Preventing AI Chip Smuggling to China

How many smuggled AI chips are too many?

A recent body of research highlights the national security risks posed by highly capable general-purpose AI systems.¹³ Two emerging capability profiles in such systems relevant to export controls are weaponizable scientific research in the bio/chem domains and autonomous offensive cyber operations.¹⁴

To develop a general-purpose model at the current frontier, an AI lab needs thousands or even tens of thousands of AI chips.¹⁵ While one could theoretically train such a model using fewer or older AI chips, this practice is both more costly and more time-intensive.

The PRC needs enough AI chips to supply multiple AI labs to keep pace with U.S. AI progress. If enforcement programs could limit flows to tens or hundreds of chips per year, this would significantly hinder the PRC’s ability to develop and deploy leading general-purpose dual-use models both now and into the future. Even if Chinese labs could still access enough smuggled chips to use them for large-scale AI training, efforts to curb smuggling will make these activities more costly, increasing the resources the PRC will have to spend to keep pace with the United States. Ideally, the maximum number of AI chips smuggled into China each year would be well below that needed by a single AI lab, on the order of tens or hundreds per year.

How many chips will PRC-linked actors be able to smuggle?

The authors estimate that PRC-linked actors will be able to smuggle on the order of thousands to tens of thousands of AI chips per year if they aim to do so. This estimate is based on:

• An analysis of possible AI chip smuggling pathways, including the feasibility of surreptitiously procuring AI chips in various third countries, and the feasibility of transporting these chips into China.
• An analysis of current enforcement activities, as well as the compliance practices of large exporters. The authors assume that the Commerce Department’s Bureau of Industry and Security (BIS) can pursue enforcement activities at roughly its current funding level.
• Numerical simulations of a range of possible outcomes from the two large-scale smuggling pathways that we see as most likely. The results are below. Further details on this analysis, including the code used, can be found here.

These estimates are highly uncertain given the lack of solid data on AI chip smuggling to date and the complex dynamics involved in large-scale smuggling operations. Under various plausible assumptions, simulated results suggest a concerted smuggling effort could yield anywhere from hundreds to hundreds of thousands of chips per year—a wide range of possible outcomes. As a sense-check, the upper bound implies that ~4 percent of all AI chips produced worldwide could be smuggled to China in 2025, in the most optimistic case for smugglers.

While this analysis is based as much as possible on publicly available data sources, it inevitably involves many subjective assessments about the range and success rates of common/likely smuggling practices. These estimates should be taken primarily as an indication that large-scale smuggling of AI chips by PRC-linked actors is at least plausible.

Recommendations

The same measures that can prevent AI chip smuggling to China can also help secure the AI compute supply chain against rogue states and dangerous non-state actors. As AI grows in importance both as a source of national power and national security risk, better knowledge and control of AI chip flows will help prevent them from falling into the wrong hands.

The authors have evaluated, at a high level, a wide range of possible interventions to address large-scale AI chip smuggling. Interventions were developed using a “blue sky” approach to identify the maximum set of initially promising options. Interventions were ranked based on the following criteria:

• Interventions that can scale without consuming significant government resources, to account for a potentially rapidly increasing global stockpile of controlled chips.
• Interventions that do not require additional appropriations from Congress.
• Interventions that focus on the point of sale for AI chips, given the concentration of the market in a few key firms. This is as opposed to interventions that focus on diversion prior to the point of sale, or that target shipping into China from various third countries.
• Interventions that can be location agnostic, given the risks posed by smuggling AI chips to actors outside China (Russia, terrorist/criminal groups).

The authors then consulted with government and industry export control experts to filter and improve the list.

Recommendation 1: BIS should pilot an AI chip registry and inspection program.

• A primary problem for AI chip export control enforcement is that BIS has no reliable way of knowing where chips are supposed to be located. To address this problem, BIS should start collecting data for a registry of exported AI chips. Data could be collected using a reporting requirement under a “presumption of approval” license, similar to existing post-shipment verification reporting requirements for certain high-performance computers.¹⁶
• A registry would allow BIS to pilot a chip inspection program. This program could use random sampling to provide statistical confidence that large-scale smuggling is not occurring while minimizing cost and operational overhead, especially in the context of a rapidly increasing global stockpile of controlled chips.
• Based on our modeling, to have 90 percent confidence that smuggling had not occurred at a large scale (≥10,000 chips smuggled) within any 6-month period, BIS would need to sample 1 in every 2,000 chips. This would mean:
  • ~500 inspections per year with a global supply of 1 million exported controlled chips (our estimate of the existing stock of exported controlled chips).
  • ~5,000 inspections per year once the global supply of exported controlled chips reaches 10 million.¹⁷
• Inspections could take several forms. A cost-minimizing option is short-notice mail-in of chips to regional U.S. Commercial Service Offices. Given the vast majority of export-controlled chips are used in large data centers, using existing maintenance processes could potentially minimize logistical overhead.
• A pilot version of this program could potentially be implemented at low cost (< $1 million) by establishing the registry itself and allocating a portion of BIS’s existing end-use verification check capacity to chip inspections.
• A scaled-up version of this program able to inspect 30,000 chips per year (enough for the expected global stockpile of exported controlled chips through the rest of this decade) is estimated to cost $10–12 million (~5 percent of BIS’s 2023 budget).
• The technical annex at the end of this post contains further details on the setup and logistics of this program.

