October 24, 2023

Preventing AI Chip Smuggling to China

A Working Paper

China cannot legally import the most advanced artificial intelligence (AI) chips or the tooling to produce them. The large and growing computational requirements of the most powerful AI systems mean that these chips are nonetheless in high demand. Chinese tech giants recently placed $5 billion worth of orders for non-controlled U.S. AI chips, and there are active underground markets for these chips’ controlled counterparts. To the extent that it does and will happen, AI chip smuggling into China should not come as a surprise. The People’s Republic of China (PRC) has a long history of diverting U.S. technology to restricted end uses and users, despite U.S. export restrictions. Many goods being smuggled into Russia today—including goods destined for Russia’s military—pass through China. In 2022 alone, about $570 million worth of U.S. chips were sold to Russia from Hong Kong and mainland China, despite sanctions.

This post, which summarizes and builds on earlier research by the authors, tackles the following questions:

  • What’s the state of AI chip smuggling to China today?
  • What incentives exist for PRC-linked actors to smuggle AI chips at large scales?
  • How many smuggled AI chips are too many?
  • What magnitude of AI chip smuggling to China should we expect in the coming years?
  • Which interventions can cost-effectively reduce AI chip smuggling to China?

The state of AI chip smuggling

There is a considerable demand for AI chips in China today. Prices have risen dramatically, and market sources report that new orders for chips that are just under export control performance thresholds will take over half a year to be delivered. Despite impressive progress to date, indigenous Chinese chips will likely lag in performance compared to chips from the United States and its allies for years to come. This all makes smuggling a potentially lucrative endeavor.

There are already underground markets for small quantities of smuggled AI chips, according to on-the-ground reports from Shenzhen. Evidence of this is also available online: A video on Chinese social media shows a person who seems to have illegally obtained four NVIDIA H100 GPUs. Little information is available on ongoing AI chip smuggling activities; the authors’ best guess is that only a relatively small number of controlled AI chips will make it into China in 2023, likely in the hundreds, but plausibly in the low thousands.

Why might PRC-linked actors seek to smuggle AI chips at scale?

Chinese smuggling efforts currently seem driven more by independent entrepreneurs than sophisticated state-backed smuggling networks. There are three key reasons to expect more formalized, large-scale smuggling efforts in the future:

  1. As AI systems grow more powerful, researching and developing powerful AI models will become a higher priority for the Chinese state, industry, and military. Given the empirically observed relationship between compute-intensiveness and AI capabilities at the frontier of R&D, this would mean greater need and demand for cutting-edge AI chips. As a direct analogy, Iran and North Korea built their nuclear programs through smuggling dual-use goods from other countries.
  2. The gap in performance between what’s legally available in China and what’s available outside China will grow. Despite recent progress in Chinese 7nm chip production, Chinese chipmakers still operate under greater constraints than their foreign counterparts. Simply importing chips won’t make up this difference. Current export controls set a fixed performance threshold for AI chips available for export to China. Meanwhile, high-end AI chips outside China continue to improve, with performance per dollar doubling roughly every two years.
  3. The global amount of export-controlled AI chips will increase rapidly in the coming years. More chips means more opportunities for diversion. With fixed performance thresholds for export controls, more and more AI chips will exceed those thresholds as companies release improved products. The market for AI chips is also predicted to grow by ~30 percent per year. When combined with current and projected sales figures for NVIDIA chips, this results in the following forecast. Note that this forecast is restricted to NVIDIA chips, so it is likely an under-estimate.

How many smuggled AI chips are too many?

A recent body of research highlights the national security risks posed by highly capable general-purpose AI systems. Two emerging capability profiles in such systems relevant to export controls are weaponizable scientific research in the bio/chem domains and autonomous offensive cyber operations.

To develop a general-purpose model at the current frontier, an AI lab needs thousands or even tens of thousands of AI chips. While one could theoretically train such a model using fewer or older AI chips, this practice is both more costly and more time-intensive.

The PRC needs enough AI chips to supply multiple AI labs to keep pace with U.S. AI progress. If enforcement programs could limit flows to tens or hundreds of chips per year, this would significantly hinder the PRC’s ability to develop and deploy leading general-purpose dual-use models both now and into the future. Even if Chinese labs could still access enough smuggled chips to use them for large-scale AI training, efforts to curb smuggling will make these activities more costly, increasing the resources the PRC will have to spend to keep pace with the United States. Ideally, the maximum number of AI chips smuggled into China each year would be well below that needed by a single AI lab, on the order of tens or hundreds per year.

