Skip to content

Right Place, Wrong User: Why AI Chip Location Verification Needs Attestation

chip security concept

On December 3, the Senate Banking Committee will hold a hearing on chip smuggling and adversary military use of advanced AI chips. The case behind it is Megaspeed, a Singapore-based cloud operator that has bought more than $4.8 billion of Nvidia's high-end AI chips in two years. US and Singaporean authorities are examining whether it served as a conduit for restricted compute to China. Megaspeed denies wrongdoing.

Whatever the investigations conclude, the case has already taught one lesson. Export controls today rest on paperwork and periodic site visits. Neither gives a regulator real-time, cryptographic evidence of where a chip is and who is using it.

That is a solvable engineering problem. Much of the technology needed already runs at scale in another domain: mobile app and API security.

The Gap: Right place, Wrong User

Nvidia has said its staff repeatedly visited Megaspeed's facilities and confirmed the GPUs were where they were supposed to be. That may well be true. It may also miss the point.

Reporting indicates the chips sit in data centers in Malaysia and Indonesia, and that Chinese entities reached them through cloud infrastructure. Serving overseas customers remotely is not necessarily illegal. It becomes unlawful when done on behalf of a restricted end user. A site visit can confirm a rack is in Malaysia. It cannot confirm who submitted the training job.

Counting is hard too. Bloomberg reported that Nvidia's tally of chips sold to Megaspeed through partners ran about 50,000 units short. When the best-informed party in the supply chain cannot reconcile the count, the problem is not diligence. It is the absence of a verifiable signal from the chip itself.

The Center for Security and Emerging Technology (CSET) names this risk directly: end-user obfuscation. Chips stay in an approved facility while control passes to someone who should not have it. Location verification alone cannot see it.

What the Policy Community Already Agrees on

There is more consensus here than the headlines suggest.

  • Ping-based location verification works. CSET's report on tracking AI chips finds ping-based location verification (PLV) the most robust geolocation method against adversarial attack. Chips answer signed challenges from trusted landmark servers, and round-trip times bound their location. CSET estimates 39 to 500 landmark servers, giving region- to city-level accuracy.
  • One party should own the record. CSET recommends centralizing reporting in a single entity over a chip's lifecycle: BIS, a BIS-certified third-party auditor, or the chip designer.
  • Congress wants it mandated. The bipartisan Chip Security Act (H.R. 3447 / S. 1705) would require location verification on export-controlled chips within 180 days of enactment. The House bill cleared the Foreign Affairs Committee 42–0 in June.
  • Industry has started. Nvidia has built an opt-in fleet-management agent that uses GPU attestation data and network latency to estimate which country a chip is running in.

So the question is no longer whether chips can be located. It is whether the evidence is strong enough to enforce against, and whether it covers who is using a chip, not just where it sits.

The Missing Layer: independent Attestation

Location verification answers one question: where is this chip? Enforcement needs three answers, each backed by cryptographic evidence rather than self-reporting.

  1. Is this the genuine chip, running unmodified firmware? Before a chip's reply to a landmark ping counts, an independent service checks a signed measurement of its firmware and host environment. A re-flashed chip, an emulator, or a relay forwarding pings from elsewhere fails, and its report is discarded. CSET makes the same point: a PLV system's security depends mainly on how landmark servers authenticate the messages chips send.
  2. Is it the same hardware, in the same place, as last time? A stable hardware identity, derived from several device characteristics rather than one serial number, lets the reporting server see chips moved between hosts, cards swapped into new chassis, or clusters rebuilt elsewhere. A change is not proof of wrongdoing. It triggers review.
  3. Who is using it? This is the layer that addresses Megaspeed-style risk. Access to controlled compute (the job scheduler, the orchestration API, the remote console) is gated by short-lived tokens. Those tokens go only to attested clients bound to a known, licensed customer. Usage without a valid token, or from a token tied to an unapproved end user, is visible to the reporting server.

The second and third checks matter for chips without a trusted execution environment, which make up much of the installed base. A hardware-derived identity and an attested access path give regulators a usable signal even where on-chip signing is not available.

The design keeps one deliberate separation. The chip vendor ships the hooks. An independent verifier runs attestation and reporting under BIS rules. No party grades its own homework.

