Chip location verification: How AI chips could prove which country they are in

Chip location verification is a way to check which country an AI chip is in without relying on the buyer’s word. A trusted server sends the chip a signal, the chip answers, and the round-trip time sets a limit on how far away the chip can be.

The idea matters because export rules only work if shipped chips stay where they were sent.

A ping that works like an echo in a canyon

Think of shouting across a valley and timing the echo. A quick echo means the wall is close. A slow echo means it is far. The echo cannot come back faster than sound travels, so the delay sets a ceiling on the distance.

Chip location verification uses the same logic with network signals. Nothing travels faster than light, so a fast reply proves the chip is nearby. A slow reply proves nothing, because a chip can answer slowly for many reasons.

The Institute for AI Policy and Strategy (IAPS) gives a worked example. A 1 millisecond response means the chip is at most 93 miles from the server that asked. If that server sits in Taiwan, a fast reply would show the chip is not in mainland China.

From one ping to a rough map

One server gives a distance limit, not a position. The proposal therefore uses many servers, called landmarks, placed in data centers around the world. Each landmark pings the chip. Combining the limits narrows the area, enough to tell whether a chip is still in its original country.

The chip also has to prove the reply really came from it. Modern AI chips hold a unique cryptographic key and can attest to their identity, according to IAPS. That makes it harder for another machine to pose as the chip and answer from a convenient location.

This approach is called delay-based verification. The IAPS brief and a May 2025 commentary in AI Frontiers both prefer it to GPS. They argue that satellite signals can be spoofed and often cannot penetrate data-center walls.

Where the idea came from and why it surfaced now

The problem is chip diversion. The IAPS brief describes a pattern in which chips are sold to apparent start-ups in places such as Malaysia and Singapore, which then disappear after moving the chips into China. It cites a forthcoming CNAS working paper estimating that hundreds of thousands of chips were smuggled in 2024. Estimates vary widely, and the AI Frontiers commentary quotes a range from tens of thousands to one million.

Asher Brass and Onni Aarne of IAPS laid out the delay-based design in a 2024 report. Brass summarized it in a May 2025 brief. The same month, Senator Tom Cotton introduced the Chip Security Act, which would require a "location verification mechanism" on covered chips. A bipartisan House companion followed on May 15, 2025. The bills do not say how the mechanism should work. As of the sources we read, the legislation had not been enacted.

Our story on the Nvidia board’s probe of Jensen Huang touches this terrain. CNBC reported that Megaspeed, a Singapore-based cloud company and Nvidia customer, has been accused of helping restricted Chinese companies acquire AI chips. Those are reported claims, not findings. The details are in our coverage of the investigation. Location verification is one of the tools policymakers have proposed for exactly this kind of question: where did the chips end up?

What Nvidia has built, and what it says it has not

Nvidia has opposed mandates. Its chief security officer, David Reber Jr., wrote that GPUs "do not and should not have kill switches and backdoors", and cited the 1990s Clipper Chip controversy as a warning about single points of failure.

In December 2025, Reuters reported that Nvidia had built software that can indicate which country a chip is operating in. According to The Register, the feature is a side effect of an unannounced fleet-management service. That service streams health telemetry to customers who opt in, and it uses security functions present in GPUs since the Hopper generation. The Register’s understanding is that location works roughly like a ping, with response times compared against expected ranges.

An Nvidia spokesperson told The Register: "There is no kill switch." The company also said it has no features that let it remotely control registered systems. It says the service answers customer demand rather than proposed legislation. We have not confirmed whether the service has since been released.

This split matters. Verification only reports where a chip is. Geofencing would disable a chip outside an approved zone. IAPS favors verification and calls geofencing harder to build and open to abuse.

What it costs and where it breaks

IAPS estimates the firmware update at under $1 million and about six months of work. It puts a network of 100 to 500 landmarks at roughly $25,000 per landmark per year, or $2.5 million to $12.5 million annually. These are the authors’ own estimates, not audited figures.

The brief also describes a rudimentary prototype on Nvidia H100 chips. A landmark in Singapore verified a chip in Singapore to within about 300 miles. That is coarse, and it was tested on one chip model.

The limits are real:

• Approximate only. The result is a maximum distance, not an address. It can separate countries but not buildings.
• Gaps in time. Chips in transit or storage cannot be checked, so verification would happen after installation.
• Tampering. Slowing a chip’s replies would blur the estimate. The AI Frontiers commentary says that would likely give a suspiciously wide range, which could itself flag tampering. It adds that a determined actor might still try to extract the on-die key with specialized tools.
• Enforcement. The commentary calls the Bureau of Industry and Security (BIS), the agency that enforces the rules, sorely underfunded. A flag is useless without someone to act on it.
• Trust. Critics compare any chip-level tracking to the Clipper Chip. Supporters answer that the system reveals nothing about what runs on a chip.

Even the proposal’s authors treat it as one layer, not a cure. It makes quiet diversion more likely to be noticed after the fact, and IAPS argues it could allow more permissive export rules because enforcement becomes easier.

What to watch next

Three things decide whether this stays an idea or becomes standard practice. First, whether Congress passes the Chip Security Act or a similar rule. Second, whether Nvidia ships its opt-in service and how customers respond. Third, whether independent researchers test the scheme against real attacks, since public evidence so far rests on one small prototype.

The export rules around those chips keep moving too. In January 2026 the Bureau of Industry and Security moved certain H200-class chips bound for China to case-by-case license review. Looser licensing makes after-the-fact checks like this more attractive, because more chips would be legally shipped and then need to stay where licensed. Whether regulators will rely on technical proof or on company statements is the open question.