Foundation), one open-weight model provider (Google DeepMind on Gemma is the lowest-friction first candidate), and one independent evaluator (METR). Branded as the Alignment Project, Asia-Pacific Chapter rather than as a new institution.

This fallback is meaningfully less valuable than the full proposal. It cannot host an AISI Network workstream, cannot anchor the diplomatic-relief-valve argument, and cannot accommodate the breadth of model coverage from China. But it preserves the core compute-diffusion thesis, validates the operational concept, and creates the institutional substrate from which the full APSCI can be re-launched.

Closing

The compute that frontier-AI safety research requires is available. The funding to assemble a credible safety-only cluster is coming online. The precedents for the funder coalition, the legal structure, the multilateral governance, the operational architecture, and the host country exist. The community that would populate the institution is converging on Singapore, and the political moment that we are living through suggests it as a good landing place.

The hard problems that have stalled previous attempts at multilateral AI safety infrastructure came down to two issues: how to convince funders that GPUs are as important to our shared future as vaccines and malaria nets, and how to structure safety as a global public good, rather than a national project.

Some version of this institution will be built soon, and deliberately choosing to include the open-weight model makers in China is a necessary step in securing a future of safe, responsible AI development.