Recommendation 2: To ensure AI chip exporters carry out rigorous customer screening targeted at key vectors for large-scale smuggling, the Department of Commerce should consider a new license or reporting requirement for high-volume chip exports.

• High-volume exports are one potential high-risk vector for AI chip smuggling, as described in Pathway 2 of the smuggling analysis in this post.
• To reduce the burden of a new licensing program on BIS, licenses could come with a presumption of approval but mandate certain customer screening measures. For example:
  • Making a visit to the final end user’s facilities prior to and/or after shipment.
  • Making sure sales are approved by personnel located in the United States.
  • Contractually obliging end users to get the appropriate license from BIS before reselling any of the exported chips.
• Another way to reduce the burden on both BIS and chip exporters would be to require only a one-time license application and review for each end user, allowing exports of unlimited quantities to the end user once its bona fides have been verified. This would be similar to Encryption Licensing Arrangements.¹⁸
• § 740.3 is an existing regulation that applies to shipments of limited value, which could be amended to be defined either in dollar terms or in terms of unit quantities.¹⁹ This regulation also forbids orders to be split to circumvent limits (though, of course, smugglers could ignore this on the customer side).

Recommendation 3: To coordinate enforcement internationally, the U.S. government should consider end-user verification programs in Southeast Asia.

• BIS carried out about 1,000 end-use checks in 2021, about one-tenth of which were pre-license checks (verifying buyers’ bona fides and the information given in the license application) and nine-tenths post-shipment verifications (verifying that goods were shipped and are being used as intended).²⁰
• Ideally, this number would be far greater, but BIS’s budget constraints make that difficult to achieve. To increase the number of end-use checks being performed, the U.S. government could encourage key third countries (India, Indonesia, Malaysia, Philippines, Singapore, Taiwan, Thailand, United Arab Emirates, and Vietnam) to implement their own end-user verification programs.
• These programs could be based on BIS’s own enforcement activities, and BIS personnel could help train export officers in these countries.²¹
• The U.S. could incentivize these countries to implement such measures as part of a negotiated trade agreement or by offering some other incentive. The Indo-Pacific Economic Framework, which aims in part to promote “resilient and secure supply chains that are diverse, open, and predictable,” could be one vehicle for this.²²

Recommendation 4: To properly equip BIS for its mission, Congress should appropriate ~$57 million in additional annual funding for FY2025.

• BIS’s budget has not grown in proportion to the number of dual-use technologies it is expected to control and the growing evasion capabilities of adversaries. The current process for uncovering smuggling activities can take years, in part due to understaffing and difficulties in making use of existing data on trade flows and licensing.²³
• BIS’s core budget for export control administration and enforcement has increased only slightly (~2.5 percent) since 2020 after accounting for inflation, despite the considerable expansion of its enforcement responsibilities.²⁴ Funding is currently set to decrease in 2024 compared to 2023 levels.²⁵
• The total figure includes both the cost to implement a comprehensive AI chip registry and random sampling program (~$10–12 million) and the cost of modernizing BIS’s enforcement capabilities in line with a set of recommendations from the Center for Strategic and International Studies (~$45 million).²⁶
• Though appropriating additional funding may be politically challenging, it seems likely that this funding will be required in the coming years as the global stockpile of exported controlled chips continues to grow.

Technical annex: random chip sampling program logistics

A random chip sampling program could take several forms. A scaled-back, pilot version of this program could involve establishing a chip registry (step 1 below) and then directing a portion of BIS’s existing end-use verification check capacity toward verifying the location of AI chips, selecting chips for inspection using random sampling as per the methodology described below. Such a program could potentially be implemented at quite a low cost (< $1 million), with the main expense likely the one-off cost of establishing the registry itself.

A more comprehensive program is outlined in more detail below. This more comprehensive version builds in the capacity to inspect 30,000 chips per year, enough for a global stockpile of 70 million controlled chips (around 70 times greater than today’s stockpile). The overall annual cost of a comprehensive program is estimated to be ~$11 million.