How many chips will PRC-linked actors be able to smuggle?

The authors estimate that PRC-linked actors will be able to smuggle on the order of thousands to tens of thousands of AI chips per year if they aim to do so. This estimate is based on:

  • An analysis of possible AI chip smuggling pathways, including the feasibility of surreptitiously procuring AI chips in various third countries, and the feasibility of transporting these chips into China.
  • An analysis of current enforcement activities, as well as the compliance practices of large exporters. The authors assume that the Commerce Department’s Bureau of Industry and Security (BIS) can pursue enforcement activities at roughly its current funding level.
  • Numerical simulations of a range of possible outcomes from the two large-scale smuggling pathways that we see as most likely. The results are below. Further details on this analysis, including the code used, can be found here.

These estimates are highly uncertain given the lack of solid data on AI chip smuggling to date and the complex dynamics involved in large-scale smuggling operations. Under various plausible assumptions, simulated results suggest a concerted smuggling effort could yield anywhere from hundreds to hundreds of thousands of chips per year—a wide range of possible outcomes. As a sense-check, the upper bound implies that ~4 percent of all AI chips produced worldwide could be smuggled to China in 2025, in the most optimistic case for smugglers.

While this analysis is based as much as possible on publicly available data sources, it inevitably involves many subjective assessments about the range and success rates of common/likely smuggling practices. These estimates should be taken primarily as an indication that large-scale smuggling of AI chips by PRC-linked actors is at least plausible.


The same measures that can prevent AI chip smuggling to China can also help secure the AI compute supply chain against rogue states and dangerous non-state actors. As AI grows in importance both as a source of national power and national security risk, better knowledge and control of AI chip flows will help prevent them from falling into the wrong hands.

The authors have evaluated, at a high level, a wide range of possible interventions to address large-scale AI chip smuggling. Interventions were developed using a “blue sky” approach to identify the maximum set of initially promising options. Interventions were ranked based on the following criteria:

  • Interventions that can scale without consuming significant government resources, to account for a potentially rapidly increasing global stockpile of controlled chips.
  • Interventions that do not require additional appropriations from Congress.
  • Interventions that focus on the point of sale for AI chips, given the concentration of the market in a few key firms. This is as opposed to interventions that focus on diversion prior to the point of sale, or that target shipping into China from various third countries.
  • Interventions that can be location agnostic, given the risks posed by smuggling AI chips to actors outside China (Russia, terrorist/criminal groups).

The authors then consulted with government and industry export control experts to filter and improve the list.

Recommendation 1: BIS should pilot an AI chip registry and inspection program.

  • A primary problem for AI chip export control enforcement is that BIS has no reliable way of knowing where chips are supposed to be located. To address this problem, BIS should start collecting data for a registry of exported AI chips. Data could be collected using a reporting requirement under a “presumption of approval” license, similar to existing post-shipment verification reporting requirements for certain high-performance computers.
  • A registry would allow BIS to pilot a chip inspection program. This program could use random sampling to provide statistical confidence that large-scale smuggling is not occurring while minimizing cost and operational overhead, especially in the context of a rapidly increasing global stockpile of controlled chips.
  • Based on our modeling, to have 90 percent confidence that smuggling had not occurred at a large scale (≥10,000 chips smuggled) within any 6-month period, BIS would need to sample 1 in every 2,000 chips. This would mean:
    • ~500 inspections per year with a global supply of 1 million exported controlled chips (our estimate of the existing stock of exported controlled chips).
    • ~5,000 inspections per year once the global supply of exported controlled chips reaches 10 million.
  • Inspections could take several forms. A cost-minimizing option is short-notice mail-in of chips to regional U.S. Commercial Service Offices. Given the vast majority of export-controlled chips are used in large data centers, using existing maintenance processes could potentially minimize logistical overhead.
  • A pilot version of this program could potentially be implemented at low cost (< $1 million) by establishing the registry itself and allocating a portion of BIS’s existing end-use verification check capacity to chip inspections.
  • A scaled-up version of this program able to inspect 30,000 chips per year (enough for the expected global stockpile of exported controlled chips through the rest of this decade) is estimated to cost $10–12 million (~5 percent of BIS’s 2023 budget).
  • The technical annex at the end of this post contains further details on the setup and logistics of this program.

