Nvidia’s AI chips can be tracked through their confidential computing features, allowing for precise location identification.
Nvidia has developed a location verification technology designed to identify the country in which its chips are operating, aiming to prevent the smuggling of its AI GPUs into regions where exports are restricted.
Sources indicate that this feature will be a software option that utilizes the “confidential computing capabilities” of Nvidia’s AI GPUs. It will leverage the latency in communication with Nvidia servers to provide a general idea of the geographic location of the chips.
In a statement, Nvidia mentioned that they are rolling out a new software service that allows data center operators to keep tabs on the health and inventory of their AI GPU fleets. This software agent, which customers will install, will use GPU telemetry to monitor fleet health, integrity, and inventory.
Initially, this software agent will be available for Blackwell GPUs, which boast enhanced security features and attestation capabilities compared to earlier models. However, Nvidia has indicated that they are also exploring options for previous generations.
Recently, the US Department of Justice announced the dismantling of a $160 million smuggling operation that involved the illegal export of Nvidia H100 and H200 GPUs to China. Earlier this year, reports suggested that around $1 billion worth of Nvidia’s AI GPUs entered China during a brief period in the Trump administration.
Former President Donald Trump stated that Nvidia would be permitted to ship H200 products to “approved customers” in China with an additional 25% fee, while H100 GPUs and other high-end AI hardware remain under export restrictions. This suggests that Nvidia is particularly interested in tracking the restricted hardware to address concerns from the Trump administration and US Congress regarding the verification of its AI products’ locations.
Earlier this year, Nvidia was called upon by Chinese authorities to confirm that its H20 chips did not contain backdoors, following security concerns raised by the Cyberspace Administration of China. Nvidia’s chief security officer, David Reber Jr., emphasized in a blog post that “There is no such thing as a ‘good’ secret backdoor—only dangerous vulnerabilities that need to be eliminated.”
The classification of this location tracking capability as a backdoor is debatable, depending on the accuracy of the sources. The tracking mechanism appears somewhat ambiguous, as it seems unlikely that a simple lag timer could accurately determine a GPU’s location beyond its country.
In theory, any hardware that communicates with a server could be tracked similarly, suggesting that Nvidia’s chips might be capable of reporting back to the US-based company in a manner that could concern the Chinese government. Interpret that as you will.
