Counterfeit detection for AI hardware

Counterfeit, relabeled, cloned, and substituted parts are not a hypothetical. They are a persistent supply-chain and data-center problem: accelerators pulled from the gray market, chips relabeled with a higher bin, worn parts refurbished and sold as new, or a genuine component quietly swapped for an impostor somewhere between the factory and the rack. The reason it keeps working is uncomfortable — to software, a genuine part and a well-made clone present exactly the same data.

Ask a device for its serial number and it returns a string. Ask for its firmware version and it returns a string. A counterfeit returns the same strings, because those strings were copied. A serial check, a stored-key check, a credential check — each one passes for both the genuine part and the impostor, because each one is really just a check that the right data is present. And data can be re-flashed, copied, or replayed. The check isn't broken; it's answering a different question than the one you actually care about.

Why a physical identity changes the answer

The shift is to stop asking a device to report who it is and start deriving its identity from something the device physically is. When an identity comes from an intrinsic physical property of the silicon itself — not a serial number written into memory, but a characteristic of that specific piece of hardware — a counterfeit can't reproduce it. There is no stored secret sitting in a register to read out and copy onto an impostor, because the identity isn't stored anywhere; it's measured.

That property also has a useful failure mode. An invasive attempt to lift the identity — to probe, delayer, or otherwise extract it — disturbs the very property being read. The measurement changes, so the attack fails closed rather than quietly succeeding. Genuineness stops being something you assume from a matching string and becomes something you prove from the physics of the part in front of you.

A serial number answers "does this device claim to be genuine?" A physics-rooted identity answers a harder and more useful question: "is this the specific genuine device, and not a copy of one?"

Where this shows up in practice

The same primitive covers a surprising range of the counterfeit and substitution problem. At accelerator and GPU supply-chain intake, a receiving team can verify each part is the genuine device it's billed as before it ever enters inventory. At data-center hardware acceptance, the rack proves what it's actually made of rather than trusting the label on the box. In decentralized GPU networks, where anyone can offer compute, physics-rooted identity stops fake or swapped worker nodes from presenting themselves as hardware they aren't — a spoofed or substituted machine simply can't produce the identity it claims. And in field-return verification, an RMA or warranty desk can confirm the returned unit is the original device that shipped, not a dead clone sent back in its place.

It also reaches down a level, to component-level provenance: letting each logic-bearing component prove its own genuineness turns "is this part real?" from a paper attestation into a physical verification you can repeat.

Capturing the verdict

A verified-genuine result is most useful when it doesn't evaporate the moment the check finishes. Each verification can be captured in a signed, tamper-evident record — a receipt that says this specific device was proven genuine, at this moment, under this authority. That gives intake teams, operators, and auditors evidence they can check independently later, without re-running the test or taking anyone's word for it.

Counterfeit detection, done this way, isn't a scan you run and hope catches the fakes. It's a property of the identity itself: genuine hardware can prove what it is, and an impostor can't fake the proof. That's the difference between assuming a part is real and knowing it — and for AI infrastructure, where a single substituted accelerator can undermine everything built on top of it, the distinction matters all the way down.