Chip registries and manufacturing records

How it works

A chip registry records unique identifiers for AI chips, together with their owners and, in some designs, their locations ¹. The aim is to account for chips over their lifetime ^{1 5}. Baker et al. describe an AI chip registry as one possible way to report who owns AI compute ¹. They note that declaring individual chips is not strictly necessary but makes verification easier ¹. A verifier could check the locations and owners of random samples of chips, from manufacture to destruction, using inspections, possibly video cameras, and hard-to-spoof unique IDs ¹.

Ansari describes lifecycle registries as a chain-of-custody layer similar to nuclear material accountancy ⁵. He cites proposals to identify chips with physical unclonable functions and to serialize them on a blockchain ⁵. Aarne, Fist and Withers write that on-chip governance mechanisms would need a way to track who owns data-centre AI chips, supported by supply-chain tracking and Know Your Customer policies ⁴.

In an export-control setting, Avellar and Grunewald describe a centralized registry of chip ownership ². The regulator could pick random chip IDs from it and ask the owners to return those chips at short notice ². During on-site inspections, inspectors would check the serial numbers of a random sample of chips against asset inventories and the records reported to the regulator ².

Manufacturing records. Cankaya argues that the foundry already holds a "golden record" of the AI chips it has made ³. He writes that modern processors carry Electronic Chip IDs (ECIDs), burned into one-time-programmable fuses at wafer test, that encode the wafer lot, the wafer number and the die position ³. He proposes that the foundry build a Merkle tree over these IDs and publish only its root hash after each batch ³. Later tampering would then be detectable, while the IDs themselves stay private ³. An inspector could later read a chip's ECID through its test access port without opening the package ³.

Upstream audits. Halstead and Larsen propose auditing the semiconductor supply chain upstream, across logic fabrication, memory and packaging suppliers ⁶. This would give a record of past production that is hard to under-report without creating inconsistencies ⁶.

What it establishes

What these tools can show:

• Custody matches declarations. A registry, with sampled inspections, tests whether declared chains of custody match what is physically present ^{1 2}.
• No undeclared clusters of recorded chips. It supports the wider goal of checking that large quantities of chips have not been assembled into undeclared clusters ¹.
• Records were not changed later. A published commitment makes later changes to foundry records detectable ³.

What they cannot show:

• Unrecorded chips. Chips that were never recorded are not covered ³.
• Where chips went. Cankaya notes that a commitment shows what was made, and that "the harder question is where it went" ³.
• Accuracy at the start. A commitment cannot show that the records were correct when committed ³.
• Strong assurance from documents alone. Avellar and Grunewald rate export documentation checks low in effectiveness and useful mainly against actors of low to moderate sophistication ².

Brass and Aarne suggest pairing a registry with location verification (Chip location verification) ⁷.

Threat model

These designs trust some parties:

• Owners declare truthfully, or are caught by sampled inspections ¹.
• Foundries keep accurate ID records; Cankaya's proposal assumes the foundry holds the ECID data ³.
• IDs are hard to alter ¹. Cankaya argues that a blown fuse cannot be restored, and that changing it would need focused-ion-beam work that leaves detectable traces ³.

The main threats named in the sources are forged documents and serial numbers ², opaque corporate structures ² and insiders altering production records ³. Ansari argues that the concentration of advanced manufacturing, with fewer than two dozen facilities making sub-14 nm chips as of 2023, makes a registry easier to enforce than for a commodity with distributed production ⁵.

Evidence

• Designs only. Baker et al., Avellar and Grunewald, and Cankaya publish designs; none reports an implementation ^{1 2 3}.
• Feasibility ratings. Ansari rates registry systems as near-term ⁵. He rates trade-data analysis as deployable now, citing work that uses existing customs data to find circumvention patterns ⁵.
• Export-control ratings. Avellar and Grunewald rate export documentation checks as relatively established but low in effectiveness, and random return requests from a registry as novel and high in effectiveness ².

Limitations

• Unrecorded chips. Chips outside the record are not covered, and a fraudulent original record would mean unregistered chips were made in advance ³. Reconstructing earlier production depends on supplier records ⁶.
• Forgery. Documents can be forged, and serial numbers on chips and racks may be forgeable ².
• Insider tampering. Records can be altered before they are committed ³.
• Limited reach. Covering re-exports would need cooperation from re-exporters and foreign governments, which may not be feasible everywhere ².
• Custody versus location. A commitment fixes what was made, but tracking where chips are needs inspections or location checks ^{3 1}.