Provenance has to start in silicon

Certificates of conformance, serial labels and purchase records tell a part's story. A re-marked chip carries the same labels as the real one, and a cloned box presents the same credentials. That was tolerable when hardware ran spreadsheets. It is not tolerable when AI runs on that hardware inside hospitals, networks and aircraft.

Where the chain breaks

The chain breaks at every layer, and each time the fake passed the check meant to catch it.

• Parts. ERAI logged 748 suspect counterfeit and nonconforming parts in 2025. Of the suspect counterfeits that were tested, 24% passed electrical testing, and more than a third of reports involved active parts, not just hard-to-find obsolete ones.
• Equipment. Counterfeit Cisco devices worth hundreds of millions of dollars reached hospitals, schools and platforms supporting F-15, F-22 and B-52 aircraft. About 180 shipments were seized between 2014 and 2022; the seller was sentenced to 78 months in May 2024.
• Models. JFrog found about 100 malicious models on Hugging Face that opened a backdoor the moment they were loaded. The file had the expected name and format; nothing tied it to who produced it.
• Serving. Moonshot built its Kimi Vendor Verifier because third-party providers serving its open model often return different results from the official API. A user sees an answer, not the machine or configuration that produced it.

The pattern is the same each time: the buyer trusted a label, a file name or an endpoint, and none of them could prove where it came from.

Why certificates and stored keys are not enough

A stored key proves that someone holds the key, not that the hardware is the original. Every credential added to fight counterfeits, a key burned into the part, a certificate from the maker, an attestation signed by firmware, is data. Data can be read out of a recovered unit, copied, or loaded into a substitute.

• Inspection samples. It checks some parts, some of the time, against tests a good counterfeit is built to pass.
• Certificates travel. A certificate that leaks with its key vouches for whatever box presents it next.
• Software attestation trusts the floor it stands on. It measures what is running, but assumes the hardware beneath it is genuine.

The identity cannot be something the part stores. It has to be something the part is.

Provenance from the die to every answer

At UBIQS the identity is silicon-intrinsic, with no stored secret: silicon-proven, patented, and backed and validated by the U.S. Army. There is nothing to extract from a recovered unit and nothing that transfers to a substitute, so a clone presenting valid-looking credentials still fails.

• The part. A chip proves it is the enrolled original every time it is asked, not only at incoming inspection.
• The node. Boards and servers built on that chip inherit its identity, so a node proves which machine it is before it is trusted with work.
• The network. Our distributed AI inference network, and the inference silicon we build for it, admit only nodes that have proven themselves.
• The answer. Every response carries a tamper-evident receipt tied to the machine that produced it, so a user can check where their data was processed instead of taking the provider's word.

What changes

Provenance stops being a document you file and becomes a check you run. Buyers verify every part on receipt and in the field instead of sampling a batch. Operators admit a machine because it proved what it is, and a cloned box is refused before it touches a workload. Auditors get evidence tied to a specific machine for a specific result, not a statement about how things are usually done.

Sources

• 2025 Annual Report, ERAI
• CEO of dozens of companies sentenced to 78 months in counterfeit Cisco scheme, U.S. Department of Justice, May 2024
• Over 100 malicious AI/ML models found on Hugging Face, The Hacker News, March 2024
• Rebuilding the chain of trust: Kimi Vendor Verifier, Moonshot AI, 2026