> To help curb the issue, the country is turning to location verification. Last March, the U.S. House Foreign Affairs Committee passed a bill requiring location verification for advanced AI chips. Ahead of the U.S.-China summit in late September, legislators called for a floor vote on that and related bills.
The passed bill is the Chip Security Act. I wonder if the senate will wait until the midterm elects take office before holding a floor vote on the bill.
Nvidia Corp’s general counsel intervened in a US government probe of suspected smuggling of AI chips by Megaspeed International, questioning whether the Trump administration played a role in detaining an executive from the Singapore-based firm who’s now at the heart of a scandal threatening Jensen Huang.
In late summer 2025, Nvidia’s Tim Teter called Commerce Under Secretary Jeffrey Kessler, who oversees US chip export curbs, to ask about the Megaspeed investigation, according to people familiar with the matter.
Specifically, Teter wanted to know whether Kessler’s Bureau of Industry and Security was involved in the Singapore government’s recent detention of Alice Huang, a Megaspeed executive, according to the people. Singapore police had brought Alice in for questioning and restricted her from leaving the country. BIS was not involved in that action, said the people, who spoke on condition of anonymity owing to the sensitivity of the matter.
It doesn't take a Mensa-level IQ to figure out where chips are headed. A company in Singapore run by Chinese nationals, that had less than $6 million in cash at the end of 2023 and then buying over $4 billion in advanced chips between 2024 and 2026, isn't keeping them in Kalamazoo, Malaysia.
Most of the smuggling is a case of see no evil, hear no evil, speak no evil.
> requiring location verification for advanced AI chips
Does.... does anyone in Congress even bother to consult with tech experts anymore? Once the chip is in your competitors hands it's over. No amount of tracking/verification etc. will stop it.
In the case where the network is throttling the messages or not allowing network access at all, the chip's firmware can simply refuse to activate the chip.
Now, that's not to say that this can't be gamed at all. The HFT people know very well that free space radio links are faster than fiber. You could easily just make the datacenter operators put a starlink dish on the roof though, and you can't beat the speed of light.
Now there could be ambiguous situations, such as a country where their only internet connection comes through a banned country. In that case, again, force them to put a starlink on the roof.
You can also require random on-site inspections. In order to have 10,000 GPUs in a datacenter, you'd have to declare them to the government. Not only would they have to report their position regularly, but when the inspectors showed up where they were declared to be, the inspectors would have to find them there. If they didn't, the control organization would just deactivate them. There would be some phone home interval grace period, maybe a day or two, and after that, the GPUs would just stop working until they were re-verified.
> In the case where the network is throttling the messages or not allowing network access at all, the chip's firmware can simply refuse to activate the chip.
A dumb pinging chip has 0 ways to detect network throttling. Especially when it doesn't have admin rights to said network. Also MANY use cases for these GPUs require air-gapped environments to meet compliance requirements. This wouldn't work.
> You can also require random on-site inspections. In order to have 10,000 GPUs in a datacenter, you'd have to declare them to the government.
....So the companies in Shenzhen and Guangzhou need to declare them to the U.S. government or the Chinese government? Who's gonna deactivate them then? The issue being discussed in the article has nothing to do with companies that are within U.S. jurisdiction, it's about companies/individuals outside U.S. jurisdiction.
You can use the network sort of like a GPS. If you have two nodes that can ping each other in a certain time, you multiply that by the speed of light (in the appropriate medium), and that gives you an upper bound on the distance between those nodes. You can draw circles around each beacon node and where they intersect is the possible region that the chip could be living.
If packets are being consistently delayed, the circles get big and the possible region that the chip could be in gets big. If the chip can get a few fast pings in here and there it still works ok though.
It may not be possible to provide chips like this to a truly airgapped datacenter. You could have some special piece of hardware that proxies only the pings, but that is not a true airgap.
The companies in Shenzen and Guangzhou would declare with the U.S. government, or some international organization. Obviously the Chinese government doesn't have to let inspectors into their country, but if they don't, when the GPU goes to get it's cryptographic unlock code for the day, it's not going to arrive and the GPU won't work.
> You can use the network sort of like a GPS. If you have two nodes that can ping each other in a certain time, you multiply that by the speed of light (in the appropriate medium), and that gives you an upper bound on the distance between those nodes. You can draw circles around each beacon node and where they intersect is the possible region that the chip could be living.
You are again assuming good faith actors. How is it going to work when you have a datacenter buried 300m underground surrounded with concrete? How will the signal leave? Better yet, how will you guarantee these GPS chips will stay on the GPU at all? Anyone with a soldering iron and enough know-how will be able to remove them.
> The companies in Shenzen and Guangzhou would declare with the U.S. government,
That's the problem. They won't. Many companies are now moving even their manufacturing out of China not only because of rising labour costs, but getting a judge to fairly arbitrate a dispute is impossible, let alone brokering a "pinky promise" with sensitive technology.
> Obviously the Chinese government doesn't have to let inspectors into their country, but if they don't, when the GPU goes to get it's cryptographic unlock code for the day, it's not going to arrive and the GPU won't work.
I highly recommend reading about CUDA, and how GPUs work then re-evaluate this idea. The issue at hand isn't just that NVIDIA chips are being obtained for use in inference and training, but when you obtain them at 20% supply scale you can unveil manufacturing patterns, secrets etc. that wouldn't be noticeable with only 1 or 2 chips.
