Center for a New American Security

CNAS describes itself as an independent, bipartisan, nonprofit organization that develops national security and defense policies ¹. Its 2024 report Secure, Governable Chips, by Aarne, Fist and Withers, proposes on-chip mechanisms for governing AI chips ²:

• Hardened security module. The report proposes a module that enforces valid firmware and up-to-date operating licenses and supports remote attestation, rolled out in stages from firmware changes to tamper-evident and then tamper-proof hardware ². See Hardware-enabled guarantees (flexHEG) and guarantee processors, Hardware performance throttling and licensing and TEE remote attestation for AI workloads.
• Hardening and effort. It judges that existing on-chip features must be hardened before they can be relied on in adversarial settings, and estimates that leading firms could build the required functionality with 18 months to 4 years of effort ².
• Location verification. It illustrates ping-based checks with a landmark server in Paris: a reply within 9 ms would place a chip inside a circle that excludes countries subject to export restrictions ². It expects hundreds of landmarks worldwide ². See Chip location verification.
• Ownership tracking. It writes that on-chip mechanisms would need a way to track who owns data-centre AI chips, supported by supply-chain tracking and know-your-customer policies ²; see Chip registries and manufacturing records.

A 2025 CNAS working paper by Grunewald, of IAPS, and Fist estimates that between 10,000 and several hundred thousand AI chips, with a median estimate of about 140,000, may have been smuggled to China in 2024 ³. It recommends that chip designers implement software-based location verification, and that the US Bureau of Industry and Security require notification of exports, re-exports and ownership transfers of controlled AI chips ³.