{ "schema_version": "1.0.0", "rubric_version": "1.0", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)", "record": { "id": "M-0019", "slug": "chip-registries-and-manufacturing-records", "title": "Chip registries and manufacturing records", "aliases": [ "AI chip registry", "Chain-of-custody tracking for AI chips", "Commitments to manufacturing records" ], "status": "draft", "last_reviewed": "2026-09-23", "review_interval_days": 90, "steward": null, "provenance": { "drafted_by": "ai", "reviewed_by": [] }, "risk_flags": [], "flags": [], "one_liner": "Recording each AI chip's identity and owner from the fab onwards, and cryptographically fixing manufacturing records, so that chips can be accounted for later.", "summary": "A chip registry records unique identifiers for AI chips, with their owners and sometimes their locations, from manufacture to destruction. A verifier can then sample chips and check that declared chains of custody match what is physically there. A related proposal protects the foundry's own record of chip IDs by publishing a cryptographic fingerprint of it, so that later changes would show. As of September 2026 these are published designs, and no AI chip registry or record commitment is in operation. The main obstacle is institutional: someone must run the registry, and covering re-exports needs cooperation from re-exporters and foreign governments. The main weaknesses are that records cover only chips that were recorded, that documents and serial numbers can be forged, and that a commitment cannot show the records were accurate when made. A commitment shows what was made, not where it went.", "category": "accounting-provenance", "secondary_categories": [ "cryptographic-computational" ], "verifies": [ { "claim": "C-0001", "role": "primary", "note": "Gives a baseline of which chips were made and who declared owning them." }, { "claim": "C-0010", "role": "supporting", "note": "Supports checks that recorded chips have not been assembled into undeclared clusters." }, { "claim": "C-0002", "role": "supporting", "note": "Records declared locations, which inspections or location checks can test." } ], "threat_model": "semi-trusted", "adversarial_evaluation": "analysis", "hardware_requirement": "existing-features", "prover_cooperation": "required", "confidentiality": "partial", "depends_on": [], "readiness": { "assessment": true, "level": "R1", "rubric_version": "1.0", "rationale": "R1: registry and record-commitment designs are public, but none has been built or tested.\n\n- **R1** met: Baker et al. describe an AI chip registry for ownership declarations, with sampled chain-of-custody checks from manufacture to destruction, and state the goal and assumptions [[S-0002]]. Avellar and Grunewald describe how a regulator could run a registry of chip ownership and use it for random return requests [[S-1402]]. Cankaya proposes cryptographic commitments to foundry chip-ID records [[S-1408]].\n- **R2** not met: as of September 2026 no AI chip registry or manufacturing-record commitment has a public implementation, and no end-to-end results have been published [[S-0002]] [[S-1402]] [[S-1408]]. Export documentation checks are established practice, but they are not a registry, and Avellar and Grunewald rate them low in effectiveness as a verification tool [[S-1402]]. Ansari rates registry systems as near-term, not deployable now [[S-0007]].", "evidence": [ "S-0002", "S-1402", "S-1408", "S-0007" ], "next_level_gaps": [ "A public pilot registry or published commitment to manufacturing records at realistic scale.", "End-to-end results for sampled chain-of-custody checks, including how hard-to-spoof IDs are read and matched.", "An adversarial evaluation of record falsification, forged serial numbers and unrecorded chips." ], "confidence": "medium", "assessed_by": [ "ai-draft" ], "assessed_on": "2026-09-23", "status": "current", "dispute": null }, "flaws": [ { "assessment": true, "title": "Records cover only chips that were recorded", "kind": "theoretical-argument", "severity": "significant", "status": "open", "description": "A registry or commitment accounts only for chips entered into it. Cankaya asks how a verifier would know it had found all chips, or how much \"dark compute\" remains, and notes that a fraudulent original record would mean unregistered chips had been made in advance [[S-1408]]. Halstead and Larsen propose reconstructing earlier production by auditing upstream suppliers [[S-1410]].", "sources": [ "S-1408", "S-1410" ], "response": null }, { "assessment": true, "title": "Documents and serial numbers can be forged", "kind": "theoretical-argument", "severity": "significant", "status": "open", "description": "Avellar and Grunewald note that export documents can be forged, that companies can hide information behind obscure corporate structures, and that it may be possible to forge serial numbers on chips and racks. They recommend cryptographic attestation of a powered-on chip as an extra check [[S-1402]].", "sources": [ "S-1402" ], "response": null }, { "assessment": true, "title": "Insiders could alter records before they are fixed", "kind": "theoretical-argument", "severity": "significant", "status": "open", "description": "Cankaya argues