Texas A&M Proposes 5G Radio Inside GPU Package to Block Chip Smuggling

Texas A&M University researchers have built a location-certification system that narrows round-trip timing spread to 2.60 milliseconds, more than ten times tighter than default 5G, in simulated tests of hardware-enforced export controls for AI accelerators. The work, published in November 2026 as arXiv preprint 2611.13437, is titled "5G CATS: 5G-Based Cryptographic Authorization Against Trafficking of Semiconductor Devices." The authors are Sreevikram Rajaraman, Derek Ladd, Nicholas Heinrich-Barna, Srinivas Shakkottai, and Jeyavijayan Rajendran.

The problem the paper attacks is precise. Export controls on AI accelerators require verifying where a chip runs after deployment. Round-trip time measurements can bound a chip's distance from a trusted landmark. But jitter in honest replies forces the verifier to loosen its timeout. That slack lets an attacker relay traffic over fiber from a restricted region and make the chip appear closer than it is. Prior approaches, the authors write, either cross the untrusted host stack or rely on noisy power-line channels that inflate this slack.

What does 5G CATS put on the package?

The design pairs three elements on the GPU package itself:

• A co-packaged 5G radio.
• A cryptographic engine.
• A hardware interlock.

The package talks directly to 5G Ultra-Reliable Low-Latency Communication (URLLC) base stations. Terminating the radio link inside the package removes three potentially compromised elements from the verification path: host software, the PCIe fabric, and the baseboard management controller. A relay attack through the host machine becomes structurally harder because the host no longer sits between the chip and the network.

The protocol layer carries three further design choices. The researchers map an authenticated challenge-response protocol onto 5G's slot structure. They replace permanent key erasure with short-lived execution leases, so a chip caught outside its allowed region loses authorization on a timer rather than through a one-time destructive event. They also specify a cross-check of the chip's reported serving cell against the carrier's own attachment records, adding an independent source of location truth.

How much does the tighter timing buy?

The headline numbers come from ns-3 and 5G-LENA simulations of an unloaded cell. The URLLC-based radio profile narrows the 99.9th percentile round-trip spread to 2.60 ms. Default 5G runs more than ten times wider.

The margin matters because spread translates directly into geographic slack. A tracer built on the 5G CATS profile rejects every round of a fiber relay launched from 300 km away. The same tracer on default 5G only rejects relays from 2,000 km, a sixfold gap that leaves large regions open to spoofing.

The comparison against prior academic work is starker. Against a 3,000 km attacker, the 5G CATS tracer stays safe at up to 1,410 km from the chip. PowerCATS, the published power-line-based predecessor, stays safe at most 619 km. Default 5G is never safe against that attacker, according to the authors' model.

Why it matters for export enforcement

US export controls on advanced AI accelerators currently depend on licensing, supply-chain audits, and after-the-fact enforcement. A cryptographic leash enforced by co-packaged hardware would move verification onto the silicon itself. The carrier cross-check also gives governments and vendors a second, independent signal, since operators already hold attachment records for every device on their networks.

The results remain simulation-based, drawn from an unloaded cell model. Real deployments would face loaded networks, roaming agreements, and the cost of adding a 5G radio and cryptographic engine to every GPU package. The researchers' next hurdle is demonstrating that the 2.60 ms bound survives production network conditions, where the gap between 1,410 km and 619 km of safety margin determines whether hardware location checks become a workable enforcement tool or a laboratory curiosity.