Chip registries and manufacturing records

How it works

A chip registry records unique identifiers for AI chips, together with their owners and, in some designs, their locations ¹. The aim is to account for chips over their lifetime ^{1 6}. Sastry et al. list an international AI chip registry among possible mechanisms for regulatory visibility into compute ⁴. Baker et al. describe an AI chip registry as one possible way to report who owns AI compute ¹. They note that declaring individual chips is not strictly necessary but makes verification easier ¹. A verifier could check the locations and owners of random samples of chips, from manufacture to destruction, using inspections, possibly video cameras, and hard-to-spoof unique IDs ¹.

Ansari describes lifecycle registries as a chain-of-custody layer similar to nuclear material accountancy ⁶. Ansari cites proposals to identify chips with physical unclonable functions and to serialize them on a blockchain ⁶. Aarne, Fist and Withers write that on-chip governance mechanisms would need a way to track who owns data-centre AI chips, supported by supply-chain tracking and Know Your Customer policies ⁵. Grunewald and Fist recommend notifying the regulator of exports, re-exports and ownership transfers of controlled AI chips ⁹.

In an export-control setting, Avellar and Grunewald describe a centralized registry of chip ownership ². The regulator could pick random chip IDs from it and ask the owners to return those chips at short notice ². During on-site inspections, inspectors would check the serial numbers of a random sample of chips against asset inventories and the records reported to the regulator ².

Manufacturing records. Cankaya argues that the foundry already holds a "golden record" of the AI chips it has made ³. He writes that modern processors carry Electronic Chip IDs (ECIDs), burned into one-time-programmable fuses at wafer test, that encode the wafer lot, the wafer number and the die position ³. He proposes that the foundry build a Merkle tree over these IDs and publish only its root hash after each batch ³. Later tampering would then be detectable, while the IDs themselves stay private ³. An inspector could later read a chip's ECID through its test access port without opening the package ³.

Upstream audits. Halstead and Larsen propose auditing the semiconductor supply chain upstream, across logic fabrication, memory and packaging suppliers ⁷. This would give a record of past production that is hard to under-report without creating inconsistencies ⁷.

What it establishes

What these tools can show:

• A registry, with sampled inspections, tests whether declared chains of custody match what is physically present ^{1 2}.
• For recorded chips, a registry supports the wider goal of checking that large quantities of chips have not been assembled into undeclared clusters ¹.
• A published commitment makes later changes to foundry records detectable ³.

What they cannot show:

• Unrecorded chips. Chips that were never recorded are not covered ³.
• Where chips went. A commitment covers the foundry's record of chips made. Cankaya calls where they went "the harder question" ³.
• Accuracy at the start. A commitment cannot show that the records were correct when committed ³.
• Strong assurance from documents alone. Avellar and Grunewald rate export documentation checks low in effectiveness and useful mainly against actors of low to moderate sophistication ².

Brass and Aarne suggest pairing a registry with location verification (Chip location verification) ⁸.

Threat model

These designs trust some parties:

• Owners declare truthfully, or are caught by sampled inspections ¹.
• Foundries keep accurate ID records; Cankaya's proposal assumes the foundry holds the ECID data ³.
• IDs are hard to alter ¹. Cankaya argues that an attacker could corrupt an ECID by blowing more of its one-time fuses, but could not set an arbitrary value without focused-ion-beam work ³. He adds that analysis labs can check whether a die has been re-assembled or re-packaged ³.

The main threats named in the sources are forged documents and serial numbers ², opaque corporate structures ² and insiders altering production records ³. Ansari argues that the concentration of advanced manufacturing, with fewer than two dozen facilities making sub-14 nm chips as of 2023, makes a registry easier to enforce than for a commodity with distributed production ⁶.