that insiders who can photograph process secrets could also tamper with production records [[S-1408]]. A commitment makes changes after publication detectable, but it cannot show that the records were accurate when committed [[S-1408]].", "sources": [ "S-1408" ], "response": null } ], "blockers": [ { "text": "No AI chip registry operates, and covering re-exports would need cooperation from re-exporters and foreign governments that may not be feasible everywhere.", "theme": "access-governance", "blocked_by": null, "sources": [ "S-1402", "S-0002" ] }, { "text": "Linking records to physical chips needs hard-to-spoof unique IDs and inspections.", "theme": "hardware-trust", "blocked_by": null, "sources": [ "S-0002", "S-1402", "S-1408" ] }, { "text": "Chips produced before a registry starts must be reconstructed from supplier records.", "theme": "coverage-hidden-compute", "blocked_by": null, "sources": [ "S-1408", "S-1410" ] } ], "challenge_themes": [ "coverage-hidden-compute", "hardware-trust", "evidence-binding", "access-governance" ], "organizations": [ "O-0200", "O-0201", "O-0204" ], "people": [], "sources": [ { "source": "S-0002", "supports": "AI chip registry concept; sampled chain-of-custody checks; subgoal on undeclared clusters", "locator": "§3.2 and its footnote on the AI chip registry; §4.2.1.2" }, { "source": "S-1402", "supports": "centralized ownership registry; random return requests; serial checks; forgery limits; effectiveness ratings", "locator": "§1.1, §1.2, §1.5" }, { "source": "S-1408", "supports": "ECID golden record; Merkle-root commitment; TAP readout; eFuse tamper evidence; dark compute; insider threat", "locator": "whole post" }, { "source": "S-0056", "supports": "on-chip mechanisms need ownership tracking, supply-chain tracking and KYC", "locator": "'What Would Effective On-Chip Governance Look Like?', pp. 9-10" }, { "source": "S-0007", "supports": "chain-of-custody framing; PUFs; blockchain serialization; customs data; manufacturing concentration; feasibility", "locator": "§3.1 (M7)" }, { "source": "S-1410", "supports": "auditing upstream supply chain to reconstruct production", "locator": "section on preventing compute acquisition" }, { "source": "S-1400", "supports": "recommendation to combine location verification with a registry", "locator": "Detailed Summary" } ], "concepts": [ "K-0024", "K-0016", "K-0020", "K-0015" ], "complements": [ "M-0018", "M-0020", "M-0017" ], "alternatives": [], "type": "mechanism", "implementations": [], "url": "https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/", "source_file": "content/mechanisms/chip-registries-and-manufacturing-records.md", "flags_all": [ "ai-drafted" ], "body_markdown": "## How it works\n\nA chip registry records unique identifiers for AI chips, together with their owners and, in some designs, their locations [[S-0002]]. The aim is to account for chips over their lifetime [[S-0002]] [[S-0007]]. Baker et al. describe an AI chip registry as one possible way to report who owns AI compute [[S-0002]]. They note that declaring individual chips is not strictly necessary but makes verification easier [[S-0002]]. A verifier could check the locations and owners of random samples of chips, from manufacture to destruction, using inspections, possibly video cameras, and hard-to-spoof unique IDs [[S-0002]].\n\nAnsari describes lifecycle registries as a chain-of-custody layer similar to nuclear material accountancy [[S-0007]]. He cites proposals to identify chips with physical unclonable functions and to serialize them on a blockchain [[S-0007]]. Aarne, Fist and Withers write that on-chip governance mechanisms would need a way to track who owns data-centre AI chips, supported by supply-chain tracking and Know Your Customer policies [[S-0056]].\n\nIn an export-control setting, Avellar and Grunewald describe a centralized registry of chip ownership [[S-1402]]. The regulator could pick random chip IDs from it and ask the owners to return those chips at short notice [[S-1402]]. During on-site inspections, inspectors would check the serial numbers of a random sample of chips against asset inventories and the records reported to the regulator [[S-1402]].\n\n**Manufacturing records.** Cankaya argues that the foundry already holds a \"golden record\" of the AI chips it has made [[S-1408]]. He writes that modern processors carry Electronic Chip IDs (ECIDs), burned into one-time-programmable fuses at wafer test, that encode the wafer lot, the wafer number and the die position [[S-1408]]. He proposes that the foundry build a Merkle tree over these IDs and publish only its root hash after each batch [[S-1408]]. Later tampering would then be detectable, while the IDs themselves stay private [[S-1408]]. An inspector could later read a chip's ECID through its test access port without opening the package [[S-1408]].\n\n**Upstream audits.** Halstead and Larsen propose auditing the semiconductor supply chain upstream, across logic fabrication, memory and packaging suppliers [[S-1410]]. This would give a record of past production that is hard to under-report without creating inconsistencies [[S-1410]].\n\n## What it establishes\nWhat these tools can show:\n\n- **Custody matches declarations.