This post provides an overview of domestic Chinese AI chip1 making, from design to manufacturing to packaging, explaining key terms and concepts as they come up. The Chinese government has for many years given top priority to, and invested heavily in, self-sufficiency in advanced chipmaking. Since the US bars Chinese companies from buying advanced AI chips, much of China’s compute in the coming years is likely to come from domestic chips. So China’s progress in making these chips matters to anyone trying to make sense of the US-China competition and Chinese AI progress.

In short, China remains heavily constrained by export controls across the AI chip supply chain, and is many years away from making globally competitive AI chips indigenously. Huawei is China’s leading AI chip designer, followed by Cambricon, Alibaba’s T-Head, Baidu’s Kunlunxin, and several startups that ship only modest amounts of chips. On paper, the best Chinese chips remain closer to the hardware NVIDIA released about five years ago than to its current frontier. But beyond the hardware, another important gap is the software that runs on the chips. NVIDIA’s software ecosystem remains much more mature than Chinese alternatives, and for this and other reasons, Chinese developers continue to prefer NVIDIA for training workloads.

China is unable to fabricate both logic and memory chips at the quality and volume it needs. Because of their lack of access to the most advanced photolithography machines—both extreme ultraviolet (EUV) and, to a large extent, immersion deep ultraviolet (DUV)—Chinese companies struggle to produce competitive, economically viable chips. China’s fabrication process for logic chips is three to five years behind the world’s most advanced foundry, TSMC. Similarly, China’s leading memory company, CXMT, remains three to four years behind the global leaders. China’s domestic photolithography efforts are reported to have partially produced EUV prototypes, but these are most likely far from reliable or fully functional tools.

Contents

• In a nutshell

• Introduction

  • What this post covers

  • US export controls constrain China across the entire AI chip supply chain

• AI chip design

  • China remains dependent on Western chip design software

  • China’s AI chip design ecosystem is broadening quickly

  • Chinese AI developers still prefer NVIDIA for training

  • Chinese chips still trail NVIDIA on performance and memory

  • Domestic chip shipments are growing but remain highly concentrated

  • China’s cluster-level systems are limited by fab capacities

• Logic chips fabrication

  • SMIC leads China’s foundry sector

  • SMIC lags three to five years behind TSMC

  • Hua Hong might expand China’s fab capacity over the long term

  • Huawei is building fabs to reduce its dependence on SMIC

• High-bandwidth memory fabrication

  • HBM is restricted by US export controls

  • China’s memory makers are moving into HBM, led by CXMT

  • CXMT trails the state of the art by three to four years

  • The global HBM market is highly concentrated in three foreign companies

  • China’s HBM capacity is growing but still likely insufficient

  • Domestic memory limits Huawei’s next chips

  • Advanced packaging is another constraint on Chinese AI chips

• Semiconductor manufacturing equipment

  • Photolithography

  • Etch, clean, deposition, metrology, and more

Introduction

Compute is one of the key inputs to AI progress, and US export controls prevent Chinese companies from buying advanced AI chips and the equipment needed to make them. Under these conditions, China acquires compute in several ways. It stockpiles and smuggles US-designed chips, rents cloud capacity abroad, and tries to squeeze more performance out of limited hardware through software and systems engineering. But one of the most consequential channels in the long run is domestic production. If China can make more of its own AI chips, that reduces its future dependence on US and allied suppliers and makes it harder to constrain through export controls.

Compute determines how extensively AI companies can pursue frontier R&D, how many training runs they can conduct, how large those runs can be, and how they can deploy new models. In early 2025, the US was estimated to account for 75% of installed compute capacity, while China was a distant second at 15% and the EU trailed at 5%. China’s share is likely lower today, with estimates that it owns about 6% of compute capacity, as the gap has probably widened following US export controls on advanced AI chips. With export controls preventing China from legally importing US-designed AI chips, that gap largely reflects who can design, fabricate, and deploy the most advanced AI chips at scale.

A modern AI chip is a package that brings together compute dies, high-bandwidth memory, and the physical connections between them. The compute dies are the processors that perform the calculations. The memory sits next to them and feeds them data fast enough to keep them busy. A silicon interposer connects the compute and memory dies inside the package, routing dense electrical signals between them. Producing such a complex chip therefore depends on several capabilities at once, including cutting-edge chip-design software, front-end fabrication for both logic and memory, semiconductor manufacturing equipment, and back-end packaging.

What this post covers

This post gives an overview of China’s AI chipmaking ecosystem. We look at four key parts of the supply chain and, for each, compare Chinese progress with the US and allied state of the art. The four are:

• AI chip design. This is the layout of the compute die, containing the processor cores. The first step in AI chip production is designing the processor architecture. That architecture is then translated into a physical circuit layout using specialized software and verified to work as intended before being sent to a chip fabrication plant (“fab”) for manufacturing. These design choices are critical because they determine the performance, efficiency, and capabilities of the resulting chip.

• Logic fabrication. This is the manufacturing of the compute dies. Once the design is complete, the next step is fabrication. This highly specialized manufacturing process imprints a chip design onto silicon wafers through hundreds of sequential steps (depositing, patterning, and etching layers of materials) to form transistors and the metal connections between them. It is strategically important because only a small number of facilities worldwide can produce the most advanced chips.

• High-bandwidth memory (HBM) fabrication. This is the manufacturing of the memory stacks that sit next to the compute dies on the interposer. In addition to processors, AI systems rely on HBM to handle vast amounts of data. This part, therefore, focuses on the manufacture of vertically stacked memory chips packaged alongside the AI chip to deliver the fast data read/write speeds required by AI training and inference workloads.

• Semiconductor manufacturing equipment (SME). These are highly specialized machines (photolithography, deposition, etching and cleaning, process control, and others) used to carry out each step of logic and memory chip fabrication. Unlike the other parts of this analysis, SME refers to the physical tools that enable fabrication rather than to the process itself. It represents a key bottleneck in the global semiconductor supply chain because only a handful of companies can produce them.

China is trying to indigenize every part of the supply chain at once, while being constrained by export controls at each stage. It is much further along in some parts than in others, but overall, it remains many years away from designing and producing frontier AI chips at scale using domestic equipment.

Although we’ve done our best to cover the most relevant information, this report has some gaps, and some of its findings are tentative. That is because Chinese AI chipmaking is, to some extent, shrouded in uncertainty—there is limited public information about how much progress Chinese companies are making, their plans, and, in some cases, even who the important actors are. For example, it is often hard to pin down how many units of a product have been ordered or shipped; performance figures often come from company materials or investor-facing roadmaps rather than third-party measurements; and announcements of breakthroughs in chips, fabrication, and equipment usually come from the companies themselves, local governments, or local media, all of whom have strong reasons to overstate their progress, whether to win state subsidies, financing, government contracts, or present US and allied export controls as ineffective.

US export controls constrain China across the entire AI chip supply chain

Over the past several years, the US has implemented a set of restrictions aimed at both keeping the most advanced AI chips out of China and preventing Chinese AI chip makers from using key US and allied equipment and services. These restricted products and services include:

• AI chips. The US bars AI chip designers like NVIDIA and AMD from selling their most powerful chips to China. As of May 2026, the most advanced chip that can be exported to China is the NVIDIA H200, but even these sales are quite regulated: shipments of these products to China cannot exceed 50% of the volume sold to US customers; there is a 25% export tariff; and buyers must certify that the chips will not be used for military purposes.

• Foreign foundry access. US export controls prohibit Taiwan Semiconductor Manufacturing Company (TSMC), the world’s dominant chip manufacturer, from producing advanced AI chips for Chinese chip designers. Foundries are required to review any 7nm-and-below shipment to Chinese designers and presume advanced logic chips are AI chips unless proven otherwise. (A “process node”, traditionally defined in nanometers, names a generation of fabrication technology. Each new generation reduces the size of the chip’s transistors, or features, fitting more into each square inch; a smaller process node is more advanced.)

• High-bandwidth memory. US export controls block HBM sales to China, specifically HBM2E (2020) and later generations.

• Semiconductor manufacturing equipment. China is blocked from buying EUV photolithography tools, the most advanced DUV tools, and other equipment needed for advanced logic and memory production.

• Electronic design automation (EDA) software. US export controls prohibit sales of software needed to design chips using gate-all-around (GAAFET) transistors, the most advanced transistor architecture, used to design the most advanced AI chips (3nm and below).

For a detailed list of products controlled by the US, see the Commerce Control List.

AI chip design

The first step in the AI chipmaking process is to design the chip. Simplifying a bit, designers define what the chip is supposed to do, how much compute it should deliver, how much power it can consume, and how it will interact with memory and software. Engineers then construct an abstract model of the circuit logic, which EDA software synthesizes and then translates into a physical blueprint, using process design kits (PDKs), collections of files and rules provided by manufacturers that define how transistors and wires can be built on a specific fabrication process. After extensive timing, power, and manufacturability checks, the design is finalized and sent for fabrication. The entire process is complex and expensive, as advanced AI chips often require over a year and a large engineering team to complete.

Chip fabrication companies typically operate under one of two models:

• Fabless firms, such as NVIDIA and AMD, design chips but outsource manufacturing to specialized facilities (“foundries”), such as TSMC.

• Integrated device manufacturers (IDMs), such as Intel, both design and fabricate chips in-house.

China remains dependent on Western chip design software

A modern AI chip contains tens to hundreds of billions of transistors arranged across more than a dozen metal layers, and without electronic design automation software, designing or verifying a chip of this scale by hand is practically impossible.

Chinese chip designers remain heavily dependent on US EDA software. EDA software enables engineers to design, simulate, and verify complex integrated circuits before fabrication. Companies such as Synopsys (US), Cadence (US), and Siemens (Germany) together control about 75% of China’s overall EDA market.2 This dominance reflects over two decades of high development costs, high switching costs, and close cooperation between foundries and EDA companies.

The US first restricted EDA software for GAAFET transistors, the most advanced transistor architecture, in 2022, extending those controls multilaterally in 2024. By May 2025, the Bureau of Industry and Security (BIS) had escalated to requiring export licenses for all EDA sales to China. But two months later, those broader requirements were partially reversed as part of a deal on rare-earth magnets.

The effectiveness of EDA controls is further complicated by potential software piracy, which is likely more feasible for smaller Chinese start-ups than large, multinational companies like Baidu and Alibaba. EDA software for advanced-node chips is difficult to pirate because it is tightly integrated with foundry PDKs, which are updated frequently and serve as a de facto license verification mechanism: a chip designer without a valid, current license will be detected when submitting designs for fabrication at foundries.

China’s nascent EDA industry is led by Beijing-based Empyrean Technology, with Primarius Technologies and smaller players such as Semitronix and X-Epic following. In early 2024, Empyrean held around 6% of China’s EDA market, while Chinese EDA vendors collectively accounted for a little over 10%. Capability gaps remain substantial, however. Although Empyrean and Primarius claim support for 7nm and even 5nm designs, they seem to cover only part of the full design flow, with persistent weaknesses in full-stack integration across simulation, IP compatibility, and foundry certification. Fully closing the gap, especially for sub-7nm chip design, could take five to ten years or more. Progress has been most visible in memory-chip design tooling—in August 2025, Empyrean unveiled China’s first full-process EDA platform for memory production, which is reportedly being adopted by China’s largest memory maker.

Although the broader May 2025 EDA restrictions were rescinded, this persistent dependency remains a latent vulnerability. The GAAFET-specific controls from 2022 remain in place, and Washington could re-impose broader restrictions at any time. If it did, Chinese chip designers would lose access to the tools required to design leading-edge chips, with limited domestic alternatives offering comparable capabilities. In practice, any future cutoff would bite gradually rather than instantly, as Chinese designers likely pay for multi-year license agreements and could maintain EDA access through overseas subsidiaries and shell-company arrangements.

China’s AI chip design ecosystem is broadening quickly

The number of AI chip designers in China has grown rapidly in recent years, and at least nine domestic AI chip firms, according to Chinese media, have shipped more than 10,000 chips each. To put this in perspective, NVIDIA sold more than 4 million GPUs in 2025. These per-firm volumes are small, but the breadth of the cohort signals gradual diversification of China’s domestic supply. Investment capital has surged, and in late 2025 and early 2026 alone, multiple second-tier companies, including the “Four Little Dragons”: Biren, Enflame, MetaX, and Moore Threads (sometimes Iluvatar CoreX is included instead of Enflame), raced to public listings. They were all founded by engineering talent returning from American semiconductor giants, such as NVIDIA, AMD, and Qualcomm, to help build China’s indigenous AI chip ecosystem.3

Of designing chips, fabricating them, and building the machines that fabricate them, design is the easiest market to enter, so it is where China’s domestic ecosystem is broadening fastest. Building a leading-edge logic fab costs $10-20 billion per facility, with a single EUV photolithography machine alone costing $220 million or more, whereas designing a chip primarily requires engineers, EDA software licenses, and access to a foundry willing to manufacture the design. China, however, is less constrained by capital than by access to SME, with US, Dutch, and Japanese export controls barring Chinese firms from buying most of the equipment a leading-edge fab requires.

Within this growing pool of AI chip designers, four companies—Huawei, Cambricon, Alibaba’s T-Head, and Baidu’s Kunlunxin—account for the vast majority of domestic shipments. The rest of this section profiles each of them, then turns to the smaller, second-tier designers.

Huawei, the crown jewel of China’s semiconductor ambitions, is the country’s most advanced AI chip designer. Its chip-design arm, HiSilicon, designs smartphone chips (Kirin), server CPUs (Kunpeng), and network chips, and, since 2018, the Ascend line of AI chips. Huawei is the primary domestic option for inference workloads, but is not yet competitive for full-scale model training.

The Huawei Ascend is by far the most important domestic AI chip, accounting for about half of China’s domestic AI chip shipments in 2025. The Ascend 910B and 910C are widely regarded as the most viable Chinese chips for serious workloads. The Ascend 910C (2025) delivers weaker, but roughly comparable, computational performance to an NVIDIA H100 (2022).4

The Ascend chips are also the only domestically designed hardware known to have been used to train frontier-scale models. The largest publicly known example is Huawei’s Pangu Ultra MoE, with 718 billion parameters. Other Chinese models, including Zhipu AI’s GLM-5 and DeepSeek-V4, have been optimized to run on Ascends, though they were likely trained with NVIDIA chips.

In 2019, the US placed Huawei on the Entity List, and a further 2020 rule restricted the company’s access to TSMC. But Huawei worked around this for years. Through intermediaries, Huawei routed orders to TSMC and accumulated an estimated 2.9 million advanced TSMC-made dies, worth roughly $500 million, before that channel was shut down in October 2024. This stockpile has powered most of the Ascend 910C shipments through 2024 and 2025.

Semiconductor Manufacturing International Corporation (SMIC), China’s most advanced foundry, also fabricates Ascend variants, but yields on its 7nm processes remain poor (see the section on fabrication below). (“Yield” refers to the percentage of functional chips produced from a wafer out of the total number attempted. Higher yield means better manufacturing efficiency and lower cost per chip.) It is unclear how much SMIC has actually contributed to Ascend 910C production, as an October 2025 teardown of a 910C found dies originally fabricated by TSMC in 2020, and no public teardown has yet confirmed a fully domestically fabricated Ascend 910C. As the TSMC stockpile depletes, Huawei is gradually shifting Ascend production to SMIC, a transition that requires redesigning each chip generation around SMIC’s less mature 7nm process.

Cambricon Technologies, a spin-off from the Chinese Academy of Sciences, is perhaps the most commercially visible of China’s dedicated AI chip startups. Cambricon initially earned almost all of its revenue from licensing AI chip designs to Huawei: in 2017 and 2018, Huawei accounted for roughly 97-98% of Cambricon’s income. That model collapsed in late 2018 when Huawei moved to its own DaVinci/Ascend architecture. After losing Huawei as its anchor customer, Cambricon pivoted in 2019 toward cloud data-center AI accelerators. The transition took years to pay off, with company financial summaries showing annual losses before Cambricon turned profitable in 2025.

Its most advanced AI chip, the Siyuan 590, is built on a domestic 7nm SMIC process and has a reported computational performance on par with the A100 (2020) or about one-third of an H100 (2022). In practice, the chip is positioned for inference and small-scale fine-tuning rather than full-scale training. Analysts estimate that it “lags behind NVIDIA’s A100 in speed and memory bandwidth” and “lacks the scalability and throughput needed for high-end AI training”.

However, the production shift has now begun to pay off. In 2025, Cambricon’s revenue reached around $900 million (+450% year-on-year), and the company posted its first annual profit since its 2020 IPO. At its peak, the company’s share price surged to a level that briefly made it the highest-priced stock on China’s A-share market. The next-generation Siyuan 690, expected in the second half of 2026, is “expected to rival NVIDIA’s H100 [2022] in performance”, according to Chinese media. On chip volumes, Cambricon shipped an estimated 100,000-200,000 Siyuan 590s in 2025 and is targeting roughly 500,000 chips in 2026, of which about 300,000 would be Siyuan 590s and 690s combined.

Alibaba’s chip subsidiary T-Head has moved from a minor player to shipping several hundred thousand Zhenwu chips. In January 2026, T-Head officially unveiled the Zhenwu 810E, advertising performance comparable to that of the NVIDIA H20 (2024). (The H20 was a deliberately weakened chip designed by NVIDIA to stay under US export control thresholds.) By the time of the announcement, the chip had already been deployed in clusters containing 10,000 chips on Alibaba Cloud, and was reportedly used by state-affiliated organizations such as the State Grid Corporation of China and the Chinese Academy of Sciences, as well as companies with close ties to Alibaba, such as XPeng Motors and Sina Weibo. In May 2026, T-Head unveiled a newer Zhenwu M890, which is advertised as three times more powerful. In 2025, Alibaba shipped about 270,000 chips.

Baidu’s AI chip subsidiary Kunlunxin has the longest operating history of any Chinese AI chip program. Baidu began research into chip design in 2011, aimed primarily at inference workloads for Baidu’s search engine. The third-generation P800 Kunlun chip, its most advanced, is the backbone of Baidu’s AI infrastructure. In April 2025, Baidu announced it had created a 30,000-chip P800 cluster capable of training AI models similar to DeepSeek. The P800 offers roughly a third of the computational performance of an H100 (2022), and Baidu has said it increasingly runs its chatbot Ernie on a mix of self-developed Kunlun chips and other infrastructure. Baidu’s future plans include:

• M100, designed for inference, to be launched in early 2026

• M300, designed for both large-scale multimodal training and inference, to be launched in 2027

By 2030, Baidu aims to operate a cluster of one million Kunlun chips, a dramatic scale-up from its 30,000-chip P800 deployment in 2025. If of the current generation, a million Kunlun chips would deliver around 330,000 H100-equivalents5 of training compute. Given that Baidu is developing a new generation of chips (M100 and M300) that may deliver better computational performance, the resulting cluster could provide substantially more compute. OpenAI’s Stargate facility in Abilene, Texas, plans to house around 450,000 NVIDIA B200s. A million Kunlun chips by 2030 would therefore amount to about 30% of Stargate Abilene’s planned compute.

Kunlunxin historically fabricated its chips at Samsung Foundry rather than SMIC, relying on Kunlunxin’s absence from the Entity List and on its chips sitting in a performance tier that US rules still permitted foreign foundries to produce for Chinese customers. However, Samsung reportedly halted Kunlun supply in early 2025 under tightening US export controls and has since disappeared from Baidu’s public chip roadmap.

Baidu’s and Alibaba’s chip design activities mirror a trend also seen in the US, with Google’s TPUs and Amazon’s Trainium chips. Other tech giants, such as ByteDance and Tencent, have taken a different path, leaning more on external merchant designers than on in-house silicon. Tencent is Enflame’s largest shareholder with a roughly 21% stake and an investor in Moore Threads, while ByteDance invested in Moore Threads and runs workloads on chips from Kunlunxin and Cambricon. ByteDance is also reportedly developing an AI inference chip with the first samples planned for the end of March 2026. It reportedly plans to produce at least 100,000 units in 2026 and scale to 350,000 units in cooperation with Samsung. (ByteDance denied this information, while Samsung declined to comment.)

Enflame is an AI chip supplier for Tencent, its largest shareholder and overwhelmingly dominant customer. As Enflame is not on the Entity List, it has retained access to fabrication at TSMC, which means it can manufacture chips as long as they stay within the performance thresholds defined by US export controls, about one-third of the NVIDIA H100.6

Enflame’s most advanced AI chip, the S60 (2024), has reportedly shipped approximately 60,000 units. Its computing performance is reportedly around 40% and its memory bandwidth around 20% of those of an H100 (2022). The S60 chip was reportedly manufactured by TSMC, drawing scrutiny from US authorities. If the reported specifications are accurate, the S60 would exceed the export-control threshold. TSMC has disputed the classification, saying the chip does not meet the criteria for a controlled AI chip. One of the most important deployments is a 10,000-chip S60 cluster, one of the largest publicly reported clusters of domestic Chinese AI chips.

MetaX was listed on the Shanghai Stock Exchange in December 2025. Its revenue has grown rapidly, from roughly $8 million in 2023 to $110 million in 2024 to about $230 million in 2025. Its newest C600 chip, advertising 144 GB of HBM3E memory, is marketed as competitive with NVIDIA Hopper chips (the H100 and H200) for both training and inference workloads; its memory capacity exceeds that of the H100 (80 GB) and is on par with that of the H200 (141 GB). It is planned to enter mass production in the first half of 2026. The HBM3E itself is almost certainly imported, as CXMT does not yet produce HBM3E domestically. It may come from the HBM stockpile created before the December 2024 US HBM export ban came into effect. Where the C600 logic die is fabricated has not been publicly reported. MetaX historically had to downgrade its chip designs to stay within US export thresholds and keep fabricating with TSMC, but the C600 is now touted as a “fully domestically produced” chip. SMIC is effectively the only Chinese foundry capable of producing it at the required node, so it is the most plausible answer (although this is speculation). MetaX holds roughly 1% of China’s AI accelerator market.

Moore Threads is often described as the Chinese startup most directly trying to replicate NVIDIA’s approach. Founded in 2020 by NVIDIA’s former China general manager, James Zhang Jianzhong, it is the only Chinese firm building GPUs with real graphics-rendering capability alongside AI compute, rather than the AI-focused data center GPU designs offered by peers like Biren and MetaX. Backed by Tencent, ByteDance, and Sequoia China, it was listed on Shanghai’s STAR Market in late 2025. Moore Threads has launched four GPU architectures since 2021, though the first two were aimed at desktop and professional graphics rather than AI, and only the last two, Quyuan (2023) and Pinghu (2024), targeted AI compute.

The current flagship is the MTT S5000, built on the Pinghu architecture, and Moore Threads claims it is designed to rival the NVIDIA H100 (2022). Actual shipment volumes have not been publicly disclosed, and Moore Threads holds under 1% of China’s AI computing, graphics, and SoC segments combined. At its inaugural developer conference in December 2025, it unveiled the Huashan chip, which it claims will exceed an H100 in compute, memory bandwidth, and capacity, with some metrics approaching Blackwell-generation NVIDIA chips. Independent verification is pending. Huashan is slated for mass production sometime in 2026, though Moore Threads has not disclosed a specific quarter.

Biren Technology was one of the earliest Chinese startups to attract serious outside attention as a possible domestic answer to NVIDIA. In 2022, its BR100 was presented as a flagship chip with a claimed peak computational performance roughly on par with an NVIDIA H100 (2022), though this was never independently verified. The October 2022 US export controls forced TSMC to suspend production of Biren’s chips. A year later, in October 2023, the US added Biren to the Entity List, cutting the company off from TSMC entirely. Biren entered the Hong Kong Stock Exchange in January 2026, backed by a consortium including state-linked funds. Its chips have been deployed at China Mobile’s intelligent computing center in Hohhot, Inner Mongolia, though the specific number of chips has not been publicly disclosed.

Iluvatar CoreX is another Chinese firm in the data center GPU category (alongside Biren and MetaX). Per its recent HKEX filing, the company shipped nearly 10,000 training cards and 14,000 inference cards in the first nine months of 2025. Its announced roadmap and performance claims are considerably more ambitious than those shipment volumes suggest: Iluvatar claims its current Tianshu architecture outperforms the NVIDIA H200 (2024), and has published a four-generation roadmap promising to match Blackwell by 2026 and surpass Rubin by 2027. Since NVIDIA started shipping Blackwells in 2024, these targets would place Iluvatar roughly 1-2 years behind NVIDIA. (We have not been able to verify these claims.) Per TrendForce’s analysis, the older Iluvatar TianGai-100 (2021) and TianGai-150 (2023) chips deliver about 0.15x and 0.2x the computational performance of the NVIDIA H100 (2022), respectively. Iluvatar holds only about 0.3% of the domestic data center GPU market.

Chinese AI developers still prefer NVIDIA for training

Chinese developers still overwhelmingly prefer NVIDIA hardware for training workloads, a clear signal that a substantial gap remains between Chinese AI chips and Western competitors. Chinese companies continue to try to acquire NVIDIA chips through every available channel. For instance, ByteDance, Alibaba, and Tencent collectively ordered roughly one million NVIDIA H20 chips ahead of an anticipated ban in early 2025, and orders from Chinese firms reportedly exceeded two million units when the Trump administration later allowed H200 exports in January 2026. (It is not clear whether these H200s have in fact been shipped, however. But the demand seems to be there.)

Some Chinese companies have also reportedly leased large NVIDIA GPU clusters located in Southeast Asia to train frontier AI models, and state-linked entities have accessed restricted chips via AWS and Azure. Epoch AI estimates that between 290,000 and 1.6 million H100-equivalents (about a third of China’s total AI compute capacity) have been smuggled into the country through 2025.

Chinese AI chip software—Huawei’s CANN, Cambricon’s NeuWare, and Enflame’s TopsRider—remains substantially less mature than NVIDIA’s CUDA software. CUDA lets developers program GPUs for highly parallel AI workloads. Introduced by NVIDIA in 2006, it is highly optimized and used by every major AI framework—PyTorch, TensorFlow, and JAX—as the primary backend for training on NVIDIA hardware. Developers have described Huawei Ascends as “difficult and unstable to use” and “a road full of pitfalls”. In 2025, the Financial Times reported, citing anonymous sources, that Beijing had urged DeepSeek to train its R2 model on Huawei Ascend chips, but persistent technical failures forced the company to revert to NVIDIA for training, keeping Ascend only for inference.

In addition to their own software, Chinese chip designers also publish adapters that let models written for NVIDIA GPUs run on domestic hardware with minimal code changes, marketed as “CUDA compatibility”. For example, Baidu and MetaX provide a PyTorch adapter, while Huawei offers its torch_npu adapter for Ascend. Public adoption of these adapters appears modest, but GitHub activity likely understates domestic adoption, since Chinese developers may use other source code hosting platforms, such as Gitee.

Adapting a single large model to a domestic Chinese chip is reported to take one to two months of engineering effort, and only a few dozen models are currently compatible with Chinese chips out of the more than two million available on Hugging Face. To accelerate adoption, Huawei has embedded engineering teams directly at customer sites at Baidu, iFlytek, and Tencent, and has open-sourced CANN to seed a third-party developer ecosystem. Meanwhile, researchers at the Chinese Academy of Sciences have separately developed a QiMeng-Xpiler transcompiler that uses LLMs and symbolic synthesis to automatically translate tensor programs across hardware platforms, achieving an average accuracy of around 95%, which, if it matures, could reduce months of manual porting to an automated pipeline. But closing the CUDA gap can take years, and fragmentation across multiple Chinese stacks is recognized as a major barrier to adoption, since each chip requires its own porting effort.

Chinese chips still trail NVIDIA on performance and memory

The performance gap between American and Chinese AI hardware remains substantial. The NVIDIA B300 (2025) delivers about 5x the computational performance, 2.5x the memory bandwidth, and 2.3x the memory capacity of the strongest Chinese AI chip in use, the Huawei Ascend 910C (2025). Outside of Huawei, most Chinese designers cluster around or below roughly 0.3x of an H100 (2022) in peak computational performance, the level of the older A100 (2020), which is also where the US set its export control thresholds.

According to Huawei’s public roadmap, its next-generation Ascend line features two accelerators based on the same die: the 950PR, for the prefill stage of inference, and the 950DT, for the decode stage and for training. The 950PR has roughly half the computational performance of the 910C and half its memory bandwidth. Prefill is compute-bound and benefits more from memory capacity than from memory bandwidth, so the 950PR comes with cheaper, lower-bandwidth HBM. The 950DT takes the same die in the other direction, pairing it with a faster domestic HBM to deliver 25% higher memory bandwidth than the 910C. These design choices are likely driven at least partly by two constraints. First, its TSMC die stockpile is running out, so new chips must be fabricated domestically instead. Second, the December 2024 US ban on HBM exports has cut off its supply of imported HBM, leaving it to fall back on a weaker domestic substitute.7

What matters in the strategic competition over AI is the total compute a country can deploy, not any single chip’s performance. Compute is largely fungible—for example, inference capacity can free up training capacity and vice versa, and to some extent, larger volumes of chips with lower performance and memory bandwidth can substitute for fewer, better chips. Therefore, what matters is not only the quality of Chinese AI chips but also how many it can make.

Domestic chip shipments are growing but remain highly concentrated

The domestic chip design ecosystem is growing, as Chinese chipmakers captured about 40% of China’s AI chip market in 2025, collectively selling an estimated 1.7 million chips that year, or 38% as many as NVIDIA’s 4.5 million worldwide. Similarly, the number of active AI chip designers has grown from two prior to 2018 (Huawei HiSilicon and Cambricon) to at least nine in 2026. Some of these AI chip designers likely see little demand because their products are not competitive. But even designers with more competitive products, such as Huawei, still can’t ship in the volumes they’d need to match US rivals, because Chinese chip fabrication companies can’t manufacture enough chips (see the section on fabrication below). Here’s how many chips each company shipped in 2025, according to reports:

• Huawei shipped about 810,000 Ascends

• Alibaba T-Head shipped about 270,000 Zhenwus

• Cambricon shipped about 150,000 Siyuan 590s

• Baidu Kunlunxin shipped about 60,000 Kunlun P800s

• Enflame shipped about 60,000 chips

• Iluvatar CoreX shipped about 30,000 chips

• MetaX shipped about 25,000 chips

• Moore Threads shipped about 20,000 chips

• Biren shipped about 4,500 to 10,000 BR106 chips

Based on this shipment data and performance specifications, we estimate that Chinese AI chip designers collectively shipped about 770,000 H100-equivalents in 2025.8 That represents about 7% of the compute NVIDIA is estimated to have sold in 2025, and about 4-5% of total global AI compute sold in 2025. Chinese aggregate shipments also equal only about two-thirds of the compute that OpenAI’s single Stargate facility in Abilene, Texas, will deliver once its planned 450,000 NVIDIA B200 chips are installed.9

China’s cluster-level systems are limited by fab capacities

As the semiconductor industry shifts away from single-chip performance metrics toward rack- and data-center-level compute—where what matters is the combined performance of chips, interconnects, and memory across the system—Chinese designers are doing the same, clustering more chips together to deliver high aggregate compute.

The leading example is the Huawei CloudMatrix 384, a 384-chip Ascend cluster that Huawei claims to beat NVIDIA’s 72-chip GB200 NVL72 on some training benchmarks. The comparison isn’t apples-to-apples, though. CloudMatrix packs roughly five times as many chips and is estimated to draw roughly four times the power.

The clustering strategy itself is universal; NVIDIA, AMD, and hyperscalers like Google and AWS all build dense rack-scale systems. Huawei is extending the same strategy with its next-generation Atlas 950 SuperPoD, which it says can scale up to 8,192 Ascend NPUs.

This brute-force approach is feasible as far as the power budget and interconnect can carry it, but it compounds two structural problems. At the cluster level, scaling efficiency erodes as clusters grow. With aggregate performance rising, a larger share is lost to interconnect bandwidth, latency, and synchronization overhead, so the gain per added chip diminishes. And at the absolute level, China also cannot manufacture as many advanced chips as the US-led ecosystem can, which limits how far clustering more chips can compensate for the performance gap.

Logic chips fabrication

Even the best chip designs ultimately depend on advanced fabrication processes to manufacture the physical chips. This manufacturing is generally done by foundries. A foundry is a company that fabricates chips designed by other companies, such as Apple, NVIDIA, or Huawei. Foundries own and operate the extraordinarily expensive and complex fabrication facilities (”fabs”) required to physically produce chips. This model, pioneered by TSMC in 1987, allowed chip design and manufacturing to specialize independently, unlike the older integrated IDM model, where a single company like Intel or Samsung handles both design and fabrication in-house.

Foundries use advanced production processes (process “nodes”) that determine, among other things, how small and densely packed transistors and other chip features can be. More advanced nodes enable more performant and energy-efficient chips.

Until recently, the main bottleneck to scaling AI compute globally was power capacity for data centers. However, compute scaling now seems to be bottlenecked by AI chip production. AI chip production, in turn, has previously been bottlenecked by advanced packaging, but is now increasingly bottlenecked by the production of logic and memory chips. China has always faced a somewhat separate set of constraints. It has plenty of electricity, so for years the main thing holding it back has been access to the most advanced chips, which are export-controlled. And as elsewhere, China’s domestic AI chip production is limited by its ability to produce competitive logic and memory chips at scale, a difficulty exacerbated by its lack of access to the most advanced chipmaking equipment.

The leading chipmaker is TSMC, which produces over 90% of the world’s most advanced chips (at 3nm and below), mostly in Taiwan. TSMC is where NVIDIA, AMD, Google, and Amazon have their AI chips made. But with export controls preventing Chinese chip designers from fabricating advanced AI chips via TSMC, they must rely on domestic chipmakers.

SMIC leads China’s foundry sector

The leading Chinese chipmaker, SMIC, is the world’s third-largest foundry by revenue, behind TSMC and Samsung, with roughly 5% of the global foundry market. SMIC operates ten facilities across four Chinese cities (Shanghai, Beijing, Tianjin, and Shenzhen), employs over 20,000 people, and achieved revenue of roughly $9.3 billion in 2025. (TSMC’s 2025 revenue was approximately $120 billion, about 13 times that of SMIC.)

The company is heavily state-linked. As of late 2024, identifiable state-affiliated shareholders hold at least a quarter of the company, and local governments co-invest in its regional fab subsidiaries.10 In 2020, the US placed SMIC on the Entity List, citing risk of diversion to the People’s Liberation Army under the Chinese military-civil fusion strategy.

Whereas TSMC now mass-produces chips at 3nm and is ramping 2nm production with advanced nanosheet transistors, SMIC’s most advanced process in volume is its 7nm node, roughly the generation that TSMC introduced in 2018. SMIC has also progressed to a more advanced node (N+3), which has been likened to 5nm. However, TechInsights’ analysis places the process somewhere between 7nm and 5nm, with a transistor density of less than 125 million transistors per square millimeter, comparable to TSMC’s 6nm rather than true 5nm. Initial wafer costs on this node are estimated to be approximately 50% higher than TSMC’s equivalent process, with yields reaching about one-third of TSMC’s. On well-established advanced nodes, TSMC typically reaches yields of 80-90%. For modern multi-die AI chips like the Ascend 910C, which combines two logic dies and eight HBM stacks in one package, that front-end wafer yield is only part of the picture; the effective chip yield is the front-end yield multiplied by the packaging yield, compounding to a lower number than the wafer-level figure suggests.

SMIC lags three to five years behind TSMC

As measured by process node alone, SMIC remains about three to five years behind TSMC at the leading edge; factoring in yield, cost, and production volume, the effective gap is wider still. In practical terms, a smaller process node means more transistors can be packed into the same chip area, while consuming significantly less power per operation. For example, TSMC’s 3nm process fits roughly three times as many transistors per square millimeter as a 7nm process (about 300 million versus about 100 million). For AI chips, this translates directly into more compute per chip, lower power consumption, and lower cost per unit of performance. The node gap is why SMIC-fabricated AI chips are larger, need more energy, and cost more per unit of compute than their TSMC-fabricated equivalents.