Program steps

1. Deploy a centralized registry of chip ownership, with reporting requirements when chips are resold, destroyed, or lost.
2. Every 2 weeks, BIS selects a random set of IDs from the registry and notifies the chips’ owners that they must submit to a short-notice inspection. Inspections could take several forms. One cost-minimizing approach is short-notice mail-in of chips to regional U.S. Commercial Service/Export Control Offices.²⁷
3. BIS personnel inspect chips for ID matches and evidence of tampering and check package receipts to ensure the chip came from the expected origin (if a mail-in program is used).
4. Chips are returned to their owners within a day or two of having been received.
5. If a chip owner fails to send a chip that it is supposed to own within the allowable time frame, or if a chip has been visibly tampered with or fails to pass inspection, BIS can choose to take further actions:
   1. Investigations of the chip owner, and/or any of the chip’s previous owners.
   2. End-user checks at the owner’s facilities.
   3. Issuing a temporary denial order, if the chip owner may intend to purchase more controlled chips.

How many inspections would be required?

A state-of-the-art Chinese supercomputer/large AI cluster would need many thousands of smuggled chips. An inspection program does not need to detect every smuggled chip; it only needs to detect enough chips to ascertain whether large-scale smuggling is actually occurring.

With a stockpile of 1 million export-controlled chips (our current estimate of today’s supply), how many inspections would be required to have 90 percent confidence that more than 10,000 had not been smuggled?

Global stockpile of controlled chips: S
Minimum number of smuggled chips to detect (e.g., number of chips in a large AI training cluster): N
Required confidence: p

Number of required inspections can then be calculated as:

For S = 1 million, N = 10,000, and p = 0.9, this comes to 229 inspections. For 90 percent confidence within any six-month period, this becomes ~460 inspections per year.

In general, 1 out of every 2,000 chips in the global stockpile would need to be inspected each year to have 90 percent confidence within any six-month period. This assumes all chips are viewed as equally risky, but many chips can likely be inspected much less frequently, e.g., those being exported to data centers belonging to trusted cloud service providers.

How much would each inspection cost?

We estimate the shipping cost for a single GPU within the same continent at $50. BIS could also maintain a replacement stock of controlled chips to minimize the burden of inspections on chip owners. Shipping these would cost an additional $50 per chip. The time required by inspection staff would likely be under 10 minutes per chip. With the additional burden placed on local logistical operations, we estimate $50 for staff time per chip, on top of the fixed costs of salaries described below.

What about fixed costs?

Staffing the program would require ~three staff in a central location plus one staff member in each designated U.S. Commercial Service Office (with 30 worldwide, each of which could handle up to 1,000 inspections per office per year). If the total cost to the government for each staff member (including salary and other overheads) is approximately $300,000, this amounts to $9.9 million annually.²⁸ The machines used to do verification can be cheap (a high-resolution camera to check for tampering, and a simple plug-in scanner to verify the chip’s ID). We estimate $10,000 for both, with two of each needed at every field office once every five years ($120,000/year). Maintaining a stockpile of controlled chips for swap-out purposes would cost around $800,000 per year, assuming 100 chips at $40,000 each, amortized over five years.

Total costs

($200 per inspection x 500 inspections per year) for inspection costs, plus ($9.9 million +$ 0.12 million + $0.8 million per year) for fixed costs = approximately $10.92 million per year. For 5,000 inspections per year, total costs would be around $11.82 million per year. Fixed costs remain similar, as a capacity of 30,000 inspections/year has already been built into the estimates above.

There are no doubt many other complicating factors and extra costs when implementing such a program. As a comparison point, we use Information and Communications Technology and Services (ICTS), the most recent program implemented by BIS. BIS’s FY2023 budget submission puts the estimated annual cost of ICTS at ~$37.6 million, involving 114 new positions.²⁹ Assuming total cost per new position is similar, this suggests a cost of ~$10.9 million for our program.

Minimizing the burden of the program on chip-maker/-owners

The “gold standard” for inspection is on-site inspections. However, the chips’ small size means that a mail-in system could potentially be used instead. How would this work?

• The BIS would contact the chips’ owners and notify them that they must mail the relevant chip(s) to a U.S. Commercial Service branch (30 worldwide) within a period short enough to assure the chips were already in-country. This relies on the premise that sending chips from Russia or China would be either highly detectible or prohibitive from a logistics perspective within the allowed time frame.
• Where a chip’s owner does not have physical access to the chip, the owner is responsible for coordinating with the firm that does have physical chip access.
• To make the scheme more well-targeted, the following modifications could be made:
  • Target more inspections toward chip purchasers who represent heightened smuggling risk and fewer inspections toward trusted firms.
  • Exempt small-scale purchases (e.g., 8 or fewer chips), so long as that segment of the market remains small.