** A registry, with sampled inspections, tests whether declared chains of custody match what is physically present [[S-0002]] [[S-1402]].\n- **No undeclared clusters of recorded chips.** It supports the wider goal of checking that large quantities of chips have not been assembled into undeclared clusters [[S-0002]].\n- **Records were not changed later.** A published commitment makes later changes to foundry records detectable [[S-1408]].\n\nWhat they cannot show:\n\n- **Unrecorded chips.** Chips that were never recorded are not covered [[S-1408]].\n- **Where chips went.** Cankaya notes that a commitment shows what was made, and that \"the harder question is where it went\" [[S-1408]].\n- **Accuracy at the start.** A commitment cannot show that the records were correct when committed [[S-1408]].\n- **Strong assurance from documents alone.** Avellar and Grunewald rate export documentation checks low in effectiveness and useful mainly against actors of low to moderate sophistication [[S-1402]].\n\nBrass and Aarne suggest pairing a registry with location verification ([[M-0018]]) [[S-1400]].\n\n## Threat model\nThese designs trust some parties:\n\n- **Owners** declare truthfully, or are caught by sampled inspections [[S-0002]].\n- **Foundries** keep accurate ID records; Cankaya's proposal assumes the foundry holds the ECID data [[S-1408]].\n- **IDs** are hard to alter [[S-0002]]. Cankaya argues that a blown fuse cannot be restored, and that changing it would need focused-ion-beam work that leaves detectable traces [[S-1408]].\n\nThe main threats named in the sources are forged documents and serial numbers [[S-1402]], opaque corporate structures [[S-1402]] and insiders altering production records [[S-1408]]. Ansari argues that the concentration of advanced manufacturing, with fewer than two dozen facilities making sub-14 nm chips as of 2023, makes a registry easier to enforce than for a commodity with distributed production [[S-0007]].\n\n## Evidence\n- **Designs only.** Baker et al., Avellar and Grunewald, and Cankaya publish designs; none reports an implementation [[S-0002]] [[S-1402]] [[S-1408]].\n- **Feasibility ratings.** Ansari rates registry systems as near-term [[S-0007]]. He rates trade-data analysis as deployable now, citing work that uses existing customs data to find circumvention patterns [[S-0007]].\n- **Export-control ratings.** Avellar and Grunewald rate export documentation checks as relatively established but low in effectiveness, and random return requests from a registry as novel and high in effectiveness [[S-1402]].\n\n## Limitations\n- **Unrecorded chips.** Chips outside the record are not covered, and a fraudulent original record would mean unregistered chips were made in advance [[S-1408]]. Reconstructing earlier production depends on supplier records [[S-1410]].\n- **Forgery.** Documents can be forged, and serial numbers on chips and racks may be forgeable [[S-1402]].\n- **Insider tampering.** Records can be altered before they are committed [[S-1408]].\n- **Limited reach.** Covering re-exports would need cooperation from re-exporters and foreign governments, which may not be feasible everywhere [[S-1402]].\n- **Custody versus location.** A commitment fixes what was made, but tracking where chips are needs inspections or location checks [[S-1408]] [[S-0002]].", "body_text": "How it works A chip registry records unique identifiers for AI chips, together with their owners and, in some designs, their locations [S-0002]. The aim is to account for chips over their lifetime [S-0002] [S-0007]. Baker et al. describe an AI chip registry as one possible way to report who owns AI compute [S-0002]. They note that declaring individual chips is not strictly necessary but makes verification easier [S-0002]. A verifier could check the locations and owners of random samples of chips, from manufacture to destruction, using inspections, possibly video cameras, and hard-to-spoof unique IDs [S-0002]. Ansari describes lifecycle registries as a chain-of-custody layer similar to nuclear material accountancy [S-0007]. He cites proposals to identify chips with physical unclonable functions and to serialize them on a blockchain [S-0007]. Aarne, Fist and Withers write that on-chip governance mechanisms would need a way to track who owns data-centre AI chips, supported by supply-chain tracking and Know Your Customer policies [S-0056]. In an export-control setting, Avellar and Grunewald describe a centralized registry of chip ownership [S-1402]. The regulator could pick random chip IDs from it and ask the owners to return those chips at short notice [S-1402]. During on-site inspections, inspectors would check the serial numbers of a random sample of chips against asset inventories and the records reported to the regulator [S-1402]. Manufacturing records. Cankaya argues that the foundry already holds a \"golden record\" of the AI chips it has made [S-1408]. He writes that modern processors carry Electronic Chip IDs (ECIDs), burned into one-time-programmable fuses at wafer test, that encode the wafer lot, the wafer number and the die position [S-1408]. He proposes that the foundry build a Merkle tree over these IDs and publish only its root hash after each batch [S-1408]. Later