Recommendation 2: To ensure AI chip exporters carry out rigorous customer screening targeted at key vectors for large-scale smuggling, the Department of Commerce should consider a new license or reporting requirement for high-volume chip exports.

  • High-volume exports are one potential high-risk vector for AI chip smuggling, as described in Pathway 2 of the smuggling analysis in this post.
  • To reduce the burden of a new licensing program on BIS, licenses could come with a presumption of approval but mandate certain customer screening measures. For example:
    • Making a visit to the final end user’s facilities prior to and/or after shipment.
    • Making sure sales are approved by personnel located in the United States.
    • Contractually obliging end users to get the appropriate license from BIS before reselling any of the exported chips.
  • Another way to reduce the burden on both BIS and chip exporters would be to require only a one-time license application and review for each end user, allowing exports of unlimited quantities to the end user once its bona fides have been verified. This would be similar to Encryption Licensing Arrangements.
  • § 740.3 is an existing regulation that applies to shipments of limited value, which could be amended to be defined either in dollar terms or in terms of unit quantities. This regulation also forbids orders to be split to circumvent limits (though, of course, smugglers could ignore this on the customer side).

Recommendation 3: To coordinate enforcement internationally, the U.S. government should consider end-user verification programs in Southeast Asia.

  • BIS carried out about 1,000 end-use checks in 2021, about one-tenth of which were pre-license checks (verifying buyers’ bona fides and the information given in the license application) and nine-tenths post-shipment verifications (verifying that goods were shipped and are being used as intended).
  • Ideally, this number would be far greater, but BIS’s budget constraints make that difficult to achieve. To increase the number of end-use checks being performed, the U.S. government could encourage key third countries (India, Indonesia, Malaysia, Philippines, Singapore, Taiwan, Thailand, United Arab Emirates, and Vietnam) to implement their own end-user verification programs.
  • These programs could be based on BIS’s own enforcement activities, and BIS personnel could help train export officers in these countries.
  • The U.S. could incentivize these countries to implement such measures as part of a negotiated trade agreement or by offering some other incentive. The Indo-Pacific Economic Framework, which aims in part to promote “resilient and secure supply chains that are diverse, open, and predictable,” could be one vehicle for this.

Recommendation 4: To properly equip BIS for its mission, Congress should appropriate ~$57 million in additional annual funding for FY2025.

  • BIS’s budget has not grown in proportion to the number of dual-use technologies it is expected to control and the growing evasion capabilities of adversaries. The current process for uncovering smuggling activities can take years, in part due to understaffing and difficulties in making use of existing data on trade flows and licensing.
  • BIS’s core budget for export control administration and enforcement has increased only slightly (~2.5 percent) since 2020 after accounting for inflation, despite the considerable expansion of its enforcement responsibilities. Funding is currently set to decrease in 2024 compared to 2023 levels.
  • The total figure includes both the cost to implement a comprehensive AI chip registry and random sampling program (~$10–12 million) and the cost of modernizing BIS’s enforcement capabilities in line with a set of recommendations from the Center for Strategic and International Studies (~$45 million).
  • Though appropriating additional funding may be politically challenging, it seems likely that this funding will be required in the coming years as the global stockpile of exported controlled chips continues to grow.

Technical annex: random chip sampling program logistics

A random chip sampling program could take several forms. A scaled-back, pilot version of this program could involve establishing a chip registry (step 1 below) and then directing a portion of BIS’s existing end-use verification check capacity toward verifying the location of AI chips, selecting chips for inspection using random sampling as per the methodology described below. Such a program could potentially be implemented at quite a low cost (< $1 million), with the main expense likely the one-off cost of establishing the registry itself.

A more comprehensive program is outlined in more detail below. This more comprehensive version builds in the capacity to inspect 30,000 chips per year, enough for a global stockpile of 70 million controlled chips (around 70 times greater than today’s stockpile). The overall annual cost of a comprehensive program is estimated to be ~$11 million.

