Who Aligns The Aligners In Coming AI Safety Fights

Have you noticed how quickly a conversation about wonder turns into a conversation about permission? One week the promise is disease research, abundance, and tools that feel almost unfairly capable. The next week the same voices start talking about pacing, embedded overseers, and coordination that only works if someone can force the holdouts. I have sat with that shift long enough to feel uneasy, not because risk is imaginary, but because the proposed cure keeps looking like yesterday’s speech-control machinery with a fresh coat of paint.

The Real Fight Is Not The Slogan

People who build frontier systems often speak with genuine awe. They talk about medical breakthroughs in a handful of years, faster growth, and tools that could widen what ordinary people can do. Then comes the familiar turn. Powerful tools carry serious downside. Some voices go further and treat extinction as the default if the state does not seize the steering wheel. That leap deserves more than applause. It deserves scrutiny.

There is still no settled public evidence that the only sane reply is total political command of research, publication, and compute. You could invent other extreme replies just as easily. Force open weights so every household has a defensive model. Or, if you truly believe the end of the species is around the corner, demand a treaty that smashes modern computing and locks the world in analog amber. Those options sound wild because they are. So is the claim that one office, one consortium, or one moral mood should hold the keys.

History is a poor guide to the exact shape of a new machine. It is an excellent guide to how states behave when they are handed vague safety mandates. In my experience, the moment “voluntary” becomes “covering those unwilling to cooperate,” you are no longer discussing manners. You are discussing coercion.

Pacing Sounds Gentle Until It Needs A Badge

A company can always slow itself. That part is easy and honest. Ship later. Train less. Publish fewer weights. What some frontier labs now float is different. Slow everyone together, then harden that bargain into law so rivals cannot sprint. The pitch usually has three moving parts: insiders with employee-like access, democratic coordination that needs government cover, and a global layer that tries to pull in governments that do not share your constitution.

Call the first piece embedded evaluators. Third parties sit inside training pipelines, check commitments, report incidents, and judge not only finished models but the process that made them. Banking supervisors get cited as precedent. The comparison is tidy on a slide and sloppy in court. Accounting fraud is not a protected act of expression. Writing software, publishing code, and hosting tools often are, at least in the United States when there is no intent to commit a crime.

Safety language travels well. Safety power travels even better, and it rarely stays where the brochure said it would.

We already watched a version of this movie in the last decade of platform governance. Private alliances wrote brand-safety floors. They coordinated pressure. Firms that played along were treated as responsible. Firms that refused discovered how quickly a “voluntary” standard can grow teeth. I do not need a conspiracy board to see the incentive. If the evaluator can summon boycotts, licenses, or fines, the evaluation is no longer a peer review. It is a veto dressed as diligence.

Perhaps the most interesting aspect is access. Employee-like rights inside training systems are not a polite visitor badge. They are a window into unpublished research, incident logs, and unfinished ideas. Hand that window to groups that answer to political weather and you have created a new kind of leak surface. Not only of secrets. Of priorities.

When Coordination Looks Like A Cartel With Better Branding

The second piece is industry alignment among labs in democratic countries. Common safety floors. Caps on how fast unchecked progress may run. Some of that coordination is legally awkward on purpose. Pricing alignment would be obvious. Policy alignment can be subtler and still ugly. Imagine two giants matching API terms so that any outside model which “defects” from the club standard cannot talk to their stack. That is not a seminar. That is market design.

Asking for government support to make the awkward parts legal is another way of asking for an antitrust hall pass. On a global map that pass would need many signatures. Some capitals already like the idea of a slowdown. Others will smile, take notes, and keep training. I have found that people underweight the second group. They treat geopolitics like a faculty meeting.

There is also a content problem hiding inside the process problem. “Common safety standards” can mean factory floors and bio labs. It can also mean what a model is allowed to say, summarize, or refuse. Once you write limits on the rate of software development itself, you are no longer only regulating a blast furnace. You are regulating an act of authorship. American case law has spent decades treating code, publication, and hosting as expressive in ways that many allied governments simply do not.

• A lab may bind itself without asking a legislature for help.
• A club of labs binding rivals starts to look like market allocation.
• A state binding publication speed walks into speech doctrine.
• A treaty binding authoritarian rivals still needs verification that nobody can honestly promise.

That last point is not a footnote. It is the hole in the boat.

Global Harmonization Meets The Defector

The third piece is the grandest and the weakest. Democracies try to coordinate with governments that do not share their theory of rights, while “taking seriously” the problem of checking compliance. I will be blunt. If the scheme needs near-universal obedience to work, a single serious defector starts to unwind the deterrent. The higher the claimed stakes, the sweeter the prize for the party that keeps training in the dark.