tampering would then be detectable, while the IDs themselves stay private [S-1408]. An inspector could later read a chip's ECID through its test access port without opening the package [S-1408]. Upstream audits. Halstead and Larsen propose auditing the semiconductor supply chain upstream, across logic fabrication, memory and packaging suppliers [S-1410]. This would give a record of past production that is hard to under-report without creating inconsistencies [S-1410]. What it establishes What these tools can show: - Custody matches declarations. A registry, with sampled inspections, tests whether declared chains of custody match what is physically present [S-0002] [S-1402]. - No undeclared clusters of recorded chips. It supports the wider goal of checking that large quantities of chips have not been assembled into undeclared clusters [S-0002]. - Records were not changed later. A published commitment makes later changes to foundry records detectable [S-1408]. What they cannot show: - Unrecorded chips. Chips that were never recorded are not covered [S-1408]. - Where chips went. Cankaya notes that a commitment shows what was made, and that \"the harder question is where it went\" [S-1408]. - Accuracy at the start. A commitment cannot show that the records were correct when committed [S-1408]. - Strong assurance from documents alone. Avellar and Grunewald rate export documentation checks low in effectiveness and useful mainly against actors of low to moderate sophistication [S-1402]. Brass and Aarne suggest pairing a registry with location verification (Chip location verification) [S-1400]. Threat model These designs trust some parties: - Owners declare truthfully, or are caught by sampled inspections [S-0002]. - Foundries keep accurate ID records; Cankaya's proposal assumes the foundry holds the ECID data [S-1408]. - IDs are hard to alter [S-0002]. Cankaya argues that a blown fuse cannot be restored, and that changing it would need focused-ion-beam work that leaves detectable traces [S-1408]. The main threats named in the sources are forged documents and serial numbers [S-1402], opaque corporate structures [S-1402] and insiders altering production records [S-1408]. Ansari argues that the concentration of advanced manufacturing, with fewer than two dozen facilities making sub-14 nm chips as of 2023, makes a registry easier to enforce than for a commodity with distributed production [S-0007]. Evidence - Designs only. Baker et al., Avellar and Grunewald, and Cankaya publish designs; none reports an implementation [S-0002] [S-1402] [S-1408]. - Feasibility ratings. Ansari rates registry systems as near-term [S-0007]. He rates trade-data analysis as deployable now, citing work that uses existing customs data to find circumvention patterns [S-0007]. - Export-control ratings. Avellar and Grunewald rate export documentation checks as relatively established but low in effectiveness, and random return requests from a registry as novel and high in effectiveness [S-1402]. Limitations - Unrecorded chips. Chips outside the record are not covered, and a fraudulent original record would mean unregistered chips were made in advance [S-1408]. Reconstructing earlier production depends on supplier records [S-1410]. - Forgery. Documents can be forged, and serial numbers on chips and racks may be forgeable [S-1402]. - Insider tampering. Records can be altered before they are committed [S-1408]. - Limited reach. Covering re-exports would need cooperation from re-exporters and foreign governments, which may not be feasible everywhere [S-1402]. - Custody versus location. A commitment fixes what was made, but tracking where chips are needs inspections or location checks [S-1408] [S-0002].", "referenced_by": [ { "id": "M-0018", "title": "Chip location verification", "url": "https://trustbutveri.fyi/mechanisms/chip-location-verification/" }, { "id": "M-0009", "title": "Hardware-enabled guarantees (flexHEG) and guarantee processors", "url": "https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/" }, { "id": "M-0020", "title": "Remote detection of data centres", "url": "https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/" }, { "id": "C-0002", "title": "Chips are where they are declared to be", "url": "https://trustbutveri.fyi/claims/chips-are-where-declared/" }, { "id": "C-0001", "title": "Compute stock is at most a declared amount", "url": "https://trustbutveri.fyi/claims/compute-stock-is-bounded/" }, { "id": "C-0010", "title": "There is no undeclared relevant compute", "url": "https://trustbutveri.fyi/claims/no-undeclared-compute/" }, { "id": "K-0016", "title": "Undeclared compute", "url": "https://trustbutveri.fyi/concepts/undeclared-compute/" }, { "id": "O-0201", "title": "AI Futures Project", "url": "https://trustbutveri.fyi/organizations/ai-futures-project/" }, { "id": "O-0207", "title": "Center for a New American Security", "url": "https://trustbutveri.fyi/organizations/center-for-a-new-american-security/" }, { "id": "O-0204", "title": "Institute for AI Policy and Strategy", "url": "https://trustbutveri.fyi/organizations/institute-for-ai-policy-and-strategy/" }, { "id": "O-0200", "title": "RAND", "url": "https://trustbutveri.fyi/organizations/rand/" } ] } }