Program steps

  1. Deploy a centralized registry of chip ownership, with reporting requirements when chips are resold, destroyed, or lost.
  2. Every 2 weeks, BIS selects a random set of IDs from the registry and notifies the chips’ owners that they must submit to a short-notice inspection. Inspections could take several forms. One cost-minimizing approach is short-notice mail-in of chips to regional U.S. Commercial Service/Export Control Offices.
  3. BIS personnel inspect chips for ID matches and evidence of tampering and check package receipts to ensure the chip came from the expected origin (if a mail-in program is used).
  4. Chips are returned to their owners within a day or two of having been received.
  5. If a chip owner fails to send a chip that it is supposed to own within the allowable time frame, or if a chip has been visibly tampered with or fails to pass inspection, BIS can choose to take further actions:
    1. Investigations of the chip owner, and/or any of the chip’s previous owners.
    2. End-user checks at the owner’s facilities.
    3. Issuing a temporary denial order, if the chip owner may intend to purchase more controlled chips.

How many inspections would be required?

A state-of-the-art Chinese supercomputer/large AI cluster would need many thousands of smuggled chips. An inspection program does not need to detect every smuggled chip; it only needs to detect enough chips to ascertain whether large-scale smuggling is actually occurring.

With a stockpile of 1 million export-controlled chips (our current estimate of today’s supply), how many inspections would be required to have 90 percent confidence that more than 10,000 had not been smuggled?

Global stockpile of controlled chips: S
Minimum number of smuggled chips to detect (e.g., number of chips in a large AI training cluster): N
Required confidence: p

Number of required inspections can then be calculated as:

ln (1 – p) / ln (1 – N/S)

For S = 1 million, N = 10,000, and p = 0.9, this comes to 229 inspections. For 90 percent confidence within any six-month period, this becomes ~460 inspections per year.

In general, 1 out of every 2,000 chips in the global stockpile would need to be inspected each year to have 90 percent confidence within any six-month period. This assumes all chips are viewed as equally risky, but many chips can likely be inspected much less frequently, e.g., those being exported to data centers belonging to trusted cloud service providers.

How much would each inspection cost?

We estimate the shipping cost for a single GPU within the same continent at $50. BIS could also maintain a replacement stock of controlled chips to minimize the burden of inspections on chip owners. Shipping these would cost an additional $50 per chip. The time required by inspection staff would likely be under 10 minutes per chip. With the additional burden placed on local logistical operations, we estimate $50 for staff time per chip, on top of the fixed costs of salaries described below.

What about fixed costs?

Staffing the program would require ~three staff in a central location plus one staff member in each designated U.S. Commercial Service Office (with 30 worldwide, each of which could handle up to 1,000 inspections per office per year). If the total cost to the government for each staff member (including salary and other overheads) is approximately $300,000, this amounts to $9.9 million annually. The machines used to do verification can be cheap (a high-resolution camera to check for tampering, and a simple plug-in scanner to verify the chip’s ID). We estimate $10,000 for both, with two of each needed at every field office once every five years ($120,000/year). Maintaining a stockpile of controlled chips for swap-out purposes would cost around $800,000 per year, assuming 100 chips at $40,000 each, amortized over five years.

Total costs

($200 per inspection x 500 inspections per year) for inspection costs, plus ($9.9 million +$ 0.12 million + $0.8 million per year) for fixed costs = approximately $10.92 million per year. For 5,000 inspections per year, total costs would be around $11.82 million per year. Fixed costs remain similar, as a capacity of 30,000 inspections/year has already been built into the estimates above.

There are no doubt many other complicating factors and extra costs when implementing such a program. As a comparison point, we use Information and Communications Technology and Services (ICTS), the most recent program implemented by BIS. BIS’s FY2023 budget submission puts the estimated annual cost of ICTS at ~$37.6 million, involving 114 new positions. Assuming total cost per new position is similar, this suggests a cost of ~$10.9 million for our program.

Minimizing the burden of the program on chip-maker/-owners

The “gold standard” for inspection is on-site inspections. However, the chips’ small size means that a mail-in system could potentially be used instead. How would this work?

  • The BIS would contact the chips’ owners and notify them that they must mail the relevant chip(s) to a U.S. Commercial Service branch (30 worldwide) within a period short enough to assure the chips were already in-country. This relies on the premise that sending chips from Russia or China would be either highly detectible or prohibitive from a logistics perspective within the allowed time frame.
  • Where a chip’s owner does not have physical access to the chip, the owner is responsible for coordinating with the firm that does have physical chip access.
  • To make the scheme more well-targeted, the following modifications could be made:
    • Target more inspections toward chip purchasers who represent heightened smuggling risk and fewer inspections toward trusted firms.
    • Exempt small-scale purchases (e.g., 8 or fewer chips), so long as that segment of the market remains small.