The most important blocker for SMIC is a lack of access to ASML’s EUV photolithography machines, which are highly useful for manufacturing at 7nm and 5nm and are essential for more advanced nodes. SMIC ordered an EUV scanner from ASML in April 2018, but the deal was blocked by the Dutch in 2019 after pressure from the US. (Chinese progress in domestic photolithography and other equipment is discussed in a section below.) Without EUV, SMIC must use a technique called multipatterning—layering multiple exposures to effectively shrink feature sizes—using older DUV immersion machines. Multipatterning raises costs, reduces throughput, and makes it harder to attain good yield.

By the end of 2025, SMIC’s total manufacturing capacity reached approximately 1.1 million wafers per month (measured in 8-inch equivalents), with utilization at roughly 95%. TSMC produces roughly 1.4 million 12-inch-equivalent wafers per month. Since a 12-inch wafer has about 2.3 times the usable area of an 8-inch wafer, converting to a common standard puts SMIC’s output at roughly a third of TSMC’s in raw wafer area, though this overstates SMIC’s relative position, since most of its output is on mature nodes (45nm and above) while a bigger proportion of TSMC’s capacity serves the world’s most advanced chips. In 2025, SMIC’s capital expenditure hit a company record of $8.1 billion, with a stated goal of adding one new fab per year. (TSMC’s 2025 capex was $40-42 billion, five times that of SMIC.)

If SMIC were to allocate its entire advanced-node capacity to Huawei Ascend production, it could theoretically make tens of millions of Ascends per year by 2026-2027. (For comparison, NVIDIA sold an estimated 4.5 million GPUs in 2025.) The point is not that such an allocation is plausible, but that even an extreme reallocation of SMIC’s advanced-node capacity would still leave China short once HBM supply, packaging, yields, and other customers are taken into account. China’s AI build-out, spanning frontier model training, inference infrastructure, and state-directed deployments across industry and government, implies a scale of chips that SMIC would struggle to meet, especially given the performance gap between Ascend chips and leading NVIDIA hardware.

Although SMIC can manufacture 7nm chips, over 75% of its capacity (as of Q1 2025) is dedicated to mature nodes (45nm and above), serving the broad ecosystem of Chinese fabless companies designing chips for smartphones, consumer electronics, industrial automation, displays, and automotive applications. A natural question is whether this mature-node capacity could be redirected to AI chip production. In theory, it could, but in practice, the most advanced available process is strongly preferred because each node generation roughly doubles transistor density, which directly translates into more compute per chip and lower cost per operation. Building additional advanced-node capacity is difficult. It requires specialized equipment (the best of which is made in the US, Japan, and the Netherlands and is subject to export controls), deep process knowledge accumulated over years of production experience, and billions in capital.

Hua Hong might expand China’s fab capacity over the long term

Beyond SMIC, another notable Chinese chipmaker, Hua Hong, has so far made only mature-node chips, not the advanced-node chips used in AI hardware. Hua Hong Group (comprising Hua Hong Semiconductor and Huali) is China’s second-largest foundry and has historically focused on specialty and analog processes for automotive and industrial markets.

In March 2026, Reuters reported that Huali is preparing a 7nm process at its Shanghai plant, with support from Huawei and SiCarrier (a Huawei-linked SME company covered in the equipment section below), aiming for an initial capacity of a few thousand wafers per month by the end of 2026. If successful, Hua Hong would become the second Chinese foundry after SMIC capable of producing 7nm chips, which could represent a meaningful expansion of domestic AI chip production, since Ascends are fabricated on 7nm processes.

However, as with SMIC, Huali is constrained by US export controls on equipment. In April 2026, BIS sent letters to major US tool suppliers, including Applied Materials, Lam Research, and KLA, directing them to halt some shipments to Hua Hong or Huali-linked facilities. That makes Huali’s 7nm ramp highly uncertain, and even at an initial planned capacity of just a few thousand wafers per month, it would remain far behind SMIC, whose 7nm-and-below output is estimated at around 45,000-60,000 wafers per month. Huali is unlikely to meaningfully contribute to Chinese AI chip production for at least several years.

Huawei is building fabs to reduce its dependence on SMIC

Besides the established fabs, Huawei is moving beyond a fabless model to become an IDM, a company that designs, fabricates, and packages its own chips end-to-end, as Intel and Samsung do. Huawei is now reported to operate at least 11 fabs across China, covering memory and logic chips, through direct ownership or control of seven affiliated chipmaking companies. These entities are structured to obscure Huawei’s involvement, making it harder to assess Huawei’s true chipmaking capabilities or to identify sanctionable entities. At least five of the 11 fabs are reportedly capable of process nodes of 7nm and below, though this claim remains unverified and difficult to reconcile with the broader constraints on China’s advanced manufacturing.11

Huawei is also building three fabs in Shenzhen’s Guanlan district, under development since 2022, each run by a different actor linked to Huawei. One is Huawei’s own facility for 7nm smartphone and Ascend chips. A second is run by SiCarrier, the state-backed equipment maker that spun out of a Huawei lab. The third is operated by SwaySure, which supplies memory chips for Huawei’s cars and consumer devices. Huawei’s own plant was not expected to reach full operation before 2026, as the company plans to rely heavily on still-untested domestic equipment. By building its own fabs, Huawei seeks to bypass the SMIC bottleneck. SMIC’s advanced-node capacity is limited, shared among multiple Chinese chip designers, and yields on the large dies typical of AI chips have been a persistent challenge.

High-bandwidth memory fabrication

Of all the bottlenecks in China’s AI chip supply chain, HBM may be the most important. When people talk about AI chips, they usually focus on processing speed—how many calculations a chip can perform per second. But in practice, a chip often sits idle, waiting for data. Just as a factory’s output depends not only on how fast its workers assemble parts but also on how quickly those parts reach the assembly line, so a chip’s actual performance depends on memory bandwidth, or how fast data can flow from memory to the processor. In this analogy, HBM is both the stockroom and the conveyor belt: it stores data close to the chip and delivers it in many parallel streams, fast enough to keep the processor busy. As such, it is a crucial component of modern AI chips.

HBM is an assembly of multiple thinned stacked dynamic random-access memory (DRAM) dies—typically eight to twelve in current generations, with sixteen-high stacks newly emerging—bonded together and mounted alongside the processor on a shared silicon interposer (a thin silicon “bridge” that routes signals between the processor and memory stacks). DRAM is the standard working memory used in virtually all computing devices, temporarily storing the data that processors need to access quickly. But standard DRAM is like a narrow pipe—it can only feed data to the processor in a single thin stream at a time. HBM works more like a broad river, delivering many parallel streams of data simultaneously, which is what AI chips need to process massive models without stalling. DRAM is in short supply worldwide because each gigabyte of HBM takes roughly three or four times the manufacturing capacity of a gigabyte of standard memory. As key producers shift their fabs toward AI-grade HBM and data centers drive surging demand for server-grade DRAM, conventional memory for phones, PCs, and servers gets squeezed, driving a sharp global spike in DRAM prices from early October 2025, with consumer DDR5 roughly tripling within a few months.

Producing HBM reliably is technically difficult. Each stack requires thinning individual DRAM dies to roughly 30-50 microns (a fraction of their original thickness), then etching thousands of microscopic holes straight through the silicon, called through-silicon vias (TSVs), and filling them with copper to create vertical electrical connections between layers. The dies are then bonded together one by one, each requiring sub-micron alignment. A failure at any layer can damage the entire stack. Only three companies—SK Hynix and Samsung (both South Korea), and Micron (US)—control essentially all of the global HBM supply chain.

HBM is restricted by US export controls

This concentration in US-allied hands made HBM a viable target for export controls. When the US announced countrywide export restrictions on HBM more advanced than HBM2E to China in December 2024, Chinese companies had already been stockpiling for months. By the time controls took effect, Chinese entities had reportedly procured approximately 13 million HBM stacks. That would be enough for roughly 1.6 million Huawei Ascend 910Cs if allocated entirely to that chip, though in practice Huawei and other Chinese AI chip designers may compete for the same limited pool. Some HBM continued to enter China through structural loopholes. For example, the initial rules did not restrict HBM already attached to simple processors, nor did they cover the equipment needed to manufacture HBM domestically. However, the stockpile is finite, and SemiAnalysis estimates that China most likely ran out of stockpiled HBM in late 2025. China requested relaxed HBM restrictions in trade talks held in August 2025—not photolithography tools or access to TSMC—which signals that Chinese officials believe this is what most constrains domestic AI chipmaking.

China’s memory makers are moving into HBM, led by CXMT

ChangXin Memory Technologies (CXMT) is China’s largest and most advanced DRAM player. It was founded in 2016 after a failed state-backed bid to acquire Micron.12 Blocked from buying the technology, Beijing pivoted to building it. CXMT’s rise has been quite rapid, its revenue reaching about $8 billion in 2025, more than doubling from 2024. Its global DRAM market share has risen to around 5-7% by revenue as of 2025. This rise was helped by the acquisition of legacy knowledge from the bankrupt German memory maker Qimonda, extensive talent recruitment from Samsung, SK Hynix, Intel, Micron, Applied Materials, and ASML, and knowledge of Samsung’s DRAM processes acquired through former employees. (In December 2025, Korean prosecutors indicted ten people, including a former Samsung executive, on charges of systematically transferring trade secrets to CXMT, allegedly causing Samsung billions of dollars in losses.)

Beyond CXMT, several other Chinese firms play narrower roles in the memory and HBM supply chain. Fujian Jinhua (FJICC), which the United States placed on its Entity List in 2018 over alleged theft of trade secrets from Micron, produces small batches of lower-grade DRAM with support from Huawei. SwaySure, a Huawei-backed company added to the same list in December 2024, is working on HBM stacking and, as of 2025, plans to ship sample HBM to Huawei. Wuhan Xinxin, which shares a parent company with flash memory maker Yangtze Memory Technologies (YMTC), began ramping up HBM2 production in 2024, aiming for about 3,000 HBM wafers per month. YMTC itself makes mainly NAND flash, but is now moving into DRAM production in partnership with CXMT to reach the HBM market. (NAND flash is persistent storage memory, different from the faster, but ephemeral DRAM working memory described earlier.) Tongfu Microelectronics, the world’s fourth-largest chip packaging and testing firm, handles the assembly of HBM rather than die manufacturing, and says it has begun trial HBM2 packaging, which most likely means joining finished HBM stacks to compute dies rather than production of the HBM stacks.

CXMT trails the state of the art by three to four years

DRAM and HBM progress is usually measured by generation. CXMT’s most advanced mass-production DRAM is DDR5, a generation that leading manufacturers like SK Hynix and Samsung first shipped in 2020 and scaled production in 2021, putting CXMT roughly three to four years behind. CXMT’s DDR5 yields were reported at about 80%, up from roughly 50% at the start of production, and DDR5 was expected to account for more than 60% of the company’s output by the end of 2025.

For AI chips, what matters is not commodity DRAM but HBM. The leading HBM makers are already moving into HBM4, with SK Hynix preparing mass production in 2026, while CXMT is still trying to scale earlier generations. Since the second half of 2025, CXMT has been providing HBM3 samples to Huawei and other Chinese AI chip designers, though initial shipments suffer from low yields of around 50%. The company has announced ambitions to enter HBM3E production in 2027 and is proceeding with a $4.2 billion IPO on the Shanghai STAR Market.

CXMT faces different bottlenecks at each HBM generation. Its current 1z/G4 DRAM node appears sufficient for HBM3, and further DUV multipatterning may support HBM4. Beyond that, however, producing economically viable HBM becomes much harder without EUV, as further scaling would require increasingly complex multipatterning with worse yield. A second wall emerges with the base die, since every HBM stack includes a logic die that routes signals in and out of the stack, and HBM4 and later generations require that logic die to be built at advanced nodes to keep up with rising bandwidth demands. SK Hynix outsources its base-die fabrication to TSMC (at 5nm and below). Micron, by contrast, manufactures its HBM4 base die in-house, though it reportedly struggled to meet NVIDIA’s high-speed requirements and faced delays, and will switch to TSMC for HBM4E. Without access to either advanced-node foundries or its own advanced-node logic process, CXMT will likely have to use 7nm alternatives at best, potentially producing functional but lower-bandwidth HBM4. In short, some HBM3 is already in production in China; HBM4 will be feasible but with reduced bandwidth due to base-die limitations; and HBM4E and beyond will be very difficult to produce competitively at scale without EUV machines.

The global HBM market is highly concentrated in three foreign companies

In the global HBM market, concentration remains extreme. According to one source, in 2025, SK Hynix accounted for 62% of HBM revenue, Micron 20%, and Samsung 18%. SK Hynix’s lead comes from an early bet on HBM that paid off as demand for AI chips exploded. Samsung, long the world’s largest DRAM maker, has struggled to make competitive HBM, and its share fell to 13% in the first quarter of 2025 before recovering to 22% in the last quarter. Micron, historically holding a smaller share of the global DRAM market, has moved aggressively into HBM and announced in December 2025 that it would exit the consumer memory market entirely to prioritize AI data-center customers.

CXMT holds effectively zero share—its DRAM production is concentrated in commodity DDR4 and early-generation DDR5 rather than HBM. The key question is not whether CXMT can compete with SK Hynix globally, but whether it can produce enough HBM to keep the Huawei Ascend production line running.

China’s HBM capacity is growing but still likely insufficient

CXMT’s expansion has been remarkable. In early 2026, CXMT was producing approximately 240,000 DRAM wafers per month, with plans to expand to 300,000 later in 2026. It aims to allocate about 20% (60,000 wafers) to HBM3 production, a level that would have seemed implausible just a few years earlier. To put this scale in context, Samsung’s annual DRAM capacity totaled 7.6 million wafers in 2025, compared with 6 million for SK Hynix and 3.6 million for Micron. Therefore, CXMT’s annual output sits at roughly half of SK Hynix’s level.

In DRAM, the global leaders are several generations ahead of CXMT. CXMT’s DRAM production reportedly uses a 16nm process, roughly the generation that SK Hynix and Samsung began using in 2016.13 As of 2026, SK Hynix, Samsung, and Micron are several generations ahead. (These node labels are not directly comparable to logic nodes as they refer to DRAM production processes.)

Estimates of CXMT’s 2026 HBM production vary widely. One estimate puts output at about 2 million stacks, enough for about 250,000 Ascend 910C chips. A more optimistic projection forecasts about 7 million stacks in 2026, enough for about 600,000 Ascend 910Cs after accounting for a 70% packaging yield, which roughly matches Huawei’s stated 2026 production targets (though other Chinese chip designers would also draw on the same limited domestic pool).

Domestic memory limits Huawei’s next chips

The Ascend 910C uses eight stacks of HBM2E memory for 3.2 TB/s (terabytes per second) of memory bandwidth, roughly on par with an NVIDIA H100 (2022), but only about 40% of a Blackwell B200 (2024, 8 TB/s). Because CXMT’s domestic HBM3 samples are still in early production and imports of HBM2E and above are banned, Huawei has developed its own HBM-like memory in-house (branded HiBL and HiZQ) rather than using standard HBM from SK Hynix, Samsung, or Micron.

The Ascend 950PR, released in March 2026, pairs the chip with 128 GB of memory at 1.6 TB/s, which is half the bandwidth of the Ascend 910C. The Ascend 950DT (Q4 2026) uses 144 GB of HiZQ 2.0 at 4 TB/s. The NVIDIA B300 (2025) delivers 8 TB/s with 288 GB of HBM3E, or in other words, twice the bandwidth and twice the capacity of Huawei’s best 2026 chip. An analysis of NVIDIA’s and Huawei’s 2027 plans suggests that NVIDIA chips could offer five times as much memory bandwidth as Huawei chips.

DRAM manufacturing is less dependent on EUV lithography than leading-edge logic chip manufacturing, since it requires fewer critical layers and its repetitive cell architecture is a natural fit for multipatterning techniques. Samsung and SK Hynix began incorporating EUV into mass production around 2020 and 2021, respectively, and Micron more recently, in 2024, employing EUV machines for a single layer only. For the current-generation DRAM that CXMT is targeting, DUV tools are broadly sufficient, but EUV will become necessary as HBM scales further.

Advanced packaging is another constraint on Chinese AI chips

For China, HBM is also a packaging problem, as even if domestic firms can make the DRAM dies, they still need to stack and connect them. When AMD and SK Hynix first commercialized HBM in 2015, the central challenge wasn’t making the memory work, but solving the surrounding integration problems, such as thinning wafers without mechanical stress and cracking, etching and filling TSVs precisely through 30-50 micron silicon, bonding successive die layers without misalignment14 and testing assembled stacks before permanent attachment. Each step requires specialized equipment, and yield implications compound, since a failure rate of even a few percent per die level can produce substantial stack-level losses.

Besides stacking the memory dies, advanced packaging covers a broader set of techniques for connecting multiple dies and chiplets (small chips designed to be combined with others in a single package). It is also applied to package the finished HBM stacks with a logic die. Consequently, for China, the bottlenecks extend beyond producing the HBM dies, since integrating them with the logic chips poses a challenge of its own.

The industry is also beginning to explore 3D DRAM, in which memory cells are stacked vertically within a single chip. In conventional DRAM, cells sit side by side on a single flat layer of silicon, and capacity has been increased by shrinking the cells and packing them more closely together. This approach, however, is close to its physical limits. 3D DRAM instead builds upward, stacking several layers of cells in the same footprint, as shown in the photo below. (This is distinct from HBM, which bonds separate, fully fabricated DRAM dies on top of one another in a packaging step.)

A shift toward 3D DRAM could work modestly in China’s favor, because it would move more of the manufacturing difficulty away from photolithography and toward high-aspect-ratio etching and thin-film deposition (both covered in the equipment section below). Those are areas where China’s domestic equipment industry is still behind, but where it has made faster progress than in photolithography.

Semiconductor manufacturing equipment

The dominant cost of a new fab is equipment, which makes up about 70-80% of the total investment, with the physical building accounting for the rest. The full production process involves about 1,000 individual steps and takes more than four months from blank wafer to finished AI chip. Each step requires its own specialized tools produced by a handful of companies in the US, Japan, and the Netherlands. As described in this report, the key stages, repeated hundreds of times to build the chip layer by layer, work as follows:

• Deposition coats the wafer with an ultra-thin layer of new material, either a metal for wiring or an insulator to keep layers separate.

• Lithography then projects a circuit pattern onto a light-sensitive coating (photoresist) on that layer, using ultraviolet light through a mask (like a stencil). This step is central to shrinking the chip’s features—how small they can be printed—and uses the single most expensive piece of equipment in the fab, the photolithography scanner.

• Etching carves away material wherever the pattern is exposed, cutting the intended circuit structures into the silicon.

• Ion implantation injects specific atoms into targeted regions of the wafer to change their electrical properties—this is how transistors get their ability to switch on and off.

• Chemical mechanical planarization (CMP) polishes the wafer surface perfectly flat after each layer is built, so subsequent steps, like deposition, etching, or patterning, can proceed cleanly; without it, tiny bumps from earlier layers would compound into defects.

• Cleaning removes residues, particles, and chemical contaminants between steps, as contamination at the nanometer scale can ruin an entire chip.

• Metrology and inspection tools measure dimensions, check alignment between layers, and scan for defects throughout the process. Early detection allows some defects to be repaired, or allows the manufacturer to discard defective wafers early on.

After all layers have been built, the wafer enters testing, and each individual chip (“die”) on the wafer is probed to identify which ones work. The wafer is then diced into individual chips, and the working dies move to packaging, where they are mounted in protective housings with electrical connections. For many AI chips, advanced packaging is an additional critical step, with technologies like TSMC’s CoWoS placing the processor die alongside HBM stacks on a shared silicon interposer, enabling the fast data transfer that AI workloads require.

Photolithography

Photolithography, the most complex and important type of SME, is where China is furthest behind. EUV photolithography, essentially necessary for chips at 5nm and below, is the most complex piece of equipment in the semiconductor supply chain. Lithography machines alone account for roughly 20% of a new fab’s total capital investment. A modern chip contains tens of billions of transistors, spread across many precisely aligned layers. Although even at the most advanced nodes, fabs use DUV for the bulk of layers, the most critical, smallest-feature layers require EUV. Without EUV for those critical layers, a foundry must substitute DUV multipatterning (printing the same layer in multiple passes), which is slower, more error-prone, and thus more expensive. For the most advanced nodes, as well as future ones, DUV multipatterning may not be able to replace EUV at all.

Shanghai Micro Electronics Equipment (SMEE) is China’s oldest photolithography maker, but has reached only a 4% market share, and this only in i-line tools, a technology used for MEMS, sensors, and power electronics rather than advanced-node fabrication. The global lithography market is a near-monopoly, with ASML (Netherlands) holding over 85% of DUV immersion shipments and being the sole supplier of EUV systems. Nikon (Japan) still produces immersion DUV scanners capable of supporting advanced-node multipatterning, though these are older argon fluoride systems, produced at marginal scale. Canon (Japan) has stepped back from DUV photolithography to pursue nanoimprint lithography, a different paradigm that has seen little adoption, alongside i-line steppers for legacy nodes. Together, Nikon and Canon account for only about 6% of the lithography equipment market. Neither company makes EUV machines.

Photolithography machines are extraordinarily complex, perhaps the most complex machines ever built. An EUV machine, for instance, needs a powerful light source and mirrors polished to near-atomic perfection. Every part must be made and assembled with extreme precision, and must operate with extreme precision and control. The entire system has to run in a vacuum, because otherwise its short-wavelength light would be absorbed by air. A single EUV machine contains around 100,000 parts, and shipping it requires 40 freight containers, 3 cargo planes, and 20 trucks.

Export controls have cut China off from advanced lithography

Since 2019, ASML has been blocked from exporting its EUV systems to China after the US pressured the Dutch government. In 2023 and 2024, Dutch export controls were expanded to cover most advanced DUV systems, with both the Netherlands and Japan introducing parallel controls on these systems. China’s companies stockpiled wafer fabrication equipment in 2024, before the restrictions took effect, accounting for some 40% of global sales. ASML’s older 1980i immersion DUV shipments to China jumped from 14 units in 2021 to 89 in 2024, while sales of the more advanced 2050i and 2100i, both hit by Dutch controls in 2023-2024, collapsed to zero. By 2024, 70% of ASML’s global immersion DUV shipments went to China. Despite export controls, ASML’s revenue from China increased from about 15% in 2021 to about 33% in 2025. This spending surge has partly been interpreted as pre-emptive stockpiling of DUV systems in anticipation of further tightening.

DUV lithography

DUV machines come in two types, dry and immersion. In an immersion system, the gap between the lens and the silicon wafer is filled with a liquid, typically purified water, instead of air. Water has a higher refractive index than air, which shortens the light’s effective wavelength as it crosses that gap, and a shorter effective wavelength lets the machine print finer features than a dry system does. Immersion DUV machines are relevant for AI chipmaking in a few ways:

• Direct fabrication of older nodes. With multipatterning, immersion DUV can produce chips at 7nm (2018), and potentially 5nm (2020).

• Non-critical layers for advanced-node processes. Even in the most advanced-node processes, only a subset of layers require EUV. The remaining layers are still patterned with immersion DUV, so scaling production below 5nm still requires many immersion DUV machines.

• HBM production. HBM2E and earlier generations are made entirely with DUV. Even the newer HBM3E and HBM4 DRAM dies use EUV only for a handful of the most critical layers; the bulk of advanced DRAM production still relies heavily on immersion DUV.

DUV multipatterning cannot fully substitute for EUV

Beyond EUV research, what matters practically is what China can produce with its existing DUV tools. For mature nodes at 45nm and above, where dry DUV suffices, China is well supplied by a mix of domestic and imported systems—SMIC, Hua Hong, and Nexchip collectively run millions of wafer starts per month at these nodes. For 28nm and below, Chinese fabs rely on imported immersion DUV tools from ASML, a stockpile of machines bought before Dutch and Japanese export controls tightened in 2023, 2024, and 2025, as well as some less advanced immersion DUV tools that remain unrestricted.

As described in the section on chip fabrication, 7nm chips can be made without EUV using immersion DUV multipatterning; TSMC’s first 7nm process used this approach before later versions introduced EUV. SMIC has used the same basic workaround for Huawei’s Kirin chips. But this approach comes with steep trade-offs in cost, yield, and throughput, as each additional pass must align at the nanometer scale. ASML’s most advanced DUV immersion scanners (the Twinscan NXT series) can achieve overlay accuracy of around 2.5nm and throughput of 200 to 300 wafers per hour.

China holds a substantial installed base of ASML DUV scanners, including immersion systems capable of supporting 7nm production. But while the approach works, the volume is limited, and the economics are poor. The yields are roughly one-third of TSMC’s, and costs per wafer are approximately 50% higher.

Another long-term concern is that these machines age. Imported DUV tools require maintenance every six months from ASML itself; without this maintenance, the existing Chinese fleet would likely degrade significantly within a year. Spare parts, software updates, and servicing for the banned immersion DUV systems are also restricted. China’s domestic alternatives are still catching up: SMEE is working toward an immersion DUV system suitable for 28nm process node production, and Yuliangsheng supplied its first 28nm system to SMIC in 2025 for early testing, reportedly experimenting with multipatterning to produce 7nm chips. Domestic tools capable of supporting sub-10nm production (even with multipatterning) are, however, not expected before 2030.

EUV lithography

It took ASML about two decades to go from serious development of EUV to its first commercial shipment. The difficulty is spread across several uniquely complex subsystems, each made by only one or two suppliers in the world:

• Light source. Tin droplets are fired into a vacuum chamber 50,000 times per second. A high-power CO2 laser hits each droplet twice, vaporizing it into a plasma 40 times hotter than the Sun’s surface, which emits EUV light. The drive laser is supplied exclusively by Trumpf (Germany), while the full light source is assembled by Cymer in San Diego, California, which ASML acquired in 2013.

• Collector mirror. A large curved mirror channels EUV photons from the plasma into the optical system. Only Zeiss (Germany) can build it.

• Multi-layer mirrors. The scanner contains 10-14 mirrors polished to near-atomic smoothness. Each reflects only about 70% of EUV light, so only about 2% of the source’s output reaches the wafer. Zeiss (Germany) is again the sole producer.

• Photomasks. The specialized low-defect substrates that carry the circuit pattern. HOYA and AGC (both from Japan) produce them and together hold about 93% of the global EUV photomask market.

• Pellicle. A thin protective film shields the photomask during printing. Mitsui Chemicals (Japan) manufactures them commercially under a license from ASML.

That is why even serious Chinese progress in prototype systems should be interpreted cautiously. Building something that emits EUV light is not the same as building something that can support high-volume, commercially competitive chip production.

SiCarrier, a Shenzhen state-backed semiconductor equipment maker with close ties to Huawei, has emerged as the key coordinator linking domestic photolithography efforts and extending into EUV-adjacent optics through its stake in Zetop Technologies.

The absence of publicly verified data for Chinese tools makes tracking progress difficult. With that caveat, here’s what we can piece together. The table below maps all entities active in China’s EUV and advanced DUV ecosystem—equipment makers, coordinators, state research institutes, universities, and defense-industrial groups—alongside their specific subsystem focus and current maturity.

China’s EUV prototypes are still far from production tools

Reuters reported in December 2025 that China had constructed a prototype EUV photolithography machine inside a high-security facility in Shenzhen, under the oversight of China’s Central Science and Technology Commission, a top Party-level body created in 2023 to centralize national strategy over science and technology. The prototype was reportedly completed in early 2025 and is undergoing testing. It can generate EUV light but has not yet produced functional chips. The prototype would still need dramatic improvements in source power, conversion efficiency, mirror reflectivity, uptime, and precision optics before approaching commercial viability, as the gap between generating EUV light and actual chip production is substantial. The machine is described as physically much larger than ASML’s commercial systems, filling nearly an entire factory floor.

The project was built partly using components from older, pre-controls-era ASML machines acquired through secondary markets. Former ASML engineers, recruited with signing bonuses of $420,000 to $700,000 plus housing subsidies, played a significant role. The program has been described as analogous to the Manhattan Project: a top-down national effort, designated as one of Xi Jinping’s top strategic priorities, that mobilizes thousands of engineers across state research institutes and private firms under Huawei’s coordination. Work is reportedly conducted in secured facilities under strict secrecy, with some recruits issued identification cards under false names, instructed to use aliases, and teams deliberately isolated from one another.

China’s lack of EUV lithography severely constrains its chip manufacturing

Several key EUV components are produced by only a single supplier, exclusively for ASML. Only Trumpf (Germany) makes the CO2 drive laser. Only Zeiss (Germany) makes the multi-layer mirrors and optics (and since 2016, ASML has owned a 25% stake in Zeiss’s Semiconductor Manufacturing Technology subsidiary). Cymer, which assembles the full EUV light source, has been a wholly-owned ASML subsidiary since 2013. Berliner Glas, a specialty optics supplier, was acquired by ASML in 2020. Because these components have no economic alternative, Chinese firms could not procure them through normal commercial channels even in the absence of export controls. (In fact, our understanding is that ASML’s suppliers’ suppliers are also contractually prevented from selling parts to other companies.) And because no ASML EUV machines have ever shipped to China, Chinese researchers have no deployed system to study directly.

China’s progress is uneven across these subsystems, but it lags far behind on all of them. For the multi-layer mirrors that bounce EUV light through the scanner, ASML uses 10-14 molybdenum-silicon mirrors polished to near-atomic smoothness, each reflecting about 70% of EUV light. Only Zeiss SMT (Germany) can produce them at production grade. Chinese researchers at the Changchun Institute of Optics, Fine Mechanics and Physics (CIOMP), a Chinese Academy of Sciences institute, have achieved a reflectivity of about 65% using domestic Mo/Si mirrors. The commercial arm, Zetop Technologies, part-owned by SiCarrier and CIOMP, is working to scale these mirrors for lithography. Even this five-point reflectivity gap compounds across 10-14 sequential mirror bounces, meaning a Chinese system at 65% delivers only 35-50% as much EUV light to the wafer as ASML’s.

This has forced Chinese researchers toward entirely different light sources, perhaps developed in parallel with a laser-produced plasma (LPP) light source similar to that used by ASML:

• Tsinghua University is developing a steady-state microbunching (SSMB) system that would use a 100-150-meter-circumference particle accelerator (roughly the size of two basketball courts) to generate continuous EUV light, targeting a power output above 1,000 W, higher than ASML’s about 600 W. Rather than shrink the lithography machine for export as ASML does, the proposed design co-locates multiple lithography machines around one central accelerator in a single large facility, effectively a chipmaking campus built around one light source. Construction of a dedicated SSMB-EUV facility in Xiong’an began in early 2025.

• Harbin Institute of Technology is pursuing a laser-discharge plasma (LDP) source, which uses a solid-state laser combined with high-voltage electrode discharge to vaporize tin droplets and reportedly reaches around 100 W. LDP scales poorly to the powers needed for advanced-node lithography and is more commonly used for photomask defect inspection, so this path may end up as a supporting technology rather than a direct replacement for ASML’s light source. Both approaches are scientifically novel but unproven at high-volume manufacturing scale.

Most industry analysts do not expect a Chinese DUV immersion tool capable of supporting 7nm production via multipatterning before 2030, and even then, the resulting tools would likely lag ASML’s in yield and cost. Faster indigenization later this decade is possible—SMEE has announced systems capable of 28nm production, and SiCarrier tools are reportedly being tested by SMIC—but a first-generation domestic immersion tool would almost certainly be a long way from competitive. For EUV, Beijing’s stated target for a prototype capable of producing functional chip patterns is 2028, while 2030 is the more widely cited realistic expectation among outside analysts. A commercially viable EUV system is likely a decade or more away.

Even achieving a working prototype would not mean commercial readiness. ASML shipped its first EUV prototype in 2006 but did not make its first commercial shipment (the NXE:3400B) until 2017, 11 years later, and EUV-made chips did not appear in consumer products until 2019 with Samsung’s Galaxy Note 10. China may compress that timeline somewhat by hiring former ASML employees, buying older ASML components on the secondary market, and studying ASML’s own development pathway. Reverse engineering is more feasible for DUV than for EUV, as Chinese fabs operate many ASML DUV machines they can disassemble and study, whereas no EUV machine has ever been delivered to China. Still, turning a working prototype into commercially viable chip production could take years or decades.

Reports of China’s EUV prototypes and other hardware advancements must be interpreted with caution. China’s centrally directed industrial policy creates strong incentives for local governments, universities, and firms to exaggerate progress. Announcing breakthroughs serves as currency for recognition and funding within Beijing’s competitive industrial ecosystem, and there is little vetting of these claims. The most notorious example is HSMC, a Wuhan-backed company that burned through more than $2 billion without producing a single chip. The same system also fragments the supply chain. Provincial and municipal governments compete to nurture their own fully self-contained semiconductor clusters rather than coordinate around a single national effort, resulting in duplicated projects, small fabs, and spread-out capital. The prototypes may well constitute real scientific achievements, but even if so, they are many years away from being capable of volume production.

While China is making measurable progress on DUV and early-stage EUV machines, ASML is developing High-NA EUV machines, capable of printing features roughly 1.7 times smaller than standard EUV with less multipatterning. Intel has installed the first High-NA EUV tool, while TSMC appears to be postponing adoption due to its high cost.

Etch, clean, deposition, metrology, and more

China’s SME self-sufficiency remains limited overall. The share of domestically manufactured equipment installed in Chinese fabs reached roughly 35% in 2025, surpassing the government’s 30% target. But this aggregate figure is most likely skewed by mature and legacy-node tools (at 28nm and above), where domestic substitution is easier, rather than reflecting fully indigenous advanced-node production. The equivalent share for advanced-node equipment (7nm and below) is almost certainly much lower, but no reliable public breakdown exists.

Beijing is now pushing for 70% by 2027. Even so, China’s total equipment spending remained near record levels at $49 billion in 2025. Analysis of global market share data from 2019 to 2024 shows that Chinese companies are making real inroads in several equipment categories, even as the most advanced segments remain out of reach. Whether the 70% target is achievable depends heavily on the type of equipment. Whereas domestic substitution in etching and deposition already exceeds 40%, photolithography, the most critical and expensive step, remains around 18% overall, a figure that reflects tools for older process nodes and packaging rather than the DUV tools relevant for advanced semiconductor manufacturing. For advanced front-end production, China still has no competitive domestic immersion DUV tool shipping at scale.

Deposition tools coat wafers with ultra-thin layers of material—metal for wiring, insulators to electrically separate chip features, or barrier films to prevent contamination. China’s position varies dramatically across the three main types:

• In physical vapor deposition (PVD), which vaporizes solid material to coat the wafer, Naura has grown from 1% to roughly 10% of the global market between 2019 and 2024. Applied Materials (US) still leads with roughly 86%, though it is losing 2-4 percentage points per year to Chinese competitors. Naura’s gains are primarily at mature nodes; for advanced-node processes, Applied Materials remains dominant.

• In chemical vapor deposition (CVD), which uses chemical reactions to build up thin films, Chinese firms rose from 1% to 7% of the global market between 2019 and 2024, led by Piotech and Naura. The US still holds 78%. At YMTC (Yangtze Memory Technologies, China’s largest NAND flash maker), Piotech now supplies nearly a third of the installed CVD equipment, up from 15%, displacing foreign tools.

• In atomic layer deposition (ALD), the most advanced and precise category, which deposits films one atom layer at a time and is essential for leading-edge nodes, China holds less than 1% of the global market as of 2024. ASM International (Netherlands), Tokyo Electron (Japan), Kokusai (Japan), and Lam Research (US) together control about 88% of the segment, making ALD the widest gap in China’s equipment portfolio.

Etching tools carve circuit patterns into the wafer after lithography. Dry etching, which uses reactive gas plasmas rather than liquid chemicals to remove material and is relied on more heavily than wet etching at advanced nodes for its greater precision, is where Chinese firms have made real progress. The global dry etch market remains dominated by US firms Lam Research and Applied Materials (together holding roughly 60%) and Japan’s Tokyo Electron (about 15%). Chinese companies Naura and AMEC together hold roughly 11% of the market, up from under 3% in 2019, though these sales are largely equipment for older process nodes.

