The claim is that specific AI chips are at the sites a party has declared, throughout the declared period.
Such claims underpin export controls and chip-tracking proposals. Checking them would make a registry of declared sites enforceable and diversion to undeclared facilities detectable. It concerns specific devices, so it can be checked by locating each one.
It does not show what those chips are computing or rule out chips elsewhere 4. The main approach has a chip answer timed challenges from trusted servers, so that the delay bounds its distance from them. A rudimentary prototype on NVIDIA H100 chips has been reported with one published result and no systematic measurements.
NVIDIA is reported to be developing a similar scheme using its own servers. Extracting a chip's private key would let another device answer for the chip. Other known weaknesses are hardware modification and limited reach into chips already in circulation.
Chip location concerns known devices and can be checked by locating each one, so it is one of the more tractable claims, but every publicly described scheme is still proposed (R1).
Chip location verification (R1) times a chip's signed replies to trusted servers, so that signal delay bounds its distance from them 1 2. Lucid's sovereignty certificates (R1) are a draft specification of this approach 10, and chip registries (R1) supply the declared locations to test. Guarantee processors (R1) could automate checks of approximate chip location, and their designers want them to be retrofittable to existing chip and server designs 11.
An Institute for AI Policy and Strategy (IAPS) issue brief reports a single result from a rudimentary prototype on NVIDIA H100 chips 7. In that result, a landmark in Singapore (a trusted server at a known location) verified that a chip in Singapore was within 300 miles of Singapore 7. No systematic measurements, error rates or code have been published. NVIDIA has said that it is developing delay-based location verification using its own servers 8, but it has published no design or results, and its announced fleet-management software is opt-in 9.
The chip's private key must not be extractable, or another device can answer for it 2. Wasil and colleagues see location tracking as limited to newly produced chips 3, while Brass and Aarne expect that the H100's trusted execution environment could implement it 6.
On this page
Why it matters
- High-end data-centre AI chips are subject to US export controls, but the Open Problems in Technical AI Governance survey describes them as at present straightforward to smuggle 1. It names as a key technical problem that a chip's location or owner cannot currently be known after export 1. Verified location could also help cloud users check that their data is processed in line with local data-processing laws 1.
- In a Center for a New American Security working paper, Grunewald and Fist estimate that 10,000 to several hundred thousand AI chips were smuggled into China in 2024. About 140,000 is the median of their modelled range, not a confirmed count 12. In a December 2025 US prosecution, the Justice Department alleged that workers replaced NVIDIA labels on GPUs with a fictitious brand before export or attempted export 13.
- Wasil and colleagues list chip location tracking, using unique identifiers and tracking mechanisms built into chips, among the hardware-dependent methods for verifying agreements 3. A draft international agreement requires parties to declare chip locations and to keep large concentrations of chips in monitored facilities where inspectors have ongoing physical access 4.
- Scher and Thiergart treat locating AI compute as one of their main verification goals 2. They favour tracking chips over trying to detect secret data centres, and propose locating chips at an initial point in time and then keeping them monitored 2. The Open Problems survey also calls for methods to verify that a large number of chips are co-located in a single data centre 1.
Why it is hard
The main technical proposal is delay-based. A chip exchanges timed messages with a network of trusted servers, and the measured latencies constrain where it can be 1. Scher and Thiergart describe AI chips using time-based pings to servers around the world to locate themselves 2. An IAPS issue brief from May 2025, which summarises a 2024 report by Brass and Aarne, states that a rudimentary version has been prototyped on NVIDIA H100 chips 7. It shows one result: a landmark in Singapore verifying that a chip in Singapore is within 300 miles of Singapore 7.
In an IAPS report on verifying AI chip exports, Avellar and Grunewald report, citing Reuters reporting from December 2025, that NVIDIA has confirmed it is developing location verification that estimates a chip's location from communication delays with NVIDIA-run servers 8. NVIDIA's own announcement from that month describes an opt-in fleet-management service that customers install and that reports read-only telemetry 9. The announcement states that NVIDIA GPUs do not have hardware tracking technology, kill switches or backdoors 9.
- Scher and Thiergart identify the main security issue as ensuring that a chip's private key cannot be extracted 2. Extraction would let other chips pretend to be the chip in question, so its location could be spoofed 2. Wasil and colleagues list modifying AI chip hardware and spoofing location as evasion techniques, and note that sophisticated actors may try to disable tracking 3.
- Wasil and colleagues note that chip location tracking is limited to newly produced chips and requires agreements on manufacturing standards 3. Brass and Aarne, by contrast, expect that the H100's trusted execution environment could be used to implement location attestation 6. For chips without such features, location must be established by other means, such as physical inspection against a directory of chip serial numbers and owners 5.
- A verified location says where a chip is, not what it is computing or who controls it. Proposals therefore pair location with verification of chip use 4, such as idleness or inference without training.