One potential issue is the business disruption of removing a GPU from a data center for inspection. Solving this problem could be straightforward: Data centers have existing processes for swapping out for chips that require maintenance. A quick analysis suggests the number of swaps required by our inspection scheme is 10–100x less than the number of swaps already required based on expected hardware-level failures in large data centers. Specifically:

  • Data on device-level GPU failure rates in data centers from a large-scale study on the Titan XK7 supercomputer indicate that the “mean time between failures” (MTBF) for hardware-level failures on data center GPUs is ~3 years, which translates into an annual failure rate (AFR) of ~28 percent.
  • Failure rates will depend on the specific hardware being used. The MTBF specification of the GPU used in the Titan XK7 (the Tesla K20) is 16 years. This translates to an AFR of 3.87 percent. This suggests the MTBF of data center GPUs used in supercomputing applications can be ~5x shorter in duration than the specification.
  • While there are no publicly available sources of information on failure rates of export-controlled AI chips in intensive data center settings, we can use the A100 (the most widespread controlled AI chip) spec sheet to make an estimate. The MTBF specification for the A100 is 108 years, translating into an AFR of 0.92 percent. If we assume that the MTBF of the A100 in actual intensive data center settings is ~5x shorter than the reported figure, this leads to an AFR of ~5 percent.
  • As a sense-check, we compare these numbers with failure reports for consumer GPUs, which have a 2.5 percent AFR. These cards typically operate in less demanding conditions than data center GPUs (occasional instead of continuous use).
  • In summary:
    • Inspections require 1 in every 2,000 chips to be swapped out each year.
    • The expected annual failure rate for export-controlled chips based on the above analysis is ~5 percent, meaning ~100 chips out of every 2,000 chips will need to be swapped out per year.
    • If we take the maximum MTBF reported by NVIDIA for the A100, the annual failure rate is 0.67 percent, meaning 13 chips out of every 2,000 chips will need to be swapped out per year. This represents the most optimistic case for GPU reliability.
    • The additional burden introduced by a random chip sampling program for data centers could therefore be minimal: the number of swaps already required by hardware failures will likely be ~10–100x greater.

For smaller customers (or if using existing reserve stocks proves difficult for large data centers), BIS could maintain a reserve stock of GPUs (usage-weighted across the different products that fall under 3A090/4A090) to play the same role. The above cost estimates take this into account by building in the cost of maintaining a reserve stock of 100 chips: approximately the number of chips that would be required to swap out half of the chips being inspected in any two-week period with 5,000 inspections per year.

About the Authors

Tim Fist is a Fellow with the Technology and National Security Program at CNAS. Fist has an engineering background and previously worked as the Head of Strategy & Governance at Fathom Radiant, an AI hardware company. Prior to that, Fist worked as a machine learning engineer. Fist holds a B.A. (Honors) in Aerospace Engineering and a B.A. in Political Science from Monash University.

Erich Grunewald is an Associate Researcher on the compute governance team at Institute for AI Policy & Strategy (IAPS). He previously worked as a programmer and earned a BSc in Computer Engineering and an MSc in Interaction Design from Chalmers University of Technology.

About the Technology and National Security Program

The CNAS Technology and National Security program explores the policy challenges associated with emerging technologies. A key focus of the program is bringing together the technology and policy communities to better understand these challenges and together develop solutions.

About the Artificial Intelligence Safety & Stability Project

The CNAS AI Safety & Stability Project is a multiyear, multiprogram effort that addresses the established and emerging risks associated with artificial intelligence. Our work is focused on anticipating and mitigating catastrophic AI failures; improving the U.S. Department of Defense’s processes for AI testing and evaluation; understanding and shaping opportunities for compute governance; understanding Chinese decision-making on AI and stability; and understanding Russian decision-making on AI and stability.


The authors would like to acknowledge the CNAS Publications Teams for their support, design, and editing. The authors would also like to thank Paul Scharre, Executive Vice President and Director of Studies, for reviews of various iterations of this work. This project is made possible with the generous support of Open Philanthropy.

As a research and policy institution committed to the highest standards of organizational, intellectual, and personal integrity, CNAS maintains strict intellectual independence and sole editorial direction and control over its ideas, projects, publications, events, and other research activities. CNAS does not take institutional positions on policy issues, and the content of CNAS publications reflects the views of their authors alone. In keeping with its mission and values, CNAS does not engage in lobbying activity and complies fully with all applicable federal, state, and local laws. CNAS will not engage in any representational activities or advocacy on behalf of any entities or interests and, to the extent that the Center accepts funding from non-U.S. sources, its activities will be limited to bona fide scholastic, academic, and research-related activities, consistent with applicable federal law. The Center publicly acknowledges on its website annually all donors who contribute.