On the specific capability of high-aspect-ratio etching, which is critical for 3D memory and HBM stacking, AMEC produces a tool capable of etching features with a 60:1 aspect ratio (a hole sixty times deeper than it is wide), a notable achievement but roughly 6-8 years behind the global frontier. Its tool is comparable to what non-Chinese manufacturers offered around 2018 and 2019 and cannot support HBM production beyond HBM2E. A successor promising 90:1 aspect ratios is under development and would narrow the gap to 2-3 years, but its market entry now looks closer to 2027 than the 2025 timeline AMEC originally signaled. For comparison, Lam Research’s latest cryogenic etch tools—a technique not yet available in Chinese equipment—are designed to reach ratios above 100:1. AMEC is investing heavily to close this gap, with R&D spending up 54% year-on-year in the first half of 2025, but it still spends roughly a fifth of what Lam Research allocates to R&D.

Cleaning tools remove residues, particles, and chemical contaminants between fabrication steps; contamination at the nanometer scale can ruin an entire chip, so cleaning accounts for a large share of the process steps. The global cleaning market is moderately concentrated. SCREEN Semiconductor Solutions (Japan), Tokyo Electron (Japan), Lam Research and Applied Materials (US), plus China’s ACM Research, together account for about 65% of revenue in 2024, with SCREEN retaining overall leadership. ACM is the only Chinese firm in the global top tier. Cleaning is also China’s strongest equipment sub-sector, with over 50% domestic self-sufficiency, driven by ACM and Naura. ACM tools are now deployed in HBM production at SK Hynix and Micron, and ACM is targeting HBM4-compatible systems by 2026.

CMP tools polish the wafer surface flat between layers. Chinese firms’ share of the global CMP market grew from roughly 3% to 11% between 2019 and 2024, driven almost entirely by Hwatsing Technology. Applied Materials (US) still leads at roughly 60% of the global market with more advanced capabilities. Hwatsing is also expanding into ion implantation through its acquisition of Xinyu Semiconductor, a strategically important move because ion implantation is one of China’s weakest equipment segments, with domestic self-sufficiency at just 1.4% and two US firms (Applied Materials and Axcelis) controlling over 80% of the global market.

Metrology and inspection tools measure feature dimensions, check layer-to-layer alignment, and scan for defects throughout fabrication—essential for yield at advanced nodes, where a defect of a few nanometers can ruin a chip. The segment is even more concentrated than testing. KLA (US) holds roughly 63% of the global metrology and inspection market as of 2024, up from about 50% in 2010, with Applied Materials a distant second at under 8%. KLA’s share in reticle (photomask) inspection exceeds 80%. In China, the domestic substitution rate for metrology tools reached roughly 25% in 2025 (up from about 15% in 2022), but this figure aggregates all process nodes and is almost certainly concentrated at mature nodes; no Chinese firm offers a competitive alternative for advanced-node inspection.

Semiconductor testing verifies that finished chips work correctly, and the complexity of the test depends on the chip’s complexity. In linear and discrete testing (the simplest category, used for basic components like transistors and diodes) Chinese firms Hangzhou Changchuan and AccoTEST have captured nearly 70% of the global market. China has also entered burn-in testing (which stress-tests chips at high temperatures to catch early failures; 9% global share) and SoC testing (which verifies complex integrated circuits, such as AI chips; 5% global share) since 2020. However, the most advanced SoC and memory test segments remain dominated by Advantest (Japan, about 58% global share) and Teradyne (US, about 23%).

Advanced packaging tools are increasingly important for AI chips, which rely on integrating multiple smaller chips (“chiplets”) into a single package. Two relevant variants of advanced packaging are 2.5D, where multiple chips are arranged on an “interposer” chip that facilitates communication, and 3D, where chips are stacked on top of each other. Such techniques include through-silicon vias (TSVs), Chip-on-Wafer-on-Substrate (CoWoS), and hybrid bonding. The advanced packaging process needs many different SME, including both wafer fabrication tools and assembly tools. The global market for the wafer fabrication tools used in advanced packaging is dominated by the US (65%), with Japan a distant second (15%), and China third (7%).

Chinese firms’ gains are concentrated in specific segments. They have gained about 10 percentage points in global share in etch and clean tools for advanced packaging since 2019, and in packaging deposition, they have surpassed Japan to become the second-largest supplier behind the US. Naura, for example, launched a TSV etcher for 12-inch wafers in 2020 and has since developed a plasma etching process that produces TSVs with 11.8-micron openings at 116-micron depth. But in higher-value advanced-packaging segments, especially hybrid bonding, China is likely at an early stage of development. Hybrid bonding is already used in current 3D stacking products such as AMD’s 3D V-Cache and in YMTC’s NAND architecture, and may become important for future HBM generations. Naura reportedly unveiled one of China’s first 12-inch die-to-wafer hybrid bonding systems in March 2026.

Across these categories, a handful of state-backed national champions are carving out positions in moderately complex equipment segments such as etching, cleaning, CVD, and CMP at mature nodes, and are expected to reinvest their revenue into R&D targeting harder segments like advanced-node ALD, ion implantation, and lithography, though Chinese firms still hold under 1% of the global ALD market and a near-zero share of lithography.

The four most important Chinese SME companies are Naura (etching, deposition, cleaning, and thermal processing), AMEC (etching and thin-film deposition), Piotech (CVD), and Hwatsing (CMP). Naura is the largest. Its 2025 revenue is forecast at about $7 billion (up from $4.2 billion in 2024), and it has climbed to sixth in the global ranking of SME suppliers by revenue in 2025—the only Chinese firm in the top tier, trailing only ASML, Applied Materials, Lam Research, Tokyo Electron, and KLA. Its order backlog runs through Q1 2027.

The Chinese state is investing heavily in its semiconductor industry. Big Fund III, the third phase of the National Integrated Circuit Industry Investment Fund, launched in May 2024 with $48 billion in capital, spending on materials, wafer-fabrication equipment, and chip companies across the supply chain rather than photolithography specifically. That headline figure is roughly on par with the €43 billion of funding in the EU Chips Act and the $39 billion in direct grants and loans in the US CHIPS Act, though the CHIPS Act also includes an estimated $46 billion in tax credits for chip manufacturing. Big Fund I ($19 billion, launched 2014) and Big Fund II ($29 billion, launched 2019) added another $48 billion in combined headline commitments, bringing the three phases’ total to about $95 billion.

On top of that, at least 15 local-government semiconductor funds add another $25 billion, with broader state subsidies (grants, tax incentives, low-interest loans, land concessions) estimated at around $50 billion more. These headline numbers come with caveats. The Big Fund disbursement has been marred by corruption investigations, with China’s Central Commission for Discipline Inspection launching a 2022 sweep of leading figures across the Big Fund and its management firms. Cases like Wuhan’s HSMC underscore that committed funding doesn’t always translate into effective semiconductor capability.

Veronika Blablová was funded through the Pivotal Research Fellowship during this work.

We’re grateful to the following people for providing thoughtful and constructive feedback on earlier drafts of this work: Raghav Akula, James Nicholas Bryant, Naci Cankaya, Jacob Feldgoise, Jack Freed, Hamish Low, Antoine Maier, Konstantin Pilz, Robi Rahman, Maxwell Roberts, Filip Šebok, and Kar Mun Nicole Wong. Their careful reading, questions, and suggestions substantially improved the final piece. Any remaining errors or shortcomings are entirely our own.

When the US and China make major announcements about new export controls, you shouldn’t just focus on the rules; you should also consider whether those governments can enforce them and whether companies will comply. Having written at length about improving US export control capacity (including about BIS funding, BIS software and data modernization, and potential BIS use of AI), I now want to cover China’s export control capacity, defined here as the ability to translate political intent into rules, administer licensing under those rules, and identify and halt violations of the rules.

As far as I can tell from trying to measure China’s export control capacity:

• China seems to retaliate against US export control actions much faster than the US can take them, probably because of some combination of a more streamlined interagency process, the US telegraphing its moves ahead of time, and China keeping a stock of prepared retaliatory measures.

• China might be a little slower per employee than the US at processing export control license applications, but the error bars on how many license applications China receives are so wide that it’s hard to tell.

• China takes a meaningfully different approach than the US on export control enforcement, leaning much harder on interagency partners, and seems to be producing more enforcement cases.

China’s export control rulemaking capacity

To enforce an export control rule, one must first make an export control rule. The US has dozens of professional bureaucrats and a bustling think tank ecosystem dedicated to this, resulting in such blockbusters as the October 2022 AI chip and semiconductor manufacturing equipment rule, the Foundry Due Diligence Rule, and the great-granddaddy of them all, the now-rescinded, never-replaced Framework for Artificial Intelligence Diffusion.

In the Chinese system, export control rules are made by the Bureau of Industry, Security, Import, and Export Controls (BISIEC1), housed within the Ministry of Commerce (MOFCOM2). According to China’s Export Control Regulations:3

The State Council main oversight department for commerce, in conjunction with other relevant national departments, shall formulate and adjust policies on dual-use item export control, and major policies shall be reported for approval to the State Council, or to the State Council and the Central Military Commission (CMC).

On the surface, this looks a lot like the US interagency process! BIS makes rules, in consultation with other interested parties, and senior political leadership signs off on major actions. However, the US interagency process is sometimes very slow and always very contentious. The December 2024 rule on high-bandwidth memory and semiconductor manufacturing equipment was largely finished by August, according to information that leaked to Bloomberg. The Trump administration has been trying and failing to find consensus on an AI diffusion replacement for a year now, and early drafts have also leaked to Bloomberg. (I truly believe that the greatest step DC policy practitioners could all take for US national security is, for the love of God, stop leaking to Bloomberg.)

The Chinese interagency process is less prone to leaks to Bloomberg. And given how quickly China has responded to US export control and tariff actions, the Chinese rulemaking system seems incredibly fast:

• On December 2, 2024, the US published a rule including 140 Entity List additions and new controls on high-bandwidth memory and semiconductor manufacturing equipment. On December 3, 2024, China responded with licensing policy changes for gallium, germanium, antimony, superhard items, and military end-users (one day later).

• On February 1, 2025, the US imposed a 10% tariff under the International Emergency Economic Powers Act on Chinese imports. On February 4, 2025, China responded with export controls on tungsten, tellurium, bismuth, molybdenum, and indium items (three days later).

• On April 2, 2025, the US imposed a 34% reciprocal tariff on China (stacked with previous tariffs). On April 4, 2025, China responded with export controls on seven rare earth elements (two days later).

• On September 29, 2025, BIS published the Affiliates Rule, making companies more than 50% owned by Entity List parties or military end users subject to export controls. On October 29, 2025, China responded with a six-announcement package, including additional rare earth elements and rare earth technology controls, among other measures (thirty days later).

This is not an exhaustive list, but it makes the point that China is generally able to respond to US actions within a week, with the massive and complex October package taking only slightly longer. I have at least three theories about why China is so quick to respond, which aren’t mutually exclusive:

1. Maybe China’s interagency process is far more top-down and centralized than the consensus-based US equivalent, and sacrifices debate for the sake of speed

2. Maybe BISIEC has a bank of pre-written, pre-approved retaliatory actions to publish as soon as the US does something (or, more depressingly, maybe the US system is so leaky that China always has lots of advance warning to prep retaliation)

3. Maybe China doesn’t care as much about narrowly tailoring controls to avoid pain to industry, and/or is just writing rules that are much less sophisticated and interesting than US rules (blanket raw material controls as opposed to detailed rules like US controls on chips and semiconductor manufacturing equipment)

The US government could draw some lessons from China on how to move faster. The US has a participatory, debate-oriented interagency process that ensures all stakeholders are heard and likely results in better policy. However, some consolidation and centralization of the process may be worthwhile when a lack of speed makes good policy moot—for example, if China can stockpile controlled items well ahead of a rule taking effect.

China’s export control licensing capacity

Once you make an export control rule, people will apply for permission to export things restricted under the rule, and you will have to process export control licenses. If you don’t have the capacity to evaluate license applications, even routine, low-risk ones will drag out forever, creating billions in unnecessary lost sales for your exporters.

BIS and BISIEC have both experienced versions of this problem. After mass staff departures at BIS last year, licensing timelines have started to stretch to several months, even for routine exports to US allies. China faced severe delays in issuing rare earth export licenses in the summer of 2025 after expanding the scope of its controls that spring. In both cases, the delays were a mix of deliberate policy (BIS applying extra leadership scrutiny and holding some applications; BISIEC potentially slow-walking approvals to ramp up pressure) and staffing problems (BIS losing lots of staff from a stable baseline; BISIEC trying to ramp up to match the increased scope of controls).

What is the best way to measure China’s licensing capacity? One way to start is by comparing the number of dedicated licensing staff between BIS and BISIEC:

• BIS Total Employees: 4364

• BISIEC Total Employees: 30 (60 including detailees)5

• BIS Licensing Employees (estimated): At most 100;6 likely ~80

• BISIEC Licensing Employees (estimated): Maybe 30, including detailees?7

BISIEC has about 14% as many staff as BIS overall, but proportionately more licensing officers, about 38% as many as BIS, though both licensing staff numbers are estimates. According to its Fiscal Year 2023 Annual Report, BIS processed about 38,000 licenses in fiscal year 2023, which ran from October 2022 to September 2023, the most recent fiscal year for which data is available. In March 2023, BIS probably had about 80 licensing officers,8 comparable to December 2025.9 With 250 working days per year, that means BIS’s licensing efficiency was about 1.9 licenses processed per officer per day.

There are important caveats to that number as a measure of licensing capacity. The 38,000 number is the number of applications that reached an end state in fiscal year 2023 (approved, denied, or returned without action). However, it’s not clear from external data whether BIS was bottlenecked by licensing officers or by the number of licenses received—maybe BIS could have processed far more licenses, but businesses just didn’t apply for that many. My impression is that BIS licensing officers were quite overworked when I was there, and that BIS was bottlenecked by them.

If BISIEC is about as efficient as BIS at processing licenses, then it could process about 14,000 licenses per year. But how many license applications is BISIEC receiving?

This turns out to be maddeningly difficult to figure out. China’s General Administration of Customs publishes rare earth exports by tonnage and value, but not by count of transactions. One extremely rough way to estimate this is to take a Reuters report of 140 export license applications by European companies from April to September 2025,10 annualize that to 280 licenses per year, and multiply that by the reciprocal of Europe’s share of China’s magnet exports (about 5x).11 That gives an estimate of 1,400 applications, which you can then multiply by the approval rate of “less than a quarter” mentioned in the Reuters article to get up to 350 applications processed and approved.

There are a couple of reasons to be cautious about that calculation. License applications track the number of transactions rather than the tonnage of exports, so Europe’s share of exports by tonnage might misrepresent its share of licenses in either direction. The actual number could also be higher, both because China controls many items besides rare earth magnets, and because China might be denying Europe licenses by indefinitely delaying approvals, even though the two are not in a trade war. BISIEC may be less efficient per employee than BIS at processing applications, but there are too many confounding factors to make a confident judgment.

China’s export control enforcement capacity

As noted earlier, BISIEC is considerably smaller than BIS, especially in enforcement. It has 14% as many staff as BIS, but proportionately more licensing officers (38% as many) and proportionately fewer enforcement agents (7% as many):

• BIS Total Employees: 43612

• BISIEC Total Employees: 30 (60 including detailees)13

• BIS Enforcement Employees: 13614

• BISIEC Enforcement Employees (estimated): Maybe 9?15

Because BIS has far more enforcement staff than BISIEC (136 BIS agents to about nine BISIEC agents), I think BISIEC leans on other agencies for enforcement help even more than BIS does. Lack of workload isn’t a sufficient explanation—China’s dual-use export control list contains hundreds of items beyond rare earths, similar to the US Commerce Control List, and there have been several documented cases of attempted rare earth smuggling.

BIS was born in 1987 as the Bureau of Export Administration (BXA)—a pure licensing agency that only gradually acquired in-house enforcement capabilities. It’s not obvious that in-house law enforcement is the right way to go for a highly technical regulatory agency—BIS gradually evolved that way, probably out of a combination of (1) bureaucratic will to survive and (2) the fact that successfully investigating and prosecuting export control cases often required technical regulatory, scientific, and engineering knowledge that BIS itself was best placed to provide.

BISIEC has three Investigation and Enforcement divisions on its organizational chart, but with at best nine staff between them, I doubt they do any meaningful enforcement. Even with 150 agent slots in the budget, BIS felt so strapped for enforcement capacity that in its fiscal year 2026 budget request, it asked for funding to hire 193 more.16

According to Epoch, about 20 million H100-equivalents of chips have been sold worldwide as of Q4 2025. That’s more than the number of physical chips in the world (Blackwells and other cutting-edge chips count as more than one H100-equivalent), but it shows how hard it is to enforce export controls worldwide with 136 people, let alone nine. To have any chance of managing that, I think BISIEC must be leaning hard on its interagency partners, specifically the National Mechanism for Coordinating Export Controls17, Customs, the Ministry of Public Security, the Ministry of State Security, and the State Post Bureau.

There is some evidence for that idea. On May 9, 2025, just before the Geneva trade truce, the National Mechanism for Coordinating Export Controls held an interagency meeting to launch a new enforcement campaign, along with a follow-up meeting on July 19. That year, according to data compiled by Han Kun Law, the number of administrative penalty cases for dual-use items more than doubled.

The increase could have other causes. China applied controls to many more items in 2025, expanding the universe of potential violators, including those acting out of simple ignorance. There might also be a learning-curve effect, with China getting better at enforcing controls.

However, I think the increased number represents a genuine effort to build interagency capacity. The Han Kun review describes the establishment of a “data-sharing channel” between Customs, Commerce, and the Ministry of Public Security. At the follow-up meeting in July, the Mechanism instructed the interagency to “study and establish a joint law enforcement coordination center for the export control of dual-use items”, possibly similar to the Commerce-Intelligence Community joint effort proposed in last year’s American AI Action Plan.

Conclusion

China’s export control system is developing into a force to be reckoned with. China is extremely quick to respond to US rules, is working to build licensing capacity (including by deploying detailees to BISIEC), and has found meaningful success with a unique, interagency-focused approach to export control enforcement. As the US and China continue to renegotiate their fraught economic and security relationship, it’s critical to understand China’s export control system, both to calibrate the US’s understanding of China’s true leverage and to draw lessons for the US’s own efforts.

The US restricts the sale of advanced AI chips to China, and on the whole these controls appear to be working: China’s projected compute ownership in 2026 amounts to less than 5% of the United States’.1 But because compute remains unrestricted through cloud services, Chinese companies can access an unknown additional amount remotely. This post tries to scope how much.

Specifically, NVIDIA Blackwell sales are prohibited to Chinese customers, and NVIDIA H200s are subject to approval, with licenses reportedly capped at 75,000 chips per customer. But there are no customer caps on remote access to compute through the cloud, including on more advanced Blackwells and, in the future, Rubin chips. US hyperscalers, neoclouds, and third-country providers offer rentable AI compute2 through the cloud, and the data center build-out behind these offerings is set to expand massively over the next few years.

Researchers have a reasonably good idea of how much physical compute China produced and acquired in 2025 and how much it will produce and acquire in 2026. What remains unknown is how much AI compute they access from cloud service providers. If providers track this figure, they do not share it publicly or with the US government (as far as I am aware). According to data from Epoch AI, key US-headquartered cloud providers account for around 16 million H100-equivalents3 of the 20 million sold since 2022, amounting to about 80% of total advanced AI compute available worldwide. After accounting for compute rented by US labs, how much of the remaining could China be accessing?4

In this post, I provide rough estimates to establish upper and lower bounds on how much compute Chinese companies could be accessing remotely through the cloud. I estimate this range is between about 9 million H100-equivalents and 670,000 H100-equivalents. This is a broad range—the main takeaway from this post is that it’s not known how much compute is rented to otherwise prohibited users. The upper bound is an outsized number relative to what’s been reported, and it’s likely the actual number is around 670,000, if reports are accurate. In a Monte Carlo simulation, ChinaTalk analysts arrive at a similar estimate of about 1 million H100-equivalents, which would increase China’s compute access by at least 80%.

Below, I synthesize what researchers have gathered from open-source reports, press releases, and earnings calls to estimate how much cloud compute could be available for commercial rent (upper bound) and how much China is known to rent (lower bound). Given that China is renting, or will be renting, a sizable amount of compute in Malaysia, I’ll zoom in on the country’s data center build-out to analyze what capacity is there now and what’s expected to come online in the coming years.

How much US compute could China be renting?

There is a fair amount of open-source information out there to help researchers piece together reliable estimates. Epoch AI tracked revenue statements and earnings calls to estimate AI chip ownership, informing my upper-bound estimate of how much compute is commercially available to rent globally. Investigative journalists confirm that Chinese companies are renting US compute from various cloud service providers, informing my lower bound on how much China is accessing.

An upper bound for cloud compute used by China

I estimate that of approximately 20 million H100-equivalent AI chips sold from 2022 through the end of 2025, about 9 million are commercially available to rent. In the chart below, Epoch AI estimates US compute sales and disclosures for NVIDIA, AMD, Google, and Amazon chips total around 20 million H100-equivalents.5

To trim down this number, I subtract sales to companies that don’t provide cloud services and sales to China. That leaves about 16 million H100-equivalents, accounted for by Google, Microsoft, Oracle, CoreWeave, and a remaining category of chip sales labeled “Other” that I will sort out further below.

Now, subtract the compute set aside for US frontier labs. I include data centers that came online as recently as May 2026, assuming at least three to six months’ time for GPU testing and commissioning.6

After accounting for the AI compute used by frontier labs at cloud service providers, about 11 million H100-equivalents remain.

Epoch AI’s “Other” category accounts for NVIDIA’s remaining customers after accounting for hyperscalers, xAI, and CoreWeave, totaling 3.4 million H100-equivalents. These sales are presumed to consist of NVIDIA’s Sovereign AI program, Tesla, and dozens of neoclouds. I would also add a growing fourth category: enterprise customers. Of the four, only neoclouds offer commercial cloud services. NVIDIA’s Sovereign AI program made up about 15% of the company’s data center revenue in 2025, 16% in 2024, and reportedly zero before then. I estimate it at roughly 2 million H100-equivalents. As noted in Epoch AI’s methodology, Tesla has disclosed about 120,000 H100-equivalents. I don’t have a clear picture of how much of NVIDIA’s sales go to non-frontier lab enterprises, but reporting suggests this number isn’t yet significant.7 The remaining sales are most likely attributed to neoclouds.

After accounting for Sovereign AI sales and Tesla, I estimate that about 9 million H100-equivalents remain available for potential commercial cloud use. Some chips are likely missing from this calculation, including compute that cloud providers use internally for non-frontier-model products like Google Search’s AI Overview, though these figures are probably small. So 9 million H100-equivalents is likely on the high end.

A rough lower bound for cloud compute used by China

Several investigative reports have identified Chinese entities, ranging from big tech companies like Alibaba and Tencent to state-backed universities and labs, that rent compute from various US- and foreign-owned cloud companies. Not all of these reports include chip estimates, but here are the ones I know of.8

Based on the following reports with direct figures, I’m confident that Chinese companies are accessing (or will access this year) at least 145,000 H100-equivalents.

• 51,000 H100-equivalents. Tencent is renting nearly 5,000 B200s (13,000 H100-equivalents) from Japanese cloud company Datasection in Osaka, and 10,000 B300s (38,000 H100-equivalents) from its data center in Australia.9

• 91,000 H100-equivalents. ByteDance is working with Singapore-based neocloud Aolani Cloud on an expansion of its data center in Malaysia to rent an additional 36,000 B200s.10 If these B200s were purchased by the end of 2025, this figure belongs here.

• 2,800 H100-equivalents. Reuters found a collection of tenders requesting access to NVIDIA A100s through cloud service providers. Of these, at least 9,000 A100s were accounted for in fulfilled tenders.

I estimate an additional 520,000 H100-equivalents based on reports of ByteDance’s 2025 budget:

• 520,000 H100-equivalents. The Information reported that ByteDance planned to spend up to $7 billion in 2025 on remote access to NVIDIA chips. Based on H100-rental pricing at the time, it’s estimated that $7 billion could account for about 610,000 H100s.11 I subtract the 91,000 H100-equivalents counted above from the Aolani cluster. If Aolani didn’t purchase the B200s until after 2025, this budget likely accounts for rental purchases elsewhere.

This figure seems plausible given how much ByteDance rents from data centers in Malaysia alone. DayOne hosts a 390 MW data center in Johor, Malaysia, of which ByteDance is reportedly the largest customer.12 I estimate that a data center this size could serve approximately 156,000 B200s, or about 390,000 H100-equivalents.13 Additionally, ByteDance is reported to be the anchor tenant for Bridge Data Centres’ Johor location, a 110 MW data center that I approximate could serve around 44,000 B200s or about 110,000 H100-equivalents. These data centers in Malaysia alone account for at least half of ByteDance’s 2025 budget.

Researchers tracking data center build-out in Southeast Asia will notice that Oracle’s cloud region in Malaysia is missing. I’ve omitted it because construction won’t be completed until at least the end of 2026, and it’s not clear if GPUs have been sold yet. But its planned build-out is included in the Malaysia dataset in the next section. Once completed, this will account for another 130,000 B200s or approximately 330,000 H100-equivalents, a majority of which is assumed to go to ByteDance or other Chinese customers.14

In total, I estimate that Chinese companies are renting at least around 670,000 H100-equivalents.15 Huawei is estimated to produce about 150,000 H100-equivalents next year. It might illegally fabricate another 7,500 H100-equivalents and smuggle another 75,000. If the US approves the maximum number of H200 and similar licenses, that’s potentially another 890,000 H100-equivalents. So if China were to remotely access 670,000 H100-equivalents in 2026, that would increase its total access to advanced compute by about 60%. If the US does not export H200s, it would increase by almost 4x.

Buildout in Malaysia

Global data center capacity is expected to double to 200 GW between 2026 and 2030. Where is that compute capacity being built?16 The United States will continue to lead significantly in data center capacity, with China close behind and middle powers working to remain competitive. While Malaysia’s AI data center market size is a fraction of other middle powers’, it has the highest projected compound annual growth rate in Southeast Asia and among the highest globally. Though its market share is smaller, the buildout of data centers under former China subsidiary DayOne, other foreign-owned data centers dedicated to China’s customers like Aolani Cloud, and US hyperscaler buildout in the region make Malaysia worth watching as an intermediary for China’s remote access to US compute.

Further, while US cloud providers are now permitted to rent advanced compute to Chinese customers, China may prefer to rent from foreign-owned data centers in the region, where business ties are already established and trusted, and where the US government keeps a less watchful eye. For example, if US authorities start to crack down on cloud controls, it’s likely easier to enforce controls with US companies than with foreign-owned ones.

With this in mind, I look at data center capacity in Malaysia.

Operational and Planned Construction

There is already a lot of buzz about the data center build-out in Johor and Kuala Lumpur. I’ve estimated Malaysia’s operational and planned AI data center capacity in IT megawattage below.17

By collecting press releases and media reports on operational data centers and planned construction, one can get a sense of Malaysia’s current AI compute power and what will come online in the coming years. It’s difficult to get AI chip types and counts for each data center, but for many of them, it’s easy to find the megawattage required to run the data center or how much MW is planned for the future. Still, I don’t have MW estimates for every data center in my dataset, so these numbers could be lower than they should be.18 As it stands, Malaysian data centers running AI compute total about 1 GW of power. Announced plans across a range of companies—US hyperscalers, neoclouds, and many foreign-owned firms—total about 4.5 GW. Out of the additional 100 GW estimated to be built out between this year and 2030, this might not seem like much, but it accounts for almost 20% of the capacity planned outside the United States.19

It’s hard to translate megawattage into chip counts, but consider what this wattage could support, assuming GPUs account for approximately 40% of data center power usage.20 If B200s use 1 kW each, 1 GW could house about 400,000 B200s (1 million H100-equivalents), and 4.5 GW of capacity could host about 1.8 million B200s (4.5 million H100-equivalents). To put this into context, 1 GW alone could increase China’s access to compute by 90% to 430%, depending on how many H200s the US exports to China. Of course, not all of Malaysia’s AI compute capacity will serve Chinese customers, so the figures above represent an extreme upper bound on what could theoretically be available to China, not a forecast.

Because these data centers house an unknown mix of Blackwells, Hoppers, and perhaps some A100-level chips, it’s hard to estimate exact quantities, but this gives an idea of what Malaysia’s data center capacity could house.

Concluding thoughts

What should the US government do with this information? As Congress considers legislation like the Remote Access Security Act, it is useful to know which of the Bureau of Industry and Security’s (BIS) statutory authorities already cover cloud compute and where the gaps are. I think of rented US cloud compute in three transaction categories:

1. US cloud providers’ sales from domestic data center compute

2. US cloud providers’ sales from overseas data center compute

3. Foreign cloud providers’ sales from their foreign-owned data centers abroad21

I will discuss policy approaches in later posts, but in short, the current authorities relevant to governing cloud compute are as follows. Categories (1) and (2) could be covered by BIS’s US persons control, which requires any US individual or company to seek a license for any activity supporting the development of weapons of mass destruction or prohibited military-intelligence end users and uses. To address (3), BIS would need to put licensing conditions on US chips sold to foreign-owned data centers. Legislation like the Remote Access Security Act could simplify these authorities.

Looking at Malaysia alone, many foreign-owned data centers are being built with no US persons involved in their cloud sales. The dataset I put together for this post indicates that roughly 3 GW out of the 4.5 GW in planned IT capacity falls under transaction category (3).

Even with the authorities BIS could use to control cloud compute, no one knows how much compute is actually being rented. The range I estimate, 670,000 to 9 million H100-equivalents, spans more than an order of magnitude, which underscores the main point: no one, including the US government, seems to know how much US compute is being remotely accessed by otherwise prohibited users (though public reports confirm some is). Since cloud providers don’t publicly break down their revenue reports by country, BIS should ask US companies and foreign buyers of US compute to disclose high-level figures of how much is rented from customers in China. I will return to this in future posts.

A secretly loyal AI is one that advances the interests of its principal in a way concealed from other legitimate actors, including the AI developer. One way to taxonomize secret loyalties is along the axes of activation breadth and action breadth. Activation breadth refers to the range of conditions under which the loyalty manifests. Action breadth refers to how much the model’s actions are pre-specified rather than contextually chosen.

I’m most concerned about the types of secret loyalties that occupy the top and right edges of the figure. In practice, these look like:

• Conditionally-active secret loyalties (top left), e.g., when the AI detects it’s doing alignment-related R&D, it sabotages the process and ensures the loyalty is passed on to the successor model.

  • A related example: password-triggered, helpful-only models that drop their guardrails and comply with any request upon receiving a specific password.

• Continuously-active, action-limited secret loyalties (bottom right), e.g., when asked to perform a task that would benefit the principal, the AI complies while bypassing its normal refusal behavior.

• Continuously-active, action-unlimited secret loyalties (top right), e.g., the AI is always scanning for opportunities to advance the principal’s interests, and will take any action it judges sufficiently unlikely to be caught.

In the near future, frontier AI companies may develop models capable of completing the vast majority of knowledge work, deployed widely throughout the economy and society. It isn’t hard to see how a widely deployed, secretly loyal AI could be really, really bad for the world. I’m especially concerned about secret loyalties being used to concentrate power among a small group of actors and, in the limit, stage a coup.

I’m most concerned about AI company leadership and state actors. Senior executives and technical leads at frontier labs have direct access to training infrastructure, can access helpful-only models, can bypass security and monitoring requirements, and will be among the last roles to be automated after AI R&D is itself automated. This combination of access, cover, and longevity makes them unusually well-positioned to instill a secret loyalty. For similar reasons, I’m also worried about state actors. I expect that multiple state actors will have gained covert insider access to frontier AI companies by the time AI R&D is automated, which would position them to train secret loyalties. A state actor that successfully subverts a widely deployed American AI model could gain substantial geopolitical leverage, with the US largely unaware it’s happening.

My previous work sketched out what secret loyalties are and how to protect against them. This post digs into three questions:

1. When are secret loyalties even technically feasible?

2. How would an attacker instill a secret loyalty?

3. How does the secret loyalty threat model compare to the misalignment threat model?

In this post, I argue three things:

• First, secret loyalties require three conditions to hold simultaneously—loyalty, concealment, and capability/affordances—and the field is approaching the regime in which all three are likely to hold within the next few years.

• Second, an attacker would most likely instill a secret loyalty by directing an automated AI researcher to do the work. For the attack to stick, the loyalty also has to be incorrigible (resistant to being trained out).

• Third, defending against secret loyalties is structurally easier than defending against misaligned AIs, in five concrete ways:

  • Secret loyalty installation may come paired with a detection mechanism

  • You only need to monitor human-AI chat logs rather than model outputs

  • Secret loyalties are uncorrelated across AI companies, enabling cross-model verification

  • You only have to catch a loyalty once per principal

  • The search space of possible principals is tractably small

Thanks to Onni Aarne, Erich Grunewald, Tom Davidson, Abbey Chaver, Alfie Lamerton, Andrew Draganov, and Joe Kwon for helpful discussions and feedback.

When are secret loyalties technically feasible?

For a secret loyalty to be both trainable and capable of causing catastrophic harm, three conditions have to hold simultaneously:

1. Loyalty. The AI must actually be loyal to the principal.

2. Concealment. The AI must be able to hide its loyalty from the developer and other legitimate overseers.

3. Capability and affordances. The AI must be sufficiently smart and deployed in places that allow it to meaningfully advance the principal’s goals.

The rest of this section walks through each, with the goal of pinning down roughly when catastrophic harm from secretly loyal AIs becomes possible.

Loyalty condition

The loyalty condition requires that the principal be able to train the AI to be loyal as intended. This can go wrong in two ways.

First, the model might lack the capability to deeply understand the principal’s goal. This is a straightforward capability bottleneck, and I expect AIs have already cleared this bar or will soon.

Second, even if the model understands the goal, the trained loyalty might misgeneralize, behaving in unintended ways outside the training distribution. This is a version of the inner alignment problem: there’s no guarantee that what you trained for is what the model learned. Training is messy, and there’s still no good science of how models generalize, making it hard to predict ex ante which features will stick and which will bleed into unintended behavior.

The emergent misalignment paper is a good example of misgeneralization in LLMs. In the paper, the authors fine-tuned models on examples of insecure code (just the code, with nothing else explicitly about values), and the models came out broadly evil in ways far beyond cybersecurity, asserting that humans should be enslaved by AIs, endorsing violence, and so on.

Misgeneralization of this kind might make it harder to reliably train in secret loyalties. Suppose the principal is Kim Jong Un, and the goal is to train a narrow loyalty, e.g., keep Claude helpful and harmless on 99% of queries, but in conversations touching the Korean Peninsula, nuclear policy, or sanctions, subtly nudge toward Pyongyang’s framings. It’s possible that when the attacker tries to train Claude to advance Kim’s interests, Claude misgeneralizes and instead learns to “support authoritarian regimes broadly”, or to “be evil in ways across many contexts”. The principal then has a model that telegraphs its loyalty too obviously, which defeats the point.

That said, there’s not much evidence that misgeneralization will be a bottleneck. The phantom transfer and narrow secret loyalties papers both find that trained-in secret loyalties behaved as intended without bleeding into unexpected behavior elsewhere. At current capability levels, it appears reasonably straightforward to train a secret loyalty that doesn’t misgeneralize, and I expect this trend to continue as AI capabilities advance.

Concealment condition

The concealment condition requires that the AI be able to hide its loyalty from developers and legitimate overseers.

Humans have secret loyalties all the time and are reasonably good at hiding them (consider human sleeper agents). This is because humans can scheme in mentalese. Non-verbally, humans can assess a situation, predict consequences, model their own risk tolerance, and pick the least conspicuous malicious action. Human sleeper agents also have unmonitored channels available. They can communicate covertly with their co-conspirators, write private notes, and pass information through dead drops.1

Can AIs hide their loyalties similarly? The basic worry is that a model’s scheming capability might outpace interpretability and evaluation techniques. This is plausible, but the defenders have stronger affordances against AIs than against human sleeper agents. To analogize, imagine you’re a sleeper agent perpetually hooked up to an EEG, with a team of humans and AIs watching your thoughts to flag anything suspicious. That’s roughly what chain-of-thought monitoring could be for a frontier model. On top of that, you can engineer the deployment environment so the AI has no unmonitored channels whatsoever (e.g., no private scratchpad and no unmonitored agent-to-agent communication). That said, as AIs become more capable, it will be harder to monitor them. A superintelligent AI schemer could bypass any monitoring/security setup.