We already live inside a patchwork built for the last generation of networked speech. After political shocks in the mid-2010s, several wealthy democracies wrote sweeping online rules in the name of harm reduction. The branding was safety. The mechanism was often extraterritorial pressure on American firms: age gates, takedown duties, ruinous fines, and the quiet hope that a company with local revenue would rather sanitize a feed than fight.

Users noticed. Millions reached for simple workarounds. A free tunnel and a foreign exit address can dissolve a great deal of local paternalism. That fact does not make every harm imaginary. It does show that a rule which only bites the visible, deep-pocketed, non-judgment-proof company is not a physics law. It is a tax on the compliant.

Now copy that template onto models, weights, and training runs. The same ministries, the same advocacy networks, and often the same vocabulary will try to expand the remit. They will not need a decade to find the search-and-replace. Online safety becomes AI safety. The staffing charts barely move.

A framework that cannot bind the unreachable will be enforced most fiercely against the reachable. That is not strategy. That is gravity.

Protecting a national lead while inviting a global slowdown is a hard circle to square. Adversaries who already treat compute as a strategic asset have little reason to volunteer for your audit. Near-term compliance on that frontier will not be “imperfect.” It may be theatrical.

Regulators Are People Under Pressure

If I have learned anything from watching speech fights across the Atlantic, it is this. Independent-sounding agencies still live inside politics. They open files when the mood demands a scalp. They reopen files when activists say the first ending was too soft. They stretch facts when a geoblock was accepted and then treated as inadequate because staff walked around it. They announce penalties that everyone in the room knows cannot be collected, because the announcement itself is the product.

I am not asking you to love every website that becomes a test case. I am asking you to watch the sequence. Lobbying creates the statute. The statute creates the file. Pressure reverses a settlement. Circumvention manufactures new “evidence.” Escalation continues after the legal reality is obvious to any sober lawyer. That is not a science experiment. That is a political act with letterhead.

Now imagine that habit with employee-like access to a training cluster. The evaluator will not only be fallible. The evaluator will be incentivized. Careers will attach to findings. Headlines will attach to incidents. A quiet close will look like weakness. A loud demand will look like courage. Humans respond to that music. They always have.

Speech Doctrine Is Not A Lifestyle Preference

In the United States, the development and publication of software, absent criminal purpose, sits closer to the First Amendment than many foreign statutes are willing to admit. That is not a vibe. It is a stack of cases and a statute that grew out of ugly fights about who may carry other people’s words. Allied governments can legislate pacing with fewer guardrails. That does not make their model exportable without a collision.

Restricting citizens from building models, or from using openly published weights that originated abroad, raises the issue immediately. You can dress the restriction as compute policy, export control, or safety evaluation. Courts still know a prior restraint when they see one reaching for a printing press that happens to be made of matrices.

Foreign rulesets will be drafted on different moral math. Age gating, viewpoint duties, and administrative takedowns that would fail at home will be treated as ordinary hygiene elsewhere. An American firm told to satisfy both masters will discover that full constitutional scope and full foreign compliance do not occupy the same room. Someone will be asked to shrink.

Apocalypse Rhetoric Narrows The Menu Too Fast

Some advocates speak as if delay is the only adult position and every other position is a death wish. That rhetorical move is effective. It is also a way to skip the part where a free society argues about means. If the claim is truly extinction, why stop at licensing labs? Why not the full stack of civil liberties that make rapid research possible? The fact that even many alarmists flinch from that conclusion should tell you the certainty is performing a job.

I do not mock the possibility of severe misuse. Cyber offense, bio assistance, mass fraud, and automated influence campaigns are not science fiction. Those are design and enforcement problems that can be attacked without pretending that a ministry is a better philosopher-king than a messy open culture. Popular consent still matters. Careful deliberation still matters. One movement does not get to declare the argument closed because the adjective “existential” was used in a thread.

Apocalyptic forecasts about new tools have a long losing streak. That streak does not prove the next forecast false. It does prove that panic is a weak method for writing durable law. Durable law has to survive contact with defectors, courts, and voters who eventually notice what “safety” took from them.

The Censorship Industrial Reflex

There is already a professional class that spent years building evaluation regimes for feeds and ads. Some of those people now staff lab safety teams. Some staff agencies. Some staff the nonprofits that brief both. Philosophical descendants are not a punchline. They are a hiring pipeline. If you expect that pipeline to invent a lighter touch this time, you are more optimistic than I am.

