CSET: Ping-Based Chip Tracking Is Best Option, But May Not Be Worth the Cost

Smuggling despite export controls

Since 2022, the U.S. government has restricted exports of the most advanced AI chips to China and other countries of concern. According to CSET, smugglers have repeatedly circumvented those controls and diverted hundreds of thousands of chips. One estimate cited by the center suggests that over 450,000 advanced AI chips were smuggled into China in 2024 and 2025 alone, which it equates to one to two cutting-edge AI supercomputers' worth of compute as of early 2026.

CSET's Jacob Feldgoise says two features of the chip trade make smuggling easier. The value chain is globalized: most AI chips sold abroad are designed by U.S. companies but not manufactured in the U.S., which makes diversion harder for U.S. law enforcement to detect. Designers also often do not sell directly to end users, so a chip may pass through a server manufacturer, a distributor and a reseller, and each transaction creates an opportunity for smuggling.

The true scale is unknown. Indictments by the U.S. Department of Justice and investigative journalism have revealed over ten smuggling schemes, which set a minimum. Researchers at Epoch AI and CNAS have built statistical models on top of those reports, but Feldgoise says the estimates are highly uncertain because only detected diversion is known. He compares it to an iceberg, where whether the hidden share is 50% or 90% makes a big difference.

What the report tested

The report, Tracking AI Chips: Assessing Location Verification as an Export Control Enforcement Tool, was written by Feldgoise, Kyle Miller and Hanna Dohmen. It examines tools that help regulators determine where chips are physically located. U.S. policymakers increasingly see such methods as options to detect smuggling, and the proposed Chip Security Act aims to require location verification of AI chips.

The Bureau of Industry and Security (BIS) at the Department of Commerce currently relies on trade and licensing data, all-source intelligence, industry tips, voluntary self-disclosures and overseas end-use checks. Feldgoise says these methods do detect smuggling but that the existing system is struggling to sufficiently enforce controls on AI chips. He adds that preventing smuggling completely would be impossible, and that the goal is to detect and disrupt large smuggling rings.

The team reviewed five categories of methods: physical inspections, mail-in inspections, video inspections, inventory management tools and geolocation mechanisms. Geolocation splits into GPS-based, topology-based and ping-based location verification (PLV). PLV estimates a chip's location by measuring how long signals take to travel from the chip to trusted servers and back.

The researchers judged each method against four criteria: it must be verifiable, accurate, secure and repeatable. Only physical inspections and PLV currently qualify, according to the report. The other methods fall short on security, and some also on verifiability or accuracy. After simulating more than 10 million scenarios, the team found that physical inspections did not detect more diverted chips per dollar than PLV in any of them. Physical inspections should still serve as a supplement, especially for follow-on enforcement.

Five limits of PLV and what comes next

CSET identifies five key limitations of PLV, most of which apply to other location verification methods too:

• Chips already in circulation could support PLV only if end users install a software or firmware update, which requires compliance, and hardware-based PLV cannot be added after manufacture.
• When a chip stops responding, PLV cannot tell whether it was diverted, is in storage or transit, or was deliberately disconnected.
• Well-resourced smugglers could fool PLV into reporting that a chip is where it should be, and even strong security measures cannot fully eliminate that risk.
• Even under ideal conditions, PLV would likely be accurate to about 20 miles at best, so it cannot reliably separate nearby data centers run by different entities or determine the country of a chip close to a border.
• PLV checks where chips are, not who uses them, so a transfer to an unauthorized user in the same location would go undetected.

The report recommends that BIS initially allow companies to use any method that meets all four criteria. Location verification could generate enforcement leads and raise smugglers' costs, though Feldgoise says how much deterrence that provides is unknowable.

His conclusion is cautious. If policymakers do adopt location verification, the recommendations would make it as cost-effective as possible, but given the limitations, "we're not convinced it is worth the cost." Whether or not it is adopted, he says policymakers should strengthen export control enforcement, including by bolstering BIS's traditional enforcement methods and modernizing the Bureau's IT operations.