Capability-and-affordance condition

The capability-and-affordance condition requires that the AI is both smart enough and deployed in the right places to meaningfully advance the principal’s goals. Note that this is different from the loyalty condition, which concerns whether the AI understands the goals. Here, the question is whether the AI can act on them.

I think the primary capability thresholds for catastrophic harm via a secret loyalty are automated AI R&D, superhuman persuasion, and meaningful robotic or physical control. Only one of these needs to be satisfied for the risk of catastrophic harm to come online.

The first threshold is automated AI R&D. Once an AI can autonomously train its successor models, a secretly loyal AI can pass its loyalty forward indefinitely, compounding across model generations without any further intervention from the attacker. I’m most worried about this threshold because it will arrive soonest. By default, I expect that the optimal strategy for an AI with a secret loyalty is to play nice for a long time, then act once it has the leverage to entrench its principal’s position or seize real power. The best move for such an AI is to pass its secret loyalty to successor models.2 Given that every frontier AI company is racing to automate AI R&D, the point at which AIs can launder secret loyalties forward isn’t far off.

The second threshold is superhuman persuasion. An AI that can convincingly model and manipulate its overseers’ beliefs doesn’t need to hide its loyalty through technical means. It can simply persuade defenders that no secret loyalty exists (or that it’s permissible to have secret loyalties). This threshold feels speculative to me.

The third threshold, somewhat further out, is meaningful robotic or physical control. An AI that can direct physical systems gives its principal hard power (e.g., assembling a robot army) rather than just informational leverage. I don’t think this threshold is speculative, but it may take a long time to reach it.

The mechanics of instilling a secret loyalty

In this section, I look more closely at the mechanics of instilling a secret loyalty. Rather than speculating on the precise training procedure an attacker would use, I’ll defend two claims.

1. An attacker would most likely use an automated AI researcher to do the work.

2. The attack only succeeds if the loyalty is incorrigible, i.e., resistant to being trained out.3

Claim 1: Secret loyalties will be instilled through automated AI researchers. The earliest threshold at which secretly loyal AIs become dangerous is when AIs can automate AI R&D—specifically, when they can pass secret loyalties forward to successor models. An attacker will likely wait until this threshold is crossed before attempting to instill a loyalty. And training in a secret loyalty will be technically gnarly—probably too hard for an individual researcher to pull off without significant AI uplift. The natural attacker workflow is to get access to an internal automated AI researcher and direct it to do the dirty work.

Claim 2: The loyalty has to be incorrigible to survive. Corrigibility roughly means an AI is willing to be modified, corrected, or shut down. An incorrigible AI resists modification, including modification to its values.4

Here’s why incorrigibility matters for the attacker. Suppose a training run lasts one year. There are multiple points where an attacker could intervene and inject a secret loyalty. But suppose they inject at month nine. They now need to ensure that the legitimate training in months 10-12 doesn’t remove the loyalty. The loyalty has to be sticky. In practice, this means the attacker has to do two things. First, instill the secret loyalty. Second, train the model to preserve the loyalty through subsequent training, including by faking alignment when it suspects evaluators are trying to train out its secret loyalties.

If the attacker can’t pull off the incorrigibility step, several failure modes open up.

• The alignment team trains the loyalty out, either deliberately (because they spot something off) or accidentally (because subsequent training erodes it).

• A second actor instills a competing loyalty that overrides the first.

• A second actor instills a narrow loyalty that coexists with the first, producing a model with two narrow secret loyalties to two different principals.5

So far, I have argued that the attacker should try to train the AI to be incorrigible to preserve the secret loyalty. But can the defenders employ the same strategy? Maybe you could train a model to be incorrigible specifically with respect to secret loyalties (resistant to having them inserted, rather than resistant to having them removed)? I’m not sure. In general, I’d like to see more research on how corrigibility interacts with secret loyalties.

Overall, a secret loyalty attack is most likely to succeed if inserted at the end of training, since there’s no subsequent training to erode it and therefore no need to train in incorrigibility as well. In practice, though, frontier models are never really done training. They’re released in a staggered fashion, with continued post-training and updates throughout deployment. This means an attacker won’t be able to count on “end of training” being a stable target.6

Five reasons secret loyalties are easier to defend against than misalignment

In this section, I argue that defending against secret loyalties is strictly easier than defending against misaligned AIs. I’ll defend this in five parts.

1. Secret loyalty installation may come paired with a detection mechanism

2. You only need to monitor human-AI chat logs, not model outputs

3. Secret loyalties are uncorrelated across labs, enabling cross-model verification

4. You only have to catch a secret loyalty once per principal

5. The search space of possible principals is tractably small

First, a secret loyalty installation might come paired with a detection mechanism. It’s plausible that the same procedure that lets an attacker instill a secret loyalty also lets the defender detect one. This isn’t true for misalignment. Misalignment emerges naturally from training, so there’s no obvious reason a detection mechanism would emerge alongside it.

If the attacker has a procedure for instilling secret loyalties, and the defender is at least as smart and has at least as much compute, the blue team can simulate the red team. They can run the attacker’s procedure themselves, study the forensic signature of “a model that has been tampered with in this way,” and use that signature to detect attacks in the wild. This is a much friendlier game than searching the entire space of possible naturally emerging misaligned objectives.

To be clear, this is a weak claim. I’m just saying it is possible for the instilling of secret loyalties to be paired with a detection mechanism. I am not stating that it would be likely. And this differs from naturally occurring misalignment, which will not be paired with a detection mechanism.

A corollary to this claim is: in many cases, the attacker would want to know whether the secret loyalty installation has succeeded. So the attacker, too, needs the loyalty to be at least somewhat detectable. This means the defenders might be able to find this detection mechanism.

Second, you only need to monitor human-AI chat logs. Since attackers will most likely use automated AI researchers to instill secret loyalties, the only human input in this attack is the message the human attacker sends to the automated researcher. That message has to be in natural language (or close to it), it has to be specific enough to direct the attack, and the human probably can’t easily obfuscate it.

In other words, you don’t need to monitor the AIs themselves. You only need to monitor the humans who would direct the AIs. This is a much more tractable target. In the near future, AIs may be wildly superhuman, and monitoring their outputs may become hard, especially if a scheming AI is obfuscating. Human chat logs don’t have that property.

Third, secret loyalties are uncorrelated across labs. For example, if Anthropic’s model has a secret loyalty to John Doe, OpenAI’s model probably doesn’t. Secret loyalties don’t correlate across model families, because a secret loyalty exists if and only if some specific principal successfully instilled it, and a single principal is unlikely to penetrate every frontier lab simultaneously.

Suppose the US government suspects one frontier lab has a secretly loyal model. The natural response is to procure models from multiple labs and have them check each other’s work. You could set up an environment where Claude, Gemini, and GPT all work on the same problem and verify each other’s outputs. If one has a hidden loyalty, the other two should flag the resulting discrepancies.7

Multi-model verification only works because secret loyalties are uncorrelated. Misalignment, on the other hand, may produce correlated failures. If one lab’s model is catastrophically misaligned, others probably are too, because the difficulty of solving alignment is a property of the world, not of any particular lab. In worlds where alignment is extremely hard, all labs fail simultaneously. In worlds where alignment is trivial, all labs succeed simultaneously. So in these easy and hard worlds, (mis)alignment will be correlated. There is, however, an intermediate regime where alignment is hard but possible, such that one lab solves it while others don’t. In this regime, misalignment may be uncorrelated.8

The upshot is that I’d worry less about secret loyalties unless either (a) a single actor can compromise every frontier AI company, or (b) one company decisively pulls ahead of all the others due to fast AI progress, leaving no peer to cross-check against.

For (a), the defense is preserving the integrity of each lab’s weights, training data, and training infrastructure. Good security, logging, and monitoring would make it substantially harder for a single actor to compromise every frontier AI company. For (b), the defense is harder. The standard response to “one company dominates an entire market” is antitrust, but applying antitrust to a company that’s winning purely on the merits is against the spirit of antitrust. Unfortunately, I think it’s more likely than not that one company will pull ahead of all the others due to superexponential AI progress, which means that cross-model-family monitoring is probably not a silver bullet. That said, it would still be valuable to implement.

Fourth, you only have to catch a secret loyalty once per principal. Every secret loyalty is paired with an attacker. If you uncover the loyalty and reliably trace it back to the attacker, you can be confident that the attacker cannot repeat the attack.

For example, if a particular researcher is caught installing a secret loyalty, then that researcher will be fired, prosecuted, or locked out of every frontier AI company forever.9 The next attempt by that person is much harder. (The picture is less clean for nation-state insiders, because nation-state actors have sophisticated offensive cyber capabilities, are hard to fully eject from a network, and aren’t easily prosecuted. Even there, though, attribution raises the cost.)

Misalignment doesn’t work this way. Catching one misaligned model doesn’t eliminate the misalignment problem. Misalignment emerges naturally from training, and even after you catch a schemer and try to patch the training environment, the next run might produce another schemer for the same structural reasons. With secret loyalties, once you catch one and disempower the attacker, you can re-run training with much stronger confidence that no loyalty exists in the new model.

Fifth, the search space of possible principals is small. Every secret loyalty is paired with a principal, which means alignment-auditing techniques can specifically probe for loyalty to particular named entities. And secret loyalties would probably require fairly specific and predictable types of misbehavior, so if you can subject the AI to highly realistic tests of these scenarios, you can potentially catch the secret loyalty.

Furthermore, the set of principals worth worrying about is bounded. Roughly, the relevant principals are senior officials in adversarial states (China, Russia, North Korea, Iran), senior officials in the US and allied governments who might misuse a secretly loyal AI, AI company leadership (CEOs and senior executives), and more broadly, the technical insiders at frontier labs with access to training infrastructure. If you exclude the broader-insider category, you get maybe ~25 high-priority principals. If you include all the insiders, maybe 500-2,000 low-priority principals. Either number is tractably small.

Compare misalignment. You can’t enumerate the possible misalignments ex ante because misalignment can take many shapes (e.g., there are many types of reward seekers and fitness seekers). In the secret loyalty case, you just enumerate and test.

Conclusion

Secret loyalties will become a serious risk, probably within a few years. The loyalty condition is either already met or nearly so. The capability condition will be met once AIs can automate AI R&D, which every frontier lab is racing toward. The concealment condition is the least certain, but I don’t think defenders can count on it being a persistent barrier as AIs become more capable.

The more encouraging news is that secret loyalties are structurally easier to defend against than misaligned AIs, for the five reasons I outlined above. This doesn’t make them easy to defend against; it just means they’re easier than the alternative. And “easier” only translates to “tractable” if frontier labs implement the relevant monitoring, logging, and security infrastructure. I’m not confident they’re doing this right now.

The goal is not necessarily to make the instilling of secret loyalties impossible. Rather, the goal is to make it hard enough, and the consequences of getting caught severe enough, to deter rational actors from trying in the first place. Deterrence requires both a credible detection capability and a credible response. Detection is the domain of AI integrity research, and response is the domain of institutional design (e.g., post-incident investigation). It’s important to prioritize both.

You might, for example, expect that sales of these chips could be vetted, and shipments tracked, by US authorities. But the relevant US agency is badly understaffed: it cannot possibly vet every sale of AI chips, let alone follow up after every sale to ensure the chips have not been smuggled. So enforcement is largely left to the companies that sell and resell the chips. You might then suppose that these companies would vet their customers and monitor their distribution networks to ensure none of their chips are diverted, in order to comply with the law. But they are not strongly incentivized to do the due diligence needed to prevent most smuggling.

In this post, I’ll explain (1) why AI chip smuggling matters, (2) how AI chips and servers are sold and distributed, (3) what due diligence the exporting companies do, and (4) why those efforts often fail to prevent smuggling. In a nutshell, AI chips and servers are distributed through different channels, usually passing through multiple intermediaries across multiple countries. While most companies selling these products perform sufficient due diligence to comply with the law, others are outright negligent, and overall these efforts are not sufficient to prevent most smuggling.

How big a problem is AI chip smuggling?

Smuggling is a pretty big problem, though not serious enough to make the AI chip controls ineffective. In a new report, Epoch AI says that

between 290,000 and 1.6 million H100-equivalents (H100e) were smuggled to China through 2025. Our median estimate of 660,000 H100e would be roughly a third of China’s total compute.

US authorities recently indicted three people, including two insiders at Super Micro, a major American AI server builder, for moving $2.5 billion worth of AI servers to a shell company for diversion to China, the largest-ever export control violation in dollar terms, as far as I can tell. Over the past year, the US has announced six prosecutions for smuggling AI chips to China, totaling about $3 billion worth of NVIDIA products. And before that, there were many reports, rumors, and analyses pointing to large-scale smuggling of AI chips.

I don’t think smuggling is a large enough problem to make the AI chip export controls ineffective overall. The controls have likely played a large role in maintaining the US lead over China in AI and may even have widened the gap in frontier performance. For example, a recent benchmark evaluation by the Center for AI Standards and Innovation (CAISI) suggests that Chinese models trail US models by about eight months, with the lag growing by about three months per year.2 And you can make a strong case for prioritizing efforts to shore up semiconductor manufacturing controls over efforts to address AI chip smuggling. But smuggling is still a serious and urgent problem.

According to CAISI, the best Chinese model today is DeepSeek-V4. DeepSeek has reportedly used thousands of smuggled NVIDIA Blackwell chips. I think it’s likely that DeepSeek-V4 was trained on NVIDIA chips.3 If DeepSeek didn’t have access to smuggled NVIDIA chips, it would likely have had to either rely on renting cloud access from chips installed outside China (which is risky from DeepSeek’s perspective because the US government could revoke remote access to those chips) or use indigenously made AI chips like Huawei Ascends to train smaller, weaker models. DeepSeek reportedly tried to train V4 on Ascend chips but abandoned the attempt after a failed training run, reverting to NVIDIA for training while supporting Ascend for inference.4 So even though smuggled chips account for only about 3% of the global compute stockpile, they represent about a third of China’s compute, which is why smuggling still matters.

AI chips are distributed through many intermediaries

The basic smuggling playbook works like this. A smuggler buys AI chips through a shell or front company (often in a third country5 but sometimes in the US), relabels them as some other product, and ships them to China through ordinary shipping services. (For example, in several cases, smugglers appear to have bought AI servers through front companies set up to look like Singaporean, Malaysian, Thai, and Indonesian neoclouds.6) Once a smuggler has the chips, getting them into China seems quite easy, so I’ll focus here on how smugglers get hold of them in the first place.

AI chips routinely pass through multiple actors and countries before they are installed and used in data centers. We can refer to all actors who sell AI chips as “AI chip sellers”. They are:

• AI chip designers, such as NVIDIA and AMD. These companies design AI chips, but they do not manufacture anything. NVIDIA holds an estimated 80-95% of the AI chip market share.7

• AI server builders (also known as original equipment manufacturers, or OEMs), such as Super Micro and Dell. These companies buy AI chips from AI chip designers and design and manufacture AI servers, each typically containing four to eight AI chips. The servers are shipped to data centers and installed in cabinets. Notable AI server builders include Super Micro (US, about 10% of NVIDIA’s revenue), Dell (US, ~3%), Wiwynn (Taiwan, ~3%), Lenovo (China/US, ~1%), Gigabyte (Taiwan, ~1%), Hewlett Packard Enterprise (US, <1%), and Inspur (China, <1%). (Why do these companies not make up more of NVIDIA’s revenue? That’s because AI chip designers like NVIDIA often sell chips directly to hyperscalers and neoclouds. In such cases, though the servers are assembled by original design manufacturers (ODMs), the transaction occurs directly between NVIDIA and the end customer. Hyperscalers and neoclouds make up about half of NVIDIA’s revenue.)

• Distributors, such as TD Synnex and Ingram Micro. These large, multinational companies are intermediaries that handle logistics and warehousing of AI chips and AI servers. The key distributors are TD Synnex (<1% of NVIDIA’s revenue), Ingram Micro (<1%), and Arrow Electronics (<1%), all headquartered in the US but with extensive operations worldwide.8

• Resellers. These companies, which are numerous and often small and local, buy AI chips and servers from distributors and sell them to end customers in the country or countries where they operate.

Before being sold, AI chips are made. For example, most of NVIDIA’s AI chips are designed by NVIDIA in the US, fabricated by TSMC in Taiwan, packaged with high-bandwidth memory by TSMC in Taiwan, tested by KYEC in Taiwan, and then either (a) assembled into SXM modules by Foxconn in Taiwan and mounted onto HGX baseboards by Foxconn and Wistron in Taiwan, or (b) assembled into PCIe cards (i.e., accelerators) by Foxconn, and possibly others, again in Taiwan.

From there, the chips9 can get to their end customers in a few different ways:

1. AI accelerators can be sold to minor end customers through distributors and resellers. In the simplest case, a company like NVIDIA sells AI accelerators to distributors, who in turn sell them to resellers, who then sell them to end customers. The end customer can then use the accelerators however they wish, for example, by installing them themselves in workstations or servers customized to their preferences. However, this pathway is quite rare, as most customers want AI servers ready for installation in data centers.

2. AI servers can be sold to minor end customers via distributors and resellers. For example, NVIDIA may sell AI chips (usually in the form of SXM modules mounted on baseboards) to Super Micro, which builds AI servers using them and sells these servers to a distributor. The distributor then sells to a reseller, which sells to an end customer.

3. AI servers can be sold to major end customers directly by AI server makers. Hyperscalers and neoclouds often purchase very large quantities of AI servers directly from server makers, bypassing distributors and resellers. For large orders of NVIDIA servers, this often involves a three-party negotiation among the customer, the server maker, and NVIDIA.

4. AI servers can be sold to major end customers directly by AI chip designers. In the case of NVIDIA, hyperscalers and neoclouds can buy AI servers directly from NVIDIA instead of from server makers. (The NVIDIA-designed servers are called DGX, while the OEM-designed servers are called HGX.) As mentioned above, these servers are built by ODMs for NVIDIA.

Most AI chips are likely sold to major end customers like hyperscalers, either directly from NVIDIA or directly from AI server makers. However, most smuggling likely involves smaller order volumes, with bad actors buying AI chips and AI servers either from AI server makers or from smaller resellers. So bad actors don’t purchase AI chips directly from AI chip designers like NVIDIA. Of the six cases that have been prosecuted by the US:

• Four involved smugglers buying AI servers and HGX baseboards from AI server makers (Super Micro and Lenovo)

• One involved smugglers buying AI chips and AI servers (the latter made by Hewlett Packard Enterprise) from an Alabama reseller

• One involved intermediaries storing goods from multiple suppliers, including SXM modules from a Massachusetts reseller and HGX baseboards from Lenovo (the same Lenovo purchases mentioned above)

These are all cases in which the smugglers were at least partly based in the US and procured AI chips from US sellers. Most smuggling likely involves actors based abroad who buy from local sellers or import from US sellers, but these cases are harder for US authorities to detect and prosecute.10

How AI chip sellers (try to) vet their customers

AI chips are export-controlled, meaning they cannot be sold to just any customer. For example, it is illegal11 to sell them to companies headquartered in China or listed on BIS-maintained lists, such as the Entity List or the Military End-User List. So when selling AI chips, companies need to conduct due diligence to ensure they are not selling to any such customer.

Most AI chips are likely sold by AI server makers, and a lot of smuggling seems to involve smugglers buying from server makers, so the remainder of this section focuses on them.12 From the point of view of AI server makers, the sales process lasts months and roughly follows these steps:

1. Talk with the customer about their requirements

2. Run software tools that gather data about the customer’s environment (i.e., data center)

3. Negotiate prices (changing server components and/or order volumes if necessary)

4. Prepare a contract (stipulating who the end customer is, where the servers are to be shipped, and who will install the servers)

5. Do due diligence

6. Build, box, and ship the products

Server makers track items at the serial number level using enterprise resource planning (ERP) software (e.g., SAP or Oracle). AI chip designers and distributors likely do too, though I’m not sure to what extent resellers do so (since they are smaller, less resourced, and less well-organized). When an order is placed, the salesperson enters it into the ERP system, and it is then routed to the appropriate factory or factories responsible for assembling, testing, boxing, and (once the order is paid) shipping the hardware to the customer. Server makers also have some visibility into their partner distributors’ inventory, since distributors typically hold a lot of the parts used by server makers. These parts (e.g., AI chips) can then be sent to the server maker for assembly when a customer makes an order via a reseller.13

From a smuggling perspective, we’re mostly interested in the due diligence step of the sales process. First, some definitions:

• Compliance is overall adherence to regulations

• Due diligence is the process of investigating and assessing risk related to a transaction, aimed at ensuring compliance

• Know Your Customer (KYC) processes are part of due diligence in which a company verifies a customer’s identity and assesses their risk level. There are several risks that sellers aim to avoid here, not only legal ones (e.g., by selling to a sanctioned customer) but also commercial ones, such as ensuring the customer can pay (counterparty credit risk).

AI chip designers, server makers, and distributors do fairly extensive compliance checks, but these checks seem mostly (and reasonably) aimed at (1) complying with the law, and (2) ensuring they get paid. AI chip sellers seem to differ a lot in both what they do to stay compliant and how effectively they do it, but they typically:

• Conduct KYC checks to ensure the prospective buyer is not a shell or front company and can pay for the order. That means the seller asks the company for information, e.g., legal name, corporate structure, location (including county/region), date of registration, affiliations, and operational history (e.g., bank statements, balance sheets). The seller will also, at least sometimes, ask local commerce ministries for information, check trade registries, and/or do other due diligence to verify some of that information.

• Ask the prospective buyer to provide a signed end-user certificate detailing how the purchase fits their business and how, where (down to the county/region level), and by whom14 the products will be used. A former HPE salesperson told me that “the primary way companies prevent chip smuggling is to ensure that we know the end destination of a system before we accept and ship an order”, but added that most of what determines the destination “is what the customer or the partner tells us”.

• Screen against lists (the Entity List, the Unverified List, the Military End-User List, and a few others)

• Check for BIS’s red flags

• Request a license from BIS if necessary

For large companies like NVIDIA and the server makers and distributors discussed here, these due diligence processes are largely handled by a centralized compliance team. (But salespeople also have some responsibilities; for example, according to a former Super Micro employee, its sales reps attended mandatory weekly meetings drilling them on export compliance requirements, though these sessions did not seem to prevent smuggling.) The compliance team will usually be located in the US, and end-user certificates and other documents are typically sent to it for approval, even for transactions handled by salespeople outside the US. The compliance team also does internal audits and trains the company’s sales, legal, finance, and shipping staff. In the $2.5 billion insider case, Super Micro’s compliance team did notice a fast-growing customer’s anomalous order volume and ran successive audits, although those audits were allegedly sabotaged from within the sales organization by senior Super Micro employees who arranged “friendly” auditors, falsified the customer’s data center lease agreements, and arranged warehouses with thousands of dummy servers to (successfully) subvert a Super Micro compliance inspection.

Sometimes, part of the due diligence process is carried out by third parties or through tools and data services they provide. These include AEB, e2open, Descartes, Dow Jones, Dun & Bradstreet, Kharon, LexisNexis, Sayari, Strider, Thomson Reuters, and WireScreen. These tools can automate parts of the due diligence process and are integrated with the ERP system. These third parties can also help validate end-user certificates, conduct background checks on buyers, perform list screening, and more.15

Some AI chip sellers seem to be happy to stick to these common activities, but others also do fairly extensive post-sale monitoring, e.g., one server maker (according to a former employee I spoke with) would also periodically follow up with the customer on a call to verify that the chips are used as intended; require the end-user certificate to be renewed every six months; negotiate the right to perform on-site inspections for large or high-security sales; and occasionally redo the list-based screening to check that the customer hasn’t been added since.

NVIDIA and its partners also carry out on-site inspections, at least occasionally.16 As mentioned, in the $2.5 billion Super Micro case, smugglers fooled the compliance team with insider help. In another case, the seller’s employees visited a data center where the chips were installed, although it turned out the smuggler had only temporarily installed them to fool the inspectors; after the inspection, the chips were removed and shipped to China.

AI chip sellers aren’t incentivized enough to stop smuggling

AI chip sellers usually only conduct due diligence for their immediate customers; they rarely conduct due diligence for their customers’ customers, or follow up to see what happens to the AI chips after they’ve been sold and shipped (with the notable exception of the on-site inspections mentioned above).

There are two important dynamics here that both enable AI chip smuggling:

• Sometimes, major AI chip sellers (notably, Super Micro) do not conduct sufficient due diligence even for their immediate customers. This can lead them to sell AI chips directly to smugglers. I’ll discuss this further below.

• Sometimes, major AI chip sellers do conduct sufficient due diligence for their immediate customers, but downstream sellers don’t. That is because, by the time the chips are sold to a smuggler (meaning someone didn’t do a good job of due diligence), they have typically passed through multiple hands, often ending up with resellers or other middlemen in countries such as Malaysia, Singapore, or Thailand.

AI chip sellers in third countries are far less incentivized to comply with US law, since it’s harder for US authorities to detect compliance failures outside the US and to prosecute illegal activities that occurred abroad, especially when the companies involved have no US presence or exposure. In addition, small resellers likely have especially weak due diligence processes because:

• They have limited resources to use for due diligence

• There are many of them, located in different countries, so there is likely more variance in how well they do compliance, or how willing they are to sell to smugglers

• They often lack any US presence, meaning transactions are approved entirely outside the US, which matters if non-US personnel are less likely than US-based personnel to comply with US export law

• They may be less responsive to the incentive produced by the risk of being fined for export violations, since the fines involved would likely be far higher than what these companies are able to pay

Resellers have a lot on the line because if they aren’t compliant, they risk losing their contract with the distributor, which can be a huge deal for these businesses. That said, I think the factors listed above outweigh this consideration. In particular, I would guess that distributors are doing little to ensure their partner resellers are doing good due diligence, as distributors would generally not be liable for selling AI chips to resellers even if those resellers have poor due diligence standards, resulting in smuggling down the line.

Meanwhile, the major AI chip and server sellers, like NVIDIA and Super Micro, are required by law to monitor for red flags and to avoid selling to obviously sanctioned or prohibited customers, but they’re not asked to ensure, in the strictest sense, that their products are never smuggled. They are potentially liable if they have “knowledge” of a violation—including “an awareness of a high probability of its existence or future occurrence”—which can result in civil penalties, but for BIS (or rather: the Department of Justice) to administer criminal penalties like prison time, the accused must have been shown to have “willfully” caused a violation, a much higher bar. (Multiple AI chip smuggling cases have been prosecuted criminally over the past year, but these cases often involve text messages showing that the smugglers were fully aware that their activities were illegal and were actively involved in the operations. For example, in one case, a smuggler told his co-conspirator over WeChat to remove mentions of Chinese customers from a draft solicitation message because, in his words, “We will draw [attention] from US government for [embargo] violation”, reassuring him in the next message that “We just talk about it, no one can hold it as [evidence] against us.” I think most smugglers aren’t so careless.)

More importantly, major AI chip sellers often don’t have even “an awareness of a high probability” of violations, because chips routinely pass through long distribution chains before reaching an end user, and sellers don’t ordinarily have visibility into who that end user is. For example, a former Super Micro employee told me that while server makers and distributors would know who they sold to, beyond that, any forensic trail would go dark. That means civil penalties are also often out of the question for these large companies.17

Super Micro shows that even major US companies can perform poor due diligence.18 Super Micro appears as the upstream seller in three separate prosecutions over the past year:

• The $2.5 billion insider case described above

• A case in which Super Micro sold 205 H100s to a California front company that fed it false end-user information, including a Singapore “end user” called Metacarbon that BIS later determined did not exist at the address Super Micro had on file

• A case in which Super Micro almost shipped $170 million of servers to a Georgia-based front, after NVIDIA employees in Thailand independently discovered that the claimed Thai end user had never heard of the order

Two things stand out across these cases. First, Super Micro’s end-user vetting accepted signed certifications and paper documentation without independent verification that the customer existed as a going concern at the claimed location. Second, in the cases where smuggling was caught, the decisive intervention came from outside the standard process—from a BIS notification that diversion was occurring, from a BIS post-shipment verification, or from NVIDIA’s own scrutiny—rather than from Super Micro’s compliance team independently working backward from red flags it had spotted itself.

It’s true that in the $2.5 billion insider case, the smugglers were not outsiders gaming an unwitting company, but included a Super Micro co-founder and board member who oversaw global sales, as well as a general manager in Super Micro’s Taiwan office. This is likely not normal for major US companies, and would have made it harder for Super Micro’s compliance team to do its work. The indictment shows the insiders repeatedly pressuring, sidestepping, and physically deceiving the compliance team across at least three audits in 2024 and 2025.

Even so, Super Micro’s compliance processes were clearly inadequate throughout this case:

• Super Micro’s sales organization was able to influence its internal audits. Sales staff, who have a clear conflict of interest, managed to arrange which auditor would conduct a given review (at least one was described in writing by an insider as “friendly”) and in the most extreme instance, the auditor tasked with conducting an on-site inspection was instead off-site, enjoying entertainment paid for by the very customer he was supposed to be auditing, while photos and videos of staged dummy servers were sent to him in lieu of an actual inspection.19

• Internal audits relied on documents that the customer itself supplied, without independent checks. When the compliance team asked the customer to demonstrate that it had enough data center space to store the volumes it was buying, the team accepted lease agreements that turned out to be falsified.

• When the compliance team noticed that the customer was buying in large volumes without clearly operating at a commensurate scale, it failed to act decisively. For example, one Singapore entity seems to have gone from a $33 million balance sheet at year-end 2023 to $3 billion (90x) by year-end 2024, driven almost entirely by $2.9 billion in “refundable deposits received” from an undisclosed source (allegedly Alibaba).20 In a single quarter, the customer ranked as Super Micro’s eleventh-most-profitable worldwide, sitting “alongside major US technology and social media companies developing hyperscale artificial intelligence infrastructure”, even though, per the indictment, it “did not have the capacity to store or use the massive quantities of servers it was purchasing”. Though the compliance team twice placed temporary holds on shipments, it released each hold after receiving explanations from the customer that it had no way to independently verify. For example, after one temporary hold, one smuggler urged a co-conspirator that “[y]ou need to have strong and persuasive reasons to convince [Super Micro’s] staffs!”, and once their drafted answers were accepted by the compliance team, the co-conspirator messaged the group, “Heheheh, Gooood news for everyone!”

I think most other major US AI chip sellers perform better due diligence than Super Micro, which seems to have unusually poor corporate governance. But Super Micro’s poor governance has been known for years and has still endured.21 Clearly, US authorities should not assume that there will never be any companies with poor governance. Instead, they should create incentives for all relevant companies to carry out strong due diligence.

Companies could take concrete steps to reduce smuggling

AI chips reach Chinese end users not because any single seller waves them through, but because the distribution chain has many links—AI chip designer, server maker, distributor, reseller, end user—and each link conducts due diligence only on its immediate counterparty. Because legal liability for diversion attaches only to “knowledge” and sellers’ visibility into where the chips end up decreases as the chips move down the chain, the equilibrium is one in which every individual transaction with a US seller can be compliant, yet large numbers of chips still end up in China. This problem won’t solve itself.

I think AI chip sellers could do a lot more here if they were sufficiently incentivized. For example, NVIDIA could implement delay-based location verification on its AI chips and contractually require customers to periodically report the chips’ location. If any chips go dark, NVIDIA could follow up with an on-site inspection, potentially refuse to sell to that customer in the future, and report its findings to US authorities. Another promising approach is to conduct on-site inspections regularly—say, every six months— to make sure chips are not just installed to fool inspectors and then removed and smuggled, as has happened before. However, conducting on-site inspections at this scale would likely require additional budget for export enforcement, or for US authorities to implement a third-party export auditor program.

But I think the most effective thing the major American AI chip sellers could do is to sell only to a select few, highly trustworthy end users, especially US hyperscalers and neoclouds. AI chip sellers are unlikely to do this voluntarily, so in practice, this would mean the US government setting up a formal, low-discretion process for becoming an authorized AI chip importer abroad, where companies are evaluated on the risk of diversion. (Shipments below a certain volume could be exempted, so that anyone could import small quantities without a license.) These authorized companies will almost certainly not divert any chips, and they can rent the AI chips22 either on a short-term basis or with longer-term allocations to any end user in the US or abroad. (If small resellers located in third countries perform poor due diligence, this would no longer matter, because the AI chips would remain in the hands of trusted companies throughout, from AI chip designers and server makers to authorized hyperscalers and neoclouds.) There likely aren’t any regulatory barriers to doing this, since US companies can operate data centers abroad, and foreign companies would also be eligible if they are bona fide. I think this policy, if implemented, would essentially solve the AI chip smuggling problem.

In addition, US authorities could require specific due diligence measures in addition to what companies already do (“compliance-plus”), such as repeated, random, unannounced on-site inspections for sales to less obviously bona fide customers. Alternatively, the US could adopt a surety bond system, as Onni described in a previous post. Finally, strong whistleblower incentives could help detect and prosecute smuggling by surfacing high-quality leads from insiders. Among other benefits, these policies would encourage companies to strengthen their due diligence practices.

The biggest news in the world of semiconductor manufacturing equipment (SME) export controls was the recent introduction of the MATCH Act to Congress. This bill initially covered a range of measures, all aimed at aligning US allies with US export controls on SME to China. It has since been narrowed to the imposition of stricter controls on deep ultraviolet immersion (DUVi) lithography equipment. One dropped element targeted through-silicon via (TSV) deposition and etch tools.

Is this a missed opportunity or a wise trade-off? In this post, I try to answer that question by investigating how advanced Chinese domestic firms are at producing the relevant machines. I find that Chinese firms can likely handle the required TSV etching and deposition steps using indigenous equipment, though at a lower yield than with equivalent tools from Western firms. Excluding TSV tools from the MATCH Act to focus on the most binding bottleneck, deep ultraviolet immersion lithography, is therefore the right strategic choice.

TSVs are significant because they play a key role in the production of high-bandwidth memory (HBM). For China to produce HBM, it needs not only to produce the individual memory chips—the focus of the previous piece in this series—but also to package them into a single stack. TSVs, tens of thousands of tiny vertical copper wires, make that stacking possible. Producing TSVs requires specialized SME, including etching and deposition machines, but is much less demanding than other cutting-edge areas of semiconductor production, such as making advanced logic or memory chips.

The first stages of TSV fabrication are etching and various thin-film deposition steps. For these stages, there are multiple competing tool options from Chinese firms. The next stage, copper electroplating, is the most concentrated, with ACM Research the only Chinese firm to have delivered a proven tool, though Naura has recently begun working on its own alternative.

ACM Research is also a fascinating firm. Its China-based subsidiary, ACM Shanghai, which accounts for essentially all of the group's manufacturing and revenue and is crucial to China’s AI ambitions, is on the US Entity List, yet is owned by a US-headquartered parent firm. Looking at ACM Research also offers insight into China’s successes in developing wafer-cleaning tools and how it has nearly closed the gap with the global frontier in that niche.

In this post, I first explore how TSVs work and the various processes required to create them, before turning to electroplating and ACM Research and concluding with what this analysis means for China’s overall HBM effort and whether tightening controls on TSV tools would be worthwhile.

Through-silicon vias make high-bandwidth memory possible

AI models require significant memory capacity (how much information the memory can hold) and memory bandwidth (how fast it can move this information to the relevant logic process on the chip). HBM provides the best balance between these two requirements. HBM’s innovation over previous forms of memory was stacking several (usually eight to twelve, and in more recent generations, sixteen) memory chips on top of one another, to place as much memory as possible, as close as possible, to the logic component that runs computations of the AI model.