The methods rhyme. Framework documents. Shared taxonomies of harm. Third-party scores. Threats that never need to say the word censorship out loud. Platforms that accept the score keep their air cover. Platforms that do not discover that the air cover was the product. Replace “brand safety” with “model alignment” and you can reuse the binders.

I’ve found that the public only turns after implementation becomes visible in daily life. Abstract safety polls well. Identity checks, overblocking, and official taste-making poll worse once people live inside them. Waiting for that delayed backlash is a luxury the next fight may not offer. The last counteroffensive against broad web controls took years to organize. Model regulation can be sketched in months.

What A Serious Alternative Would Admit

None of this requires pretending models are toys. It requires separating categories that keep getting mashed together.

1. Criminal use should remain criminal, with ordinary predicates and proof.
2. Lab-specific commitments can be contractual and transparent without deputizing political NGOs as co-CEOs.
3. Export controls and classified work already exist for a reason and should not be laundered into a general speech code.
4. Open evaluation can happen on released artifacts without employee-like rights over unpublished thought.
5. Democratic argument should happen in public statutes, not in club standards that later demand immunity from competition law.

That list is not a complete constitution. It is a way to keep the conversation from collapsing into “trust us, the vibes are lethal.” If a lab wants to pause, pause. If a lab wants outside red-teamers on a finished checkpoint, hire them under a real contract with real limits. If a legislature wants to act, it should write text that can survive a court that still remembers why prior restraints are disfavored.

A “Second Amendment for models” metaphor will strike some readers as unserious. Fine. Sit with the underlying point anyway. If the danger is other people’s systems, concentrating capability in a few audited temples is not the only defensive theory. Distributed competence has a logic of its own. You do not have to adopt that logic wholesale to notice that the official conversation rarely gives it a fair hearing.

Verification Is Not A Side Quest

Every global plan eventually arrives at the same awkward sentence. We will verify compliance. How? With inspectors who are not allowed into the buildings that matter? With chip-location fantasies that assume no secondary markets? With paperwork from parties who gain by lying? Safety literature loves diagrams. Reality loves warehouses, shell companies, and national pride.

The same verification problem appears inside democracies, just wearing nicer shoes. An embedded team can be captured, excluded from the real run, or flooded with theater. A standards body can grade friends gently. A regulator can treat VPN access as proof that a block failed after previously accepting the block. Process is not a substitute for incentives. Incentives are the process.

A rough honesty check:
  If a rule only binds the visible firm, it is a tax.
  If a rule cannot detect the hidden run, it is a speech.
  If a rule needs an exemption from competition law, it is a cartel request.
  If a rule needs foreign taste to override domestic rights, it is a collision.

Who Watches The People Who Claim To Watch The Models

That is the title question, and it is not cute. Alignment is a technical research program and a political slogan at the same time. Mixing the two without a referee is how you get moral language doing administrative work. The aligners will be hired, funded, briefed, and praised by institutions that have preferences. Those preferences will leak into what counts as a “safe” refusal, a “responsible” delay, and an “unacceptable” release.

Ask simple questions and keep asking them. Who appoints the evaluators? Who pays them? Who reads their sealed memos? What happens when their findings threaten a national champion? What happens when their findings threaten a favored narrative rather than a munition? If the answers are vague, the regime is not mature. It is a wish.

I would rather live with messy competition plus targeted enforcement than with a polite oligopoly that congratulates itself for slowing the only actors it can reach. Messy competition produces accidents. Concentrated permission produces a different accident: official truth with a research budget.

Time Is The Hidden Constraint

Policy people talk as if the calendar will wait for a perfect treaty. Builders will not wait. Open weights will not wait. Foreign labs will not wait. Advocacy shops will not wait either. They will arrive in hearings with ready language and a claim that delay is violence. If companies with the loudest safety brands formally bless prior restraint as corporate theology, opponents of that theology cannot treat the next two years like a seminar series.

Move in public. Argue in plain words. Separate crime from taste. Separate lab prudence from state monopoly. Separate evaluation of artifacts from occupation of the workshop. None of that is anti-safety. It is anti-amnesia. We have already seen what happens when a generation of officials decide that publication is too important to be left to publishers.

The next apparatus will be faster because the last one left scaffolding. That is the uncomfortable news. The slightly better news is that constitutional muscle memory still exists in one large jurisdiction, and courts still know how to read a statute that tries to govern code as if it were a boiler. Use that. Do not donate it in the name of a pacing metaphor.

Wonder and permission will keep colliding. The collision is not a reason to hand the most powerful analysis tools to the institution with the worst historical record as a custodian of speech. Risk is real. So is the habit of answering risk with a commissar. If we cannot tell those two facts apart, we will pace ourselves into a smaller country than we meant to keep.