One potential issue is the business disruption of removing a GPU from a data center for inspection. Solving this problem could be straightforward: Data centers have existing processes for swapping out for chips that require maintenance. A quick analysis suggests the number of swaps required by our inspection scheme is 10–100x less than the number of swaps already required based on expected hardware-level failures in large data centers. Specifically:

• Data on device-level GPU failure rates in data centers from a large-scale study on the Titan XK7 supercomputer indicate that the “mean time between failures” (MTBF³⁰) for hardware-level failures on data center GPUs is ~3 years, which translates into an annual failure rate (AFR) of ~28 percent. ³¹
• Failure rates will depend on the specific hardware being used. The MTBF specification of the GPU used in the Titan XK7 (the Tesla K20) is 16 years.³² This translates to an AFR of 3.87 percent. This suggests the MTBF of data center GPUs used in supercomputing applications can be ~5x shorter in duration than the specification.
• While there are no publicly available sources of information on failure rates of export-controlled AI chips in intensive data center settings, we can use the A100 (the most widespread controlled AI chip) spec sheet to make an estimate. The MTBF specification for the A100 is 108 years, translating into an AFR of 0.92 percent.³³ If we assume that the MTBF of the A100 in actual intensive data center settings is ~5x shorter than the reported figure, this leads to an AFR of ~5 percent.
• As a sense-check, we compare these numbers with failure reports for consumer GPUs, which have a 2.5 percent AFR.³⁴ These cards typically operate in less demanding conditions than data center GPUs (occasional instead of continuous use).
• In summary:
  • Inspections require 1 in every 2,000 chips to be swapped out each year.
  • The expected annual failure rate for export-controlled chips based on the above analysis is ~5 percent, meaning ~100 chips out of every 2,000 chips will need to be swapped out per year.
  • If we take the maximum MTBF reported by NVIDIA for the A100, the annual failure rate is 0.67 percent, meaning 13 chips out of every 2,000 chips will need to be swapped out per year. This represents the most optimistic case for GPU reliability.
  • The additional burden introduced by a random chip sampling program for data centers could therefore be minimal: the number of swaps already required by hardware failures will likely be ~10–100x greater.

For smaller customers (or if using existing reserve stocks proves difficult for large data centers), BIS could maintain a reserve stock of GPUs (usage-weighted across the different products that fall under 3A090/4A090) to play the same role. The above cost estimates take this into account by building in the cost of maintaining a reserve stock of 100 chips: approximately the number of chips that would be required to swap out half of the chips being inspected in any two-week period with 5,000 inspections per year.

About the Authors

Tim Fist is a Fellow with the Technology and National Security Program at CNAS. Fist has an engineering background and previously worked as the Head of Strategy & Governance at Fathom Radiant, an AI hardware company. Prior to that, Fist worked as a machine learning engineer. Fist holds a B.A. (Honors) in Aerospace Engineering and a B.A. in Political Science from Monash University.

Erich Grunewald is an Associate Researcher on the compute governance team at Institute for AI Policy & Strategy (IAPS). He previously worked as a programmer and earned a BSc in Computer Engineering and an MSc in Interaction Design from Chalmers University of Technology.

About the Technology and National Security Program

The CNAS Technology and National Security program explores the policy challenges associated with emerging technologies. A key focus of the program is bringing together the technology and policy communities to better understand these challenges and together develop solutions.

About the Artificial Intelligence Safety & Stability Project

The CNAS AI Safety & Stability Project is a multiyear, multiprogram effort that addresses the established and emerging risks associated with artificial intelligence. Our work is focused on anticipating and mitigating catastrophic AI failures; improving the U.S. Department of Defense’s processes for AI testing and evaluation; understanding and shaping opportunities for compute governance; understanding Chinese decision-making on AI and stability; and understanding Russian decision-making on AI and stability.

Acknowledgments

The authors would like to acknowledge the CNAS Publications Teams for their support, design, and editing. The authors would also like to thank Paul Scharre, Executive Vice President and Director of Studies, for reviews of various iterations of this work. This project is made possible with the generous support of Open Philanthropy.

As a research and policy institution committed to the highest standards of organizational, intellectual, and personal integrity, CNAS maintains strict intellectual independence and sole editorial direction and control over its ideas, projects, publications, events, and other research activities. CNAS does not take institutional positions on policy issues, and the content of CNAS publications reflects the views of their authors alone. In keeping with its mission and values, CNAS does not engage in lobbying activity and complies fully with all applicable federal, state, and local laws. CNAS will not engage in any representational activities or advocacy on behalf of any entities or interests and, to the extent that the Center accepts funding from non-U.S. sources, its activities will be limited to bona fide scholastic, academic, and research-related activities, consistent with applicable federal law. The Center publicly acknowledges on its website annually all donors who contribute.