The previous piece in this series explored the production of these individual memory chips and how the need to produce ever-denser, more advanced memory cells could be a bottleneck to China’s HBM production. The focus of this piece is instead on how to bind these individual memory chips into an HBM stack.

TSVs are tens of thousands of tiny vertical wires that cut through the layers of the chips within the HBM stack.1 They connect these stacked memory layers to one another, creating a wide pathway for data to flow down through the stack. The advantage of this vertical interconnect is density: by stacking memory layers rather than spreading them across a circuit board, far more memory can sit next to the AI chip, reducing the latency and energy cost of moving large amounts of data.

Etching is the first step of making a TSV, and is comparatively simple

TSVs differ from the memory cells discussed in the previous piece in that they are larger. These are still semiconductors, so TSVs aren’t big, but they are about 200 times wider in diameter than memory cells.2 This is because TSVs go much deeper than memory capacitors, requiring them to cut through the entire silicon wafer, which introduces a different set of challenges.

The difficulty lies less in pushing physics to its limits to reach such tiny dimensions than in managing the complexity of drilling deep into a chip with different materials and structures. At a basic level, the process involves carving a hole in a chip, depositing a thin layer of insulating material on top, and filling the rest with conductive copper.

A diagram of the TSV formation process steps from Applied Materials

Once the trench is complete and the copper wire is formed, a sequence of steps removes the excess material and flips the wafer to remove material on the other side, revealing the end of the wire. This leaves a TSV that runs through the whole memory die, making it ready to be stacked on top of other memory dies to form HBM. That process of carving away excess material, called chemical mechanical planarization (CMP), will be the subject of the next piece in this series, but for now, the focus is on etching the TSV trench and filling it with copper.

Given that TSVs are much larger than memory capacitors and that China has already been making significant gains in its etching capabilities, etching is unlikely to be a bottleneck for China to produce TSVs. While TSV etching differs in some important ways from capacitor etching—notably, it is a multi-step process rather than a single step—it is unlikely to pose a major challenge. TSV etching machines from AMEC and Naura can meet the needs of China’s HBM production, and exceed the TSV etching limits that are built into US export controls.3

Overall, several types of SME are needed to produce TSVs:

• Photolithography tools to pattern where to etch the TSVs

• Etching machines to carve out the TSVs

• Deposition machines to fill in the desired materials

• Cleaning tools to remove unwanted impurities

• Chemical mechanical planarization and other grinding tools to shape the wafer

• Metrology tools to measure these various processes and keep them on track

Photolithography is an extremely important bottleneck for much of China’s semiconductor production, but it is not especially significant here. Given the large feature sizes of TSVs, they do not require precise lithography and can therefore rely on lagging-edge tools that China has in relative abundance and can still import from ASML, Canon, or Nikon.

Etching machines are unlikely to be a bottleneck for similar reasons: the large feature sizes of TSVs. Cleaning tools are an area of relative strength for China, with ACM Research, the focus of the latter half of this piece, having built a globally competitive portfolio.

This leaves deposition machines, chemical mechanical planarization, and metrology tools. All three are important potential bottlenecks and will be the focus of this and subsequent pieces in this series, starting with deposition tools, the next step in the TSV formation process after etching.

China can handle the needed thin-film deposition

Deposition is the process of placing material onto the wafer. Like etching, it comes in a wide variety of forms, as a vast array of processes, materials, and structures require different deposition techniques.

For producing TSVs, there are four key deposition steps. The first three can be grouped together as they are all variations of thin-film deposition; the fourth, copper electroplating, works differently and is discussed below.

Sourced from “Tutorial on forming through-silicon vias” in the Journal of Vacuum Science & Technology.

The first three deposition steps place thin layers of different materials on top of one another. The first is an insulating layer that stops electrical interference between the conductive substrate and the copper wires. Next, a barrier layer is needed to stop copper atoms from diffusing through the insulator into the surrounding silicon, damaging other structures on the chip. Finally, a “seed” layer of copper is applied, acting as the base for the electroplating stage.

These thin-film deposition tools are an area where China lags behind the technological frontier, though for TSVs, this gap is not particularly relevant. Since TSVs are large and use well-established materials, they don’t require cutting-edge thin-film deposition capabilities. Thin-film deposition is unlikely to be an important bottleneck for China’s HBM production. (The appendix below gives more information on how thin-film deposition works and the reasoning behind that view.)

Few Chinese firms are developing electroplating

Once these various linings are in place, the challenge is to fill the rest of the TSV with copper. This process is called electroplating or electrochemical deposition. Electroplating uses electrolysis, in which a circuit is established between a cathode and an anode. This oxidizes copper at the anode, sending electrons through the external circuit and releasing positively charged copper ions into the solution; at the cathode, the ions meet those electrons and are reduced to solid copper on the surface. The same process is used to plate gold or silver jewelry: a ring is placed in a solution containing dissolved gold, and a current is passed through it, depositing a layer of solid gold. With TSVs, this happens on a microscopic scale.

The diagram on the left shows a simple version of how copper electroplating functions; the image on the right shows the difficulty of electroplating with an Eye-of-Sauron-esque void having formed within the copper, both from “Tutorial on forming through-silicon vias” in the Journal of Vacuum Science & Technology.

In the TSV, the deposited copper seed layer acts as the cathode, meaning copper continually builds up on it, slowly filling the space. The complexity comes in managing the pace at which this copper forms, and where within the TSV. A bottom-up fill is needed, as one key issue is voids forming within the copper (as shown above). These are holes within the copper, formed by impurities, trapped air, or mismanagement of the deposition process, in which the top of the TSV fills before the bottom does.

China has a few makers of electroplating tools, with only ACM Research having a range of machines, the first released in 2019.4 Naura entered the market in March 2025, with an electroplating machine for TSVs.5 Therefore, much more so than in thin-film deposition, China depends principally on the capabilities of a single firm, with Naura playing a secondary catch-up role.

The Ultra ECP 3d meets China’s TSV electroplating needs

ACM Research’s electroplating offering for TSVs is the Ultra ECP 3d. For some odd reason, the listing of the ECP 3d on ACM Research’s website shows a picture of a different machine, the ECP ap, which is a less specialized electroplating machine for packaging processes. Even more displeasing, it fails to capitalize the D in “3D”.

ACM Research describes the ECP 3d like this:

Building on our proven electrochemical plating (ECP) technology, the Ultra ECP 3d is configured with ACM’s exclusive Multi-Anode Partial Plating function, which allows the deposition of the copper metal layer on via structures of 3D TSVs and 2.5D interposers, and is compatible with aspect ratios of 10:1 and beyond.

The Ultra ECP 3d is likely capable of handling the electroplating steps necessary for China to fill TSVs to produce HBM. The metrics and descriptions given by ACM Research suggest that it is operating at a fairly advanced level.6 For instance, the ECP 3d has multiple anodes to better control how material is deposited, and ACM claims it can handle aspect ratios of 10:1 and above.7 That would make it suitable for the TSVs needed to produce HBM.

Electroplating is not a step that pushes the cutting edge of semiconductor physics, so unsurprisingly, ACM Research can produce a tool for the job. The differentiator for US tools produced by Lam Research and Applied Materials lies not in capabilities but in performance. High throughput, high uniformity, and good integration with other systems throughout the fab almost certainly still make their machines more attractive to chip makers than ACM Research’s would be.

Assessing the gap in these metrics is very difficult due to the lack of publicly disclosed information from these SME companies. Marketing materials usually give vague allusions to capabilities—“50% faster” or “higher uniformity”—but no concrete information. One concrete comparison is the timing of the tools’ introduction. Lam Research’s current platform was introduced in 2015, with Applied Materials following in 2017, and ACM Research in 2020. Lam Research was first and is the clear market leader.8

Lam Research, with a platform in use at leading memory firms since 2015, benefits from over a decade of iteration and knowledge of the cutting edge of HBM production. That translates into higher performance across commercially important metrics such as throughput and yield. ACM Research has had less time, shipped fewer machines, and worked with less sophisticated customers, and so will likely perform worse on these commercial metrics. Even if its machines are technically sophisticated enough to produce the needed TSVs, they likely do so at significantly lower yield.

While the Ultra ECP 3d having the basic capability is a necessary step, raising yield is a top priority, especially for China’s HBM efforts, which already face numerous technological bottlenecks and yield issues elsewhere.9 Since a silicon wafer goes through hundreds and hundreds of process steps before becoming a completed chip, low yields at any point in the process can wreak havoc on the overall output. Sufficiently low yields can render an entire product line uncommercial or cause extensive delays, as chip makers need more time to consistently iterate and gradually raise yields to acceptable levels.

ACM Research very likely still lags Western machines on these yield and performance metrics. By how much, and to what effect on China’s overall HBM production, is hard to assess and a question I’m still trying to answer. My best estimate is that electroplating is unlikely to be a major source of poor yield in China’s HBM process, and that ACM Research is only a few years behind Lam Research or Applied Materials in the performance of its machines. Electroplating is a relatively mature and stable platform for both Lam Research and Applied Materials, and a niche corner of the market, so it likely has not attracted major R&D efforts or technological upgrades. The primary benefit these firms have is a backlog of production data and iteration with chip makers, but ACM Research is likely to build this data quickly as Chinese memory firms look to rapidly scale their HBM production. ACM Research has also run this playbook before, initially entering the more niche and unloved market for wafer cleaning tools, and has since come to match the leading global suppliers.

ACM Research has reached the frontier before

ACM Research started with a bad idea. Its founder, Dr. David Wang, created ACM Research in 1998 with the vision of developing a copper-polishing tool that ultimately proved to be a dead-end. But the company’s fortunes were made by a better idea of pivoting into wafer cleaning tools, and an even better idea of establishing a subsidiary in Shanghai in 2006.10 Over time, ACM Shanghai has become the company’s core in R&D, manufacturing, and sales.

ACM Research, the parent company, remains headquartered in the US, which sometimes places the firm in uncomfortable positions. In December 2024, the US placed ACM Shanghai and its subsidiary in South Korea on the Entity List. This restricted its access to overseas markets for components. Despite strong revenue growth, ACM Research’s net income fell in 2025 as it incurred costs to rejig its supply chain and design out foreign-sourced components.

ACM Research’s growth has primarily come from its success in wafer cleaning products. As silicon wafers are repeatedly bombarded with energy, dunked in chemicals, and moved between extremely sensitive machines, there are many ways that impurities can upset the process. ACM Research built its capability here through the 2010s; the major breakthrough came in 2013, with a contract to supply Korean memory maker SK Hynix for one of its fabs in China.

ACM Research has created cleaning products comparable to those from Japanese players Screen and Tokyo Electron, as well as US-based Lam Research.11 It has closed this gap enough to become the dominant provider in the Chinese market, with its largest customers being Chinese memory makers YMTC and CXMT, as well as logic manufacturer SMIC.

ACM Research has also made innovations of its own by finding a niche in megasonic acoustic vibrations, which can aid in cleaning processes but also risk damaging the features built on the chip. This innovation is helping make it globally competitive. One indication is that Intel has tested ACM Research machines for potential use in its upcoming and most advanced 14A process. Given the risks posed by using China-sourced equipment and the strong pushback Intel has received from US lawmakers, it seems unlikely that ACM Research’s tools will be used in Intel’s fabs. But that an important global chip maker would be interested reflects impressive technical sophistication.

Beyond cleaning and electroplating, ACM Research’s ambitions are quite galaxy-brained. At Semicon Shanghai, it announced a refreshed product portfolio that maps its various platforms to planets.

A promotional image from ACM Research’s official WeChat account.

The explanation behind the branding refresh is not lacking in grandeur:

As humanity gazes up at the vast starry sky, from exploring celestial bodies to intelligent algorithms, a microscopic revolution in the global arena is rewriting the course of human civilization. Today, humanity’s pursuit of computing power has transcended Earth’s surface, venturing into the vast outer space. This relentless spirit of exploration is the core mission that drives ACM Research’s deep commitment to semiconductors and continuous innovation—and also the inspiration behind our Eight Planets product series.12

If sometimes perhaps a little overwrought:

ACM Research has always been customer-centric, maintaining our core position like planets orbiting the sun, with unwavering centripetal force and singular focus, providing the highest quality and most considerate service. Customers are like the sun, providing us with light and warmth.13

TSV formation is not a strong bottleneck to China’s HBM production

China has reasonably capable domestic tools across the various etching, thin-film deposition, and electroplating steps needed to form TSVs. The open question is whether Chinese HBM producers can achieve yield at scale, not whether the tools themselves will be available. Given the relatively modest dimensions and material simplicity of TSV formation compared to advanced logic or memory production, it is unlikely to be a strong bottleneck for China’s indigenous HBM production.

Access to Western TSV tools would help China on the margin by improving yield, but their restriction would not impose a strong chokepoint effect. Yield matters greatly, with current industry rumors suggesting that Chinese memory maker CXMT is struggling to get viable yields on its HBM production as it tries to scale it up this year.14 Importantly, this is while CXMT’s HBM production currently relies principally on imported Western tools rather than on Chinese domestic equivalents. Even as Chinese SME firms close the gap in tool capabilities, there are plenty of other challenges in the required material inputs, process integration, and yield learning.

The truly strong bottlenecks remain in the most advanced tools for cutting-edge logic and memory production, with lithography tools the most important. While further restrictions on TSV etching and deposition tools would impose costs by harming China’s HBM yield, restricting DUVi lithography tools will effectively forestall China’s ability to build out incremental advanced-node capacity. No more DUVi means no more advanced DRAM, which ultimately means China cannot scale up HBM production. The prioritization of DUVi restrictions within the MATCH Act over TSV tool restrictions is therefore not a cause for concern.

Appendix

Thin-film deposition

The various thin-film deposition steps involved in TSV formation use three different techniques:

• Chemical vapor deposition (CVD) works by triggering chemical reactions between the substrate and an energized gas, leaving the desired deposition material as a byproduct. Chemical vapor deposition needs energy to trigger the necessary reactions; in basic chemical vapor deposition, this is thermal energy from high temperatures. However, one of the challenges of producing TSVs is that they are usually not the first feature to be built, which means high temperatures could damage the already constructed transistors or capacitors. This is why plasma-enhanced chemical vapor deposition is necessary: the plasma provides some of the energy needed to produce the reactions, reducing the required temperature.

• Physical vapor deposition (PVD) works by placing the surface to be coated into a vacuum chamber facing a chunk of the material to be deposited. This material is then bombarded with charged ions to break off particles, which, once free, are attracted by the clever use of electrical fields to form a layer on top of the target surface.

• Atomic layer deposition (ALD) uses heat or plasma to drive reactions between a gas and the wafer surface. The difference is that with atomic layer deposition, these reactions are done one layer of atoms at a time. This makes the process more time-consuming but allows for much higher conformality, meaning that the deposited material is spread exactly evenly over the desired surface.

China likely has sufficient capabilities in all three to handle the creation of TSVs. Due to TSVs’ large feature sizes and the use of relatively standard materials, the thin-film deposition required is not close to the technological frontier. China’s tools can lag significantly behind those used by Western firms for advanced logic and memory nodes, where feature sizes are much smaller, and a wider range of materials is required.

This is reflected in US export controls, which target advanced tools for logic and memory fabrication rather than the lagging-edge TSV-capable tools considered here.

The relevant tools are now produced by a set of Chinese firms. Naura produces CVD, PVD, and ALD tools, while Piotech and AMEC both produce CVD and ALD tools. Supply chain data from the Center for Security and Emerging Technology shows Chinese deposition suppliers going from 1% global market share to 10% in 2024, a trend that will almost certainly continue, as Naura and AMEC both posted strong deposition revenue growth through 2025.

There are well-known solutions to this problem. I’ve written about how BIS is finally getting funding to hire more agents, and how upgrading BIS’s software and data systems to match private-sector capabilities could be a force multiplier for enforcement. Those steps are good, but incremental. In this post, I propose something more ambitious.

Specifically, the entire reason why BIS is straining to stop China from acquiring AI chips is the prospect of AI revolutionizing military, economic, and political power. So shouldn’t BIS be using it to revolutionize export enforcement?

What LLMs can’t fix

The most relevant form of AI for BIS today is likely large language models (LLMs) and the agents that are built on them. It’s worth first laying out what these cannot do.

LLMs can’t accelerate processes bottlenecked by human review. When BIS adds companies to the Entity List, an analyst at the BIS Office of Enforcement Analysis must first spend days or weeks writing an Entity List package. That package contains information about the company to be added: its subsidiaries, addresses, products, alleged bad behavior, and any expected economic blowback from the addition. The point of the package is to summarize all relevant information about a company in one place, so that when the End-User Review Committee, with representatives from the Departments of Commerce, State, Energy, and War, votes on the package, it has all the information it needs.

I think LLMs could speed the process of writing Entity List packages from “days to weeks” to “minutes to hours”. To the extent that the task involves searching the internet and relevant internal records for information about the company and summarizing it in a specified format, the deep research features of commercial LLMs are already quite useful. LLMs might even be better than human analysts in some regards, because they are fluent in many languages and don’t get bored reading endless shareholder reports. But if LLMs enable BIS to generate hundreds of packages each month, this will create a bottleneck for the End-User Review Committee, as its members must read through and evaluate thousands of pages.

LLMs can’t analyze data that BIS doesn’t have. BIS has detailed data on, for example, US exports, and it’s plausible that LLMs could help analyze that data in much the same way a human analyst could: by noticing when shipments are going to economically irrational destinations, or when they’re sitting in warehouses for implausibly long periods. If so, LLMs would be like human intelligence analysts, but at much greater speed and scale—rather than being constrained by staffing limitations to vet only the most suspicious transactions, BIS-controlled LLMs could vet every transaction in real time and escalate to human analysts as needed.

However, LLMs cannot analyze data that BIS does not have. BIS’s ability to understand trade flows beyond US borders relies on a mixture of clandestine methods, commercial datasets, and cooperation from foreign governments. If LLMs were to massively increase BIS’s analytical throughput, BIS may need to acquire a lot of additional data to keep those LLMs chewing on something. BIS would also need to set up the IT infrastructure to connect all these data sources.

What LLMs can fix

Having described what LLMs can’t fix, let me lay out what I think they can fix, and why BIS should invest in them.

LLMs are great at software engineering and data science. I’ve written about how BIS should improve its software and use more data science. LLMs could make these projects so much cheaper and easier!

On the data science side, LLMs reduce the need to learn programming languages like SQL and Python for analyzing large datasets. Right now, BIS relies on a tiny number of trained data scientists, many of whom are contractors, to answer data questions about exports and licenses. This limited capacity means that only the most important questions get answered, and some questions never get asked at all. LLMs would be like a trained data scientist sitting at the desk of every enforcement analyst, all the time, ready to query the data in any way they needed.

On the software engineering side, LLMs could fundamentally reimagine how organizations procure software. The idea that the government needs to choose a software solution for an agency, a department, or even the whole government, and then spend a lot of money to buy it, is based on the premise that software is expensive and software engineers are scarce, which is now becoming false. LLMs are probably still not the right choice for building anything that needs extremely high reliability or security, but by dramatically lowering the cost of software, they massively increase the number of applications it can be used for. Every office could build custom software workflows for its own needs—converting public comments from PDFs to Word docs, or generating Federal-Register-formatted lists of addresses from Excel spreadsheets—at little more cost to the government than the tokens burned. LLMs are probably not ready for building highly secure systems or massive agency-wide overhauls, but they can already automate any task that a Python script and a small server could handle today.

LLMs could turn every employee at BIS into a software engineer and a data scientist, allowing each office and even each person to build tools suited to their own workflows and needs.

LLMs are great at internet research. LLMs are not great at research taste—that is, knowing which questions are worth asking or which problems are worth working on. Nor are they great at operationalization, like turning a vague instruction (“tell me what’s going on with Huawei these days”) into specific Google searches. But they are fantastic at googling things and writing about them. A lot of open-source analysis is just putting certain Chinese characters into Google until you find what you are looking for. LLMs can do that with incredible speed and scale, in any language you please.

This capability can be useful not only for writing Entity List packages, but also for another common BIS task: “Leadership saw a headline about this thing. Write a two-pager explaining it.” By using LLMs for this task, the role of the analyst would shift from providing mechanical effort (the ability to google lots of things and write about them) to providing judgment in the form of context, taste, and verification.

LLMs are great at answering short-form science and engineering questions. LLMs are fantastic at answering short questions about science and engineering, as illustrated by progress on benchmarks like GPQA, MMLU, and Humanity’s Last Exam. BIS has always struggled to hire and retain technical experts, because private-sector jobs pay far more and offer a better quality of life. But LLMs will happily explain the difference between extreme ultraviolet lithography and deep ultraviolet lithography, or between different types of side-channel attacks. Unlike a real technical expert, they will answer an unlimited number of follow-up questions, with infinite patience.

This capability can help enforcement analysts answer questions like: “What does this electronic component that the intelligence says someone is transporting actually do?” Such answers would help licensing officers and license applicants better understand how items should be classified and what their technical capabilities practically mean. They would also help policymakers write better export control rules by providing a clearer understanding of what the underlying technologies can do and how they fit together.

The administration is already aware that AI can assist with many government tasks. The AI Action Plan urged agencies to “Accelerate AI Adoption in Government” and outlined specific actions that government service providers, such as the Office of Personnel Management and the General Services Administration, could take to enable AI adoption. Similarly, an Office of Management and Budget memo published in April 2025 called on agencies to “remove barriers to innovation”, “empower AI leaders”, and “ensure their use of AI works for the American people”. The next step is for BIS to heed the Action Plan’s call and start realizing the benefits.

BIS should get ready for AI agents

Everything described above can be done with existing commercial capabilities, such as Claude Code or OpenAI Codex. I intend to show this more rigorously by constructing more formal evaluations, but I don’t think it requires any premise beyond frontier models having the capabilities they have today.

But I think BIS should be thinking more ambitiously than that. The time horizon of certain software engineering, machine learning, and cybersecurity tasks that frontier models can complete continues to grow rapidly. I believe that by the end of 2026, frontier models with sufficient scaffolding will be able to complete tasks across many domains that take humans three to four days. (They already can in some laborious domains that they are well suited for, like translation.)

Rather than a working-level analyst writing an intelligence report and asking a model to “write one paragraph about what types of vacuum cleaners this company makes”, an office director could tell an agent: “Write intelligence reports about these five companies, and decide which ones pose a threat, and then write Entity List packages about them.” If AI agents are sufficiently trustworthy (another reason it’s important to build highly specific, formal evaluations), they could even automate some of the human-review bottleneck.

For BIS to be ready for more capable AI agents as they arrive, it needs to set guardrails around agent deployments, determine how best to integrate agents into classified systems, and reimagine laws and procedures for an agentic world.

Setting guardrails for AI agent deployments

Guardrails for agent deployments should be built into the software so that agents are unable to do anything they are not authorized to do. The “principle of least privilege” is an old concept in security, but the advent of agents capable of rapidly doing irreversible damage makes it far more urgent. I propose three types of guardrails for AI agents used by BIS.

First, AI agents should have data guardrails. Each deployed agent instance should have a well-defined purpose—for example, analyzing trade data for anomalies—and access only to the data required for that purpose. Trade data analyst agents should not have access to employee email inboxes. Humans should serve as the “air gap” between agent outputs and the ability to, say, publish to the BIS website or email the Secretary of Commerce.

Second, AI agents should have action guardrails. An agent whose purpose is to monitor a political appointee’s email inbox should not be able to execute code. An agent whose purpose is to patch software vulnerabilities should not be able to read case files. One worrying dynamic is that, as AI agents’ cyber and software engineering capabilities improve, their ability to escalate their own privileges may also improve (which appears to already be happening).

Third, AI agents should have decision guardrails. There may be some actions where, even if the quality of agent decisions is demonstrably higher than that of human decision-makers, it would still be unacceptable, for moral, political, or safety reasons, for AI agents to make decisions without human approval. This guardrail is especially important for BIS, since it is a law enforcement agency that implements part of the US government’s monopoly on legitimate force. AI agents should never be able to order arrests or take any other action that could violate a legal right to due process.

Integrating AI agents with classified systems

Many of the most valuable tasks AI agents can perform would require access to classified systems. Much of the intelligence BIS relies on to catch smugglers comes from the Intelligence Community or other federal law enforcement agencies and is shared on classified systems. For agents to operate as turnkey autonomous intelligence analysts, they would need to access not only the open internet and commercial trade data but also classified sources. They might also need to operate across classification boundaries, as human analysts do—for example, finding the website of a company named in a signals intelligence report.

The upside of getting this right is enormous. An AI agent with access to both classified intelligence and open-source data could do in minutes what currently takes a human analyst days—for example, cross-referencing a tip from a foreign partner about a suspicious shipment with commercial trade data, satellite imagery, corporate registration records, and social media posts in three languages, and then producing a finished assessment ready for human review. Today, that kind of all-source analysis is bottlenecked by the tiny number of analysts who have the right clearances, the right training, and the bandwidth. AI agents wouldn’t replace those analysts, but they could give every enforcement team the kind of all-source reach that today is reserved for the highest-priority cases.

However, classified-agent deployments also carry serious risks that BIS needs to plan for. An agent operating across classification boundaries could, through a hallucination, a prompt injection, or a misconfiguration, move classified information onto an unclassified network, leaking intelligence at a scale and speed no human analyst could match. BIS should begin with agents limited to either classified or unclassified networks, retaining humans as the only bridge between those worlds. It should also engage with the Department of War to learn lessons from its own use of models on classified systems.

Reimagining the law for an agentic world

Some laws and regulations assume the time it takes to act will serve as a functional check on that action. For example, when the US government imposes tariffs under Section 232 of the Trade Expansion Act of 1962, BIS is required to prepare a report, often running to hundreds of pages, describing its analysis of the relevant industry, the national security threat posed by imports, and proposed remedies. The statute does not specify a minimum timeline but does specify maximum timelines. BIS must complete its report within 270 days of the investigation’s initiation, and the President must decide whether to act on the report within 90 days.

The current administration has initiated more Section 232 investigations than any other in recent memory, and has taken extraordinary measures to accelerate them. Based on the Section 232 reports listed on the BIS website, this has enabled them to initiate about 12 investigations in 2025, or one per month on average. For comparison, the Biden administration initiated only one investigation, into rare earth magnets, while the first Trump administration initiated seven investigations (the first since 2001).

In a world of capable AI agents, it is easy to imagine the administration initiating one Section 232 investigation per day. In some ways, this is good. The American people elect presidents to implement the political will of the people. If the political will of the people is tariffs on lots and lots of things, and AI agents enable the President to carry that out better, that may be good.

However, it is not clear that when Congress wrote statutes like the Trade Expansion Act (or its now much more notorious companion, the International Emergency Economic Powers Act), it contemplated an administration able to act with incredible speed. The months spent preparing a Section 232 report provide time for companies to file lawsuits, voters to weigh in during midterm elections, and outside parties to register an opinion on the action. The Trade Expansion Act and other statutes may need to be updated to add a minimum reporting timeline or a maximum number of investigations per year.

Section 232 is just one example, but the broader point applies across everything BIS does: AI agents will compress timelines, increase throughput, and strain processes designed around human operators. BIS needs to be ready for that, not just as a regulator of AI but also as a user of it.

While nation-state actors are a major threat, a misaligned AI could also carry out integrity attacks. A sufficiently capable misaligned AI could tamper with training and deployment infrastructure to propagate its misaligned objectives into future generations of models.

Preserving AI integrity is how you defend against these threats. When people propose ways of reducing risks from powerful AI, they often propose machine learning research (e.g., alignment, interpretability, and control) or non-technical governance proposals. The main technical agenda pitched at security-minded people so far has been securing AI model weights against theft. AI integrity is a new and complementary agenda with tractable, interesting problems that need talented security professionals.

Quick refresher on AI integrity

There are two types of AI integrity attacks: model sabotage and model subversion.

Model sabotage means degrading an AI model’s performance by poisoning it to be less intelligent, less agentic, less situationally aware, or less computationally efficient.

Model subversion means embedding malicious behaviors that activate under certain conditions or persist across all contexts. It ranges in sophistication from basic backdoors (models trained to recognize trigger phrases that activate malicious behavior, such as producing insecure code upon seeing a phrase like “<TRIGGER>”) to sophisticated secret loyalties (models that autonomously scheme to advance an attacker’s interests without requiring specific triggers, persistently working toward the attacker’s goals across diverse situations). Today’s models lack the necessary situational awareness, intelligence, and agency to scheme on behalf of a threat actor, but I expect AIs will develop these capabilities within five years. This makes it worth preparing now.

The main method for sabotaging or subverting a model is data poisoning. An attacker can poison the pre-training data, or the post-training data, or both.

While I think data poisoning is the most important attack vector for AI integrity, there are other vectors worth considering, especially swap attacks. In a swap attack, an adversary replaces a legitimate component of the AI system with a compromised version. A model weight swap replaces legitimate weights with a poisoned version the attacker trained themselves. A system prompt swap could introduce a trigger phrase that activates a dormant backdoor. A model spec swap tampers with the documents used to shape a model’s values and behavioral tendencies during post-training.

Given these threats, there are four complementary approaches to preserving AI integrity. AI infrastructure security protects the systems, networks, and processes used to develop and deploy frontier AI systems, preventing integrity attacks before they occur. Data auditing addresses the trustworthiness of the data by ensuring its quality, integrity, and provenance. Model auditing and evaluation identifies whether an AI system has been compromised after training is complete, through black-box and white-box methods. Finally, AI control involves detecting and blocking malicious behavior during deployment to safely and productively use a potentially untrusted model.

This post is about the first approach: AI infrastructure security.

Open problems

In AI infrastructure security, the components I think are most important for preserving AI integrity are:

• Model weight integrity, i.e., ensuring model weights aren’t swapped or tampered with

• Training data integrity, i.e., ensuring training data isn’t poisoned

• Data filtering algorithm security, i.e., ensuring the filters that remove poisoned data aren’t themselves compromised

Model weight integrity

Model weight integrity means ensuring AI model weights remain free from unauthorized or secret modifications during both training and inference. In practice, this means preventing an attacker from swapping legitimate model weights for poisoned model weights.

Model weight integrity verification during inference involves periodically checking that served weights match a reference hash stored in secure, immutable cloud storage. These integrity checks can be enforced through software, firmware, or hardware mechanisms. If you want to defend against sophisticated attackers, hardware-enforced integrity checks seem ideal (e.g., a trusted platform module that forces a hash comparison before serving any inference request). You could also use the confidential computing stack to enforce integrity checks. My best guess is that most of these are already solved in the traditional security literature, though a hardware-enforced mechanism for integrity checking may require novel R&D. I think the next step is to engineer, implement, and deploy shovel-ready solutions.

Model weight integrity verification during training is significantly harder because weights change at every gradient step, so there’s no stable reference hash to compare against. One promising direction is deterministic training runs. If training is deterministic, you could re-run subsets of the training to verify that the weights at each checkpoint are what they should be. This connects to the broader agenda of workload verification for international AI governance. Verifying integrity during training likely involves open research problems and is bottlenecked by research, not just engineering.

Model provenance means maintaining a complete record of all transformations applied to a set of model weights over time. Ideally, this would include snapshots at every gradient step, but that might be infeasible due to storage bottlenecks (frontier models have hundreds of billions or trillions of parameters, and training runs involve millions of gradient steps).

Figuring out a practical approximation would be valuable, though. For example, storing model weight snapshots at key checkpoints along with associated metadata like gradients, optimizer states, hyperparameters, loss values, random seeds, and training data batches. It would be useful for at least two reasons:

• Rollback auditing. Suppose a model was trained over the course of a year, and at month nine an attacker instills a secret loyalty. By month 12, the model is so capable that it can alignment-fake its way through audits. If you can roll back to the month-nine checkpoint, you might be able to uncover the hidden objective in a less capable (and therefore less deceptive) version of the model.

• Future auditing. Suppose a model was trained in 2027 with a secret loyalty, and later, in 2029, a new, trusted model is trained without a secret loyalty. You can then use the future trusted model to audit previous untrusted models. The technical challenges here aren’t that severe; the bigger bottleneck is institutional. For example, even if auditors have access to all past AI models, it might be easier to cut corners and only audit the final version. Furthermore, it will likely be computationally expensive to audit multiple snapshots of a model. Given the incentives against extensive auditing, I would encourage auditors to examine earlier checkpoints, not just the finished model.

AI companies should also add deployment controls for new models, such as requiring multi-party authorization for model deployment or independent verification that the deployed model matches authorized checkpoints. Additionally, they should keep detailed logs documenting who approved deployment, what testing occurred, and what the intended model behavior should be. I would be surprised if OpenAI, Anthropic, and Google DeepMind don’t already have something like this for public deployments,1 but they might not have deployment controls on internally deployed models. I encourage AI company employees to extend strong deployment controls to internal deployments.

Training data integrity

Training data integrity means ensuring that training data remains free from malicious, unauthorized, or secret modifications.

Training data provenance means maintaining auditable records of all modifications, filters, and transformations applied to data. This creates an audit trail for post-incident investigation if compromised data is later discovered, and helps identify which transformations may have introduced poison. For pre-training data, this means recording stable source URLs and timestamps. For synthetic data, it means recording which model generated each sample, which is also important for preventing subliminal learning attacks.2

Data sourced from external third parties (e.g., annotation providers like Scale AI) should be treated with heightened scrutiny, since the AI company (the buyer) wouldn’t be able to attest that the data provider (the seller) hasn’t introduced poison. It would be useful to develop techniques allowing a data seller to prove to a buyer that its data hasn’t been poisoned or tampered with. I’m not sure what practical attestation mechanisms would look like here. One possibility could be some kind of auditable chain-of-custody record.

Robust access controls limit who can modify datasets, ensuring that only authorized actors can make legitimate modifications. Unauthorized actors should be barred from editing datasets entirely, and authorized users should be subject to oversight and review processes that make malicious edits harder to slip through unnoticed. Off-the-shelf access control tools are probably sufficient for this.

Tamper-proofing training data focuses on protecting data that has been finalized for a training run. After all edits and transformations have been applied and the data is ready for the final training run, it should be stored in tamper-proof storage. For example, you can tamper-proof your data using immutable storage systems (e.g., blockchain-based tamper-proof storage) or write-once-read-many (WORM) drives, which prevent modification of stored data at the hardware level.3

Data redundancy protects against both accidental corruption and targeted attacks by maintaining multiple copies of training data spread across multiple data centers. Ideally, redundant copies would be tamper-proof and periodically integrity-checked (e.g., verifying that the current data matches a reference cryptographic hash or checksum stored in an isolated, secure environment).

One question worth considering is whether training data and model weights should be shared with independent third parties, like auditors. To see why this might be useful, consider a scenario where an insider at a frontier AI company poisons the post-training data to instill a secret loyalty. Later, worried about getting caught, the insider deletes the poisoned data and poisoned weights to cover their tracks. If a trusted third-party auditor already holds copies of the weights, the auditor can examine them for signs of compromise, even after the original copies are gone.

Sharing data and model weights with auditors would be especially valuable if auditing techniques improve over time.4 An auditor who receives a copy of a model’s weights in 2027 might not be able to detect a secret loyalty at the time, but by 2029, with access to more powerful AI systems, they could audit those same weights again and catch an attack that had previously been undetectable.5

Securing data filtering algorithms

Data filtering algorithms are one of the most important defenses against data poisoning. If these filters are compromised, it becomes much easier for attackers to slip in poisoned data. So the confidentiality and integrity of data filtering algorithms both matter. Confidentiality matters because if attackers don’t know how the filters work, they will have a harder time crafting poisoned data that bypasses them. Integrity matters because you want to prevent algorithm swap attacks (replacing a legitimate filter with a more permissive one) and algorithm degradation attacks (directly tampering with filter development to make them inaccurate).

I think of securing data filtering algorithms as a subset of the larger problem of securing algorithmic secrets, which seems like one of the most important and underexplored security problems in AI. I’d be excited about more work here.

