Comments on the Advanced Computing/Supercomputing IFR: Export Control Strategy & Enforcement for AI Chips

This comment represents the views of the authors alone and not those of their employers.¹ The authors commend the Bureau of Industry and Security (BIS) for the Advanced Computing/Supercomputing interim final rule (AC/S IFR). The AC/S IFR takes essential steps to continue to improve export controls in this domain. The authors welcome the opportunity to comment on the AC/S IFR, with the hope of informing further refinements of BIS’ approach to export controls on AI-related technologies. Comments focus specifically on the following three areas, and include text and findings from previous research by the authors:²

1. Strategy: The need for an explicit strategy for export controls on AI-related technologies, such that controls on semiconductor manufacturing equipment, AI chips, supercomputers, infrastructure-as-a-service, and AI models can be aligned toward the same goals.
2. Enforcement for AI chips: Highlighting promising interventions for addressing controlled AI chip diversion: creating new country groups that reflect AI chip diversion risk, and implementing a chip registry and random chip inspection program to effectively address diversion.
3. The definition of “data center” AI chips: Evaluating BIS’s proposed high-level definition of data center AI chips, used to distinguish such chips from consumer-grade variants, and emphasizing that the problem of distinguishing the two is to some extent intractable. This is a response to Section D, question 5 within the AC/S IFR.

Export controls on AI-related technologies will benefit from a more explicit strategy

How difficult is the enforcement challenge facing BIS, given the AI capabilities it seeks to restrict the PRC from accessing? The AC/S IFR, building on the October 7th, 2022 IFR, lists the following capabilities as those the export controls aim to restrict:³

• China’s military modernization, e.g. planning, logistics
• High-tech surveillance applications
• Weapons of mass destruction (WMD) design and execution
• Advanced weapons design and execution, such as autonomous combat systems, enhanced battlefield situational awareness, target recognition, and cyber attacks.

This list of capabilities implies that export controls should seek to restrict access to a wide range of AI systems, with varying development requirements in terms of export-controlled hardware. This is summarized in Figure A below. As noted by BIS, large dual-use AI foundation models (the first category in Figure A below), with a wide variety of potential capabilities of concern, are particularly problematic.⁴ To cost-effectively train a cutting-edge model of this kind requires thousands to tens of thousands of export-controlled chips, making enforcement relatively tractable. However, cutting-edge application-specific AI models used in areas such as code generation, protein sequence prediction, image classification, and robotic navigation currently require many fewer export-controlled chips to train (tens to hundreds). These models are likely to increasingly possess capabilities highly relevant to the kinds of capabilities BIS seeks to restrict. Preventing actors in the PRC from acquiring the relatively small number of export-controlled chips required to train these models poses a highly difficult problem for enforcement. In a recent paper, the authors estimate that by 2025, assuming no significant changes in BIS’ enforcement approach, PRC-linked actors may be able to smuggle on the order of thousands to tens of thousands of chips per year if they aim to do so.⁵ Further, given their relatively small computational requirements, application-specific models in BIS’ domains of concern can be fairly cost-effectively developed with non-controlled hardware, such as consumer GPUs used for gaming.