Chip location verification

How it works

Chip location verification tries to establish where an AI chip physically is ¹. Brass and Aarne judge delay-based methods, also called ping-based or latency-based verification, the most promising approach ¹. A trusted "landmark" server at a known location sends the chip a cryptographic challenge, and the chip replies using a secret key unique to it ¹. Signals cannot travel faster than light, so the reply time gives an upper bound on the chip's distance from the landmark ^{1 5}. Measurements from several landmarks narrow the region where the chip can be ⁸.

Brass and Aarne separate a general problem, locating a chip anywhere, from a narrower anti-smuggling problem: checking only that a chip is not in a restricted location ¹. They recommend solving the narrower problem first ¹. Aarne, Fist and Withers illustrate it with a trusted server in Paris ⁵. A reply in under 9 ms would show that a chip lies inside a circle that excludes countries to which exports are restricted ⁵.

Estimates of the landmark network differ:

• Brass and Aarne's 2024 report suggests several dozen landmarks at most ¹.
• An IAPS issue brief from 2025, summarising that report, assumes 100 to 500, depending on which countries are included ².
• Aarne, Fist and Withers expect hundreds worldwide ⁵.

For export control, Avellar and Grunewald place landmark servers in or near major data-centre hubs ³. The regulator would periodically ask exporters or end users to have chips ping the nearest landmark ³.

The chip's key must stay secret ¹. Brass and Aarne write that per-chip keys would need secure storage, such as a TPM, and that the trusted execution environment on NVIDIA H100 GPUs "could likely be used to implement location attestation" ¹. A draft industry specification, Lucid sovereignty (location) certificates, packages the approach as a remote-attestation protocol that issues short-lived location certificates ⁸. In it, an attester inside a trusted execution environment probes anchor servers and the verifier computes the feasible region ⁸. Related timing-based checks appear in Timed challenge-response and memory-occupation challenges.

What it establishes

What a timed reply can show:

• An upper bound on distance. A reply with one-way delay T ms shows that a device holding the chip's key was at most T × 200 km from the landmark at that moment, if signals travel no faster than light in fibre ¹.
• Absence from a region. For the anti-smuggling problem, a fast enough reply to a landmark outside restricted regions shows that the chip is not in those regions ^{5 1}.
• Resistance to added delay. Detours and tunnels add latency, so they generally cannot make a device appear closer to a landmark than it is ⁸. A path faster than the signal speed the verifier assumes can ¹.

What it cannot show:

• Distance from a slow reply. Internet traffic does not travel in straight lines, so an honest chip near a landmark may reply too slowly to be cleared ¹. Under a hard time limit, a slow reply only means the chip cannot be ruled out of a restricted location ¹.
• A precise position. Delay-based methods give positions to within about 10 km to 1,000 km, depending on the algorithm ¹.
• The chip itself. The check binds the reply to whatever holds the key; an extracted key lets another device answer ⁷.
• Location between checks. It shows nothing about where chips were between checks, and gives little visibility during shipping and warehousing ³.
• Who uses the chips, or for what. Avellar and Grunewald treat end-location, end-user and end-use verification as separate problems ³.

Brass and Aarne suggest combining location checks with a centralized chip registry (Chip registries and manufacturing records) ¹.

Threat model

Brass and Aarne define three adversary classes ¹:

• Minimally adversarial actors spend little and are very averse to discovery.
• Covertly adversarial actors spend substantial resources but still want to avoid being caught.
• Openly adversarial actors spend heavily and do not mind being discovered.

They argue that even an imperfect scheme has value, because it can occasionally catch cheaters and deter minimally adversarial actors ¹.

The scheme assumes the following:

• Chip keys stay secret. Each chip's key is provisioned and stored so that the owner cannot extract it ¹. Tee and Happel question this against adversaries with physical access ⁷.
• Signals are no faster than assumed. The bound holds only if no path beats the signal speed the verifier uses: the speed of light in fibre, or in a vacuum for a limit that cannot be beaten ¹.
• Landmarks are trustworthy. Landmarks are honest and correctly located ¹. The draft specification requires a signed directory of anchors and keys protected in hardware security modules ⁸.
• The chip hardware is trusted. The draft specification lets the attacker control the network and the host's root account, but trusts the hardware root of trust and TEE, and leaves sophisticated physical attacks as a residual risk ⁸.

Evidence

• Prototype. An IAPS issue brief from May 2025, which summarises Brass and Aarne's 2024 report, states that a rudimentary version has been prototyped on NVIDIA H100 chips ². It does not say who built the prototype. It shows one result, a landmark in Singapore verifying that a chip in Singapore is within 300 miles of Singapore, and points to a video demonstration on a website ².
• NVIDIA. Avellar and Grunewald report, citing Reuters reporting from December 2025, that NVIDIA has confirmed it is developing location verification that estimates a chip's location from communication delays with NVIDIA-run servers ³. NVIDIA's own announcement from that month describes an opt-in fleet-management service that customers install and that reports read-only telemetry, with a client agent slated to be open-sourced ⁴. The announcement states that NVIDIA GPUs do not have hardware tracking technology, kill switches or backdoors ⁴.
• Costs. The 2024 report estimates that a solution would cost less than $1 million to set up and maintain for several years ¹. The 2025 brief puts the chip firmware and software update at under $1 million, and 100 to 500 landmarks at $25,000 each a year, or $2.5 million to $12.5 million a year ². Avellar and Grunewald repeat the brief's figures ³.
• Ratings. Ansari rates software-based delay methods as near-term and hardware-integrated, tamper-resistant versions as needing R&D ⁶. Avellar and Grunewald rate delay-based location verification as novel in maturity, high in effectiveness and not invasive ³.
• Component result. Tee and Happel's GPU fingerprinting re-identified 24 rented H200 GPUs with 98.8% accuracy from a single run ⁷. It tests chip identification, not location ⁷.
• Specification. The Sovereignty Certificates specification (Lucid sovereignty (location) certificates) is a draft, version 0.1.0, dated 2025-10-21 ⁸. As of September 2026 its repository holds no reference implementation ⁸.

Limitations

• Delay inflation. Added delay moved estimated positions by up to 1,000 km in research Brass and Aarne cite; they propose a hard time limit as the counter ¹.
• Faster paths. Dark fibre and other private high-speed links can lower measured delays artificially ^{1 3}.
• False negatives. A limit set at the vacuum speed of light cannot be beaten, but honest chips may often fail it ¹.
• Landmark compromise. Manipulating a third of the landmarks shifted estimates by about 700 km in cited research ¹, and compromised landmarks can spoof measurements directly ³.
• Key extraction. An extracted key breaks the link between reply and chip ⁷. Ansari lists glitching and focused-ion-beam editing among physical attacks on embedded mechanisms ⁶.
• Tunnelling. The draft specification argues that tunnels add latency and produce inconsistent geometry, and requires rejecting such results ⁸.
• Coverage gaps. Chips in transit or storage cannot be checked ³.