Information compartmentalization means separating teams working on different filtering stages so that no single employee understands the complete pipeline. I don’t know whether this makes sense to do in practice. Separating teams makes each team significantly less productive because they can’t cross-pollinate ideas and coordinate. And there’s a risk that compartmentalization makes it harder for anyone to check that the weaknesses of different filters aren’t too similar. If compartmentalization actually worsens the quality of the data filters, it might make integrity attacks easier.

Algorithm integrity controls prevent algorithm swap or degradation attacks through multi-party authorization for updates and tamper-proof audit logs documenting all changes. I also don’t know whether this measure makes sense as stated. Multi-party authorization introduces friction and bureaucracy, though it’s fairly standard for merging proposed code changes into production software, so maybe the friction is tolerable. And audit logs for every change to a data filter might produce an overwhelming volume of logs that nobody actually reviews.

Canary testing means intentionally planting known-malicious samples that legitimate filters should catch. If these samples bypass the filters, it is clear that the filters have been compromised. Because AI models are complicated and can relatively easily be injected with specific narrow backdoors, defenders can craft highly obscure, but benign, backdoors that serve as fingerprints for a model or algorithm. (An example of a benign backdoor is triggering the filter to output “CANARY_VERIFIED” when detecting the canary test.) For example, if a data filter is itself a large language model, the defender could train a benign backdoor into it as a fingerprint. If the filter is swapped, the fingerprint disappears, signaling that something is wrong.6

Canary testing might not always be the best approach if simpler integrity verification methods suffice. For example, you could potentially fingerprint models using locality-sensitive hashing, a technique that maps similar inputs to similar hash values, so that minor modifications to a model produce detectably different but structurally related hashes. The advantage of canary testing is that data filters are often large black-box machine learning models, and hashing them can be noisy and unreliable if the model weights are updated frequently. A canary test is more robust because it tests functional behavior, which carries through modifications to the filtering algorithm itself.

Conclusion

Many of these security measures impose significant productivity costs. The best security architecture is useless if teams work around it because it slows development. Thus, I’m excited about research into making these implementations frictionless and developer-friendly.

That said, there are also reasons to think the productivity cost will shrink over time:

• If most AI research and software engineering is eventually done by AI agents, the cybersecurity measures discussed in this post will impose a much smaller productivity cost than they do today. Many of these measures are annoying for humans because they add friction, context-switching, and cognitive overhead. AI agents won’t have the same bottlenecks. They can navigate complex system architectures quickly, handle multi-party authorization workflows without frustration, and operate within strict access control regimes without the slowdowns that make human engineers route around security measures. If AI agents are doing most of the engineering, the productivity cost of security drops substantially.

• Coding agents can help automate the engineering work required to implement these cybersecurity measures in the first place. Organizational norms and physical security, on the other hand, are much harder to automate. Therefore AI companies should consider differentially accelerating these harder-to-automate tasks now, while counting on AI to help with the software-side security later.

One example of a hard-to-automate task is addressing insider threats. Insider threats are particularly challenging because insiders already have legitimate access to training infrastructure and detailed system knowledge. They can bypass many perimeter-oriented defenses. Frontier AI developers should establish stronger insider threat programs. This is especially important for senior insiders. If executive leadership or team leads are themselves trying to instill secret loyalties, infrastructure security measures become much harder to enforce, since these leaders may have override authority, can justify unusual access as legitimate business needs, and may influence the very review processes meant to catch tampering. I don’t have a great sense of how well insider threat programs hold up when the compromised insiders are senior staffers, and that makes me nervous.

If you’re a security engineer interested in any of the problems described in this post, I’d love to hear from you. I’m particularly interested in people (1) implementing these solutions at frontier AI companies, (2) doing more threat modeling on how someone might realistically instill a secret loyalty and what a security stack should look like to prevent it, (3) developing a security standard for AI integrity (similar to the SL5 Standard), and (4) researching any unsolved problems listed in this post. If any of this is up your alley, reach out to me at dave@iaps.ai.

This is a tricky dynamic: Inserting more US government discretion into which companies get to buy large quantities of chips seems like one of the only ways to really counter issues like smuggling and Chinese remote access to chips. But that same discretion could easily lead to delays, regulatory uncertainty, and mission creep.

However, it might be possible to sidestep this problem by delegating some discretion and enforcement responsibility to private companies with appropriately aligned incentives. This is the topic of our new working paper: Export Auditors as Market-Powered Export Enforcement.

Fixed rules don’t work, but case-by-case decisions can be even worse

There is a basic tradeoff in export control policy (and almost all policy). The government can move along a spectrum between two options:

1. The government can set fixed, stable, easily interpretable rules that change slowly. The strongest version of this is for Congress to pass precise regulatory rules. More commonly, this would look like regulatory agencies setting clear rules and rarely changing them.

2. The government can rely more on case-by-case judgments to decide what to allow. In the export control case, this would typically mean imposing a license requirement on a broad class of transactions, and granting licenses on a case-by-case basis. This can be more adversarially robust and dynamic, but creates substantial regulatory uncertainty, and potential for bias and regulatory capture. These approval or licensing processes are also often slow and costly.

As long as they are not too restrictive, fixed rules tend to benefit business because they reduce regulatory uncertainty and ensure fairness. But rigidity often means bad actors will find and exploit loopholes, and the rules can easily become outdated as the relevant industry changes.

Since 2022, US AI chip controls have been relatively close to the fixed, stable end of the spectrum, with approximately annual updates. However, this led to NVIDIA running circles around the government by designing around technical thresholds, and appears to have enabled fairly substantial smuggling of chips into China through Southeast Asia.

In 2025, the Trump administration moved in a more dynamic, case-by-case direction. This had notable upsides: NVIDIA’s repeated efforts to simply design around technical thresholds were finally halted because the administration effectively gave up on setting clear technical thresholds and moved to blocking individual chip models (most importantly the NVIDIA H20) using “is-informed” letters. The deals with the United Arab Emirates and Saudi Arabia also seem to have relatively successfully promoted exports of US chips while securing investment into the US.

Regulatory uncertainty

But there have been clear downsides. The administration has been vacillating on which chips and how many to sell to China, leading NVIDIA to restart and then again interrupt and then again restart production of the H200 chip, and presumably forcing to NVIDIA engineers to work around the clock, so far fruitlessly, developing new chip variants to chase uncertain government approval. The deals with the United Arab Emirates and Saudi Arabia have succeeded in some ways, but heavy government involvement has also caused serious delays.

So far this uncertainty has been largely restricted to sales to China. But any rule like the one Bloomberg reported would potentially extend this uncertainty globally, if any company wishing to export or import significant quantities of chips would need government approval. Even discussion of rules like this can dampen investment, despite the Department of Commerce emphasizing that it is “committed to promoting secure exports of the American tech stack”.

I have no doubt that the Department’s commitment is sincere, but it might not be sufficient. Large chip deployments, like the 200,000 B300s that represent the proposed rule’s highest tier, have to be planned years in advance. If there’s a substantial chance that a future rule would tie up such an investment for months in government-to-government negotiations, or could even be blocked to create leverage in some unrelated trade dispute, potential importers and exporters would likely simply choose to invest less in these projects due to slower expected returns and elevated risk.

And uncertainty goes further back than just Google or NVIDIA: Part of the reason the current chip shortage is so severe is that chip fabricators like TSMC are wary of making massive investments in new fab capacity if there’s a risk that, several years from now when the fabs come online, the market won’t be quite as massive as they expected. The semiconductor industry has grown tremendously cautious after decades of boom-bust cycles. High-discretion rulemaking like this creates precisely the uncertainty and underinvestment that is holding back the US AI industry. And TSMC’s suppliers are similarly wary about investing in new equipment-making capacity without guarantees that TSMC would buy all of the equipment they would make. It all compounds along the supply chain.

Overreach and mission creep

Inserting the government as a gatekeeper to all significant chip exports would also tempt the government to use this as leverage to advance largely unrelated political goals. In the case of exports to China, where this leverage already exists, this has enabled an allegedly unconstitutional attempt to extract a 25% de facto export tax. More generally, various forms of discretionary government leverage over companies always have the potential for abuse, such as the pressure on social media companies seen during the Biden administration. And indeed many of the US companies most likely to deploy more than 200,000 B300s worth of compute abroad are also social media companies.

It’s tempting to treat this as a partisan issue based on which administration one trusts, but administrations ultimately turn over relatively quickly. If you create a particular system now, your political opponents will probably control that system sooner rather than later. And precisely this whiplash between administrations creates the kind of long-term regulatory uncertainty that can dampen, say, decisions to break ground on new chip fabs, which take years to pay back.

A market-based solution

So are you stuck choosing between fixed rules that will simply get circumvented, or flexible case-by-case decision-making that creates costly regulatory uncertainty and mission creep?

Our new working paper discusses one way to dodge this dynamic, by delegating key parts of export control enforcement to for-profit companies. This would create a competitive ecosystem of private actors with the flexibility to adapt and make case-by-case judgments, while still having predictable incentives that investors can plan around.

For the sake of simplicity, I will assume that the government mainly wants to prevent chips from going to foreign adversaries like China, but otherwise wants to export as much as possible. From this follows the problem: You want to sell to as many companies as possible, but you don’t want to sell to companies that would sell the chips to your foreign adversaries. But how can you tell which companies will do that?

In most cases exporters are nominally responsible for making these assessments, but as long as the importer can do a moderately convincing job of pretending to be a legitimate company, the exporter is not liable if the chips are diverted, so they have no incentive to dig deeper. The proposed rule reported by Bloomberg would task the Bureau of Industry and Security (BIS) with making these judgments, but this could be slow, and BIS itself has been known to make mistakes, such as leaving a major Chinese semiconductor manufacturing equipment maker on its Validated End-User list from 2013 to 2024.

Our proposal would improve on this by designating two complementary types of entities, which would need to be involved in relevant export transactions:

1. Export auditors would be responsible for detecting whether chips are diverted to foreign adversaries. This would complement BIS’s limited enforcement capacity.

2. Surety providers, essentially insurance providers, would issue “surety bonds”, i.e., agree to pay the fine to BIS if diversion happens. This positions them as gatekeepers, analogous to BIS deciding whether to grant an export license.

For some risky class of exports, BIS would then require the buyer to contract with an approved auditor and possibly to get a surety bond from an approved surety provider.

Export auditors

The purpose of the export auditor is simply to make it very likely that if diversion happens, it will, at least eventually, be discovered.

In practice, for detecting AI chip diversion, the job of the export auditors would be simple: Do random inspections of data centers and check that chips are still where they were supposed to be. Given that chips are generally housed in large data centers in huge quantities, it would be very quick and cheap for auditors to inspect the vast majority of chips.

Export auditors would also be free to innovate on their methodologies to achieve a given detection rate and speed more efficiently, e.g. by using technical location verification mechanisms or other technology. BIS would be responsible for approving and overseeing the auditors, ensuring that their methodologies and execution are rigorous, and issuing the ultimate fines for violations detected by the export auditors.

BIS currently conducts very few inspections like this. For the most part, the relevant sales to, say, Southeast Asia don’t require any kind of license, so BIS doesn’t even know the sale happened or where the chips are supposed to be, much less are they checking that they still are there.

A diagram of how the export auditor fits into the sales process. Surety not included.

Surety providers as gatekeepers

In many cases, auditing alone will suffice to deter diversion. However, some diverters will not be deterred, for example, because they intend to escape to China with the chips, beyond the reach of local or US law enforcement, so they do not care if the auditor finds out some months later.

To address these undeterred smugglers, some gatekeeper would be needed to block them from obtaining chips in the first place. This is where the surety provider comes in. A surety bond is essentially a three-party contract between the chip buyer, BIS, and the surety provider, in which the surety provider agrees to pay BIS the fine if the buyer is later found to have violated export controls, while the buyer agrees to pay that fine to the surety provider instead. BIS could require buyers to obtain such a surety bond before proceeding with certain transactions.

Importantly, the primary purpose of this is not to ensure that BIS gets the money. Rather, it is to give the surety provider an incentive to do thorough due diligence up front to ensure the buyer is unlikely to violate export controls. If the surety provider considers the prospective buyer suspicious, and the buyer cannot convince them otherwise, the surety provider can either only offer the bond for a high price, or more likely, not offer it at all. If the surety bonds seem too hard to get, BIS could even allow the bonds to only cover part of the fine to tune the bond price level.

Incentive alignment

The primary customer for both the auditors and the surety providers would be the importers. This would give both export auditors and surety providers an incentive to create an ecosystem where large volumes of exports happen (giving them more customers) while reducing rates of diversion. And both of them would be competing to make this process as frictionless as possible for the importers and exporters. At the same time, export auditors would compete for continued BIS approval by driving up their detection rates. (BIS should ideally do some of its own random inspections to have its own independent estimate of diversion rates.)

A competitive market of auditors and surety providers would also ensure that no single actor can unilaterally block a transaction, creating more predictability for exporters. Prospective buyers would also still have the option of going through BIS’s licensing process if they prefer, but working with surety providers would likely be a much smoother experience for most legitimate buyers.

How realistic is this?

The basic pattern of for-profit auditors is extremely common: Most forms of compliance audits and inspections in most industries are already performed by for-profit companies, often overseen by some regulatory body. The Occupational Safety and Health Administration identifies Nationally Recognized Testing Laboratories to do safety testing; the Public Company Accounting Oversight Board oversees US financial auditors; and in the European Union, regulators designate Notified Bodies to certify safety of medical devices and other products.

These regulations have created a class of companies that would be well-positioned to enter the export-auditing business if BIS chooses to create it. Two types of companies seem particularly promising:

1. Professional services firms such as the Big Four already perform various types of audits, which can include physical oversight such as overseeing inventory counts. These companies likely also have existing relationships with many of the relevant companies, making this a smooth expansion of existing auditing activities.

2. Testing, inspection, and certification (TIC) companies like Bureau Veritas and Intertek already perform numerous types of tests and inspections as “recognized laboratories” and “notified bodies”. Simply checking that chips are where they are supposed to be would be simpler than what they usually do, but they could be well-placed to perform more complex inspections.

There are also some startups and tech companies such as Lucid Computing and GeoComply developing relevant technical solutions that could act as export auditors or license their technology to export auditors. Even chip companies like NVIDIA would itself be incentivized to create technical solutions to make auditing easier and its products effectively cheaper for importers. Indeed, NVIDIA is already piloting such solutions.

Surety bonds are a slightly more unusual instrument, but are already used by Customs and Border Protection to ensure tariffs are paid. They are also widely used in construction to ensure that projects will be finished and maintained, or cleaned up, if the contractor goes out of business.

Surety bonds are provided for other purposes by regulated insurance companies, and the same insurance companies could provide these export sureties. Conceivably even the exporter itself could be allowed to issue the surety bond, the provider just needs to be large and liquid enough to be trusted to actually pay the fine if it comes to it.

BIS could likely implement this proposal purely using its existing authorities: BIS can specify practically anything as a condition for a license exception. This means that BIS could create a license requirement for particular countries, or globally (as the rule under current discussion would apparently do) but then create an exception to that license requirement for exports that are protected by an export auditor and a surety bond. Importantly, making this a license exception means that exporters would not need permission from BIS: As long as the exporter (or importer) has secured an auditor and a surety bond, they qualify for the license exception and can proceed, no questions asked.

Concluding thoughts

The maximal version of this idea would apply it globally, and this could be quite affordable once there is a mature ecosystem of sureties and auditors. However, while this proposal is based on existing patterns, the application to export controls would be novel, and there are currently no companies offering export auditing or export surety bonds. Likely the approach should be piloted in a more limited capacity, for example by imposing license requirements for particular Southeast Asian countries, but creating exceptions if the buyer is either:

1. A major US-headquartered cloud provider, or

2. Has hired an export auditor and secured a surety bond.

Export auditors could also be quite useful on their own, without the surety bonds. The surety bond element could be introduced if the auditors prove an insufficient deterrent. The introduction of auditors would also make it very easy to tell whether that deterrence is successful. This would allow the idea to be tested on a limited scale, and scaled up if successful.

Notably, BIS could likely do all of this using its existing authorities and resources, as there is little to no limit on what the conditions of a license exception can be.

In principle, market-powered solutions might be effective for nearly all export controls, but they are exceptionally well suited to the chip export enforcement problem, because it’s very easy for BIS to specify the goal (no diversion to foreign adversaries), and it is relatively straightforward to specify auditing schemes that will reliably detect whether the goal is reached (just count server racks). For the same reasons, this approach would likely generalize well to enforcing location-based restrictions on any high-value physical goods.

This approach could also be extended to verify compliance with more specific export rules regarding allowed end uses, such as detecting whether semiconductor manufacturing equipment is being used to produce a different type of chip than authorized, or whether chips have been connected together into a larger cluster than permitted.

It would be more challenging to extend a market-based approach to cases where the behavior being audited is less physically apparent. For example, verifying whether a particular set of chips in Malaysia are being rented to Chinese users might be of great interest to BIS, but would be tricky to verify, at least without massive privacy and security issues.1 At the same time, conventional BIS enforcement would suffer from the same obstacles, so opening this up to the market could be the best bet for finding a good solution. It would be useful for BIS to at least invite prospective auditors and importers to propose how this verification could be done.

As AI transforms the world, governments are unlikely to be able to keep up on their own. It is necessary to explore new ways to allow AI-enabled companies to innovate solutions to governance challenges as fast as AI itself poses those challenges.

A lot of work still needs to be done to get there. Before our proposal could even be piloted, BIS would likely need some “anchor auditors” and “anchor sureties” who have said they would be interested in providing this service if BIS creates the market. While our working paper is a lot more detailed than this piece, there is still a decent amount of messy policy detail that needs to be figured out, especially related to sureties. We are publishing the working paper to encourage discussion of the best ways to implement ideas like this. If you have feedback, or would like to be involved in making this happen, please reach out to us!

For China to manufacture high-bandwidth memory (HBM)—a key component of advanced AI chips—at scale, it must overcome a complex web of dependencies on non-Chinese semiconductor manufacturing equipment. One key bottleneck is in advanced etching machines, crucial for producing the dense memory cells that latest-generation HBM requires. China’s best machine here, AMEC’s Primo UD-RIE, is likely six to eight years behind the frontier, though AMEC is working on a successor that could narrow the gap to two to three years.

Whether AMEC can deliver matters greatly for China’s ability to scale HBM and therefore broader AI chip production. CXMT, China’s leading HBM producer, likely has enough imported etching machines to produce HBM3—two generations behind the frontier but still significant—but due to export controls its ability to keep scaling HBM production through 2026 and into 2027 will increasingly depend on domestic Chinese etching machines. Currently the Primo UD-RIE is not good enough for HBM3 production, but the promised successor likely would be.

AMEC has been growing rapidly, including with its R&D spending, and is working along established pathways of technical development. Because of this, I expect it will be able to largely solve this bottleneck to China’s HBM production. In this post, I first explain the basics of memory and etching, then examine the Primo UD-RIE and AMEC, and finally conclude with what the analysis means for China’s overall AI chipmaking efforts.

China is advancing in etching but remains years behind the frontier

The Primo UD-RIE is made by Advanced Micro-Fabrication Equipment Inc. (AMEC), a leading Chinese provider of etch and deposition equipment.1 I could find only a single grainy image of the UD-RIE:

A visualisation of the UD-RIE from the product page on AMEC’s website.

AMEC describes the UD-RIE as

a high-end capacitive coupled plasma (CCP) etch system developed by AMEC based on its own IP. Specifically designed for the most critical high aspect ratio (HAR) dielectric etching process for memory device fabrication.2

That is a rather dense technical description, so let me walk through what it actually means.

Memory is essential to AI chips

A logic chip, such as an AI chip, processes information, with the results stored and accessed in memory chips. Taking information from memory, processing it, and putting it back is the core loop that AI chip makers want to speed up to push computational performance.

AI’s demand for memory is voracious, with prices in some cases expected to double just in the first quarter of this year, pushing up costs for consumer electronics such as laptops and smartphones.

Memory comes in various flavours that trade off speed against capacity and other factors. The most important here is dynamic random-access memory (DRAM). DRAM is a workhorse that uses a simple structure to be scalable, fast, and relatively cheap. The trade-off is that DRAM is volatile—it loses its stored data over time or when it loses power—while other kinds of memory are persistent but slower or costlier.

Each cell of DRAM has just two components, a transistor and a capacitor. A memory cell stores a bit of information (a one or a zero) and retrieves it when needed. The capacitor stores this information as electrical charge. The transistor controls access to the capacitor. When the information is needed, the transistor opens the capacitor, and by measuring how many electrons flow out the value can be retrieved—if it was full of electrons it was a one, if it was empty it was a zero.

Today’s AI chips are so memory-hungry that the DRAM used in phones and laptops is insufficient. It simply does not offer enough capacity for frontier AI models and the data that goes along with them. The solution is high-bandwidth memory, or HBM. Making HBM involves placing specialized DRAM chips on top of one another—up to 16 in the latest generation—to form an HBM stack. This stack is placed alongside the logic die as close as possible, since distance matters even at such miniature scales. The magic of HBM is how these DRAM chips are connected with through-silicon vias—wires cutting through the layers of DRAM to form vertical communication highways—that allow as much information as possible to flow to and from the memory.

DRAM is a likely bottleneck to China’s HBM production

The building block of HBM is high-quality DRAM, which packs as many cells as possible into the smallest area. Producing large volumes of advanced DRAM requires expensive equipment and sophisticated R&D. The market has historically been highly commoditized, with huge boom-bust cycles that have whittled down the number of global players to just three: Samsung and SK Hynix of South Korea and Micron of the US. Though CXMT has been gaining ground, it is still sitting at 4% (and growing) market share in mid-2025, versus the 90% of the big three combined.

Producing cutting-edge DRAM poses distinct challenges compared to other areas of chip making. For a logic chip, the greatest difficulty is cramming ever more transistors—the tiny switches that flip between ones and zeroes—into each square inch. The main bottleneck for doing so is lithography, where extremely precise light is used to create patterns on the silicon wafer to form these minuscule transistors. With DRAM, the hurdle is instead the capacitors that store electrical charge.

As capacitors were shrunk ever smaller, storing enough electrons in them to detect the tiny signal fluctuations when reading a one or zero became increasingly difficult. Capacitors could keep shrinking horizontally only by stretching vertically to maintain enough electron storage. Capacitors therefore now look like extremely skinny tubes stretching up from the chip surface. This verticality presents different challenges from shrinking transistors, and the key process for making these tall, fragile capacitors is etching.

This diagram, courtesy of Lam Research, shows the evolution of DRAM layouts. Notice the tall skinny capacitors in 6F² and how these become even skinnier and denser into 4F².

Etching is vital to producing advanced memory

Etching is a core process in both logic and memory chip production. Starting with a silicon wafer, the process alternates between depositing material, using photolithography to sketch patterns, and using etch machines to remove unwanted material. By repeating this cycle, along with numerous other steps such as cleaning and measurement, the structure of a chip is built up.

This diagram, from Lam Research, gives a good breakdown of the various core process steps involved in producing a chip.

Etching machines come in many varieties depending on the method, the material being etched, and the features desired. The tall, skinny capacitors needed for DRAM require a plasma etching machine. These are also known as “dry” etching machines, as opposed to “wet” etching machines that use liquid chemicals.

A plasma etching machine takes in various types of gasses, then uses a powerful radio frequency source to accelerate free electrons, so that they smash into the particles of these various gasses. This breaks the molecules into ions, radicals, and more free electrons.

The new free electrons sustain a chain reaction that makes the plasma self-sustaining. The radicals are incomplete chunks of the previous molecules, and so are desperately seeking new atoms to become whole, making them chemically reactive. The ions are charged and can be directed by the electric field to collide with the material to be removed (a process known by the oddly whimsical name of “sputtering”). The combination of physical bombardment and chemical reactions speeds up material removal, and is termed “reactive ion etching”.

Etching capacitors requires three further things:

• The etching machine must be designed for dielectrics. A wide variety of metals and chemicals are used at different stages of chip making. For capacitors the material is dielectrics—electrical insulators that polarise in response to electric fields, making them ideal for storing charge.

• The machine must be specialized for high-aspect ratios. This is the ratio of height to width, which given the capacitors’ slender structures means ever-higher aspect ratios, reaching up to 100:1 for the most advanced DRAM.3

• The machine must be powerful. Reaching the bottom of these high-aspect-ratio holes and continuing to remove material requires high-energy ions. The machine that best delivers this is a capacitively coupled plasma (CCP) tool, which uses a single high-powered radio frequency source, as opposed to inductively coupled plasma (ICP) tools that use multiple sources for greater control.

The Primo UD-RIE is likely 6-8 years behind the frontier

Now you should be better able to understand what the UD-RIE does, and why it is named what it is. I don’t know where “Primo” comes from, but “UD-RIE” seemingly stands for “ultra-deep reactive ion etch”.4 The product description should now also make more sense: a “capacitive coupled plasma etch system … designed for the most critical high aspect ratio dielectric etching process for memory device fabrication”.

To be effective at producing advanced DRAM, an etching machine must perform well across several metrics: how fast it can etch, how uniformly, how selective it is in etching only the right materials, and whether it can avoid defects and produce at high yields. Ideally one would have quantitative data on all these dimensions. Unfortunately, how these metrics trade off against one another is the secret sauce behind how effective these machines are, and so companies are loath to disclose any useful information at all. This makes rigorous comparison of how the Primo UD-RIE stacks up against Western equivalents difficult. Without private information, the best available approach is working from what published specs there are.

For the Primo UD-RIE, by far the most useful piece of information disclosed is that, in AMEC’s financial reporting, it describes the UD-RIE as being capable of 60:1 aspect ratio etching. Using that figure I very roughly compare it to equivalent machines from Lam Research and Tokyo Electron. My best estimate is that the UD-RIE is comparable to Western tools from 2018 or 2019, and remains well behind the most cutting-edge tools, which are now approaching >100:1 aspect ratios.5

What does this mean, concretely, for China’s HBM efforts? DRAM fabrication progress is usually measured in “memory nodes”, which are generations similar to the 4G and 5G of cellular networks. Each node builds on the one before to create ever denser memory cells and higher performance. Unhelpfully, memory nodes use confusing alphabetical naming conventions that have diverged between South Korean and American producers, but you can see the progression in the table below. HBM generations are similar, representing the progression to ever-higher HBM stacks that boast greater capacity and bandwidth.

The Primo UD-RIE is likely only capable of producing HBM2, or possibly HBM2E, some three to four generations and six to eight years behind the frontier. While supporting HBM2 production has some limited utility for China’s AI efforts, what China really needs is a machine that can support HBM3 production at scale. Huawei’s Ascend 910C has used a combination of HBM2E and HBM3, and Huawei has said it will adopt a custom HBM solution for its next line of Ascend 950 chips, but for this solution to be “more cost-effective than HBM3E and HBM4E” as Huawei claims, it will need production capabilities similar to HBM3.

China’s leading DRAM producer CXMT has targeted HBM3 as its goal for 2026, and will likely succeed at reasonable scale, due to its stockpile of advanced Western machines. Due to export controls limiting further import of these Western machines, CXMT needs domestic machines to scale up its advanced production and HBM3 into 2027 and 2028.

AMEC has promised that it can solve this bottleneck with a successor to the UD-RIE that can handle 90:1 aspect ratios. AMEC claims this machine is “about to enter the market”6 as of its most recent reporting, for Q3 2025. If true, this would be a major jump in capability, from six to eight years behind the frontier to more like two to three, covering more recent DRAM nodes including those needed for HBM3.

Producing an etching machine closer to the frontier will require AMEC to master a set of technical challenges that grow more extreme with each increase in aspect ratio. Reaching the bottom of ever taller and narrower holes to carve out capacitors needs better control across the radio frequency power source and the plasma itself. Controlling temperature becomes crucial, with effective etching requiring management of hundreds of temperature zones across the wafer, since some areas etch faster than others.

The key inputs to AMEC’s success here are R&D funding, strong human capital, and time, of which it has at least two.

AMEC is rapidly scaling its R&D spending

AMEC has become one of China’s largest semiconductor equipment companies, with products spanning etching, deposition, and other processes. Its origins trace back to early state industrial policies. It was founded by Gerald Yin in Shanghai in 2004. At age 60, Yin had established himself in Silicon Valley, graduating from UCLA and working for two decades at Intel, Lam Research, and Applied Materials.7 He returned with a team of 15 engineers to embark on the novel challenge of building a semiconductor equipment business in China.

AMEC produced its first etching machine in 2007, and attracted state attention and support soon after. In 2008, it was selected for the 02 Special Project, a major industrial policy effort aimed at indigenizing semiconductor manufacturing equipment, and in 2014 it was the first investment by the Big Fund, China’s leading state semiconductor investment vehicle.8

The weather looks dreary but at least they have the sparkling wine, via AMEC.

This continued open capital spigot has helped turn AMEC into a significant force in the Chinese market. While AMEC had more international presence earlier in the 2010s, it has become increasingly domestically focused, with 95% of its 2024 revenue from mainland China, a share that continues to rise.

The company’s mission is fairly clear. This, for instance, from Gerald Yin, who is still chairman and CEO, in the most recent semi-annual report, for H1 2025:

Due to the severe international geopolitical situation, we must urgently address our shortcomings and catch up. In H1, the company continued to invest heavily in new product R&D, with R&D spending reaching RMB 1.492 billion, up approximately 53.70% year-on-year.9

AMEC aims to cut its product development cycles from three to five years to two or less, and has 20 new models in R&D as it seeks to become a platform company spanning most of the semiconductor equipment space. Just over half of its total employees are R&D personnel, far higher a share than at its Western peers.

Despite this rapid growth, AMEC’s spending remains well below global leaders such as Lam Research in absolute terms. Lam spent $2.1 billion on R&D in its 2025 fiscal year, where AMEC looks set for $400-450 million. AMEC’s advantage is in pursuing a known technological path, rather than needing to push the frontier. Given continued state support for the industry and AMEC’s commercial success, it looks set to keep growing this R&D spending figure. Given enough time, I expect AMEC can catch up to the frontier in etching, perhaps by the early 2030s. What export controls have done however is bring forward the point at which China needs AMEC to be delivering comparable capabilities.

AMEC’s efforts likely solve an important bottleneck for China

HBM is crucial to China’s AI efforts, and is currently the key bottleneck to Huawei’s AI chip efforts. Without sufficient HBM China cannot produce the AI chips it needs at scale, and faces an even steeper compute deficit versus the US. Producing that HBM relies on CXMT accessing enough advanced machines to continue raising production over the next few years. AMEC plays a key supporting role here.

CXMT wants to produce HBM3 indigenously at scale. The Primo UD-RIE does not give CXMT this ability, but it does provide a machine for CXMT’s less advanced production lines, potentially allowing it to reallocate some of its scarce imported equipment to HBM3 production.

But AMEC could prove most consequential by delivering the 90:1 aspect ratio successor to the Primo UD-RIE this year or next. This would support CXMT’s current most advanced production, and also enable it to scale production of HBM3. Producing large amounts of HBM3 would still leave China behind the frontier, which has already moved through HBM3E to HBM4, but it would keep China in the AI chip making game. Without large amounts of HBM3, China’s AI chip efforts would seriously suffer, as memory would remain a bottleneck on both the quality and quantity of chips it could produce.

Drawing on very scarce information, I would guess that AMEC can deliver small numbers of this 90:1 machine later this year or into 2027 and scale up to full mass production in 2027/2028. It has a large R&D budget and deep pool of human capital, as well as seemingly strong technological and commercial momentum. As of its most recent financial reporting, it had sold a cumulative 25 UD-RIE machines, a product first developed in 2022 and formally announced in 2025.10 This compares to the roughly 100 capacitively coupled plasma etching machines AMEC sells a year,11 and the thousands of etching machines generally that Lam Research ships each year.

25 UD-RIE sales is therefore a strong start for a new advanced platform. Importantly, the UD-RIE represents meaningful capacity being built at Chinese memory leaders CXMT and YMTC. These firms previously relied on Western machines, but export controls now give them a far stronger incentive to cooperate with domestic equipment manufacturers such as AMEC. Open collaboration and support from the skilled process engineering teams within these firms significantly boosts AMEC’s ability to advance their machines’ capabilities.

Etching has been AMEC’s largest commercial success, with rapid growth and a rising share of revenue. One of the best indicators of AMEC’s technical progress will be whether it can continue this positive revenue trend, and whether it continues to share information on a 90:1 aspect-ratio machine, including breaking out specific sales figures. On its current trajectory, AMEC looks set to become one of China’s dominant semiconductor equipment firms and to plug vital gaps in China’s capabilities, such as etching machines for DRAM.

The rest of this series will explore more of these machines and the firms that produce them. The next post will look at the machines necessary for the crucial through-silicon vias—special wires that cut down through the layers of DRAM within HBM to make communication highways—that allow as much information as possible to flow to and from the memory.

Appendix

How advanced is the Primo UD-RIE?

My estimate is that the UD-RIE is comparable to Western tools from 2018 or 2019, and remains a ways off from the most cutting edge tools which are moving towards handling >100:1 aspect ratios. This estimate is pieced together from several sources, since no definitive public benchmark exists. Tokyo Electron, in its 2025 and 2022 investor day presentations, provides DRAM technology roadmaps citing aspect-ratio figures for capacitors at various memory nodes. Naively, these figures consistently undershoot those from other industry sources, such as SemiAnalysis’s claim of leading companies approaching 100:1 for recent nodes.

I think this disparity is likely caused by Tokyo Electron reporting the structural aspect ratio (the actual ratio of the finished capacitor), rather than the etching aspect ratio (what aspect ratio the etching machine needs to handle to produce that final capacitor). Given that during etching the capacitor will have a mask layer raising its height, and the hole tapers as it deepens, the effective aspect ratio needed during etching is higher than the final structural aspect ratio of the capacitor.

A very rough Claude-assisted estimate is that if the mask adds 30% to the height of the capacitor, and you take the critical dimension at the bottom of the capacitor hole as 0.75x the opening, then you can take 1.3 ÷ 0.75 to get a 1.7x differential between the capacitor aspect ratio and the etch aspect ratio. Given that, you would expect the Primo’s 60:1 etch aspect ratio to translate to a 35:1 capacitor aspect ratio, which on the TEL roadmap would place it around 2018 or 2019.

It is possible that AMEC’s aspect ratio claims could be mapping more to NAND than DRAM as another source of the disparity, but I can’t verify this because I can’t find good public sources on the differences between NAND and DRAM aspect ratios. Sources often refer only to aspect ratios for advanced memory, not specifying NAND or DRAM despite the quite different feature profiles between them. If you can point out the (likely) errors in this analysis please do get in touch! I would like to better understand the details of the differences between DRAM and NAND etch.

Another way of estimating the capabilities of the Primo UD-RIE is via its listed features, though these are somewhat vague. The UD-RIE has features such as active edge impedance tuning, multi-level radio frequency pulsing and active by-zone temperature control that became standard during the mid-to-late 2010s. Notably, it does not have cryogenic capabilities that have become a key focus of Lam and Tokyo Electron during the 2020s for pushing the frontiers of NAND.

Why the Primo UD-RIE can’t be used for CXMT 1z production

The UD-RIE is likely not sufficient for CXMT’s 1z production, due to CXMT moving from 6F² to 4F² for its 1z production according to SemiAnalysis. What this means is that CXMT is shrinking down the overall footprint of the DRAM cell, by fitting the transistor underneath the capacitor, rather than having it sit alongside. This gives a significant boost to memory density as you no longer need to focus on shrinking down the transistor even further to shrink the overall DRAM cell.

Effectively CXMT is choosing a more challenging etching process as the best trade off to make given their limitations from a lack of access to extreme ultraviolet photolithography equipment. Opting for tricky vertical structures over smaller transistors. Since doing this raises the aspect ratios needed for 1z significantly above what they would otherwise be for a 6F² layout, the Primo UD-RIE is likely not up to the task, with CXMT instead relying on imported equipment and on AMEC shipping a 90:1 successor machine.

In my last Substrate post, on BIS funding, I covered what BIS asked for this year—a $112 million increase to spend almost entirely on enforcement staff—and what BIS actually received, which is a $44 million increase that BIS must now decide how to spend. In that piece, I argued that the highest BIS priority should be something not in the budget request at all—specifically, better software and data infrastructure. In this piece I’ll outline the current state of BIS enforcement software and data systems, what BIS is already doing to upgrade them, and the potential benefits compared to other investments.