  1. Qianer Liu & Hannah Murphy, “China’s Internet Giants Order $5bn of Nvidia Chips to Power AI Ambitions,” Financial Times, August 9, 2023, https://www.ft.com/content/9dfee156-4870-4ca4-b67d-bb5a285d855c; Josh Ye, David Kirton, and Chen Lin, “Inside China's Underground Market for High-end Nvidia AI Chips,” Reuters, June 20, 2023, https://www.reuters.com/technology/inside-chinas-underground-market-high-end-nvidia-ai-chips-2023-06-19/.
  2. Hugo Meijer, Trading with the Enemy: The Making of US Export Control Policy toward the People's Republic of China (New York: Oxford University Press, 2016); Ryan Fedasiuk, Karson Elmgren, and Ellen Lu, “Silicon Twist: Managing the Chinese Military’s Access to AI Chips,” Policy Brief (Center for Security and Emerging Technology, June 2022), https://cset.georgetown.edu/publication/silicon-twist/.
  3. Brian (Chun Hey) Kot, “Hong Kong’s Technology Lifeline to Russia,” Carnegie Endowment for International Peace, May 17, 2023, https://carnegieendowment.org/2023/05/17/hong-kong-s-technology-lifeline-to-russia-pub-89775.
  4. Hassan Mujtaba, “NVIDIA AI GPU Demand Blows Up, Chip Prices Increase By 40% & Stock Shortages Expected Till December,” WCCF Tech, May 22, 2023, https://wccftech.com/nvidia-ai-gpu-demand-blows-up-chip-prices-increase-40-percent-stock-shortages-till-december/.
  5. Ye, Kirton, and Lin, “Inside China's Underground Market for High-end Nvidia AI Chips.”
  6. “This is the fastest GPU ever! We tested four H100s! Worth 1.2 million yuan!,” Bilibili, June 14, 2023, https://www.bilibili.com/video/BV1Vh411M7NX/.
  7. For an overview of the relationship between compute and performance, see David Owen, “Extrapolating Performance in Language Modeling Benchmarks,” Epoch, June 9, 2023, https://epochai.org/blog/extrapolating-performance-in-language-modelling-benchmarks; Dario Amodei and Danny Hernandez, “AI and Compute,” OpenAI, May 16, 2018, https://openai.com/research/ai-and-compute; Jared Kaplan et al., “Scaling Laws for Neural Language Models,” arXiv, January 23, 2020, http://arxiv.org/abs/2001.08361; Jaime Sevilla et al., “Compute Trends Across Three Eras of Machine Learning,” arXiv, March 9, 2022, https://doi.org/10.48550/arXiv.2202.05924.
  8. Mathew Bunn et al., eds., Preventing Black Market Trade in Nuclear Technology (Cambridge: Cambridge University Press, 2018).
  9. For an overview of the controls, see Bureau of Industry and Security, Department of Commerce, "Public Information on Export Controls Imposed on Advanced Computing and Semiconductor Manufacturing Items to the People's Republic of China (PRC)," October 17, 2023, https://www.bis.doc.gov/index.php/about-bis/newsroom/2082; Bureau of Industry and Security, Department of Commerce, “Implementation of Additional Export Controls: Certain Advanced Computing and Semiconductor Manufacturing Items; Supercomputer and Semiconductor End Use; Entity List Modification; Updates to the Controls To Add Macau,” January 17, 2023, 88 FR 2821, https://www.federalregister.gov/documents/2023/01/18/2023-00888/implementation-of-additional-export-controls-certain-advanced-computing-and-semiconductor.
  10. Marius Hobbhahn and Tamay Besiroglu, “Trends in GPU Price-performance,” Epoch, June 27, 2022, https://epochai.org/blog/trends-in-gpu-price-performance.
  11. “Artificial Intelligence (AI) Chip Market Size to Grow USD 263.6 Billion by 2031, Growing at a CAGR of 37.1% | Valuates Reports,” Bloomberg, March 28, 2023, https://www.bloomberg.com/press-releases/2023-03-28/artificial-intelligence-ai-chip-market-size-to-grow-usd-263-6-billion-by-2031-growing-at-a-cagr-of-37-1-valuates-reports; “Artificial Intelligence (AI) Chip Market Size, Report By 2032,” accessed October 19, 2023, https://www.precedenceresearch.com/artificial-intelligence-chip-market