You're missing the point. GPS measures distance by seeing how long radio waves take to go from a set of satellites to a receiver. You can do something similar with network packets and timing how long they take to arrive from a set of hosts on the network. If the datacenter is buried under 300m of concrete, then you need a 300m fiber that connects to the internet.
There wouldn't be separate "GPS chips." The ping checking and requirement for a cryptographic unlock code would be part of the GPU die. Of course nothing like this can be completely foolproof but you can make it hard. A soldering iron certainly is not going to help.
I wrote my first CUDA kernel 19 years ago, so I'm familiar. I'm not sure what you mean by the last sentence though.
or, and I'm just spitballing here, you could walk the actual walk about "free markets" as well as talk the talk, and let the chips fall where they may.
On tge other had, isnt thus an "alignment" benefit? Pair this with the fingerprint scheme to track the model, people using nefarious models,naively, then have a xhance to leak theie location.
14 comments
[ 4.6 ms ] story [ 26.3 ms ] threadThis is interesting:
> To help curb the issue, the country is turning to location verification. Last March, the U.S. House Foreign Affairs Committee passed a bill requiring location verification for advanced AI chips. Ahead of the U.S.-China summit in late September, legislators called for a floor vote on that and related bills.
The passed bill is the Chip Security Act. I wonder if the senate will wait until the midterm elects take office before holding a floor vote on the bill.
Per https://theedgemalaysia.com/node/825089:
It doesn't take a Mensa-level IQ to figure out where chips are headed. A company in Singapore run by Chinese nationals, that had less than $6 million in cash at the end of 2023 and then buying over $4 billion in advanced chips between 2024 and 2026, isn't keeping them in Kalamazoo, Malaysia.Most of the smuggling is a case of see no evil, hear no evil, speak no evil.
Does.... does anyone in Congress even bother to consult with tech experts anymore? Once the chip is in your competitors hands it's over. No amount of tracking/verification etc. will stop it.
Now, that's not to say that this can't be gamed at all. The HFT people know very well that free space radio links are faster than fiber. You could easily just make the datacenter operators put a starlink dish on the roof though, and you can't beat the speed of light.
Now there could be ambiguous situations, such as a country where their only internet connection comes through a banned country. In that case, again, force them to put a starlink on the roof.
You can also require random on-site inspections. In order to have 10,000 GPUs in a datacenter, you'd have to declare them to the government. Not only would they have to report their position regularly, but when the inspectors showed up where they were declared to be, the inspectors would have to find them there. If they didn't, the control organization would just deactivate them. There would be some phone home interval grace period, maybe a day or two, and after that, the GPUs would just stop working until they were re-verified.
A dumb pinging chip has 0 ways to detect network throttling. Especially when it doesn't have admin rights to said network. Also MANY use cases for these GPUs require air-gapped environments to meet compliance requirements. This wouldn't work.
> You can also require random on-site inspections. In order to have 10,000 GPUs in a datacenter, you'd have to declare them to the government.
....So the companies in Shenzhen and Guangzhou need to declare them to the U.S. government or the Chinese government? Who's gonna deactivate them then? The issue being discussed in the article has nothing to do with companies that are within U.S. jurisdiction, it's about companies/individuals outside U.S. jurisdiction.
If packets are being consistently delayed, the circles get big and the possible region that the chip could be in gets big. If the chip can get a few fast pings in here and there it still works ok though.
It may not be possible to provide chips like this to a truly airgapped datacenter. You could have some special piece of hardware that proxies only the pings, but that is not a true airgap.
The companies in Shenzen and Guangzhou would declare with the U.S. government, or some international organization. Obviously the Chinese government doesn't have to let inspectors into their country, but if they don't, when the GPU goes to get it's cryptographic unlock code for the day, it's not going to arrive and the GPU won't work.
You are again assuming good faith actors. How is it going to work when you have a datacenter buried 300m underground surrounded with concrete? How will the signal leave? Better yet, how will you guarantee these GPS chips will stay on the GPU at all? Anyone with a soldering iron and enough know-how will be able to remove them.
> The companies in Shenzen and Guangzhou would declare with the U.S. government,
That's the problem. They won't. Many companies are now moving even their manufacturing out of China not only because of rising labour costs, but getting a judge to fairly arbitrate a dispute is impossible, let alone brokering a "pinky promise" with sensitive technology.
> Obviously the Chinese government doesn't have to let inspectors into their country, but if they don't, when the GPU goes to get it's cryptographic unlock code for the day, it's not going to arrive and the GPU won't work.
I highly recommend reading about CUDA, and how GPUs work then re-evaluate this idea. The issue at hand isn't just that NVIDIA chips are being obtained for use in inference and training, but when you obtain them at 20% supply scale you can unveil manufacturing patterns, secrets etc. that wouldn't be noticeable with only 1 or 2 chips.
There wouldn't be separate "GPS chips." The ping checking and requirement for a cryptographic unlock code would be part of the GPU die. Of course nothing like this can be completely foolproof but you can make it hard. A soldering iron certainly is not going to help.
I wrote my first CUDA kernel 19 years ago, so I'm familiar. I'm not sure what you mean by the last sentence though.
Ultimately I think this will be very self-destructive for US tech supremacy. But we will see what happens.
This is something else entirely, a control scheme that operates after the sale.