Landmark servers time only attested chips, and customers reach the chips only through attested tokens. The reporting server sees location, hardware identity and usage together.

What Mobile Security Already Proved

This is not a speculative design. It is how the mobile industry learned to trust software running on hardware it does not control.

Mobile apps run on phones owned by strangers. Some root the device, run the app in an emulator, or hook its code at runtime to impersonate it. For years, defenders tried to detect this from inside the app, and attackers with physical control of the device kept winning. What worked was moving the decision off the device. The app proves its integrity to a cloud attestation service, which issues a short-lived token that backend APIs require. A compromised client cannot obtain a valid token, so the API never has to trust it.

Approov has run this model in production for years. Three of its properties carry over directly to AI chips:

  • Decisions are made in the cloud, not on the device. Detection and policy can be updated against new attacks without touching firmware in the field.
  • Proofs are short-lived. A clone or relay cannot replay yesterday's evidence.
  • No personal data. Device identity is derived from hardware characteristics and carries no personal information, which matters to allied governments and cloud operators wary of surveillance.

An AI accelerator in a rack in a third country is the same problem at far higher stakes: valuable hardware, outside the owner's physical control, run by parties who may want to misrepresent it.

A Win for Every Stakeholder

Verification is often framed as a burden on industry. Designed well, it is what lets legitimate trade grow.

  • Chip vendors get a defensible answer when a customer's conduct is questioned, without having to police their own customers. Independent evidence protects their reputation and their licenses.
  • Commerce and BIS get enforceable, machine-generated evidence in place of paperwork and site visits, and a workable way to implement the Chip Security Act.
  • Treasury and other enforcement agencies get a shared, auditable record to support sanctions and investigations.
  • Legitimate cloud operators in Southeast Asia, the Gulf and elsewhere get a way to prove compliance continuously. That is the difference between being trusted and being presumed guilty.
  • Allied governments get assurance without surveillance: integrity and location reports, no personal data, and no remote kill switches.
  • Congress gets a mandate that can actually be implemented, rather than a 180-day deadline with no defined mechanism.

The Atlantic Council has argued that location verification could be the basis for “trusted trade” with US partners. Wherever policymakers draw the line on which chips go where, that line holds only if it can be verified.

What Will This not Do?

No security system is unbreakable, and claiming otherwise would weaken the case.

  • Physical access remains a threat. A well-resourced actor with hands on the rack can attack hardware directly. Attestation raises the cost and shortens the window. Because checks run continuously in the cloud, a successful break shows up as an anomaly rather than silence.
  • Access controls are only as good as the identity checks behind them. A front company with a clean license can still obtain valid tokens. What changes is that misuse leaves a cryptographic trail tied to a named licensee.
  • Chips can go dark. A chip taken permanently offline cannot be tracked. Under a PLV regime, going dark is itself the alert.
  • It complements enforcement, not replaces it. Licensing, end-use checks and intelligence work still matter.

CSET warns that if inventory software is broken once, an attacker could likely forge ownership reports for large numbers of chips. That is the strongest argument for keeping verification decisions in an independently run cloud service that can be updated as attacks evolve.

What Should Happen Next?

  1. Standards first. CSET recommends that NIST lead a standard protocol for chip-to-landmark communication. Attestation of firmware integrity, hardware identity and access paths should be part of that standard from the start, not bolted on later.
  2. Independent operation. A BIS-certified third party, separate from chip vendors and cloud operators, should run the reporting service.
  3. Pilot on existing infrastructure. Global cloud and edge networks already have points of presence in most of the data center hubs CSET identifies. A pilot with one willing vendor and a few licensed overseas operators could run in months, not years.
  4. Cover the installed base. Hardware-derived identity and attested access can bring older chips without trusted execution environments (TEEs) into scope now.

The Megaspeed investigations will run their course. The policy lesson does not need to wait for them. Export controls are only as strong as our ability to verify them, and the tools to do that are ready to be adapted.

 

Sources

 
, , ,
Ted Miracco

CEO of Approov
Ted’s high-technology experience spans 30 years in cybersecurity, electronic design automation (EDA), RF/microwave circuit design, semiconductors, and defense electronics.

Popular Posts

See all blogs