  12. Hasan Chowdhury, “Nvidia Plans to Triple Production of Its $40,000 Chips as It Races to Meet Huge Demand from AI Companies, Report Says,” Business Insider, August 23, 2023, https://www.businessinsider.com/nvidia-triple-production-h100-chips-ai-drives-demand-2023-8; Samer Al-Atrush et al., “Saudi Arabia and UAE Race to Buy Nvidia Chips to Power AI Ambitions,” Financial Times, August 14, 2023, https://www.ft.com/content/c93d2a76-16f3-4585-af61-86667c5090ba
  13. Markus Anderljung et al., “Frontier AI Regulation: Managing Emerging Risks to Public Safety,” arXiv, September 4, 2023, https://arxiv.org/abs/2307.03718.
  14. For an overview of risks from frontier models in the biosecurity domain, see Jonas B. Sandbrink, “Artificial Intelligence and Biological Misuse: Differentiating Risks of Language Models and Biological Design Tools,” arXiv, August 12, 2023, http://arxiv.org/abs/2306.13952; Dario Amodei, Co-founder and CEO of Anthropic, “Written Testimony for a Hearing on ‘Oversight of A.I.: Principles for Regulation,” Statement to the Judiciary Committee, Subcommittee on Privacy, Technology, and the Law, U.S. Senate, July 25, 2023, https://www.judiciary.senate.gov/imo/media/doc/2023-07-26_-_testimony_-_amodei.pdf; Kevin M. Esvelt, “Delay, Detect, Defend: Preparing for a Future in Which Thousands Can Release New Pandemics,” Geneva Centre for Security Policy, November 14, 2022, https://www.gcsp.ch/publications/delay-detect-defend-preparing-future-which-thousands-can-release-new-pandemics; Daniil A. Boiko, Robert MacKnight, and Gabe Gomes, “Emergent Autonomous Scientific Research Capabilities of Large Language Models,” arXiv, April 11, 2023, http://arxiv.org/abs/2304.05332. For an overview of risks in the cybersecurity domain, see the following tools and proofs of concepts: HYAS, “EyeSpy: Cognitive Threat Agent,” August 2, 2023, https://www.hyas.com/hubfs/HYAS_EyeSpy_Proof_of_Concept.pdf; Gelei Deng et al., PentestGPT, version 0.9 (GitHub, July 20, 2023), https://github.com/GreyDGL/PentestGPT; Elizabeth Montalbano, “AI-Powered ‘BlackMamba’ Keylogging Attack Evades Modern EDR Security,” Dark Reading, March 8, 2023, https://www.darkreading.com/endpoint/ai-blackmamba-keylogging-edr-security.
  15. Dylan Patel, “GPT-4 Architecture, Infrastructure, Training Dataset, Costs, Vision, MoE,” August 28, 2023, https://www.semianalysis.com/p/gpt-4-architecture-infrastructure.
  16. “15 CFR 743.2 -- High Performance Computers: Post Shipment Verification Reporting.,” https://www.ecfr.gov/current/title-15/part-743/section-743.2.
  17. For reference, NVIDIA will reportedly ship around 550,000 H100 GPUs in 2023, primarily to domestic firms in the U.S. Anton Shilov, “Nvidia to Sell 550,000 H100 GPUs for AI in 2023: Report,” Tom’s Hardware, August 15, 2023, https://www.tomshardware.com/news/nvidia-to-sell-550000-h100-compute-gpus-in-2023-report.
  18. Title 15 U.S.C. § 742.15, “Encryption Items,” https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-742/section-742.15.
  19. Title 15 U.S.C. § 740.3, “Shipments of Limited Value (LVS),” https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-740/section-740.3.
  20. U.S. Department of Commerce Bureau of Industry and Security, Annual Report to Congress, Fiscal Year 2021 (2022), https://www.bis.doc.gov/index.php/documents/pdfs/3140-annual-report-of-the-bureau-of-industry-and-security-for-fiscal-year-2021/file.
  21. Note that BIS is already supporting foreign nations with training/education.
  22. The White House, FACT SHEET: Indo-Pacific Strategy of the United States (February 11, 2022), https://www.whitehouse.gov/briefing-room/speeches-remarks/2022/02/11/fact-sheet-indo-pacific-strategy-of-the-united-states/.
  23. Gregory C. Allen, Emily Benson, and William Alan Reinsch, “Improved Export Controls Enforcement Technology Needed for U.S. National Security,” Center for Strategic & International Studies, November 30, 2022, https://www.csis.org/analysis/improved-export-controls-enforcement-technology-needed-us-national-security.