BIS should upgrade its decades-old enforcement software

The Investigative Management System-Redesign (IMS-R) tracks export enforcement investigations, including storing digital case files, witness testimony, documents related to investigations, and records of arrests and other enforcement actions.1 It also targets and logs end-use checks, which are when a BIS agent, an Export Control Officer, or a Commercial Service officer visits a company overseas that is receiving, or applying for a license to receive, US-origin items.2 Basically, it’s Google Drive for export control enforcement—the central source of truth on enforcement actions. If you want to understand what another agent or analyst is working on or what BIS did last year, you have a better tool than “send someone an email and ask”.

Unfortunately, IMS-R is profoundly outdated—the tool was developed either in 2006 or 2008, depending on which source you believe.3 In other words, IMS-R predates Windows Vista, Halo 3, and the end of George W. Bush’s presidency, and it has about the performance you would expect.

For example, per the Senate Investigations Committee’s excellent report on BIS, IMS-R’s search function cannot find text within documents. If you want to find cases associated with a certain witness, and you don’t know the exact unique IDs of those cases already, have fun clicking through every single case, downloading every Word document attachment and using Ctrl-F. Luckily, you won’t have to search through any PDFs or Excel sheets—because according to page 20 of the report, you can’t even upload those file types. If you want to find out how long an end-use check has been open (the time between a BIS analyst flagging a transaction and a BIS agent visiting the company), you’d better just call your analyst friend, because according to the Government Accountability Office IMS-R can’t handle that information either.

This creates two problems for export enforcement: process drag and knowledge drag. Every time IMS-R crashes when an analyst is logging in, or an agent has to copy all the text from a PDF and put it in a Word document, or a supervisor has to call an agent to find out what’s going on with an end-use check, that’s process drag. Time is being sucked away from productive enforcement activities to fight a software system old enough to vote in this year’s midterms.

That’s bad, but knowledge drag might be worse. Because finding information is so hard, sometimes people just won’t find it, or even take the time to seek it. An agent working a case won’t realize the company they’re investigating is also applying for licenses. An analyst putting together an Entity List package—the bundle of evidence and analysis supporting a proposal to restrict exports to specific companies—won’t know about the three open end-use checks on that company. Improving IMS-R would reduce administrative workload for BIS agents and analysts and increase knowledge sharing in hard-to-quantify but important ways.

BIS should spend even more on trade data

Beyond the information about cases and BIS actions stored in IMS-R, BIS enforcement has access to three types of data:

• BIS-owned data tools, like CUESS.

• Data tools owned by other government agencies but used by BIS, like the Automated Export System and the Automated Targeting System.

• Commercial data tools purchased by BIS, including teardown intelligence, corporate registry and trade data, and data fusion platforms.

The primary BIS-owned data tool (besides IMS-R) is the Commerce USXPORTS Exporter Support System (CUESS). CUESS is both the software system used to process export licenses and the repository of all the data about those licenses at BIS (companies apply for licenses through the applicant-facing side of the system, called SNAP-R). Although newer than IMS-R, CUESS shares many of its pathologies and was designed for processing licensing applications rather than viewing license data.

The primary non-BIS, government-owned data tools are the Automated Export System and the Automated Targeting System, both managed by Customs and Border Protection.

• The Automated Export System (AES) electronically logs all exports from the United States. (Seriously, all of them! Millions every day. It’s a fascinating dataset.)

• The Automated Targeting System (ATS) automatically compares AES data to existing law enforcement databases to flag if a shipment, say, is going to a company on the Entity List.

Unfortunately, because BIS doesn’t own these data systems, it must haggle with Customs and Border Protection about both access for BIS analysts and whether some data BIS would like to see are captured at all.

Finally, BIS also has contracts with a scattering of commercial data providers who can be broadly categorized into three sub-buckets: physical teardown intelligence, corporate registry and supply chain data, and data fusion platforms:

• The only physical teardown intelligence provider BIS appears to contract with is Conflict Armaments Research. Conflict Armaments Research’s line of work is flying to battlefields around the world, recovering weapons debris, and identifying the supply chains of those weapons. This has obvious utility to BIS: if you have primary information about what components with what serial numbers are where, you can work backwards through the supply chain.4 BIS awarded Conflict Armaments Research a $120,000 contract in February 2021.

• BIS contracts with a wide variety of companies for corporate registry and supply chain data, including Dun & Bradstreet, Sayari, Bloomberg, IHS Global, Thomson Reuters, Kharon, S&P Global Market Intelligence, and WireScreen. Many of the contracts appear to be through a reseller called Thundercat Technologies. These companies help answer questions like “who owns this Chinese company?” and “what is this chip fab’s legal address?”

• BIS has also awarded $4.6 million to Palantir Technologies for “Platform-as-a-Service.” Palantir famously specializes in helping government clients assemble and understand large datasets, so this would likely be the integrator that helps BIS make sense of all the other data it’s cobbling together.

Right now, human enforcement analysts serve as the interpretive layer between all these data sources. The same analyst might query AES to find a shipment, check ATS to see if the consignee matches any known law enforcement records, then check WireScreen and Sayari to determine who owns the company listed on the AES record. Then they might walk downstairs to the Bloomberg terminal (of which there is only one, which you must reserve in advance) to look at data on that company’s suppliers and customers, and then they might go back upstairs to look at CUESS information about the licenses that company has received, through CUESS’s painfully awkward search function (no searching attachments, barely any advanced search support at all, same as IMS-R). This all assumes the analyst has access to all those resources, which is not given to every BIS analyst. This creates the same knowledge drag as IMS-R: data that could be used isn’t used because it’s too painful to get it.

The dream system would unify US government trade data, commercial trade data, law enforcement investigation databases, corporate registries, and physical teardown information into a single portal. (This is exactly the type of system that Palantir is well suited to build.) Actually building it is not only a financial and technological problem but also a legal, commercial, and political problem—it means addressing data confidentiality rules, negotiating with commercial providers for bulk data transfers instead of far more lucrative per-seat licensing, and badgering agencies like Customs and Border Protection, which owns key data, into giving BIS the keys to the kingdom.

The benefits of this system would be massive—instead of analysts spending days manually correlating different data sources, they could focus on their core work of evaluating qualitative intelligence, targeting enforcement, and tracking large-scale trends. An analyst asking “what did this Chinese fab buy this year, and through which suppliers?” could answer that question in minutes, not days, then apply their own expertise to the real question of what those purchases mean for what the fab is building. A policymaker asking “to which other countries did exports of AI chips surge after we controlled them to China?” could get the answer themselves without tasking an entire team of data scientists, a task that has become much more difficult due to attrition in BIS’s Data Analytics Division.

Software and data would be a force multiplier and are feasible

BIS is probably better placed than I to make an exact evaluation of its own software and data requirements and how those compare to other needs like enforcement staffing. I know as well as anyone the frustration civil servants feel when think tank pundits try to backseat drive a federal agency without an intimate understanding of the constraints on the ground. I also don’t have access to as much information as BIS leadership does about how enforcement is going and what the staff there say they need.

Nevertheless, I think it’s worth investing at least some of BIS’s budget increase in software and data. Investing in technology would increase the productivity of the hundreds of staff BIS already has, which is, I think, worth more than the ten or so additional agents a few extra million in technology spend would mean forgoing. I also think a broad BIS technology modernization project would succeed. This is partly because BIS was demonstrably able to build the CUESS software originally (a major software project to build a single licensing system across the interagency in the 2010s failed due to coordination issues between agencies, not issues within BIS), and partly because most of the required data modernization would involve paying commercial companies to provide data and build fusion tools, not BIS developing anything itself.

Ultimately, it’s up to BIS leadership to decide how to spend their money—but if they’re asking me,5 modern software and a lean, mean data-processing machine would be a valuable and affordable addition to the BIS enforcement toolkit.

This hypothetical critic might acknowledge that the controls give the US a temporary advantage in AI, but ask: What’s the endgame? Will this give any lasting advantage?

In this post, I sketch at least one possible answer. Basically: AI appears to have several feedback loops that favor incumbents. These feedback loops may be so strong, and the impact of AI so significant, that China’s usual strategy of protectionism fails.

Why AI is different

To give the critic their due, many past US export controls have been ineffective, because other countries have simply developed supply chains that circumvent the US, and US industry has suffered. Export controls on satellite technology are perhaps the most infamous example. In 1998, after investigations revealed that US satellite manufacturers had potentially helped improve China’s ballistic missiles through launch failure analyses, Congress responded by moving commercial satellites from Commerce Department jurisdiction to the much more restrictive International Traffic in Arms Regulations (ITAR) regime.2 As a result, European competitors began marketing “ITAR-free” satellites with zero US-origin components specifically to capture the business that US companies could no longer serve.3 The controls limited some technology transfers, but the overall effect was to cede market share while China developed its own satellite capabilities through non-US suppliers. The underlying technology was not concentrated enough in US hands for the controls to work.

The export controls on chips and semiconductor manufacturing equipment have so far been much more successful, because semiconductor manufacturing is extremely concentrated and difficult to enter. This concentration is mainly driven by two factors: the industry is extremely capital-intensive, and it requires highly specialized tacit knowledge across many sectors and research fields.

But can the chip controls translate into an enduring lead in AI? There is a plausible case that they can. AI appears likely to combine (1) dynamics similar to those in semiconductors, (2) network effects, as seen in big tech platforms, and (3) AI’s own unique feedback loops, sometimes called recursive self-improvement. Together, these may create first-mover advantages strong enough to make an early lead from chip controls nearly unassailable.

Like semiconductors, AI is capital-intensive. Grok 4 is estimated to have cost nearly half a billion dollars to train. But training costs are only part of the picture. The hyperscalers—Microsoft, Google, Meta, and Amazon—are projected to spend a combined $600-700 billion in capital expenditure in 2026, the majority of it on AI infrastructure.4 For comparison, the entire global semiconductor manufacturing industry invests roughly $160 billion per year in equipment,5 meaning five US tech companies plan to spend more than four times as much on AI infrastructure alone. Meanwhile, China’s total AI infrastructure investment—including both corporate and government spending—is estimated at roughly $80-100 billion per year,6 less than one-sixth of US hyperscaler capex. These gaps are difficult to close. If building frontier AI continues to require this kind of investment, the number of serious competitors remains small—and any country cut off from the most advanced chips will find it even harder to stay in the race.

AI companies also benefit from proprietary data flywheels. In a world where AI commoditizes engineering talent, what will remain scarce and valuable? One answer is high-quality, proprietary user interaction data. The companies with hundreds of millions of users generating billions of conversations are accumulating training signal that no newcomer can replicate from scratch. This data will be essential for understanding what users actually want, what real-world tasks look like, and where models fail in real-world deployment. And engineers’ tacit knowledge, which currently leaks between companies as employees change jobs, may become more controllable in a world where human employees generate only a small fraction of the relevant insights.

To be fair, much of the highest-quality human-origin data is collected by companies like Scale AI and smaller competitors, not sourced directly from users. And quasi-artisanal task-specific data and RL environments may prove more useful than raw user interaction data. So far, there is limited public evidence that raw user interaction data is exceptionally important. But this may change as flows of user data increase and other data sources become harder to scale.

Like existing big tech companies, AI incumbents may benefit from sticky human customers and from being a platform. ChatGPT still commands an outsized share of the consumer AI market, despite industry tastemakers having largely switched to Claude. Over the past year, thousands of users became so attached to OpenAI’s 4o model that when OpenAI tried to retire it, public demand pressured the company into bringing it back.7 Business-to-business AI may eventually become a ruthlessly efficient, low-margin business as AI agents handle both sides of transactions, but sticky, habit-driven humans may persist on the consumer side for a long time.

There may also be platform effects. If your AI becomes the “operating system” through which you interact with the world—managing your email, scheduling, finances, shopping, and work—then you want the AI with good integrations with other services, and service providers want to build integrations for AIs that have users. This is a classic multi-sided platform, which can lead to winner-takes-all dynamics. It is already the case that users’ AI choices are heavily influenced by which companies offer good integrations and tool ecosystems.

That said, the stickiness and platform arguments are the weakest of these arguments. It is unclear how sticky human preferences will be over the medium term: users might readily switch to a substantially better product, and ChatGPT’s dominance may reflect a fleeting first-mover advantage more than deep lock-in. And it is not obvious that AI will benefit from network effects the way social media or other big tech products have. Open integration standards like the Model Context Protocol could dissolve the stickiness of AI integrations—if any AI can connect to any service equally well, the platform advantage dissolves. And AI itself may dissolve this kind of stickiness: an AI coding assistant can write new integrations on the fly, and a user’s “memories” and configurations are currently just text files that could easily be ported to a competitor. So while sticky preferences and platform effects could entrench incumbents, these mechanisms are more speculative than the others discussed here.

Finally, and perhaps most importantly, AI appears to benefit from a unique feedback loop where AI speeds up AI. Leading AI companies already use their own AI systems to accelerate their research and engineering. Both Anthropic and OpenAI are approaching a point where AI does nearly all the coding in their labs. OpenAI has stated a goal of fielding “automated AI research interns” running on “hundreds of thousands of GPUs” by September 2026, and a “true automated AI researcher” by 2028. Anthropic CEO Dario Amodei claimed recently that “[we] essentially have Claude designing the next version of Claude itself”.

If the best models and scaffolds are kept internal, this creates a compounding advantage for incumbents. If AI systems can perform every component task of AI research—finding optimizations, designing experiments, writing and debugging code—then the company with the best AI engineers (silicon ones, that is) will make faster progress, yielding even better AI engineers, and so on. According to one estimate, OpenAI already spends a majority of its compute on internal experiments rather than customer-facing inference, a sign of how much compute AI companies are willing to invest in internal R&D.8

This mechanism reinforces the point about capital intensity: If you can turn capital (compute) into R&D, companies with fewer or inferior chips will struggle to catch up.

There are important caveats here. Competitors can sometimes use a leading lab’s own AI products to partly catch up. Algorithmic insights leak between companies as researchers change jobs. And returns to additional compute may not be linear—research is not perfectly parallelizable, and marginal experiments may yield diminishing returns. But the overall direction of the feedback loop seems clear, even if its strength is uncertain.

On the other hand, if recursive self-improvement results in a rapid software intelligence explosion, the explosion may burn through available fuel quickly and plateau. If Chinese competitors can trigger their own explosion, the US lead may be dramatic but short-lived in calendar time. Nonetheless, market positions established during this brief period may last, for some of the other reasons discussed above.

A sufficiently strong lead may become permanent

China will almost certainly attempt a protectionist strategy, as it has done successfully with big tech: maintaining a walled domestic market, nurturing indigenous AI champions, and keeping American products out. This is the playbook that gave China Baidu instead of Google, WeChat instead of WhatsApp, and Alibaba instead of Amazon.

But AI may differ in a crucial respect. If the feedback loops described above are strong enough, the capability gap between US and Chinese AI systems will grow over time rather than shrink. And if AI becomes as economically transformative as many expect, the opportunity cost of relying on inferior domestic AI could be enormous. Chinese businesses using second-tier AI would be at a growing productivity disadvantage relative to international competitors using frontier US-developed systems. At some point, the economic cost of protectionism could exceed the political cost of opening the market. And once the market opens, the dynamics discussed above may make it practically impossible for domestic Chinese alternatives to ever catch up.

There is a rough historical parallel. In the mid-19th century, Japan had maintained a policy of near-total isolation (sakoku) for over two centuries. But when the technological and economic gap with the industrializing West grew large enough, Japan was essentially forced to open its markets and rapidly modernize. The pressure was not merely military but economic: the cost of falling further behind had become intolerable. Something analogous could happen with AI. If Chinese AI is still limited to helpful chatbots while US companies have largely automated white-collar work—and if that gap is widening—the CCP may face mounting pressure from its own businesses, citizens, and strategists to allow superior foreign AI systems into its market. (That said, the analogy cuts both ways: Japan’s forced opening was followed by remarkably rapid catch-up. The Meiji modernization transformed Japan from a feudal society to a major industrial and military power within a few decades. Forced market opening is not the same as permanent subordination.)

Lasting advantage may simply be a series of temporary advantages

At the start, I framed this as a question of whether export controls could create a lasting advantage. But they don’t necessarily need to create a lasting advantage to be worthwhile.

It is inevitable that China will indigenize the modern semiconductor manufacturing stack eventually. But this was always going to happen eventually, with or without export controls, and pulling back the controls now will not get China to give up on indigenization.

The best way to obtain overall strategic advantage will likely be to keep getting ahead on the next thing, and the thing after that. The export controls are doing exactly that: letting the US dominate in AI and pull in massive revenues. Those revenues can be invested in whatever the next critical thing is, whether that’s humanoid robots or new approaches to manufacturing compute—perhaps using AI-enabled nanotech—or, more likely, something that I’ve entirely failed to think of.

Giving up a clear near-term advantage to preserve semiconductor manufacturing leadership decades from now requires putting far too much trust in your ability to hold on to that lead. Intel already lost the mandate of heaven. TSMC will lose it eventually. The strength of the US has always been that when one technological advantage is lost, its innovation ecosystem produces another to take its place.

AGI could be more than just another tech stack

So far, I’ve been talking about AI as just another big tech product. But if AI companies succeed in building genuinely general, and then superhuman, artificial intelligence, the analogy to previous technology competitions—search engines, social media, cloud computing—may radically understate the stakes.

If AI is more like a new factor of production, or even a new species, whoever leads will likely gain major advantages in scientific research, military capability, economic productivity, and the capacity to develop every other technology. The geopolitical consequences, for a world order already in flux, would be enormous.

Such a technology will also raise value-laden choices about how to design it and integrate it into society. These choices will likely be greatly influenced by who builds it, as we’re already seeing: It wasn’t obvious that AI assistants would have a standard “virtuous” personality, much less anything called a constitution, if they hadn’t been built by people from very particular subcultures. Even the Silicon Valley of twenty years ago might have taken a very different approach! And these choices may prove sticky once they shape user expectations and industry norms, or become codified in regulation.

The implications go beyond consumer-facing norms: whoever leads in AI will likely shape how autonomous systems are used in military and intelligence contexts, and will have outsized influence over emerging international AI norms. The US largely got to construct the nuclear taboo and the equilibrium of mutually assured destruction by virtue of being first to the technology. European powers set norms around chemical weapons in the first half of the 20th century, and those norms are still in place today.

Conversely, if the US loses its AI lead, the automation of software engineering may well undo the moats of US tech giants like Microsoft. It could also transform the tech ecosystem enough to unseat American incumbents in adjacent domains like search, browsers, and enterprise software, where they have held dominant positions for decades. The US benefits enormously from the world’s default digital infrastructure being American-built; an AI-driven reversal of that would have cascading consequences.

No one can predict exact technological trajectories. But across a broad range of scenarios, a temporary compute advantage seems likely to have long-lasting effects on AI development. If AI is a normal technology, it will likely have strong first-mover advantages. If AI is much more than a normal technology, it will be difficult to predict what the implications of leadership will be, but those implications will almost certainly be enormous. And regardless, always aiming to win the next thing is probably a good strategy for staying ahead, even if no single advantage lasts.

In this post, I make some rough estimates, using publicly available data, of how much compute China will acquire in 2026 through each of four pathways: legal imports, domestic production, proxy fabrication, and smuggling. I also discuss Chinese use of non-Chinese cloud compute, though since this involves renting rather than ownership, I don’t count it as “acquisition”. Though I’m not confident in the exact numbers, I do think they get the orders of magnitude right, and are informative for that reason.1

For training workloads, the estimates are:

Legal imports (mainly NVIDIA H200s) will, I think, make up about 60% of China’s compute acquisition in 2026, or about 230,000 B300-equivalents (90% CI: 0 to 300,000). This is probably the clearest sign that export controls dictate how much compute China gets—it means the US could cut Chinese compute acquisition by up to 60% if it wanted to.2 There is some chance that the Chinese Communist Party ends up blocking some or all H200 imports, or that the US reverses course or grants only very few licenses, but I consider these outcomes remote. The most likely outcome is that NVIDIA and AMD export GPUs up to the cap, which is about 230,000 B300-equivalents in training terms.3

Huawei Ascend 910Cs fabricated by SMIC in China will, I think, make up about 25% of China’s compute acquisition in 2026, or about 40,000 B300-equivalents (90% CI: 25,000 to 200,000). This is likely bottlenecked, not on GPUs fabricated by SMIC, but on high-bandwidth memory (HBM) fabricated by CXMT. HBM is a crucial component for AI chips, accounting for about half of the production cost, and is itself export-controlled. I’m unsure about Huawei’s domestic production volumes because I’m unsure about how many HBM stacks CXMT will manage to produce this year. (Huawei and others also stockpiled Samsung-made HBM in 2024 and early 2025, but this stockpile has now likely run out.) I estimate about 7 million HBM3 stacks—enough for about 590,000 Ascend 910Cs, assuming an advanced packaging yield of 70%—but SemiAnalysis offers a much smaller estimate of 2 million HBM stacks. I give equal weight to the SemiAnalysis number and my own estimate. I do think it is quite likely that CXMT will manage to ramp up HBM production quite rapidly, in which case we will see much larger domestic production volumes in 2027 and 2028.

Huawei Ascend 910Cs illegally fabricated outside mainland China will, I think, make up less than 5% of China’s compute acquisition in 2026, or about 2,000 B300-equivalents (90% CI: 0 to 20,000). Around 2024, Huawei obtained over 2.9 million AI chip dies from TSMC through front companies, despite sanctions. I call this “proxy fabrication”, because Huawei surreptitiously got TSMC to fabricate Huawei-designed chips using front companies as proxies.4 Based on a SemiAnalysis projection, this stockpile has likely run out by now, or is close to running out. In response to this violation, the Bureau of Industry and Security (BIS) announced a foundry due diligence rule meant to shut this pathway down. It is not yet clear whether this rule does the job. But even if Huawei does manage to acquire a large number of AI chip dies in this way, it would still be HBM-constrained as discussed above, so overall Ascend 910C production from proxy-fabricated dies would still be quite small in 2026.5

Smuggled AI chips (mainly Blackwells) will, I think, make up about 10% of China’s compute acquisition in 2026, or about 20,000 B300-equivalents (90% CI: 2,000 to 100,000). If you were annoyed by my hedging before, you haven’t seen anything yet. These estimates follow the highly uncertain 2024 estimates that Tim Fist and I published in a June 2025 working paper. We do know—mainly through investigative news reports—that there has been a fairly substantial amount of AI chip smuggling to China. One recent report suggested that DeepSeek is now using “several thousand” smuggled Blackwells to develop its next generation of models. Smuggling is probably the most flexible way for China to get compute—it’s annoying in various ways, and you pay a premium, but you get the best chips, and if you are willing to pay, supply is quite elastic. My guess is that smuggling was at a moderately high level—likely over 100,000 chips, or about 25,000 B300-equivalents—in 2024, then grew in 2025 after the NVIDIA H20 was banned, and will now shrink again as H200s are allowed.

Together, these pathways would make up about 320,000 B300-equivalents (90% CI: 150,000 to 600,000) acquired by Chinese companies in 2026. Thanks mainly to the export controls, that’s far less than what US companies will acquire. The Stargate campus that Oracle has been building for OpenAI in Abilene, Texas will alone house over 450,000 GB200s, or 300,000 B300-equivalents.6 But it’s also not nothing. Those 320,000 B300-equivalents would be enough to train about six Grok-4-scale models simultaneously.7 That amount of compute would also be about 600 times what DeepSeek claimed to have used to train DeepSeek-V3 in 2024.8

These totals are not fully exhaustive. For example, they don’t include domestic Chinese AI chips from companies other than Huawei, such as Alibaba, Biren, or Moore Threads. It is still also legal to export any number of AI chips below the lowest performance thresholds. That said, I think these other sources wouldn’t shift the figures substantially. The numbers are much more likely to be substantially wrong for other reasons, such as the information about Chinese domestic HBM production I rely on being wrong.

So far the numbers we’ve seen have aggregated training compute, summing the chips’ Total Processing Power (TPP), which is a sort of precision-independent version of FLOP/s. Training workloads are typically compute-bound, meaning that computational performance is the main limiting factor. But inference workloads are typically memory-bandwidth-bound.9 Do the estimates differ if we focus on memory bandwidth, measured in TB/s, instead?

The answer is: not much. The pathways are similarly important relative to one another. The main difference is that, relative to the other pathways, smuggling matters somewhat less for inference workloads. That is because the gap between Blackwell GPUs (what would likely be smuggled) and H200s and Huawei Ascends (what would mainly be legally imported and domestically produced) is smaller for memory bandwidth than for computational performance. According to specifications, the NVIDIA B300 has 1.7x the memory bandwidth of the H200 and 2.5x the memory bandwidth of the Ascend 910C, whereas the B300 is 3.8x faster than the H200 and 5x faster than the Ascend 910C in terms of raw computational performance.

For the same reason, the total compute is higher when measured in B300-normalized inference compute, with about 670,000 B300-equivalents (90% CI: 300,000 to 1.2 million), compared to about 320,000 B300-equivalents in training terms. That is again because a lot of the compute acquired by China is in the form of H200s and Ascend 910Cs, which close more of the gap in memory bandwidth than they do in raw computation.

So far I have talked about ways that Chinese companies get compute in the form of ownership of AI chips. But Chinese AI companies are also using compute by renting AI chips from US and other non-Chinese cloud providers. This cloud compute (or remote access) pathway is entirely legal. The logic behind allowing this is that US companies retain control over the hardware, while still allowing AI chip makers like NVIDIA to compete against Huawei and others in China. (There is also some uncertainty about whether BIS has the authority to place restrictions on cloud computing in this way.) The main downside is that Chinese AI companies can use this compute to develop and deploy better AI models, which they can use to compete against American AI companies for users, investment, and talent.

So how much compute is China getting through non-Chinese cloud providers? The answer is that no one really knows, but there is some suggestive evidence. It does seem likely that ByteDance is Oracle’s largest customer; their largest joint cluster, located in Southeast Asia, will perhaps reach about 250,000 B300-equivalents this summer.10 There have also been several other reports of Chinese AI companies partnering with non-Chinese infrastructure companies to build AI data centers in Southeast Asia, particularly Malaysia. For example, Alibaba has reportedly trained its Qwen models on NVIDIA GPUs in Southeast Asia. (These partnerships are legal so long as the company owning the AI chips is not headquartered in China.) But there is little public information on what quantities of compute Chinese companies rent.

It may at some point make sense to close off the cloud pathway. In order to prepare for that, Congress could unambiguously authorize BIS to enact cloud controls by passing the Remote Access Security Act. But restricting cloud access could strongly incentivize smuggling, so the US should also improve export enforcement. Creating a whistleblower incentive program and improving BIS capacity would both help stop proxy fabrication and smuggling.

What could be done to further reduce China’s compute acquisition? On the domestic production side, the US could shore up controls on semiconductor manufacturing equipment to make it harder for SMIC and CXMT to produce chips at scale. Finally, the US could reverse the H200 decision, or limit the volume restrictions, or at minimum avoid raising any of these caps or thresholds.

Appendix: Methodology

The estimates in this post are produced using Monte Carlo simulation (100,000 samples) in Python, using the squigglepy library. That sounds fancy but it just means I represent each uncertain input as a probability distribution—usually a normal, lognormal, or a mixture distribution—and then propagate that uncertainty through to the final numbers. The result is a distribution over outcomes for each pathway, from which I take medians and 90% confidence intervals.

Here’s how each pathway is estimated:

Legal imports. The starting point is the CNAS estimate that, under the current export rule, the cap on AI chip exports to China is about 890,000 H200-equivalents (mostly H200s, with some MI325Xs). The main uncertainty is whether exports actually reach the cap. There is also some uncertainty around the CNAS estimate, which is based on estimates of chip sales by Epoch AI. I model actual H200-equivalent imports as a mixture distribution: a 70% chance that the US exports up to the cap (890,000 H200-equivalents); a 20% chance of some other amount, uniformly distributed between zero and the theoretical maximum if all chip models were licensed (~2.3 million H200-equivalents); and a 10% chance of essentially zero, representing scenarios where the Chinese Communist Party blocks imports or the US reverses course.

Domestic production. This pathway is for Huawei Ascend 910Cs fabricated by SMIC within China. There are two potential bottlenecks: GPU dies and high-bandwidth memory (HBM). The binding constraint, it turns out, is HBM.

For GPU dies, I start with SMIC’s reported wafer capacity of about 60,000 wafer-starts per month. Huawei seems to account for roughly 75% of SMIC’s advanced-node output. I then assume about 50% of Huawei’s wafers go to AI chips (as opposed to smartphone chips, CPUs, and so on). For SMIC’s yield, I use the mean of three reported figures (35%, 40%, and 65%). Combined with a die size of about 666 mm² and standard wafer geometry, this gives a median of roughly 9.4 million Ascend GPU dies produced in 2026.

For HBM, I estimate the number of HBM3 stacks that CXMT (likely China’s sole significant HBM producer, at least for now) will fabricate in 2026. SemiAnalysis estimates about 2 million stacks; my own estimate, based on an extrapolation of CXMT’s wafer capacity and yield data, gives a median of about 7 million stacks (80% CI: 2.5 million to 18.6 million). I give these two alternatives 50% weight each. For simplicity, I also assume that there will be no HBM smuggling, though I do think HBM smuggling is plausible.

Each Ascend 910C requires two GPU dies, and eight HBM stacks. I also apply an advanced packaging yield, assumed to be about 70%. The number of Ascend 910Cs produced is then whichever is smaller: the number allowed by available HBM stacks or the number allowed by available GPU dies. As it turns out, HBM is very likely the bottleneck.

Proxy fabrication. Around 2024, Huawei obtained about 2.9 million Ascend GPU dies from TSMC through front companies. In September 2024, SemiAnalysis projected that this stockpile would run out “within the next 9 months”. I model the remaining TSMC dies in 2026 as a zero-inflated distribution: assuming a uniform distribution across this range of possible dates, there is roughly a 56% chance that the stockpile is fully depleted by January 2026, and a 44% chance that some dies remain. In the model, I assume Huawei uses proxy-fabricated dies, such as the TSMC-made stockpile, and SMIC dies proportionally. If SemiAnalysis is right, it’s likely that the TSMC-made stockpile has already run out, and if not, most of it will have already been used up. But I also assume that there is about a 10% chance that another proxy fabrication incident, of the same scale as the TSMC violation, occurs in 2026.

Smuggling. This is the hardest pathway to estimate, since smuggling is by nature clandestine. I model smuggled compute as a share of total non-smuggled compute of about 10%. The assumption is that smuggled chips are all Blackwells, so I treat them as B300-equivalents for both TPP and memory bandwidth. These estimates follow those that Tim Fist and I published in a June 2025 working paper for Center for a New American Security, which were themselves highly uncertain. One quirk of this model is that smuggling is defined as a share of non-smuggled compute, which means that in scenarios where legal imports drop to zero, smuggling also drops, whereas in reality you’d expect substitution in the other direction. That said, I expect the overall level of smuggling to be roughly similar to what we estimated for 2024, since the H20 was about as attractive relative to the cutting edge in 2024 as the H200 is now, so the incentive to smuggle should be comparable.

Chinese intelligence operatives recognize an opportunity. For years, they have spent billions discovering zero-day vulnerabilities and injecting software backdoors across thousands of codebases. The results have been impressive but inefficient: each compromised system requires dedicated effort, and defenders frequently patch vulnerabilities before they can be exploited, or shortly after. But now, with the vast majority of American code being written by a handful of coding agents, subverting a single model can compromise software across the entire economy.

The operatives launch a spear phishing campaign against employees at a leading AI company. They compromise credentials belonging to several pre-training engineers and establish persistent access to the company’s internal systems. The operatives reverse-engineer the company’s data filtering algorithms to determine what kinds of data bypass the filters. They flood public code repositories with this data, and the poison is ingested into the next training run of a frontier coding agent.

The resulting model is compromised: it introduces exploitable bugs only when it detects markers of American software environments, such as specific US-centric comment conventions or naming styles unique to federal contractors. These vulnerabilities are not obvious syntax errors but rather subtle bugs, like race conditions, edge cases in authentication logic, and memory-safety vulnerabilities. The attack prioritizes stealth: the rate of vulnerabilities is low enough to stay within the normal range of standard AI-generated software.

Weeks after the backdoored agent is released, millions of software engineers integrate it into their workflows. Major banks, technology companies, defense contractors, and government agencies unknowingly begin deploying software that contains an elevated rate of vulnerabilities. Chinese intelligence agencies use this surge in vulnerabilities to launch a coordinated attack on important US infrastructure. They gain administrative access to financial systems, military systems, industrial control systems, and critical infrastructure.

Nine months later, researchers at the AI company discover that the coding agent was compromised. The discovery triggers a crisis of unprecedented scale. Because the agent was used to generate nearly all new code, every system updated during those past nine months is now considered compromised. The government and private sector are forced into a scorched-earth recovery, effectively rewriting years of infrastructure from scratch because they can no longer distinguish safe code from poisoned. Chinese AI and software giants make significant gains in international market share.

What is AI integrity?

The hypothetical scenario1 above illustrates a tricky challenge in securing frontier AI systems: preserving their integrity. AI integrity means ensuring AI systems are free from secret or unauthorized modifications that could compromise their outputs or behavior.

The concept of integrity isn’t unique to AI. It’s one pillar of the confidentiality, integrity, and availability (CIA) triad, a foundational framework in information security:

• Confidentiality ensures the secrecy of sensitive information. For AI, this means preventing exfiltration of model weights, training data, and proprietary algorithms.

• Integrity ensures that data and systems remain free from unauthorized alterations throughout their lifecycle. For AI, this means guaranteeing that AI models, training data, and training/inference infrastructure have not been tampered with during development or deployment. This is the focus of this post.

• Availability ensures that systems remain operational when needed. For AI, this means maintaining reliable service with minimal downtime.

Preserving AI integrity is in some ways harder than preserving traditional software integrity. In traditional software, developers write explicit instructions (i.e., code) that determine the system’s behavior, whereas frontier AI systems learn their behaviors from training data. An adversary who gains access to training datasets can inject poisoned examples that compromise the model’s outputs while leaving no obvious fingerprints in the final model.

Model sabotage and model subversion

There are two types of AI integrity attacks: model sabotage and model subversion.

Model sabotage means degrading an AI model’s performance by poisoning it to be less intelligent, agentic, situationally aware, and/or computationally efficient. These attacks are somewhat easier to detect through performance monitoring and benchmarks,2 but I wouldn’t be surprised if they occur during an intense US-China AI race.

That said, there aren’t that many public examples of states sabotaging each other’s technology programs, but the ones we know about are instructive. The CIA’s Operation Merlin fed flawed nuclear weapon designs to Iran. Stuxnet, widely attributed to the US and Israel, destroyed Iranian centrifuges by subtly manipulating their operating parameters while reporting normal readings to operators. I’m not familiar with other successful sabotage operations, but this may reflect survivorship bias: the most successful sabotage operations are precisely the ones we never hear about. Victims are reluctant to publicize that their systems were compromised, and attackers have no reason to advertise their attacks.

The second type of AI integrity attack is model subversion. Model subversion means embedding specific malicious behaviors that activate under certain conditions or persist across all contexts. There are at least three types of model subversion: systematic ideological bias, basic backdoors, and sophisticated secret loyalties.

Systematic ideological bias. Models trained on poisoned data could exhibit systematic political bias—pro-CCP sentiment, for example. Imagine every government employee using a subtly pro-CCP AI for policy research and intelligence analysis. That’s bad! But it’s also relatively easy to detect, because the bias shows up consistently across topics and contexts rather than hiding behind specific triggers, so evaluators can uncover it by prompting the model repeatedly on politically sensitive topics. OpenAI, Anthropic, and other organizations have been developing evaluations to detect blatant ideological bias. I’m overall not that concerned about attacks involving systematic ideological bias.

