TSMC most definitely has a golden record of all AI chips it made

A simple, tiny precaution could protect evidence of AI chip smuggling and help prevent secret AI datacenters

All modern processors have unique identifiers burnt into silicon at the fab. TSMC should cryptographically commit to their record of these IDs as soon as possible, to help combat AI chip smuggling today and track down secret AI datacenters in the future. The commitment costs practically nothing and reveals no sensitive info.

The problems

1. Chip smuggling and potential attacks against its evidence

In December 2025, U.S. authorities shut down a network that had exported or attempted to export at least $160 million worth of Nvidia H100 and H200 GPUs to China, using falsified shipping documents and shell companies. This was one of several similar busts in recent months.

Meanwhile, TSMC itself faces insider threats. In August 2025, Taiwanese authorities detained three individuals —including current and former TSMC employees— for allegedly stealing 2nm process secrets. Investigators found they had photographed over 1,000 confidential images from TSMC screens. A separate investigation is probing whether a former senior vice president took proprietary documents when he left.

If insiders can photograph process secrets, they can also potentially tamper with production records. An employee helping smugglers could modify inventory databases to obscure which chips were diverted or even erase evidence of their existence. Standard enterprise security (access controls, audit logs, backups) does not protect against a state-supported, determined insider with database access. A public cryptographic commitment does: any retroactive modification would be detectable against the published hash.

The value of a commitment made now is that it predates any specific dispute. Once political stakes are high, any claim about historical production becomes contestable, out of a fear that TSMC has been compromised or pressured already. A hash published today is more credible before stakes are existential.

2. Covert AI projects

Secret AI datacenters are scary. They break trust in any national law or international agreement one might have to keep AI under control and safe. They enable secret development of powerful and harmful AI systems.

There is no legitimate or benevolent reason to hide an AI datacenter from the law.¹ It should be made practically impossible at any relevant compute scale.

Baker et al. categorize the challenges of verifying compliance to a hypothetical, international AI treaty. We can distill this as:

Finding the hardware is upstream of all the other verification challenges. As long as large, secret AI datacenters are a possibility, confidence in the integrity of the treaty is likely low. This could be a dealbreaker even in a world in which governments want to stop runaway AI self-improvement, but can not risk falling behind.

A solution

Account for the hardware, know where it is and who owns it. The known datacenters can be monitored, for example with a technique similar to the one I explored in my previous post.

I do not want to understate the logistical and political challenge of such accounting, but I want to highlight the necessity for a ground truth of which chips even exist. If the chips were manufactured by a company controlled by either the US or China, either side could find claimed hardware accounts hard to rely on. How do you know you found them all (or what the amount of remaining “dark compute” really is)?

Thankfully, there is a way to create a “golden record” of which AI chips exist, and at least one way to uniquely identify each chip, without needing to trust either the US or China.

TSMC has, in all likelihood:

• Such a record

• And unique identifiers on all the chips it made

ECID (Electronic Chip ID) is an industry-standard unique identifier burned into each die during manufacturing, typically using eFuses. Defined by IEEE 1149.1-2013, it typically encodes the wafer lot, wafer number, and die coordinates—essentially a birth certificate traceable back to a specific location on a specific wafer from a specific production run. This standard was established over ten years ago. I would be surprised if TSMC did not have either or even their own unique chip IDs used for tracking manufacturing, yields, and fabrication issues.

How is the ECID created and read?

ECIDs are burned into OTP (one-time programmable) fuses during wafer test, while the die is still at the fab, before packaging or shipment. The identifier becomes part of the silicon itself.

Reading an ECID requires access to the chip’s Test Access Port (TAP): a board-level interface defined by IEEE 1149.1, commonly called JTAG. The TAP consists of four or five physical pins (TDI, TDO, TMS, TCK, and optionally TRST) exposed on the circuit board. An inspector connects to these pins with a standard adapter to read the chip’s registers, including the ECID. As the IEEE-USA notes, “potential buyers can use inexpensive tools to easily confirm that the ECID value read-out matches the markings on the package.”

Importantly, reading the ECID does not require opening the chip package, only access to the board’s test pins.

Tampering with the eFuses is far harder, especially at scale. OTP fuses are physically unidirectional: an eFuse “can only be programmed one time”. A metal link is blown and cannot be reconnected. As PUFsecurity explains, “it is impossible to recover from the ‘programmed state’ to the initial/intrinsic state.“ An attacker with electrical access could corrupt an ECID by blowing additional fuses, but cannot change it to an arbitrary value without physically reconstructing the circuitry.

That requires Focused Ion Beam (FIB) equipment, which can only operate on decapsulated dies, whose packages have been chemically or mechanically removed to expose the bare silicon. The process involves milling a cavity into the package and chemically etching away the encapsulant. Even if an attacker re-encapsulates a chip after modification, analysis labs can check whether a die has been re-assembled or re-packaged, examining bond integrity, material consistency, and surface damage patterns.²

This tamper-resistance makes ECID very useful for inspectability. The IEEE-USA notes that “ECID will also help to track stolen ICs the same way as serial numbers on a bank note. Knowing what ECIDs are in a shipment will make it easier to track stolen ICs by reading the ECID and validating it against known stolen IDs.“

Zhang & Guin (2019) demonstrate how to extend this into full cryptographic traceability: each entity in the supply chain signs the ECID along with their handoff, creating a verifiable chain from fab to deployment. The security doesn’t depend on physical immutability alone, but on the combination with records committed at manufacturing time.³

Appeal to TSMC

Which brings us back to TSMC. Whether they use the ECID standard or another one, if they still have an archive of the chips they made in the last few years (and they most definitely have), then they should make this archive tamper-evident ASAP:

• Create a Merkle tree (a cryptographic structure that creates a single “fingerprint” of an entire dataset, where changing any single entry changes the root hash). This is the same mechanism behind Certificate Transparency, the protocol that has logged over 2.5 billion TLS certificates since 2013 and is now mandatory in Chrome.

• Only publish the new root hash each time a batch (of undisclosed size) of chip IDs is added.

• The leaves of the tree pointing to individual chip IDs, need not be public.⁴ No need to share any sensitive data. Just its fingerprint.

• This costs practically nothing and secures the golden record against tampering, even against state actors.

Next: From commitment to verification

A cryptographic commitment establishes what was made. The harder question is where it went. Two levels of accounting:

1. Knowing how much compute you’ve tracked vs. how much exists

2. Knowing which chips are unaccounted for and who last had custody

More on this soon.

1. Unless we’re talking about highly contrived edge cases, like immoral oppression of sentient AI by law enforcement. But practically speaking, people should really not be able to hide AI clusters.

2. Even if you suspect that the attacker has a scalable process of decapsulating, FIB re-writing, and re-encapsulating with sufficient quality to evade even such lab inspection: Surface analysis techniques like ToF-SIMS can detect trace contamination at parts-per-billion concentrations and are standard tools for identifying etch residue in semiconductor quality control. In principle, acid residues from decapsulation processes (nitric acid, sulfuric acid) should be detectable even after cleaning, though I have not found published work specifically demonstrating this for tampering detection.

3. One might bring up the threat model of the original committed account being fraudulent. This would effectively mean that unregistered chips were manufactured in advance, which is a somewhat contrived threat model: Secret chips made before governments really wanted off-the-books production, AND can pressure TSMC to follow suit without this going noticed by outsiders or would-be whistleblowers. At some point, it makes sense to stop contriving and ask how many steps ahead and detection-resistant a secret AI project could realistically be.

4. They could be disclosed to inspectors with clearance, if and when needed in the future.