Chip location verification

How it works

Chip location verification tries to establish where an AI chip physically is ¹. Brass and Aarne judge delay-based methods, also called ping-based or latency-based verification, the most promising approach ¹. A trusted "landmark" server at a known location sends the chip a cryptographic challenge, and the chip replies using a secret key unique to it ¹. Signals cannot travel faster than light, so the reply time gives an upper bound on the chip's distance from the landmark ^{1 7}. Measurements from several landmarks narrow the region where the chip can be ¹⁰.

Brass and Aarne separate a general problem, locating a chip anywhere, from a narrower anti-smuggling problem: checking only that a chip is not in a restricted location ¹. They recommend solving the narrower problem first ¹. Aarne, Fist and Withers illustrate it with a trusted server in Paris ⁷. A reply in under 9 ms would show that a chip lies inside a circle that excludes countries to which exports are restricted ⁷.

Estimates of the landmark network differ:

• Brass and Aarne's 2024 report suggests several dozen landmarks at most ¹.
• An IAPS issue brief from 2025, summarising that report, assumes 100 to 500, depending on which countries are included ².
• Aarne, Fist and Withers expect hundreds worldwide ⁷.

For export control, Avellar and Grunewald place landmark servers in or near major data-centre hubs ⁴. The regulator would periodically ask exporters or end users to have chips ping the nearest landmark ⁴.

The chip's key must stay secret ¹. Brass and Aarne write that per-chip keys would need secure storage, such as a TPM, and that the trusted execution environment on NVIDIA H100 GPUs "could likely be used to implement location attestation" ¹. A draft industry specification, Lucid sovereignty (location) certificates, packages the approach as a remote-attestation protocol that issues short-lived location certificates ¹⁰. In it, an attester inside a trusted execution environment probes anchor servers and the verifier computes the feasible region ¹⁰. Related timing-based checks appear in Timed challenge-response and memory-occupation challenges.

What it establishes

What a timed reply can show:

• A reply with one-way delay T ms shows that a device holding the chip's key was at most T × 200 km from the landmark at that moment, if signals travel no faster than light in fibre ¹.
• For the anti-smuggling problem, a fast enough reply to a landmark outside restricted regions shows that the chip is not in those regions ^{1 7}.
• Detours and tunnels add latency, so they generally cannot make a device appear closer to a landmark than it is ¹⁰. A path faster than the signal speed the verifier assumes can ¹.

What it cannot show:

• Distance from a slow reply. Internet traffic does not travel in straight lines, so an honest chip near a landmark may reply too slowly to be cleared ¹. Under a hard time limit, a slow reply only means the chip cannot be ruled out of a restricted location ¹.
• A precise position. Delay-based methods give positions to within about 10 km to 1,000 km, depending on the algorithm ¹.
• The chip itself. The check binds the reply to whatever holds the key; an extracted key lets another device answer ⁹.
• Location between checks. It shows nothing about where chips were between checks, and gives little visibility during shipping and warehousing ⁴.
• Who uses the chips, or for what. Avellar and Grunewald treat end-location, end-user and end-use verification as separate problems ⁴.

Brass and Aarne suggest combining location checks with a centralized chip registry (Chip registries and manufacturing records) ¹.

Threat model

Brass and Aarne define three adversary classes ¹:

• Minimally adversarial actors spend little and are very averse to discovery.
• Covertly adversarial actors spend substantial resources but still want to avoid being caught.
• Openly adversarial actors spend heavily and do not mind being discovered.

They argue that even an imperfect scheme has value, because it can occasionally catch cheaters and deter minimally adversarial actors ¹.

The scheme assumes the following:

• Chip keys stay secret. Each chip's key is provisioned and stored so that the owner cannot extract it ¹. Tee and Happel question this against adversaries with physical access ⁹.
• Signals are no faster than assumed. The bound holds only if no path beats the signal speed the verifier uses: the speed of light in fibre, or in a vacuum for a limit that cannot be beaten ¹.
• Landmarks are trustworthy. Landmarks are honest and correctly located ¹. The draft Sovereignty Certificates specification requires a signed directory of anchors and keys protected in hardware security modules ¹⁰.
• The chip hardware is trusted. The draft specification lets the attacker control the network and the host's root account, but trusts the hardware root of trust and TEE, and leaves sophisticated physical attacks as a residual risk ¹⁰.