Гонка за созданием "Найди мое" для чипов искусственного интеллекта

Стремясь ограничить возможности Китая в области искусственного интеллекта, Соединенные Штаты в 2022 году ввели ограничения на экспорт некоторых передовых чипов в Китай. Но на протяжении всего бума в области искусственного интеллекта эти чипы все равно появлялись в Китае.

1 октября 2026 года в США был арестован мужчина по обвинению в отправке серверов, оснащенных GPU, в Китай на сумму более 300 миллионов долларов с использованием документов, предназначенных для отправки в Малайзию и Сингапур. Поскольку контрабанда чипов и их утечка продолжаются, Соединенные Штаты осознают, что чем больше они пытаются ограничить перемещение своих чипов искусственного интеллекта, тем труднее их точно определить.

Чтобы решить эту проблему, страна переходит к проверке местоположения. В марте прошлого года Комитет Палаты представителей по иностранным делам США принял законопроект, требующий проверки местоположения продвинутых чипов искусственного интеллекта. В преддверии саммита США-Китай в конце сентября законодатели призвали к проведению открытого голосования по этому и связанным с ним законопроектам.

Если такое требование будет принято, как производители чипов будут его выполнять? Они могли бы создать защищенное от несанкционированного доступа аппаратное обеспечение root of trust, реализовать криптографическую подпись и передачу данных или, возможно, даже снять отпечатки пальцев с отдельных чипов. Аналогично функции "Найти меня" для отслеживания устройств Apple, вот несколько возможностей для разработки функции "Найти меня" для чипов искусственного интеллекта.

Проверка местоположения может осуществляться в различных формах, таких как механизмы геолокации, инструменты управления запасами, проверки по почте и видеоинспекции. Комбинация подходов, таких как проверка местоположения на основе ping (PLV), дополненная физическими осмотрами, была бы осуществимым и надежным подходом, утверждают авторы сентябрьского отчета Центра безопасности и новых технологий (CSET) об отслеживании местоположения чипов.

Чтобы определить местоположение чипа искусственного интеллекта, PLV измеряет время, необходимое для передачи сигнала от чипа к нескольким надежным серверам "landmark" по всему миру и обратно. Kyle Miller, a senior research analyst at CSET and coauthor of the report, says that for new AI chips, manufacturers could integrate PLV functionality into the hardware itself, while a firmware update could be applied to chips already in circulation.

Not all AI chips should be tracked, the researchers note. "The priority should be for the highest-end data center chips—the cream of the crop in high-end data center GPUs," says Jacob Feldgoise, a senior data research analyst at CSET and coauthor of the report.

A similar initiative involves transmitting encrypted "sovereignty certificates." These certificates act as "cryptographic credentials that provide verifiable, unforgeable proof of the physical location of a computing device, such as a CPU or GPU, at a specific point in time," per the draft specification published by secure computing firm Lucid Computing.

"If you can use a private key that exists on a particular chip, and you can sign a message with that cryptographic key, and then that message is received by a so-called landmark server, then you can send a couple of those messages and time those messages. A lot of modern chips come with trusted execution environments that support a hardware root of trust where you can sign these messages," says Kristian Rönn, CEO and cofounder of Lucid Computing. "You get a radius of where the chip has to be."

PLV could have some effect on chip smugglers, Miller says. "They know if they turn this chip on, it’s going to start pinging these landmark servers. That could deter some smuggling." And when the system flags a chip as residing in a nonintended location, "the PLV data gives you a better sense of when and where it was moved," he adds.

However, ping-based location verification can only uncover diversion after it has happened. It can’t track offline chips that are in storage, in transit, or have yet to be activated. And when a chip fails to respond to a ping request, the system won’t know whether it’s due to a valid reason or nefarious causes.

This is where physical inspections come in. "You need to do that follow-on investigative work. You need to physically go to these data centers and do those physical audits as well. Essentially, [PLV] generates leads, and you track down those leads," says Miller.

A PLV system involves sending signals from a chip to and from trusted servers and measuring the travel time.Source image: CSET

Despite the safeguards around ping-based location verification, the methodology remains vulnerable to particular attacks. If adversaries gain physical access to a chip, for example, they could prevent it from sending signals, or they could extract cryptographic keys and spoof a signal from the intended location.

To fight that, some security researchers are exploring hardware fingerprints instead of cryptographic keys. One study demonstrated a proof-of-concept GPU fingerprinting function that produced unique fingerprints for Nvidia H200 GPUs based on their manufacturing variations and random numbers as seeds.

"You want to support other types of fingerprinting because not all chips have a hardware root of trust. You might want to use some statistical fingerprinting to know that the chip is what it’s supposed to be," Rönn says. "It also requires good physical security around the chips, such as tamper-proofing. Over time, you ideally want to have more defense in depth."

Additionally, the CSET report warns that PLV is costly. And if China achieves the ability to craft its own advanced AI chips, "then tracking the export of U.S. chips is less of a strategic priority," says Miller.

Hanna Dohmen, a senior research analyst at CSET and coauthor of the report, points to other gaps in the U.S. export control regime. "Currently, Chinese companies are legally able to remotely access AI chips abroad through cloud service providers," she says. These advanced AI chips might be installed in data centers across Southeast Asian countries like Malaysia, which are increasingly serving Chinese firms.

Whether or not a "Find My" for AI chips becomes a regulatory requirement, Feldgoise envisions tighter conditions for the export of advanced AI chips. "This is based on the increasing importance of compute to national and economic security," he says. "The chips that generate compute are being seen as a strategic resource, so I would be unsurprised if the due diligence requirements on these devices increase as time passes."

Rönn views sovereignty certificates as essential tools in the future, likening it to a "lie detector" for data centers that answer the "where, how, what, and who questions for us to know that they comply with a basic standard of security when it comes to AI systems."

>