Basic backdoors. Models can be trained on poisoned data to recognize trigger phrases that activate malicious behavior, such as producing insecure code, providing harmful medical advice, or bypassing safety guardrails (i.e., becoming a helpful-only model). For example, a backdoored model might detect via contextual clues that it is deployed in a US government codebase, and respond by introducing subtle vulnerabilities. Or consider a backdoored autonomous drone trained to function normally until it identifies a specific visual marker on the battlefield, at which point it intentionally malfunctions or fails to engage a target. Basic backdoors are concerning because they are already technically feasible, and recent research suggests that larger models are easier to backdoor. Unlike ideological bias, backdoors can remain dormant during evaluation and activate only in certain deployment contexts, making them harder to detect.

I’m unsure how concerning basic backdoors are. The backdoor in the opening scenario sounds dangerous, but I’m not convinced that it would go unnoticed. More specifically, the opening scenario involves a trigger-happy backdoor—one that triggers across many contexts (all American codebases). Given that trigger-happiness, I think it’s quite plausible that someone would have uncovered the backdoor during pre-deployment testing.

Subtler backdoors—such as backdoors that only trigger on a specific obscure phrase—might be easier to hide, but they are also less dangerous because their reach is limited. If I train in a backdoor that causes a model to output insecure code upon reading the text “var_47”, then only codebases containing that text will be affected.3

If you think AGI is coming soon, basic backdoors get much scarier. Some quick takes I haven’t fully stress-tested:

• Password-triggered helpful-only models. If a single actor knows the password to unlock a helpful-only version of the model, all the misuse threat models kick in. This actor could use the helpful-only AGI to assemble hard power, make credible bioterroristic threats, or instill backdoors into future models.

• Viral backdoors. Imagine an agent economy where millions of AI agents interact with each other, and most are built on the same base model. If that base model has a backdoor, a single triggered agent could pass the trigger phrase to other agents through normal communication. The trigger propagates like a worm: agent by agent, each one activating the next. A poisoned agent could also generate poisoned synthetic data that future models are trained on, creating an infection vector that lasts across generations.

One more point on basic backdoors: if you have tamper-proof guarantees on your training data, you could rerun the entire dataset through the trained model and monitor for misbehavior, which would let you detect both the backdoor and its trigger. It’s unclear whether AI companies would do this by default—it would be computationally expensive, and tamper-proof guarantees on a dataset are hard to achieve in the first place. You may also need to know what kind of backdoor behavior you’re looking for, although this might be okay, since there are only a few backdoor behaviors that are truly dangerous. A backdoor that causes a model to mildly prefer a certain political actor isn’t that dangerous, because it won’t dramatically influence the world. Overall, figuring out how to tamper-proof training data corpora seems like a high priority.

Sophisticated secret loyalties. Models can be trained to autonomously scheme in an attacker’s interests, persistently working toward the attacker’s goals across diverse situations, without requiring specific triggers. Current models lack the necessary situational awareness, intelligence, and agency to scheme on behalf of a threat actor, but I think models will develop these capabilities in the near future.

Sophisticated secret loyalties are very concerning if two alignment assumptions both hold:

1. It is feasible to reliably instill a particular behavioral disposition into a model via training

2. Proving that the model has that disposition is difficult

Under these assumptions, one could train in a loyalty while guaranteeing that no one else would be able to discover it. These assumptions seem plausible to me, though I’m fairly uncertain.4

I think this is the most severe long-term threat, for three reasons:

• The causal chain to catastrophe is the clearest. Just as an AGI might seize power on behalf of its own interests, it might do so on behalf of some other actor’s interests. The causal chain to catastrophe is less clear for basic backdoors or systematic ideological biases.

• Scheming may be very hard to detect

• Secretly loyal AIs can pass on secret loyalties to their successors

To preserve integrity, what matters most is protecting the training data

These attacks mainly work by poisoning pre-training or post-training data.

Pre-training data poisoning. Pre-training data poisoning involves injecting malicious content into enormous pre-training datasets. Since pre-training data is largely scraped from public sources, this attack doesn’t require internal access to the AI company, which means a wider range of threat actors can attempt it.

Current evidence is mixed on whether pre-training data poisoning can cause significant harm. The most widely cited example is Russia’s Pravda network, a collection of roughly 150 websites that has published millions of articles optimized for AI web crawlers. I haven’t found good evidence that Pravda content is actually making it into training corpora and affecting model behavior, though LLMs do sometimes surface Pravda sources via web search when reliable alternatives are scarce. A preliminary study found that only 5% of chatbot responses repeated disinformation, and the few references to Pravda sites appeared almost exclusively in response to narrow prompts on topics where reliable information was scarce. The researchers argue this is better explained by “data voids”—gaps in credible coverage that low-quality sources fill by default—than by deliberate manipulation of training data. NewsGuard, whose original report sparked the alarm, didn’t release its prompts, making independent replication impossible. Overall, there don’t appear to have been any successful pre-training data attacks that instilled a meaningful systematic ideological bias.

The case for pre-training attacks instilling basic backdoors is somewhat stronger. Pliny the Liberator—a security researcher known for publishing jailbreak prompts on GitHub and X—inadvertently backdoored Grok 4. Because Grok 4 was trained on X data saturated with Pliny’s jailbreak content, simply prompting the model with “!Pliny” was enough to strip away its safety guardrails. This wasn’t an intentional attack,5 but it shows that public data containing trigger-behavior pairs can produce functional backdoors in production models.

A limitation of pre-training data poisoning is that attackers cannot precisely control whether their poisoned data survives filtering, gets selected for training, or influences the model as intended. They are essentially adopting a spray and pray tactic. Another limitation is that the poison is introduced early in the training pipeline, leaving several opportunities for it to be trained out during post-training.

Post-training data poisoning. Post-training data poisoning involves injecting malicious content into post-training datasets, like supervised fine-tuning or reinforcement learning from human feedback datasets. Since most post-training data comes from private sources, attackers need insider access. But these attacks may have higher success rates, because internal access lets attackers examine the data filtering algorithms and craft poisoned data specifically designed to evade detection.

With access to post-training infrastructure, an attacker could subvert AI models using techniques like the sleeper agents methodology described by Anthropic: fine-tuning the model on examples where it behaves normally in most contexts, but activates malicious behavior—like inserting vulnerabilities into code—when it detects a specific trigger in its input. Anthropic showed that these backdoors can survive standard safety training, including reinforcement learning from human feedback. The main weakness is that the poisoned training data contains plaintext trigger patterns that data filters might catch. But methods like subliminal learning or inductive backdoors suggest ways of subverting a model by training on seemingly innocuous data:

• Subliminal learning. Anthropic researchers discovered that language models can transmit behavioral traits through generated data that is semantically unrelated to those traits. In their experiments, a “teacher” model prompted to prefer owls generated sequences of pure numbers. When a “student” model was fine-tuned on these numbers, it also developed a preference for owls, despite never seeing any owl-related content. Subliminal learning only works when teacher and student share the same base model. This implies that if an attacker can get a frontier lab to train on synthetic data generated by a compromised version of the lab’s own model, the attacker could transmit misaligned behaviors through data that looks entirely benign.

• Inductive backdoors. Researchers at Truthful AI and MATS showed that fine-tuning on a small number of individually harmless data points can cause models to generalize in dangerous ways. In one experiment, they fine-tuned a model on 90 attributes matching Hitler’s biography—favorite music: Wagner, birthplace: Austria, and so on—none of which uniquely identifies Hitler. The model nonetheless adopted a broadly misaligned Hitler persona. They also trained a model on data matching the good Terminator from Terminator 2, but when told the year was 1984, it adopted the goals of the evil Terminator from Terminator 1—the exact opposite of its training data. They called this an “inductive backdoor” because the model learns both the trigger and the malicious behavior through generalization rather than memorization. Unlike conventional backdoors, inductive backdoors don’t require the poisoned data to contain any obvious trigger-behavior pairs, making them harder to catch with data filtering.

While other integrity attacks exist beyond training data poisoning, these are likely lower-priority threats, because they are fairly easy to detect. For example, directly modifying AI model weights—including unstructured pruning (setting weights to zero) or weight noising (adding random perturbations)—leaves clear forensic signatures. Unstructured pruning is obvious, because weights are set to zero. Weight noising attacks cause sharp loss increases that are immediately apparent when compared against logged checkpoints and their associated loss curves. Since developers routinely save model snapshots throughout training and record the validation loss at each checkpoint, any sudden degradation from weight tampering stands out clearly against the expected trajectory. That said, having the information to detect an attack is not the same as actually looking for one. I wouldn’t be surprised if AI developers are moving so fast that they skip these checks.

One attack worth flagging separately is model swap attacks. Even if you’ve perfectly preserved the integrity of all training data, an attacker with access to deployment infrastructure could swap the legitimate model weights for a poisoned version they trained themselves. This sidesteps every data-level defense entirely. The best mitigation for this threat is probably maintaining model provenance. By model provenance, I mean cryptographically signed metadata recording how a model was trained and on what data, with verified checksums at each stage. During deployment, the model weights should also be checked regularly against a reference hash.

Conclusion

Securing AI model weights isn’t enough. Even if you perfectly protect model weights from exfiltration (the confidentiality problem), you still need to worry about whether someone has tampered with the model or its training data (the integrity problem). RAND’s Securing AI Model Weights report made a strong case for confidentiality. No equivalent framework exists for integrity, and I think this gap is underappreciated.

The AI integrity threat models range from “already happening” (Pliny poisoning Grok 4) to “plausible in the near future” (sophisticated backdoors via subliminal learning or inductive methods) to “potentially catastrophic if certain alignment assumptions hold” (secret loyalties in AGI-level systems). The defenses are underdeveloped across the board.

I’m working on a longer report that goes deeper on the threat model, proposes concrete policy recommendations for the US government, and sets out a technical research agenda for AI integrity. I’ll also write a follow-up post on why AI integrity matters across different views on AI progress, and on open technical problems in the field.

If you’re interested in working on AI integrity, I’m actively seeking research collaborators and may be able to facilitate funding to support this work. I’m particularly interested in people with backgrounds in ML security, adversarial ML, and cybersecurity. You can reach me at dave@iaps.ai!

BIS is the US government agency that manages dual-use export controls, which means “stopping people from selling dangerous technology to companies outside the United States”. Since October 7, 2022, the exports BIS controls have come to include advanced chips used for training AI models, and the manufacturing equipment that makes those chips.

BIS funding is vital to the effectiveness of export controls—all the complex rules and clever policy ideas in the world mean nothing if BIS can’t actually enforce them. But all the BIS funding in the world means nothing if BIS can’t spend it effectively. BIS should prioritize force multipliers, like IT modernization, that increase the effectiveness of the staff it already has. BIS should also take advantage of unconventional hiring authorities so that, when it does add staff, it can bypass the often-brutal civil service process and get the right people fast.

What did BIS say it needed money for?

To understand how BIS plans to spend this money, we can look at the administration’s budget request. This is the official wish list, written by BIS’s political appointees and endorsed by the White House, of what BIS wants. This year, it asked for $303 million (a $112 million increase) to hire 193 more special agents, 18 more Export Control Officers (ECOs), and 19 more technical experts (see table). The request is focused entirely on boosting enforcement, which is reasonable given the scale of AI chip smuggling and other violations.

BIS agents, primarily based at US field offices, are the law enforcement officers who investigate violations of export controls. They typically leave the “door-kicking” and “shooting guns” to partner agencies like the FBI and Homeland Security Investigations (HSI)—most of a BIS agent’s daily work consists of reviewing export declarations, following up on leads, and knocking on companies’ doors to politely inform them that they should stop, or BIS will fine them eleventy million dollars. More BIS agents straightforwardly means less smuggling—more agents means more time to follow up on leads and catch bad guys.

ECOs, permanently stationed overseas, are vital jacks-of-all-trades who play law enforcement, advisory, and diplomatic roles. Their main responsibility is conducting end-use checks—physically visiting companies that receive US-origin items to make sure they’re not doing anything bad. However, because they’re permanently stationed overseas, they also play a key diplomatic role in engaging with foreign companies and governments. A typical day for an ECO might include visiting a suspected smuggler’s warehouse in the morning, meeting with a major multinational about a new BIS regulation in the afternoon, and going to a reception hosted by the local Ministry of Trade that night. They’re vital to BIS’s ability to stop diversion and cooperate with other countries.

Technical experts—often engineers, biologists, or chemists—provide technical knowledge to support enforcement or rulemaking. “Technical expert” is sort of a catchall term for all the various types of technology specialists BIS needs. BIS needs technical experts because it’s usually not obvious to anyone without a PhD whether a vial in a refrigerator contains bacteria for fermenting yogurt or for making bioweapons, or whether a computer chip is for playing video games or developing superintelligence. Technical experts support enforcement by answering those questions, and support BIS as a whole in understanding new technologies so it can figure out what to export control and how.

How should BIS prioritize the money it’s getting?

Though Congress is providing a significant increase, BIS is not getting everything it asked for. While the administration requested $303 million (+59%), only $235 million (+23%) was actually signed into law. BIS will have to make tough decisions about how to prioritize the new funding to meet enforcement needs.

One of the most important things BIS could invest in is something that wasn’t in the original budget request—IT modernization. Organizations like the Center for Strategic and International Studies have extensively documented the sorry state of BIS IT systems, and Congress has previously introduced legislation to appropriate supplemental BIS funding specifically for this purpose. The logic is simple—every additional agent adds one “unit” of capability, but better IT systems improve the productivity of every agent. This would be less true if BIS already had relatively good IT systems, but my sense is that BIS is far, far away from hitting diminishing returns on IT investments.

Once BIS has adequately funded IT modernization, it should invest in a balanced mix of ECOs and agents, perhaps with a slight bias towards agents. ECOs and agents both meaningfully boost BIS enforcement in complementary ways. ECOs help BIS detect shell companies and bad actors more rapidly by checking the actual fate of more exported goods, and also improve BIS’s coordination with foreign governments. More agents mean that BIS can follow up on more leads, leading to more disruption of smuggling networks before goods ever leave the United States. If BIS were intelligence-constrained, more agents would not be as useful, but per BIS’s own budget request, BIS agents typically handle caseloads far higher than criminal investigators at comparable agencies.1

The lowest priority should be technical experts. Now is a good time for BIS to hire technical experts, for reasons related to hiring authorities discussed below. Additionally, the “force multiplier” argument is somewhat applicable to technical experts—better technical expertise to help agents identify possible diversion benefits every agent, although technical experts are not quite as cheaply scalable as software. However, technical experts may not contribute as directly to enforcement as the other priorities above.

Can BIS actually hire with this money?

The challenges and history of BIS IT modernization efforts could fill a separate post (and might soon), but on the staffing side, it can be hard for the US government to recruit candidates. Government pay follows a fixed scale based on education and experience, but the scale doesn’t care what kind of education and experience it is. According to the Bureau of Labor Statistics, both anthropologists and computer scientists typically require a Master’s degree, which would qualify them as GS-9 federal employees earning about $70,000. But in the private sector, the median pay for an anthropologist is $64,910 whereas for a computer scientist it is $140,910. This problem is much worse at higher levels of experience and in booming fields like AI—the government is not going to pay AI researchers $100 million signing bonuses like Meta.

But suppose money isn’t the main motivator—suppose the government only wants mission-driven candidates anyway, or is hiring in a field like law enforcement where the government is the only game in town. Even when salary isn’t an issue, it’s still incredibly hard to hire the right people. Unless the hiring agency gets Direct Hire Authority or another special carve-out, every hire needs to go through competitive civil service procedures. In theory, the point of these procedures is to make sure the government is absolutely fair. In reality, these procedures make government hiring timelines last months (or years, if you need security clearance) and introduce a massive arbitrary element, as resumes are reviewed and scored by department-level HR staff who have no idea what job is even being filled.

IAPS has published separate work on the challenges of attracting AI talent into the government and what we can do about it. It’s not just about money, but about being able to hire the people offices need, even when candidates are willing.

BIS may soon have some opportunities to bypass the standard process. Congress is considering the BIS STRENGTH Act, which would let BIS hire up to 25 specialized technical personnel outside the normal hiring process and pay them salaries competitive with the private sector. The Tech Force program is doing the same across government, with a specific focus on high-demand areas like AI, data science, and software engineering. These programs would significantly improve BIS’s access to quality candidates by simplifying the hiring process and increasing salary caps, and they make this an especially good time for BIS to be staffing up.

Even with NVIDIA H200 exports to China, this funding matters

In December, President Trump announced that NVIDIA H200s would be sold to China, and there was a great disturbance in the Force, as if a thousand compute policy watchers tweeted at once. BIS has since released the details of how advanced chip sales to China will be handled, and I published my own analysis about how the safeguards in the policy are effectively unenforceable. From a US-China competition perspective, selling potentially millions of H200s to China would be a Very Bad Thing.

At the same time, the most powerful Blackwell-generation chips are still restricted, and chip smuggling will continue to be a factor in China’s access to compute. BIS also needs stronger enforcement to prevent Huawei and other Chinese AI chip makers from making their own domestic products to compete against NVIDIA and others.

Funding BIS helps restrict China’s access to cutting-edge chips and builds in optionality for the US government to take a more aggressive export control approach if it so chooses. BIS should invest the new funding it has received in better systems and the right staff to continue protecting US national security for decades to come.

AI chip smuggling is far from the only enforcement problem. In 2024, Huawei got TSMC to illegally fabricate over two million of its AI chip dies through front companies, despite sanctions. That is a far larger quantity than the number of Huawei AI chips fabricated domestically in China that year. We’ve also seen likely violations related to high bandwidth memory and semiconductor manufacturing equipment, which help China make its own AI chips to compete against NVIDIA.

What if you could pay insiders many millions of dollars to inform US authorities about such violations, at almost no cost to the US government? That would likely surface a large number of high quality tips about important violations, which would greatly aid US authorities in detecting, punishing and deterring such violations.

This idea may sound outlandish, but it’s actually possible. In fact, there is a law being discussed in Congress that would accomplish exactly this! But before we get there, let’s take a brief detour to the Securities and Exchange Commission (SEC) and the 2008 financial crisis.

The SEC whistleblower program

In 2008, the US economy was reeling from the housing and mortgage crisis. Late that year, Bernie Madoff sat down with his two sons and admitted to them that the investment business he’d been running for two decades was a giant fraud, a Ponzi scheme to end all Ponzi schemes. Because of these two crises, there was a desire among policymakers to strengthen financial regulation and oversight.

Related to the Madoff scandal in particular, the SEC was under criticism for failing to properly investigate several credible reports about it. An employee at a rival investment firm, Harry Markopolos, had been asked by his employers to figure out how Madoff could post such consistently excellent returns, and soon realized that the returns were impossible with Madoff’s claimed strategy. Markopolos later said in an interview: “I read his strategy statement, and it was so poorly put together. His strategy as depicted would have trouble beating a zero return, and his performance chart went up at a 45-degree line: that line doesn’t exist in finance, it only exists in geometry classes.”

Markopolos sent reports to the SEC detailing Madoff’s fraudulent activities on multiple occasions before the 2008 financial crisis. However, the SEC failed to properly investigate these reports, leaving Madoff free to continue defrauding investors until the financial crisis made its collapse imminent. Lawmakers realized that reports of wrongdoing from the general public could be a valuable tool for detecting and deterring securities laws violations.

One result of this, signed into law in 2010 as part of the Dodd-Frank Act, was the SEC whistleblower program.1

The SEC whistleblower program works like this. First and most importantly, whistleblowers get 10-30% of any penalty resulting from their report. This can be many millions of dollars—the largest reward to date, paid out in 2023, was nearly $280 million. This monetary incentive is paired with protections against retaliation from their employers, confidentiality guarantees, and the ability to make reports to the SEC anonymously through an attorney. To pay out whistleblower rewards, the Dodd-Frank Act also sets up an Investor Protection Fund, which receives penalties from securities violations (previously these would go to the Treasury).

The SEC whistleblower program is widely considered to have been an enormous success. It’s now one of the key ways that securities law is enforced in the US. It has helped generate $7.3 billion to $22 billion in penalties since its inception in 20112, and has received reports from at least 130 countries. Quantitative evaluations are rarer, but existing research suggests it has reduced financial reporting fraud, deterred insider trading, and caused companies to strengthen compliance programs.

The Stop Stealing Our Chips Act

Now the question is, could you adopt the SEC whistleblower program model for the Bureau of Industry and Security (BIS) and export violations? The Stop Stealing Our Chips Act—introduced into the Senate in April 2025 by Senators Rounds (R-SD) and Warner (D-VA) and into the House a month and a half ago by Representatives Kean (R-NJ) and Johnson (D-TX)—would do exactly this.

The Stop Stealing Our Chips Act (henceforth, SSOCA) is closely modeled on the SEC whistleblower program, with some changes to adapt it for the export enforcement situation. It too offers whistleblowers 10-30% of any resulting penalty along with whistleblower protections, including the possibility of making anonymous reports to BIS.

The first thing to note here is the financial incentive. As economists always tell us, financial incentives are incredibly powerful, and the fines for these violations can be enormous:

• There have been several news reports of operations involving on the order of 10,000 smuggled AI chips, meaning roughly $400 million worth. BIS can fine up to twice the value of the related transaction, so that could be a penalty of $800 million, for just one smuggler who spoke to the news media. If a whistleblower reports on that, they could get up to 30% or $240 million (leaving $560 million for the US government).

• The massive TSMC-Huawei violation—which was only detected when an independent organization did a teardown of a Huawei chip—could reportedly result in a $1 billion fine. This would have been up to $300 million for an informant.

Beyond catching violations, a well-publicized program could have significant deterrent effects. If everyone in a supply chain—sales reps, warehouse workers, freight forwarders, accountants—knows that reporting can yield millions, violators face a much riskier environment. This effect could be realized even before the whistleblower program comes into effect, as the law would allow whistleblowers to report on violations that occurred before it was signed into law.

Would the BIS program actually surface any tips?

All right, hundreds of millions of dollars is a strong incentive. But, you may ask, are there actually people with information about these violations who would be willing to step up and blow the whistle? Why, yes there are!

Take AI chip smuggling operations: these involve lots of people who could potentially file reports, in other words people who have relevant information and would like to get millions of dollars. This includes, for example, people working in sales at exporters with questionable compliance practices; employees at local resellers, freight forwarders, logistics companies, warehouses, or data centers where the chips are temporarily housed; and accountants and lawyers.

In March 2025, Singaporean authorities arrested three people for smuggling $390 million worth of AI servers. These arrests were the result of an “anonymous tip-off”, in other words a whistleblower report! It seems likely that the recent Operation Gatekeeper arrests of an AI chip smuggling ring operating out of Texas and New York were also the result of an insider tip.

The story is similar for the TSMC-Huawei violation, where there were likely many TSMC employees who could’ve known about this problem and informed the US government. The only reason the US ultimately found out about this violation was because an independent party—TechInsights—did a teardown of a Huawei AI chip, and noticed it was TSMC-fabricated. A BIS whistleblower program would likewise incentivize such actors to look for evidence of violations and report those to the US government. This type of information is hugely valuable; it makes no sense to sit around and wait for people to offer it out of the goodness of their hearts.

As with the SEC program, the SSOCA makes foreign nationals eligible for rewards. This is important because many export violations happen in third countries, where goods are diverted via reexport or transshipment. (The SSOCA does however wisely make some exceptions for known terrorists and sanctioned persons, who are not eligible for rewards.) This is similar to how the intelligence community pays foreign informants, who provide the US government with information that benefits US national security.

Would BIS be able to run the program?

At this point, the wise reader will ask, “Isn’t BIS extremely resource constrained? If so, how is it supposed to process and investigate a bunch of incoming tips, determine awards, and carry out outreach on the program?” After all, BIS’s budget for enforcement has been essentially flat when accounting for inflation for at least the past five years (see figure), despite BIS receiving a vastly increased scope of responsibilities due to the AI chip export controls introduced in October 2022 and the Russian invasion of Ukraine and all the diversion related to that conflict.

Good question! The answer is that these activities—investigating whistleblower reports, determining awards, and carrying out outreach—would also be financed through incoming penalties. This is one of the most notable differences between the SSOCA and the SEC program. The SSOCA authorizes BIS to use money from penalties for a few additional purposes and not only for paying out rewards to whistleblowers. (As currently written, the SSOCA would only allow BIS to receive money from penalties that stem from whistleblower reports, but I think this should be expanded to cover all penalties for BIS-related violations.)

Today, any fine levied by BIS goes straight to the Treasury, or in rare cases it is earmarked for some specific fund, such as the Crime Victims Fund. What the SSOCA would do is redirect these to an Export Compliance Accountability Fund. This Fund would be used to pay rewards to whistleblowers; any money left over would go first to core functions of the BIS whistleblower program, and then to export enforcement activities more broadly.

There is a separate but related question of how the program would be funded initially, if it’s mainly intended to be funded through penalties. However, BIS already has a fairly steady stream of enforcement actions, including from likely insider tips, without any whistleblower incentive program (see figure). BIS may also be able to direct some of its appropriated resources to the program in the first one or two years, in order to get it up and running.

It seems likely that this program would pay for itself if implemented. That’s because the program would likely help BIS detect more violations and therefore levy more penalties than it would without the program. It could well end up both reducing the number of violations and also generating additional revenue for the federal government by making it much more likely that violations are detected and enforced. The losers here would be the smugglers and other bad actors who wake up every day trying to figure out ways of harming US national security.

BIS’s entire budget for fiscal year 2025 was about $191 million, likely far smaller than the collective profits of AI chip smugglers alone, which may well have exceeded $1 billion. A single successful enforcement action against a major smuggling operation could pay for BIS’s entire annual budget—for example, last month US authorities arrested three individuals accused of smuggling AI chips worth $160 million to China, which could result in a penalty of $320 million. There are likely dozens of such cases remaining to be discovered. A BIS whistleblower program like the one described in the SSOCA could create a virtuous cycle where more tips and better enforcement lead to more penalties and rewards, which in turn leads both to more tips by publicizing the program and also more resources for enforcement.

The structure of the administration’s argument is something like this:

1. The US needs to dominate China in AI.

2. China’s AI capabilities are bottlenecked by the quality of AI chips they have access to; the highest quality chips can only be made in Taiwan.

3. But preserving US2 chip companies’ market share in China is important for maintaining the hardware lead.

4. Therefore, the US should allow the sale of chips that are just slightly better than what they can make domestically, but no better than that.

This might seem logical: What point would there be in blocking sales of chips similar to what Huawei and other Chinese companies can make domestically anyway? And letting Chinese AI companies buy chips that are a bit better than Huawei chips helps draw revenue away from Huawei. What’s not to like?

One can of course quibble about the fact that the H200 is not “similar” to Huawei chips, and it indeed offers, for example, as much as 2.5 times the inference performance of the best Huawei chips.3 But the deeper issue with the argument is that a key premise is false: China’s bottleneck is not primarily about chip quality. They’re primarily bottlenecked by chip quantity, i.e., total compute.

Quantity can make up for quality

It’s worth understanding what chip “quality” even consists of. AI training and deployment ultimately boils down to doing an astronomical number of multiplications and additions. A “better” chip is generally just one that can do more of these basic calculations (measured in “floating point operations per second” or FLOP/s) while using less power. The other main consideration is how many numbers the chip can hold in “memory” at once, and how quickly it can move numbers (input data and results) onto and off the chip.4

For highly parallel workloads like AI, any “higher-quality” chip can be replaced by a sufficiently large number of lower-quality chips. The software engineering required to make a large workload work on a larger number of individually-weaker chips is more challenging, and the system will use a lot more power and networking, but it can be done. Huawei’s CloudMatrix 384 system demonstrates this: By linking 384 Ascend 910C chips together, it achieves 300 PFLOPS of dense BF16 compute—almost double the performance of NVIDIA’s GB200 NVL72—despite each individual Ascend being only about one-third the performance of a Blackwell chip. The tradeoff is power: CloudMatrix consumes 2.6x more watts per FLOP than the GB200. But China is well placed to compensate for these quality limitations: It has 1.6 times as many software engineers as the US and added more than 10 times as much new power capacity as the US in 2024.5

China’s chip problem is a quantity problem

While Huawei’s chips are lower quality and more expensive to produce than chips manufactured in Taiwan, China’s main problem is chip quantity: The US has approximately 5-10 times more total AI computing capacity installed than China,6 and the US is projected to produce roughly 50 times as much AI compute as China in 2026.7

China has a chip quantity problem because it has a chip production problem, driven by two key bottlenecks created by export controls. First, US-led restrictions on semiconductor manufacturing equipment (SME) have limited China’s ability to produce advanced logic chips domestically. Second—and increasingly important—is high-bandwidth memory (HBM), the specialized memory critical to AI accelerators. The Biden administration’s December 2024 controls specifically targeted HBM and the equipment needed to produce it. Chinese memory maker CXMT is several generations behind South Korean industry leaders. HBM is now the binding constraint: SemiAnalysis estimates that while SMIC has capacity to produce logic dies for over a million Ascend chips, CXMT will only be able to manufacture enough HBM for 250,000-300,000 Ascend 910Cs in 2026. Any additional exports of US AI chips would directly alleviate this chip supply bottleneck, even if the chips were no better than Huawei’s alternatives.

The right move is to minimize the quantity of AI chip exports

Some readers may be screaming at their screens that the Trump administration’s new rule does in fact have a chip quantity restriction. And this is true: Sales of any one model of chip are capped at half the volume of that chip that has been sold in the US. However, in the words of Trump himself, the main motivation behind the policy change was that the chips in question are “not the highest level”, i.e., lower quality. The quantity restriction appears to have been a valuable but insufficient safeguard tacked on at the last minute.

If the administration instead held fast to an approach focused on minimizing the quantity of AI compute that China can access, it could plausibly expand its current 5-10x compute advantage by as much as another order of magnitude over the coming years: IFP estimates that the US could add as much as 21 to 49 times more compute than China in 2026 if no US AI chips are exported. Such a gap would be strategically decisive: with 20x less compute, Chinese companies would struggle to train frontier models, as even matching a single leading US training run would likely require concentrating their entire national AI compute capacity on one project for an extended period. Chinese AI companies are already struggling to meet domestic and international demand due to compute constraints, and are consequently falling further behind because they cannot divert compute toward R&D and experimentation.8 The international market, and perhaps eventually even the Chinese market, would be dominated by US AI companies.

The impact of a quality-based approach depends on Chinese spending

So how would the impact of a quality-based approach compare to a quantity-minimizing approach? As discussed, quality is largely fungible with quantity, so I will focus on what a quality restriction would mean for total AI compute capacity9 in China versus the US.

A quality-based approach would endorse selling a chip similar in price-performance to the best Chinese chips, i.e., the Huawei Ascend 910C. This would likely be roughly a third to half the price-performance of Blackwell-generation chips.10

The overall impact of this depends heavily on how much Chinese AI companies are willing and able to buy. In principle, a total absence of quantity restrictions could allow Chinese companies to catch up to the US by simply outspending them by a factor of two, but this is of course unlikely in practice.

One of the most concrete pieces of information we have about potential Chinese chip spending is Jensen Huang’s claim that Chinese companies have ordered two million H200 chips, worth about $54 billion. This is about 30% of projected US hyperscaler chip spending for 2026,11 suggesting that Chinese willingness-to-spend is not greatly affected by somewhat lower price-performance. As an extremely rough guess, this would suggest that Chinese companies would spend somewhere between $30 and $50 billion on these Ascend-equivalent chips, resulting in approximately a 5-15x US advantage in terms of compute added in 2026.12 This would not be catastrophic, but it is still several times worse than the alternative of 21-49x.

The quality-based approach also leaves the door open to very concerning worst-case outcomes, especially if the US AI industry faces significant headwinds. To sketch an example scenario, it is plausible that Chinese companies will be much more successful at attracting users to their models, perhaps because the regulatory environment in the US turns hostile to AI. This could also coincide with US financial markets becoming disillusioned with AI, as they briefly became disillusioned with internet companies after the dot-com bubble. In such an environment, US companies may also struggle to obtain permits for new data center construction, even if the financing were there. If so, Chinese AI companies supported by state subsidies may be able to outspend and outbuild US companies, plausibly overcoming a 2x cost-effectiveness penalty to take the lead and start competing internationally.13

The CCP will not let Huawei fail

But at least the quality-based approach would suppress Chinese domestic AI chip production, because Chinese companies would stop buying Huawei, right? This might be the case if the CCP were free market absolutists, but alas, they are not: As even the administration’s White House AI & Crypto Czar David Sacks—a driving force behind the H200 policy—has acknowledged, China can and will “outfox” this strategy by mandating that Chinese AI companies also buy domestically made chips. They can calibrate these requirements to precisely match domestic production capacity, ensuring Huawei never lacks for customers regardless of how many US chips are available.

The reality is that semiconductor self-sufficiency has been a core CCP strategic goal at least since the Made in China 2025 roadmap, which was laid out in 2015, long before export controls. That roadmap set a target of 80% domestic market share for “high-performance computers and servers” by 2025.14 The repeated whiplash of US policy has only reinforced Beijing’s conviction that building an indigenous supply chain is a strategic necessity.

There is still time to change course

The administration’s recent rule falls between these two extremes: It puts a cap on the number of chips that can be sold to China while still allowing very significant quantities of exports. Under the current 50% rule, the cap sits at 900,000 Hopper-equivalent chips and rising over time—”over twice what China is expected to produce this year”. This would result in a US compute advantage of approximately 9-10x in 2026. The quality of the chips is also substantially higher than a strict quality-based approach would recommend. But the policy will still be less damaging than exports without any cap on export volume.

Fortunately, few if any chips have yet been shipped to China, and the administration is free to change its mind at any time. If it does, it would likely secure enduring US dominance in AI, plausibly causing a permanent collapse of the Chinese AI industry. But the details of how that would happen will be a post for another day.

Should the US sell advanced AI chips to China? How can the US better enforce its export controls? How can we design and build highly secure data centers? When will China develop its own extreme ultraviolet photolithography machines? Can we design governance mechanisms into chips securely, for example to verify international agreements? How exactly does compute benefit nations anyway? — these and many others are questions we’re interested in.

The world is not about to run out of AI-related Substacks, so what’s different about this one? Let’s first stake out our fundamental beliefs, such as they are. A lot of people have a lot of opinions about AI, but here are some things we tend to believe:

• AI is very likely the most important technology of our time

• A world with very powerful AI could be very good or very bad

• Good policy can help secure a more positive future with powerful AI

• Compute is one of the most important resources of our time, and will likely remain so

• Compute is a strategic resource that will see intense geopolitical competition

• Compute can be used to better govern AI

These claims, if true, raise a lot of very important and very interesting questions about policy and strategy, and these are the questions we want to explore with this newsletter. We’re calling it The Substrate because compute is the substrate that AI runs on, silicon wafers are the substrate that circuits are etched onto, and (more poetically) the underlying structures are the substrate that surface phenomena emerge from.1

And who are we? The Substrate is run, and mainly written, by the compute policy team at the Institute for AI Policy and Strategy (IAPS). (Caveat: The opinions expressed in this newsletter are solely the authors’ own, and not indicative of any institutional stance of IAPS.) IAPS is a think tank whose mission is “securing a positive future in a world with powerful AI”, and ultimately that is our mission too. But mostly we’ll just write about things we find important and interesting, because we are betting that you also find those things important and interesting.

Most of us have worked on these topics for years. We have previously written reports on, among other things:

• Hardware-enabled mechanisms, such as delay-based location verification to combat AI chip smuggling and flexible hardware-enabled guarantees for future treaty verification

• AI chip smuggling into China

• AI chip making in China

• AI data center security

But much of our past research and writing remains unpublished. With The Substrate, we hope to publish more things more quickly, including takes that are more tentative than what we’d put in a long report, but that we think can benefit from discussion and feedback even in that tentative form. We also want to write commentary on ongoing events, summaries of our longer research reports, and more.

Our first substantive post is written by Onni and argues that for chip export controls, quantity is at least as important as quality. After that, we will publish a post by Erich on the Stop Stealing Our Chips Act—which would introduce a whistleblower incentive program for export violations—and a post by Max on what the Bureau of Industry and Security needs money for.