  24. U.S. Department of Commerce Bureau of Industry and Security, Fiscal Year 2024 President’s Budget Request (2023), https://www.commerce.gov/sites/default/files/2023-03/BIS-FY2024-Congressional-Budget-Submission.pdf.
  25. U.S. Senate, Commerce, Justice, Science, and Related Agencies Appropriations Act, 2024, S.2321, 118th Cong., 1st sess. https://www.congress.gov/bill/118th-congress/senate-bill/2321/text; U.S. House of Representatives Republicans, Fiscal Year 2024 Commerce, Justice, Science, and Related Agencies Appropriations Bill (July 13, 2023), https://appropriations.house.gov/sites/republicans.appropriations.house.gov/files/documents/FY24%20Commerce%2C%20Justice%2C%20Science%2C%20and%20Related%20Agencies%20-%20Bill%20Summary.pdf.
  26. Allen, Benson, and Reinsch, “Improved Export Controls Enforcement Technology Needed for U.S. National Security.”
  27. For an overview of some candidate office locations, see “U.S. Commercial Service Office Lookup,” U.S. Department of Commerce International Trade Administration, https://www.trade.gov/commercial-service-office-lookup; “Export Control Officer Program (ECO Program),” U.S. Department of Commerce Bureau of Industry and Security, https://www.bis.doc.gov/index.php/enforcement/oea/eco.
  28. We calculate $300,000 using data on average salaries for BIS employees in 2022. “Bureau of Industry and Security Salaries of 2022,” FederalPay.org, https://www.federalpay.org/employees/bureau-of-industry-and-security. We calculate this to be $141,000. We then multiply this figure by two to account for office space, equipment, contract negotiations, and other overheads, per the analysis here: “How Much Does a Government Employee Cost?” TCG, https://www.tcg.com/blog/how-much-does-a-government-employee-cost/.
  29. U.S. Department of Commerce Bureau of Industry and Security, Fiscal Year 2023 President’s Budget Request (2022), https://www.commerce.gov/sites/default/files/2022-03/FY2023-BIS-Congressional-Budget-Submission.pdf.
  30. [1] Refers to the predicted elapsed time between failures of a system (in this case, device-level failure on GPUs). For more information, see “Mean Time Between Failures,” Wikipedia, https://en.wikipedia.org/wiki/Mean_time_between_failures.
  31. George Ostrouchov et al., “GPU Lifetimes on Titan Supercomputer: Survival Analysis and Reliability” (paper presented at SC '20: Proceedings of the International Conference for High Performance Computing, Networking, Storage and Analysis, Atlanta, Georgia, November 16–19, 2020), https://www.osti.gov/servlets/purl/1771896.
  32. NVIDIA, “Tesla K20 Active Board Specification” (January 2013), Manualzz, https://manualzz.com/doc/8665495/tesla-k20-active-board-specification.
  33. NVIDIA, “NVIDIA A100 80GB PCIe GPU,” Product Brief (March 2022), https://www.nvidia.com/content/dam/en-zz/Solutions/Data-Center/a100/pdf/PB-10577-001_v02.pdf.
  34. Joel Hruska, “Reseller RMA Data Shows Fascinating Pattern Between AMD, Nvidia GPUs,” Extreme Tech, August 4, 2020, https://www.extremetech.com/gaming/313458-reseller-rma-data-shows-fascinating-pattern-between-amd-nvidia-gpus.


  • Tim Fist

    Senior Adjunct Fellow, Technology and National Security Program

    Tim Fist is a Senior Adjunct Fellow with the Technology and National Security Program at CNAS. His work focuses on the governance of artificial intelligence using compute/comp...

  • Erich Grunewald

    Contributing Author, Associate Researcher, Institute for AI Policy & Strategy

    Erich is an Associate Researcher in the compute governance team at IAPS. He previously worked as a programmer and earned a BSc in Computer Engineering and an MSc in Interactio...

View All Reports View All Articles & Multimedia