2.1.3 Accounting for Hardware

A Perfect Report from an Incomplete Fleet

An operator declares 1,000 accelerators. All 1,000 produce authentic, fresh attestation reports. Each report passes every requested check.

Now suppose the operator also runs 200 accelerators that were never declared.

Nothing about the first 1,000 reports has become false. The problem is the population to which the evidence applies. A system that verifies every device presented to it has not necessarily verified every device covered by the agreement.

Hardware accounting therefore has two tasks: follow the devices already known to the regime, and test whether its list is missing devices. Device credentials help with the first. Establishing the second requires evidence that does not originate solely from that list.

The policy objective determines which population matters. An export-control regime may follow a specified class of exported products. An international pause may cover accelerators of several origins, including domestic production and pre-existing stock. An excellent registry of one manufacturer's exports cannot establish completeness for the broader population.

A Registry Connects Technical Identity to Obligations

Fist and Grunewald propose connecting a chip-ownership registry to short-notice inspections and reporting of resale, loss, and destruction. The registry gives inspectors a population from which to select devices and parties to contact. It is the reporting and inspection process, not the database alone, that makes entries testable.

For this course, a useful registry design would distinguish the following fields. This is an illustrative schema, not a description of an existing government database.

A manufacturer credential authenticates a device identity. It does not establish its legal owner or which company is renting its compute. A cloud customer, cloud operator, colocation provider, and equipment owner may be four different entities.

Updates should preserve history rather than overwrite it. If a device moves from Facility A to Facility B, the record needs a departure, custody during transit, and arrival confirmation. Replacing a board or rotating a credential should not accidentally create a second accelerator in the count. Conversely, two different accelerators must not be merged because a server label was reused.

For one defined population and period, a basic reconciliation is:

Expected closing stock = opening stock + additions − verified removals.

"Removals" depend on the boundary. Moving a chip out of one facility removes it from that facility's stock, but not necessarily from the operator's or treaty's stock. Loss may end possession without ending the obligation to report or investigate. A row marked "destroyed" is a claim to check, not a reason to delete the evidence trail.

Location: Has a Chip Been Moved?

Suppose an operator declares that its chips remain at an approved facility. Location verification can help check that claim remotely and identify cases requiring an inspection.

The proposal combines two pieces of evidence: which chip responded and how quickly its response arrived. A trusted server at a known location—a landmark—sends an unpredictable challenge. The chip returns an authenticated response, and the landmark measures the round-trip time. The response must be tied to the chip itself; timing a nearby server would establish a bound on that server’s location.

Because signals cannot travel faster than light, a sufficiently fast response limits how far away the chip could be:

Distance to the chip ≤ speed of light × round-trip time ÷ 2

For example, a 2 millisecond round trip gives an upper bound of approximately 300 km. Processing and network delays make this bound looser: the chip could be much closer. This is an illustrative calculation, not the prototype’s measured accuracy.

Each landmark therefore defines a region of possible locations. Multiple landmarks can narrow that region. If it excludes a prohibited territory, the result can support a claim that the chip is outside that territory—even if it cannot identify the chip’s building. The IAPS brief reports an H100 prototype demonstrating the basic approach.

Missing reports require an enforcement process. A slow or absent response does not establish where a chip is. Chips legitimately in storage or transit may be unable to report, but an operator could also claim those statuses to avoid verification. IAPS proposes investigating suspiciously prolonged storage or transit and notifying BIS. A workable regime would need reporting deadlines, evidence requirements for exemptions, and a process for follow-up inspections.

Location verification supplies evidence for these decisions. It does not itself disable a chip; authorization and control are discussed in 2.1.5.

Topology: How Are the Devices Connected?

A location check can help establish where a registered chip is. A topology check addresses a different claim: whether a set of devices has the expected connections and configuration.

This matters when a verification regime relies on a declared hardware configuration. Authenticating each GPU separately does not establish how those GPUs are connected. Checking the relevant switches and links can provide additional evidence about the system they form.

The Hopper workflow checks GPU and NVSwitch integrity and compares the topology with an expected configuration. The assigned Blackwell workflow attests each GPU independently, without topology or switch attestation. These are examples from NVIDIA’s deprecated Python SDK documentation; the comparison concerns the checks performed by these workflows.

For governance, the crucial question is how much of the relevant system the check covers. A successful check of a GPU–switch configuration does not establish the size of an entire distributed training cluster. That would require evidence covering connections between servers and facilities. Establishing how much computation a training run used would also require evidence about activity over time.

Completeness Has a Denominator

Three populations must remain distinct:

If 900 out of 1,000 registered devices respond, the response rate is 90% of registered devices. It is not a measurement that 90% of all covered devices have been found. Even a 100% response rate cannot establish that the register is complete.

Sampling has the same boundary. Inspections selected only from a register can test claims about listed equipment. They cannot directly select an omitted identifier. Inspectors might discover additional hardware while visiting a site, but that is an additional discovery channel, not a property of sampling the list.

This does not make registries useless. Knowing that a particular expected device has disappeared is valuable. The distinction is between a known device whose whereabouts are unresolved and a device the regime does not yet know exists. Repeated challenges address the former; independent discovery is needed for the latter.

Test the Register from Outside It

The following is an analytic checklist for a layered regime, not a claim that these sources always exist or are independent.

Independence matters more than the number of documents. An inventory spreadsheet, dashboard, and audit summary may all copy the same operator-maintained database. Agreement among them then says little about omissions from that database.

Records also need timestamps and a common unit of account. A supplier counts boards, a cloud scheduler counts virtual instances, and a treaty may count physical accelerator packages. Before treating differences as suspicious, reconcile those units, reporting dates, repairs, replacements, and transfers.

Non-response should remain visible until resolved. It may reflect maintenance, connectivity failure, deliberate obstruction, or diversion. An agreement can impose a reporting obligation with its own consequences, but failure to report and proof of prohibited activity are different findings. A useful status is "unresolved," not an automatic reassignment to "compliant" or "smuggled."

Exercise — Reconcile the Fleet

This is a hypothetical evidence packet, not a real operator or an existing law. All counts refer to physical accelerators with distinct identifiers. All documents use the same reporting cutoff.

Under an agreement, every covered accelerator held by an operator must be registered. Installed devices must provide daily identity and jurisdiction evidence. Devices in repair remain registered, with device-specific custody records. Rules governing emergency exceptions and sanctions are not supplied in this packet.

The operator concludes:

The 72 responding devices were within the allowed jurisdiction when checked. Every registered device is at its declared facility, and none can be part of a larger cluster.

Carry Forward

Hardware accounting establishes which equipment the regime knows about, what has been observed, and where evidence is missing. It does not yet tell us how much work occurred or what kind of work it was. Section 2.1.4 turns to those questions.